Hacker News Reader

Is it useful to stuff the first 257 bytes of a HTTP response with a set-cookie with a 1-second expiry containing random nonsense?

No.

Why not? Sounds like a reasonable band-aid to me.

Because there is a viable attack on the whole keystream, not just the first 256 bytes.