Traffic seems to be going through cloudflare. Probably to defend against a DDoS. Hitting the URL directly gave me an untrusted certificate. Going via http://ycombinator.com/ works fine.
Even if there's no "I understand the risks, let me proceed" button, this will work.
The invalid certificate was a cloudflare one, so probably acceptable : )
(and it's always better than accessing over HTTP)