Hacker News Reader

1. That blog is written by someone who does not know what HTTP request and response headers are.

2. The solution provided does not solve the problem of foo.com not trusting bar.foo.com.

1. Yes, I admit, I don't know everything. My old self admittedly knows less than my present self (the post was written 4 years ago), who most likely, I hope, knows less than my future self. I posted the link in the hope that others may find it valuable to see how such a bug might manifest itself.

2. The post was written in an exploratory tone, not a factual, "here are the facts, here's how to solve this problem across all scenarios" tone.

Thanks for your feedback.

Reply on news.ycombinator.com