Hacker News Reader

On the video, it is mentioned that the advertisements are in a frame.

Is the iframe pointed at a separate domain though? This is crucial to enforce the same origin security within javascript.

You could also make use of the sandbox[0] attribute, but that will really only benefit IE10+ users (and chrome, ff, others.)