Hacker News Reader

Is the iframe pointed at a separate domain though? This is crucial to enforce the same origin security within javascript.

You could also make use of the sandbox[0] attribute, but that will really only benefit IE10+ users (and chrome, ff, others.)