The Hacker News Shortcut That Betrays Everything the Community Stands For

I clicked a link the other day. It started with hackerne.ws—a neat, tidy shortcut to Hacker News. I landed on the front page in seconds. But something felt off. The little padlock icon in my browser bar was missing. Not just missing—it was replaced by a ‘Not Secure’ warning.

This is the domain the Hacker News community itself uses for quick access. It’s a redirect domain: type hackerne.ws, and you get bounced to news.ycombinator.com. But here’s the thing: that redirect is served over plain HTTP. Port 443? Closed. No certificate. No encryption. The entire trip from your browser to the real site is naked and unprotected.

If you’re on a coffee shop Wi-Fi, a hotel network, or even a shared office connection, anyone with a laptop and a basic tool can see which link you clicked—and modify the page you’re about to see before you ever reach Hacker News. That’s not a theoretical risk. It’s a trivial, real-world attack vector.

Now, let’s be honest: Hacker News is a community that prides itself on engineering rigor. The front page is filled with debates about encryption, TLS 1.3, certificate pinning, and the sanctity of the web’s trust model. And yet, the very door that the community built for itself—the shortcut that makes it easier to reach the conversation—is left unlocked.

This isn’t a minor oversight. It’s a contradiction. The same people who will tear apart a startup’s security posture in a 200-comment thread are quietly using a redirect domain that violates every principle they claim to uphold. You can’t preach about the importance of HTTPS while leaving your own welcome mat in plaintext.

Let me be clear: this is not about a conspiracy or a sophisticated attack. It’s about the simple, boring failure to apply a known best practice. The domain hackerne.ws exists for convenience—it’s shorter, easier to type. But convenience without security is just a trap. Every time a user types that URL, they’re trusting that the redirect is safe. And that trust is misplaced.

I reached out to a few people who know the history of the domain. The response was a shrug: ‘It’s been like that for years.’ Exactly. Complacency is the enemy of security, and the Hacker News community has been complacent about its own infrastructure for so long that the flaw has become a feature.

Why does this matter? Because the web’s trust model is built on chains of small guarantees. Every link you click, every redirect you follow, every step along the path is supposed to be verified. When one link in the chain is broken, the entire journey is suspect. The fact that hackerne.ws is HTTP-only means that anyone on your network can intercept the redirect, replace the destination with a phishing site, or inject malicious content—and you’d never know until it’s too late.

This is not a hypothetical. I’ve seen it happen. In 2018, a researcher demonstrated how easy it is to exploit unsecured redirects to steal credentials. The technique is called ‘sslstrip’—it’s been around for over a decade. And yet here we are, in 2025, with a domain that the most technically literate community on the internet uses every day, and it’s still unencrypted.

I’m not writing this to shame anyone. I’m writing this because the gap between what we preach and what we practice is where the real vulnerabilities live. The most dangerous security flaw is the one you know about but ignore. Hacker News is a beacon of thoughtful engineering. But its own shortcut domain is a reminder that no one is immune to the simplest of mistakes.

So here’s the fix: turn on HTTPS for hackerne.ws. Get a certificate. Redirect from port 443 with a proper 301. It’s a 10-minute job. The community that built Arc, wrote the best essays on startup culture, and debated the nuances of zero-day exploits can absolutely handle this. The question is: will they?