<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>mike-cardwell</author><text>Your Strict-Transport-Security definition is missing the &quot;includeSubDomains&quot; flag. STS is a lot more effective if you use that flag.&lt;p&gt;You should discuss how X-Frame-Options prevents sites legitimately loading your pages inside frames too. I believe Reddit does this amongst others in order to displays a small control panel at the top of the page. X-Frame-Options is appropriate for many sites, but perhaps not for blogs.&lt;p&gt;You should talk about how CSP prevents most bookmarklets from working. For example readability and instapaper. I really like CSP, but people should be made aware of this.</text><parent_chain></parent_chain></comment><story><title>Simple ways to improve the security of a web app</title><url>http://blog.fiesta.cc/post/13896457582/three-simple-ways-to-improve-the-security-of-your-web</url></story>
<instructions>Your goal is to analyze the following comment and estimate how highly it will be upvoted by the Hacker News community.</instructions><comment><author>alexchamberlain</author><text>I wasn&apos;t expecting much from yet another &quot;How to secure your website...&quot; article, but those headers are completely new to me.</text><parent_chain></parent_chain></comment><story><title>Simple ways to improve the security of a web app</title><url>http://blog.fiesta.cc/post/13896457582/three-simple-ways-to-improve-the-security-of-your-web</url></story>