Exactly, unless you turn off javascript and limit yourself to a very limited subset of sites you are a sitting duck. I would have thought HN general consensus would be that this is a very very bad idea.