This and the strange cURL CVE suggest it's a good time for vulnerability scanners to support VEX. Package publishers or users of vulnerability scanners can create VEX documents which would help prevent their releases and so on from being blocked on these kinds of CVEs.
> Everything what's been said about Reddit applies to HN as well.
Reddit is clearly going for near term profitability with the recent API changes they're making, likely in light of their looming IPO. The recent layoffs they've announced further suggest they're chasing short term profits. I doubt HN has a similar motive that would inspire similar changes.
My guess is that the opportunity cost (if not the actual overhead costs) of billing for the HN API would make charging for API access are revenue drain.