It may have been a prototype they quickly wrote, and planned to do a heartier implementation later. And when they suddenly got onto HN's front page, a whole bun

It may have been a prototype they quickly wrote, and planned to do a heartier implementation later. And when they suddenly got onto HN's front page, a whole bunch of excitement happened and they completely forgot that this was just a prototype. "Pushing it to a public server" is really minor. Mozilla had this issue, too, when they had a new filename technically available on a server and someone jumped the gun and told the whole world that the new version was ready. Well, it wasn't. A bunch of kids whined that it was all Mozilla's fault for having a file available on their public server, but while it's arguable that a service that is reachable by URL has no expectation of privacy, it's a hell of a lot harder to argue that having a service reachable by URL implies a warranty that it is safe to use. Friends in the 90's would run telnet and web servers with "Username:" "Password:" "Credit Card Number:" prompts. It was funny to watch that some people would type in apparently real data, although we never verified.