If you're actually paying a significant cost generating stack traces for NPEs, there's a JVM option to deal with that (-XX:-OmitStackTraceInFastThrow). It still generates a stack trace the first time; if you're able to go search for that first one it shouldn't be a problem for debugging.
So should Protonmail (and any other site with similarly sensitive data) be setting that header, then? It’s probably hard to change the default. I bet some use cases (SSO popups?) depend on it.
It's not unreasonable to set a different header value for the login page only, where it should be safe because no external user data is being rendered.
That is a little different, though: those attributes are for if you're example.com linking to protonmail, the header is for if you're protonmail deciding on security policies for interactions with example.com.
Has nothing to do with legal differences. It's just a different customer service team you end up talking to. It's in the same class of tricks as knowing the precise set of prompts to give to get immediately to a human operator when you call the main line.
I'm not sure what you are seeing, but perhaps it's just a login wall. I was able to read it; I'm logged in but have never paid for Twitter or X. X does tend to hide certain things (such as replies and replied-to tweets) if you're not logged in.
> his 15km split was initially recorded as 39:47 before it was confirmed after the race as 40:07, improving his own world best.
(5km was 13:34)
https://worldathletics.org/competitions/world-athletics-labe...