"almost everything" is a bit of an overstatement, I think.
I did incorrectly assume that news.YC was based on reddit- I've since corrected that.
"This allowed users to make links in the comment section that could run javascript that could steal your cookie and your login details" would be more accurate. The issue has(very speedily) been resolved since, but there is no need to make light of a textbook XSS exploit.
I do, but marketing is my job decription at the startup I work for ( avanoo.com ).
I think it's important to set at least rudimentary benchmarks/milestones in terms of growth and brand recognition.
After that, throw a bunch of stuff on the wall and see what sticks. The few ideas with the most ROI in terms of 1. traffic and 2. user retention should be at the forefront of your future strategies.
This may not sound like much of a plan, but as long as you have a mini-strategy in place for every one of your marketing efforts, and as long as you understand and, if possible, participate in the community you are marketing to, the try-everything approach should work.
I'm curious, do such small sites usually get bought for the technology or the traffic?