From their response headers, it seems like the request is coming from NGINX directly. How do they defend themselves against DOS attacks?

Big server. And if it goes down it goes down? Who cares, it's hackernews.

I have a handful of sites DNS/NS through Cloudflare, with their certificates, and they are working OK.