U are right, but.... U should not generate vanity even by ur self, how do u know that vanity generator software don't have back door ? Its all fucked up in this world , there is no safety , and that is one of big problems of bitcoin, but well we get more aware as we go, we learn expensive lessons, but we LEARN them . Mine cost me all 90% of my bitcoins, so...

This doesn't help. The attack was made through GET request to an picture outside of the site (big security issue of web browsers) . The attack will work even if you open that page from disk. Only protection is pull out the ethernet cable.

I guess that will not help to, it will be still stored . Only way is to do it on pc that never connects to internet , but well who knows all that , he would never bother making "cool" vanity addy in a first place. We just did not know, never even crossed my mind  that they will store our private keys.

Application is still able to wait until you mistakenly switch to online. It can store all values in local storage and send them later.

When you paying?

Bitcoin has one big issue, which may make it unusable in the future. You cannot have easy-to-use true offline wallet. Because if you want to pay - spend funds - you need to go online, download all unspend outputs, then create transaction and sign it at offline, and then switch back to online and broadcast it. Every time you are going to online, there is a chance, that unwanted piece of software running in your offline wallet will get chance to leak your private key.

Alternatively you can use online computer and offline wallet and carry the request through no-internet medium, such a QR code, but it still need device with camera and display and it is not easy-to-use.

Bitcoin protocol need an improvement, which should allow to create partial transaction signed by the private key that allows to 3rd party spend your coins up to specified amount. 3rd party can be merchant. 3rd party can take any of your unspend outputs and create transaction to any address that he chooses, but only up to specified (and signed) amount  (transaction should send rest of coins back to source address). Result transaction is finally signed by another private key... so you will need two private keys to create such a transaction, but second private key is used only to protect transaction against unwanted change. Second private key can be supplied by the 3rd party.

This can help to not only create true offline wallet, but to simplify money transfer between customer and merchant, Customer only needs HW wallet with display able to show QR code and keyboard to type amount and pin. Merchant will need online application to sign transaction and broadcast it.

From following the style of rules here, I've also learnt never to walk next to a road; never to drive a vehicle or fly (how many thousand car fatalities and injuries per year, and flights although much safer are still risks); even never to live in a house (so many fatal accidents happen at home) or go to work (because some people die in work related injuries). I'm currently looking at moving to a secure safe 500m underground where I aim to grow my own food from resources gained from my very rare trips to ground level and filter the water out of the rock. I shall forsake all technology I haven't built/invented myself from scratch and avoid personal contact (people have colds and other diseases and antibiotic-resistant strains are getting stronger).

I think the more practical lessons are to be more cautious in these early days (I still think it is early days, even if its years) of bitcoin and not invest money that you can't afford to lose if you plan to store it anywhere other than secure cold storage (and if you're really paranoid, even cold storage paper in a top-secret government-standard safe is a bit risky). If you want to invest and support and use and share a currency that is, in currency terms, very very new still, expect risk (and the potential gains/usage are higher because of that).

Mt.Gox seemed safe while it was working, but people following it closely already saw warning signs - and moved out in time to avoid too big a loss. Professional investors who deal with risk like this often are practiced at spotting warnings like that and are very methodical about weighing the risk/benefit, so if you're not one of them you're at a slight disadvantage and should be ready to be on the losing side occasionally.

Just out of reference if you were really truly in want of making sure you were secure, you could run armory offline, use vanitygen to generate addresses and import those addresses into your cold storage/air gapped device. From there you could create transactions on your internet connected device, then move that transaction to the offline device and have it signed then move that back to the online device to be broadcast. It's a lot of work, but it pretty much guarantees that it's impossible for your keys to be stolen. It's simply a matter of how lazy you are.

Well i'm also one of those who was not careful, and didn't had the proper knowledge, to make a vanity address on the site.
Yes of course i could've look the code, source, but i don't know any of this. 
I didn't lose much, thankfully i was a little suspicious( Bitcoin is the most paranoid community i know, they helped me in that sence) and didn't put all the BTC i own.

I don't have a lot of faith of having some fund back but i'll still give a try:

Vanity address gotten by the site-that-shouldn't-be-name: https://blockchain.info/fr/address/1weezoVx2zDnogLRabRcDawTVQ33VrbmB
the amount spent to get the vanity address: https://blockchain.info/fr/tx/1656b29b85d7e8f693ccb3273d63a1e2e00c0e978601a8767dcd205a4532ae34

And finally the address for refund(if that ever happen): 1LJ1GPj5Fkkh2Xgee9bWkwhF1K4yRZmZYY

P.S. I know the amout i've lost is small compare to some others that have been stolen from, but for me it is.
May this lesson help some other newly, or veteran, users of bitcoins.

" we are hacked"

this excuse reminds me a lot of scams.