3 ms·

This isn't related to the post content (which was great), but I noticed that HN lists the domain as "surge.sh", which doesn't make a lot of sense because surge.

This isn't related to the post content (which was great), but I noticed that HN lists the domain as "surge.sh", which doesn't make a lot of sense because surge.sh is just the web hosting service this site is on. With the web, the convention right now is to treat the subdomain as a different security origin (with the exception of www). So the link should show c0ffee.surge.sh, not surge.sh. If this is a manual setting, it probably also needs to be set for neocities.org. I noticed that wordpress.com domains were being subdomained properly. It really shouldn't be manual, it should just always show the correct origin domain.

germanier 9y ago
There is the Public Suffix List but it doesn't seem to contain those domains. Does HN use that list? https://publicsuffix.org https://publicsuffix.org
- kyledrake 9y ago
  I was warned to not use it by it's maintainers because it would make the root of our domain potentially unusable. If I understand it correctly, it's designed for things like domain roots (.com), not domains with subdomains.
  - jacobwg 9y ago
    It is useful for some security protections in such a hosted subdomain scenario which is why herokuapp.com, herokussl.com, github.io, gitlab.io, etc are on the list, but yes, you would not be able to use your primary domain there, you'd need a dedicated domain for your customers and their subdomains. Namely, having your hosting domain on the public suffix list means that browsers will not allow setting cookies on the suffix (similar to how you cannot set a cookie for ".com"), which prevents rogue websites on the same root domain from stealing sensitive cookie values from other subdomains.
    - kyledrake 9y ago
      At any rate, wordpress.com is not on the public suffix list either, so that doesn't appear to be the issue here.
- sr2 9y ago
  Surge is not notable enough to be on that list. I think it only applies to institutions, museums, and things like that. Judging from this anyways: https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat
  - LeifCarrotson 9y ago
    You didn't read through far enough (or, more likely, you didn't ctrl-F well enough). After the "ICANN DOMAINS" section is the "PRIVATE DOMAINS" section. It contains entries like: - s3.amazonaws.com - blogspot.com - githubusercontent.com but there are many other sites in the list which are less notable.
    - kyledrake 9y ago
      Indeed, it doesn't really have anything to do with notability. You'll notice none of those root domains you just provided have sites attempting to use cookies on them.
    - sr2 9y ago
      Oh okay thanks for clarifying.

germanier 9y ago

There is the Public Suffix List but it doesn't seem to contain those domains. Does HN use that list? https://publicsuffix.org https://publicsuffix.org

kyledrake 9y ago
I was warned to not use it by it's maintainers because it would make the root of our domain potentially unusable. If I understand it correctly, it's designed for things like domain roots (.com), not domains with subdomains.
- jacobwg 9y ago
  It is useful for some security protections in such a hosted subdomain scenario which is why herokuapp.com, herokussl.com, github.io, gitlab.io, etc are on the list, but yes, you would not be able to use your primary domain there, you'd need a dedicated domain for your customers and their subdomains. Namely, having your hosting domain on the public suffix list means that browsers will not allow setting cookies on the suffix (similar to how you cannot set a cookie for ".com"), which prevents rogue websites on the same root domain from stealing sensitive cookie values from other subdomains.
  - kyledrake 9y ago
    At any rate, wordpress.com is not on the public suffix list either, so that doesn't appear to be the issue here.
sr2 9y ago
Surge is not notable enough to be on that list. I think it only applies to institutions, museums, and things like that. Judging from this anyways: https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat
- LeifCarrotson 9y ago
  You didn't read through far enough (or, more likely, you didn't ctrl-F well enough). After the "ICANN DOMAINS" section is the "PRIVATE DOMAINS" section. It contains entries like: - s3.amazonaws.com - blogspot.com - githubusercontent.com but there are many other sites in the list which are less notable.
  - kyledrake 9y ago
    Indeed, it doesn't really have anything to do with notability. You'll notice none of those root domains you just provided have sites attempting to use cookies on them.
  - sr2 9y ago
    Oh okay thanks for clarifying.