8 ms·
Show HN: One hostname to rule them all
- thomcrowe 9y agoLOVE the artwork here! Great story guys.
- jakobdabo 9y agoWhat about the protections from XSS which Content Security Policies[0] can provide? It would be unfortunate when a bug in your blog engine can cause a hack of your store. [0] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP
- mrkurt 9y agoCSP still applies, you can apply restrictions by path and hostname. Or am I missing your meaning?
- jakobdabo 9y agoFor some reason I believed that CSP rules can be hostnames but not paths. At least in Mozialla's documentation above there is not a single example of a rule with a full path. I can't check it by myself right now to find out the truth as I'm far away from my development PC.
- mrkurt 9y agoAh, Mozilla's docs are not great. The spec allows a URI, and there is guidance on how to interpret paths: https://www.w3.org/TR/CSP2/#source-list-path-patching https://www.w3.org/TR/CSP2/#source-list-path-patching
- lvh 9y agoAccording to the CSP2 spec, the value of a -src directive contains three parts: - protocol/scheme (optional) - hostname (mandatory) - path (optional) Notably, there is no query portion or fragment portion; browsers are expected to ignore those. Path matching works like a prefix if it ends in a slash. If it doesn't, only exactly that path matches. In CSP3, the secure protocol/scheme (https, wss) always matches, even if you explicitly specify http:// http://. In CSP2, the implicit scheme matches either; an explicit scheme only matches that scheme. This is typically not useful behavior because you probably have HSTS anyway, so people just use hostnames and only rarely specify the protocol. Most values in practice seem to just be hostnames in general; paths too are rare.
- jakobdabo 9y agoThank you, that was insightful.
- dgoldstein0 9y agoCSP doesn't help unless you can apply a strict policy to every page of your site. If a single page has an XSS, that gives js execution to the attacking code, which can then steal cookies, forge requests, exfiltrate localstorage, etc. With multiple domains, you at least can limit the blast radius of an XSS; on the same domain, most protections can be circumvented. E.g. there's no cors protection, so if different apps use different implementations of csrf, just fetch a the other app's page over XHR and parse out it's csrf token; it's probably their or in a cookie which you should be able to read.
- dom0 9y agoCookies aren't restricted to paths as well.
- yahelc 9y agoNo, cookies can be restricted to paths, it's just less commonly utilized. https://developer.mozilla.org/en-US/docs/Web/API/Document/cookie#new-cookie_path https://developer.mozilla.org/en-US/docs/Web/API/Document/co...
- tptacek 9y agoThey can be, but the restriction isn't useful, because the Javascript same-origin policy doesn't reliably defend the boundary.
- dgoldstein0 9y agoexactly. It still boggles my mind that browsers don't send up the path and domain of a cookie when sending the name & value with a request. for anyone interested in the topic, https://www.usenix.org/system/files/conference/usenixsecurity15/sec15-paper-zheng-updated.pdf https://www.usenix.org/system/files/conference/usenixsecurit... is a must read
- jjuhl 9y agoBadly veiled advertisement.
- showerst 9y agoI wish there was a way to just tell search engines whether your content should be treated as part of the parent subdomain or not for SEO purposes. That way you'd keep the XSS protections of CSP, while still not breaking things like github pages or a zillion other subdomain hosted services.
- dgoldstein0 9y agosounds like you want https://w3c.github.io/webappsec-suborigins/ https://w3c.github.io/webappsec-suborigins/
- stephenr 9y agoI think that's the opposite: telling browsers to treat some paths as different origin
- deleted 9y ago[deleted]
- CharlesW 9y agoOkay, so the claim is subdomains = bad, subfolders = good. Is that true? I'm seeing vague claims ("Subdomains accumulate positive signals differently than root domains") without anything of substance to back up their veracity or relevance.
- hayksaakian 9y agoMany people have tested this and written about their results: https://moz.com/blog/subdomains-vs-subfolders-rel-canonical-vs-301-how-to-structure-links-optimally-for-seo-whiteboard-friday https://moz.com/blog/subdomains-vs-subfolders-rel-canonical-... http://www.bloggingflail.com/subdomains-vs-subdirectories-seo/ http://www.bloggingflail.com/subdomains-vs-subdirectories-se... https://medium.com/mention/how-we-increased-search-traffic-373-in-6-weeks-2cb342bd73ec https://medium.com/mention/how-we-increased-search-traffic-3...
- jamestomasino 9y agoEven these articles will mention that the benefits to SEO are secondary to good, relevant content that is well structured and semantic. There are downsides as well. Your ability to run paid search is limited by your domain. You can't bid for multiple positions on the same keyword with a single property. In practice, our businesses have had a much better return from the SEM benefits than the minor SEO boost.
- mrkurt 9y agoSpecialized landing pages are one of the few time it makes sense to have separate hostnames. Which is why we put this on onehostname.com.
- CharlesW 9y ago> Specialized landing pages are one of the few time it makes sense to have separate hostnames. Why, what is the theory? Do you have any concern that the "help folder-ize subdomains" business may go away with a Google algorithm update?
- firloop 9y agoIronically hosted on a different hostname than their main site.
- mrkurt 9y agoFixed! Good thing our site's setup through fly.io! https://fly.io/onehostname/ https://fly.io/onehostname/
- megous 9y agoAll data, including user passwords, and all their content going through a third party. All exchanged for some dubious SEO benefits. What can go wrong?
- mrkurt 9y agoWe have an article about how to do it yourself with nginx, if you feel like setting up a bunch of servers in different places: https://fly.io/articles/delivering-multiple-applications-on-one-hostname/ https://fly.io/articles/delivering-multiple-applications-on-...
- junke 9y agoAt the risk of stating the obvious, the One Ring is cursed.
- zxcmx 9y agoOh hey, and all your js is now on one origin so if you have an xss in your third-party blog software, you now have xss in your app! Also, good luck writing a sane content-security-policy if you do this.
- johnchristopher 9y agoYeah, but its maker is his master so... :).
- yberreby 9y agoThe accompanying blog post[1] might have been a better fit for submission, as it has actual content: [1]: https://fly.io/articles/one-hostname-to-rule-them-all/ https://fly.io/articles/one-hostname-to-rule-them-all/
- falsedan 9y agoI still don't know what this is for, all the fluff (inserted to keep the reader's attention when explaining stuff that might be boring) gets in the way.
- theoctopus 9y agoIt's a service that transforms subdomains to paths. E.g.: blog.example.com -> example.com/blog api.example.com -> example.com/api docs.example.com -> example.com/docs ... and so on. Supposedly for SEO benefit, but there's the obvious security risk of running all traffic through a third-party.
- quickthrower2 9y agoA bit like CloudFlare?
- theoctopus 9y agoThey seem to work in similar ways, but Cloudflare focuses on speed and security, this just seems to focus on SEO. The security risk is in theory the same, but I'd argue that the risk from Cloudflare is lower as they're a well established service used by major companies.
- Prefinem 9y agoIf you want to do this yourself, caddy http server [0] works really well and is incredibly easy to use / setup. They even have an example on their home page that shows this for /api and /blog [0] https://caddyserver.com/ https://caddyserver.com/
- kodablah 9y agoAlternatively: https://traefik.io/ https://traefik.io/
- mrkurt 9y agoIt works pretty well with nginx too: https://fly.io/articles/delivering-multiple-applications-on-one-hostname/ https://fly.io/articles/delivering-multiple-applications-on-... It's trickier than it seems, though, because you need to get the right combination of Host/X-Forwarded-Host right for a given hosting service. And you frequently need to rewrite HTML to fix links. Not rocket surgery, but usually I'd rather put my hours into dev and not tweaking a proxy.
- tokenizerrr 9y agoWhich is why people just use subdomains. Far less hassle, works fine.
- rcthompson 9y agoThis is exactly what I use to run a bunch of different personal services in subfolders on the same hostname. Sadly, though some things don't support running in subfolders.
- falsedan 9y agoUse nginx to lie to them so they think they're running at the server root?
- fiatjaf 9y agoEverything is easy if you're hosting all your stuff in the same machine. It gets complicated if you're using third party services, PaaS etc.
- BugsJustFindMe 9y agoThis could be an object lesson in how not to build a landing page. What is this? What is it for? I see a cartoon...but what the hell does any of it mean? Why am I signing up? What am I signing up for? > Want all your applications on One Hostname? Uh...no? Should I? I have no idea! Oh look. Tiny, low contrast text at the very bottom of the page linking to an article that loses my interest before it gets to the point. This could have been 24 point bold arial black on white: "We made a service called Fly to help you convert subdomains into load-balanced subdirectories to strengthen your brand and improve[0] your SEO. yada yada yada..." [0] - citation needed, lol
- fiatjaf 9y agoTotally disagree. The landing page is nice, is pretty, it invites you to read and has two very useful links. If it was a black on white page I would have read it, acknowledge it and close, perhaps add it to Pinboard for later use and never look at it again. The way it is now I've clicked the links and read the whole article, almost.
- deleted 9y ago[deleted]
- BugsJustFindMe 9y agoIt's very pretty, and it tells you absolutely nothing. Sorry. Correction. It tells you that you can sign up for...something.
- BartSaM 9y agoI, and I suppose a lot of people, give between 3-5 seconds to tell me what it does. If I am not able to find a reference to anything within this time - I will close the tab. I have scrolled whole website looking for one headline or enlarged text with one sentence explanation of what this is. Once I failed I turned in to HN comments. UX on this website is awful, but it has a possibility to be an amazing one. Just a few small changes and people will link to this page as an example of UI. But for now is pretty bad.
- geekuillaume 9y ago
- spookyuser 9y agoI don't really have anything to add beside that the fly.io website is beautiful.
- deleted 9y ago[deleted]
- nailer 9y agoThe solution, after reading three pages of this site describing the problem very slowly, is a guide to using folders with nginx or haproxy? HN didn't know this already?
- stephenr 9y agoIt's <basic _nix tool> as a service. I'm honestly not going to be surprised when "println as a service" appears AND people use it
- mdekkers 9y agoI spent 30 seconds looking at this, and have no idea what they are selling. The first "usable" content was something about taking down blue towers. If you have to sell me on the basis of a stretched LOTR reference, I am going to assume your actual value proposition doesn´t really hold its´own.
- stephenr 9y agoIt's a paths to subdomains reverse proxy service. Or, an opportunity to completely fuck yourself when someone breaches them and starts logging all your customer login requests
- mzzter 9y agoI love the landing page story. I also strive for single hostnames, but preferably out of one's own server through a proxy in front instead of folders. Relative URLs in subfolders just don't seem to work well on dynamic websites. One problem I haven't figured out with this app-level routing, though, is how to have a reliable status endpoint. The distance the pinging server needs from the app's running process is at odds with this routing strategy.
- eadz 9y agoYou can do this with AWS cloudfront