5 ms·

From some quick googling, it seems to me that having a ~ in the url is not a standard, rather it is only a coincidence that most of the time it is used in cases

From some quick googling, it seems to me that having a ~ in the url is not a standard, rather it is only a coincidence that most of the time it is used in cases where the content is user uploaded (e.g. the user home directory on a UNIX machine).

Alex3917 9y ago
It's not a coincidence, the reason that universities and other content providers follow this pattern is specifically to signal that the company/institution doesn't vouch for whatever is being hosted.
- kevin_thibedeau 9y ago
  They use it because universities traditionally exposed per-user web pages through the Unix shortcut path to their home account directory. The tilde has no other significance and doesn't make much sense outside of a Unix system.
  - deleted 9y ago
    [deleted]
- jlgaddis 9y ago
  The reason is because that's how mod_userdir has worked for a couple of decades or so. It was a way to easily allow unprivileged users to share content from their ~/public_html/ directory.
  - Alex3917 9y ago
    Interesting. This makes sense from a technical perspective. Nevertheless, it's clearly associated with UGC content, and as far as I know there have never been any major sites that have hosted non-UGC content using this scheme. (E.g. there is no history of use for things like Amazon product pages or whatever.) And in school we were always taught that content coming from user pages on university systems shouldn't be cited as if it were academic content being published or endorsed by the university. I'm sure others were taught the same.
    - p4lindromica 9y ago
      The reason this matters is the same origin policy, which tilde does not protect you from
      - Alex3917 9y ago
        That makes sense. I still think there is good reason to create a standard around this indicating UGC content within a subdomain though. For example: - Browsers might want to treat it differently for malware scanning purposes. - Content owners might want to treat it differently when filing automated DMCA complaints. - Search engines might want to treat it differently for ranking purposes.
        cyphar 9y ago
        One of the biggest reasons why GitHub (for example) uses a separate subdomain is so that a persistent XSS exploit on their UGC domain cannot access HTTPOnly cookies or other information from their real domain. Impersonation is a bigger problem for a government, but it's also a security measure against how broken the current security model for things like cookies is.
        Alex3917 9y ago
        I get why subdomains can be useful for preventing XSS and CORS issues, especially for non API-driven sites. The problem is that subdomains are used for all sorts of things, so just because something is on a subdomain doesn't signal that it's UGC content. Even if you hosted each person's content on its own subdomain, it would still be useful to have a standard way to signal that this content wasn't created by the organization who owns the domain. The benefit of the tilde is that, at least as far as I know, it has never been used for anything other than signaling that something is UGC content. (Even if that was a technological accident and not its original intent.)
        joombaga 9y ago
        > it would still be useful to have a standard way to signal that this content wasn't created by the organization who owns the domain. Do you think the assumption that the content was created by the organization who owns the domain should be default? Wouldn't it be better for the organization to provide a signature for the content it did create?

Alex3917 9y ago

It's not a coincidence, the reason that universities and other content providers follow this pattern is specifically to signal that the company/institution doesn't vouch for whatever is being hosted.

kevin_thibedeau 9y ago
They use it because universities traditionally exposed per-user web pages through the Unix shortcut path to their home account directory. The tilde has no other significance and doesn't make much sense outside of a Unix system.
- deleted 9y ago
  [deleted]
jlgaddis 9y ago
The reason is because that's how mod_userdir has worked for a couple of decades or so. It was a way to easily allow unprivileged users to share content from their ~/public_html/ directory.
- Alex3917 9y ago
  Interesting. This makes sense from a technical perspective. Nevertheless, it's clearly associated with UGC content, and as far as I know there have never been any major sites that have hosted non-UGC content using this scheme. (E.g. there is no history of use for things like Amazon product pages or whatever.) And in school we were always taught that content coming from user pages on university systems shouldn't be cited as if it were academic content being published or endorsed by the university. I'm sure others were taught the same.
  - p4lindromica 9y ago
    The reason this matters is the same origin policy, which tilde does not protect you from
    - Alex3917 9y ago
      That makes sense. I still think there is good reason to create a standard around this indicating UGC content within a subdomain though. For example: - Browsers might want to treat it differently for malware scanning purposes. - Content owners might want to treat it differently when filing automated DMCA complaints. - Search engines might want to treat it differently for ranking purposes.
      - cyphar 9y ago
        One of the biggest reasons why GitHub (for example) uses a separate subdomain is so that a persistent XSS exploit on their UGC domain cannot access HTTPOnly cookies or other information from their real domain. Impersonation is a bigger problem for a government, but it's also a security measure against how broken the current security model for things like cookies is.
        Alex3917 9y ago
        I get why subdomains can be useful for preventing XSS and CORS issues, especially for non API-driven sites. The problem is that subdomains are used for all sorts of things, so just because something is on a subdomain doesn't signal that it's UGC content. Even if you hosted each person's content on its own subdomain, it would still be useful to have a standard way to signal that this content wasn't created by the organization who owns the domain. The benefit of the tilde is that, at least as far as I know, it has never been used for anything other than signaling that something is UGC content. (Even if that was a technological accident and not its original intent.)
        joombaga 9y ago
        > it would still be useful to have a standard way to signal that this content wasn't created by the organization who owns the domain. Do you think the assumption that the content was created by the organization who owns the domain should be default? Wouldn't it be better for the organization to provide a signature for the content it did create?