There are security implications to this decision. JavaScript uses a security model called the same-origin policy. There are differences in the implementation b

There are security implications to this decision. JavaScript uses a security model called the same-origin policy. There are differences in the implementation between different browsers but here's the gist: JS may modify the DOM if-and-only-if the domain containing the script shares the domain of the DOM. Loosely, the check is done by comparing document.domain strings. If the strings match, everything is kosher. You can truncate document.domain by lopping off period delimited prefixes. Even if you lop foo.com down to the TLDs, you won't be able to do the same trick and cut bar.com down and get scripts to run in the same context. If you're hosting content on blog.example.com and example.com, an attack on blog.example.com could truncate the document.domain down to 'example.com' and execute malicious script on the primary domain. I would recommend using blog.example.com and www.example.com, but never example.com.