6 ms·

What you may be surprised to learn is that Chrome isn't just stripping "www." from the beginning of the subdomain. "subdomain.www.domain.com" displays as "subdo

What you may be surprised to learn is that Chrome isn't just stripping "www." from the beginning of the subdomain. "subdomain.www.domain.com" displays as "subdomain.domain.com"

type0 8y ago
This is amazing, what a freak show.
contravariant 8y ago
Isn't this a security risk? What if someone malicious takes control of the www.com domain?
- speleding 8y ago
  The www.com might not be easy to get, but there is probably a www name at another important TLD that can be purchased. And if you own that domain you can easily get SSL certificates too. Sounds like Chrome could now be a phisher's best friend…
  - qu4z-2 8y ago
    It appears that it only does it for anything subdomainish -- that is, not the first part after the TLD. I tested it against .nz which has a silly mix of .{co,govt,school}.nz second-level domains and directly registered example.nz domains and it always displays at least one "registered" bit. Which is almost worse because it seems like people have put thought into this.
- larkeith 8y ago
  This entire change is a security risk - there is no guarantee that any subdomain has the same owner as the primary, and that's not even getting into subdomain hijacking.
  - thaumasiotes 8y ago
    Let's get into subdomain hijacking a bit. Imagine taking control of www.www.www.google.com .
strictnein 8y ago
Should file this as a bug. If they seriously missed this that is just amazing.
pishpash 8y ago
lol, this one is a plain bug if true, and hints at a really rash change, like, not reviewed at all. It's getting likely it will have to be reverted and a loud slap in the face delivered as should be.
- deleted 8y ago
  [deleted]
Klathmon 8y ago
I just downloaded canary and tried it and you are absolutely right. about.www.github.io shows as about.github.io I'm on board with this change in general, but this is absolutely something that needs to be fixed. Not only is that just annoying and wrong, but it could be dangerous in some situations. Also, it doesn't just stop at one removal. http://www.www.about.www.www.stuff.www.www.example.com shows as about.stuff.example.com Interestingly though it doesn't remove it if it's the TLD, or the actual domain (so stuff.www.whatever shows as stuff.www.whatever).
- mrunkel 8y ago
  I'm guessing this is implemented as s/www\.//
  - evozer 8y ago
    Here is the implementation: https://github.com/chromium/chromium/blob/master/components/url_formatter/url_formatter.cc#L71 https://github.com/chromium/chromium/blob/master/components/...
- lysp 8y ago
  http://www.m.m.www.about.m.www.www.stuff.m.m.m.www.www.example.com http://www.m.m.www.about.m.www.www.stuff.m.m.m.www.www.examp... also = about.stuff.example.com
boomlinde 8y ago
Today is a great day to own www.com
- Klathmon 8y ago
  Luckily it doesn't work with TLDs or the "domain" part (or whatever the name for the "google" in "google.com" is). So stuff.www.com shows as stuff.www.com But www.www.com shows as www.com

What you may be surprised to learn is that Chrome isn't just stripping "www." from the beginning of the subdomain. "subdomain.www.domain.com" displays as "subdomain.domain.com"

type0 8y ago

This is amazing, what a freak show.

contravariant 8y ago

Isn't this a security risk? What if someone malicious takes control of the www.com domain?

speleding 8y ago
The www.com might not be easy to get, but there is probably a www name at another important TLD that can be purchased. And if you own that domain you can easily get SSL certificates too. Sounds like Chrome could now be a phisher's best friend…
- qu4z-2 8y ago
  It appears that it only does it for anything subdomainish -- that is, not the first part after the TLD. I tested it against .nz which has a silly mix of .{co,govt,school}.nz second-level domains and directly registered example.nz domains and it always displays at least one "registered" bit. Which is almost worse because it seems like people have put thought into this.
larkeith 8y ago
This entire change is a security risk - there is no guarantee that any subdomain has the same owner as the primary, and that's not even getting into subdomain hijacking.
- thaumasiotes 8y ago
  Let's get into subdomain hijacking a bit. Imagine taking control of www.www.www.google.com .

strictnein 8y ago

Should file this as a bug. If they seriously missed this that is just amazing.

pishpash 8y ago

lol, this one is a plain bug if true, and hints at a really rash change, like, not reviewed at all. It's getting likely it will have to be reverted and a loud slap in the face delivered as should be.

deleted 8y ago
[deleted]

Klathmon 8y ago

I just downloaded canary and tried it and you are absolutely right. about.www.github.io shows as about.github.io I'm on board with this change in general, but this is absolutely something that needs to be fixed. Not only is that just annoying and wrong, but it could be dangerous in some situations. Also, it doesn't just stop at one removal. http://www.www.about.www.www.stuff.www.www.example.com shows as about.stuff.example.com Interestingly though it doesn't remove it if it's the TLD, or the actual domain (so stuff.www.whatever shows as stuff.www.whatever).

mrunkel 8y ago
I'm guessing this is implemented as s/www\.//
- evozer 8y ago
  Here is the implementation: https://github.com/chromium/chromium/blob/master/components/url_formatter/url_formatter.cc#L71 https://github.com/chromium/chromium/blob/master/components/...
lysp 8y ago
http://www.m.m.www.about.m.www.www.stuff.m.m.m.www.www.example.com http://www.m.m.www.about.m.www.www.stuff.m.m.m.www.www.examp... also = about.stuff.example.com

boomlinde 8y ago

Today is a great day to own www.com

Klathmon 8y ago
Luckily it doesn't work with TLDs or the "domain" part (or whatever the name for the "google" in "google.com" is). So stuff.www.com shows as stuff.www.com But www.www.com shows as www.com