> For example, GitHub controls DNS for .github.io so if they wanted to track people across all GitHub Pages, they could.* The public suffix list historically h

> For example, GitHub controls DNS for .github.io so if they wanted to track people across all GitHub Pages, they could.* The public suffix list historically has been opt-in. If you look at the (human readable) https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat you'll see: // GitHub, Inc. // Submitted by Patrick Toomey <security@github.com> github.io githubusercontent.com Major companies have historically wanted to list their user-content domains on the PSL because it helps protect users cookies from other users. It's possible that this announcement changes things, but I think it mostly doesn't. The main problem with a DNS-based system is just that you would need to get everyone to switch to it, and figure out what to do in the mean time. If ".io" or someone doesn't set the DNS flag then that's a major security issue for everyone under it.