3 ms·

I'm not convinced yet... One of the uses of PSL is to separate mutual distrusting users to whom you provide a domain (eg appspot.com) and with the PSL, it actu

I'm not convinced yet... One of the uses of PSL is to separate mutual distrusting users to whom you provide a domain (eg appspot.com) and with the PSL, it actually sets everything up to prevent accidental cookie leakage... a perfect case of 'secure by default' for new customers, without requiring every developer to properly implementing origin policies. As far as I see the PSL is still the only way to provide that security in a failsafe way. So let's perhaps redefine the PSL for just security and privacy and slowly move away from attempts to use it for quota enforcements, but let's not replace it with 'hope' just yet... Disclaimer: had a PR approved for the PSL a couple of weeks ago, to be able to provide users I don't necessarily trust with development subdomains to play with but provision them with wildcard letsencrypt certificates (which is easiest if you just manage the DNS for them...)

IX-103 7y ago
That's kinda the point. Right now the PSL is the best solution for a lot of things, but it fails at all of them. The PSL is compiled into most web libraries (as a security measure), so those domains are only truly separate if the browser is new enough to have the updated version of the PSL. In other cases they all look like the same domain and you get no security and no privacy. In case you think this unlikely, how many people still use cell phones that are no longer being updated? How many "smart" TVs or other web-enabled devices aren't getting updates? Of course, if you have a way of ensuring that browsers whose PSL is too old can't access your site or any of its subdomains then you might have some guarantee of security. The point is that we need something that works. There are a few ideas out there. First party sets would do a lot for security and privacy, but there are issues with using them for reputation and attribution.

IX-103 7y ago

That's kinda the point. Right now the PSL is the best solution for a lot of things, but it fails at all of them. The PSL is compiled into most web libraries (as a security measure), so those domains are only truly separate if the browser is new enough to have the updated version of the PSL. In other cases they all look like the same domain and you get no security and no privacy. In case you think this unlikely, how many people still use cell phones that are no longer being updated? How many "smart" TVs or other web-enabled devices aren't getting updates? Of course, if you have a way of ensuring that browsers whose PSL is too old can't access your site or any of its subdomains then you might have some guarantee of security. The point is that we need something that works. There are a few ideas out there. First party sets would do a lot for security and privacy, but there are issues with using them for reputation and attribution.