"It's wrong to trust the URL bar" is true but only because the companies operating services like... Google... don't bother trying to protect their URLs. It's no

"It's wrong to trust the URL bar" is true but only because the companies operating services like... Google... don't bother trying to protect their URLs. It's not hard to have a separate 'user content' domain for your user content, we've done it at places I used to work for. But for some reason people think it's enough to use a subdomain or get cute and use the same domain with a different TLD (looking at you, github.io) So it is kind of frustrating to see someone offering to fix a problem they helped create in the first place through neglect or carelessness.