3 ms·
Isn't that why sites like GitHub Pages moved to GitHub.io. Any popular service at this point wouldn't be allowing user content on their main domain.
by manojlds 6y ago
Isn't that why sites like GitHub Pages moved to GitHub.io.
Any popular service at this point wouldn't be allowing user content on their main domain.
- geofft 6y agoNot only that, but github.io is on the Public Suffix List, which is designed for this purpose. Any site that allows users to run servers or host arbitrary HTML/JS on a subdomain should ensure that the parent domain is on the Public Suffix List, which ensures that one user can't even attack another. (The other problem the Public Suffix List solves is that "foo.co.uk" and "bar.co.uk" shouldn't be treated like "foo.example.com" and "bar.example.com", even though they have the same number of components.)
- yorwba 6y agoTIL https://publicsuffix.org/list/ https://publicsuffix.org/list/
- lioeters 6y agoInteresting - I'd heard about the reasoning for github.io being separate from github.com, to deal with untrusted subdomains. But I didn't know that anyone could register on the Public Suffix List. The submission process is done via a pull request, described here: https://github.com/publicsuffix/list/wiki/Guidelines https://github.com/publicsuffix/list/wiki/Guidelines