4 ms·

Have you considered requesting that your domain be added to the public suffix list? https://publicsuffix.org/ https://publicsuffix.org/ If subdomains of your d

by jefftk 6y ago

Have you considered requesting that your domain be added to the public suffix list? https://publicsuffix.org/ https://publicsuffix.org/ If subdomains of your domain should be treated as independent sites, the public suffix list is (sadly) how you communicate that to browsers. (Disclosure: I work for Google, speaking only for myself)

gomox 6y ago
Fascinating. I had never heard of this, and cloudfront.net is in there, which might provide a clue as to why Google only blacklisted our subdomain and not the whole thing (imagine that!). Is there any downside to being on this list?
- jefftk 6y ago
  > Is there any downside to being on this list? If example.com were on list then a cookie set on a.example.com couldn't be read on b.example.com. In this case that would probably be a good thing, since the subdomains represent independent sites, but if a site were erroneously added that could be a problem (mail.yahoo.com and groups.yahoo.com should share login cookies, for example). The list was originally created to handle cookies, but more recently it's been used for other notions of "site", like cache sharding.
kps 6y ago
> the public suffix list is (sadly) how you communicate that to browsers Sadly, indeed. Had they never heard of DNS?
- jefftk 6y ago
  How would you propose handling this with DNS? Here are some things it covers: * a.example.com and b.example.com are the same site * a.co.uk and b.co.uk are not the same site * a.cloudfront.net and b.cloudfront.net are not the same site * a.higashikawa.hokkaido.jp and b.higashikawa.hokkaido.jp are not the same site * a.example.higashikawa.hokkaido.jp and b.example.higashikawa.hokkaido.jp are the same site There is a proposal to do something similar using response headers and .well-known urls: https://github.com/privacycg/first-party-sets https://github.com/privacycg/first-party-sets
  - folmar 6y ago
    _i_am_tld.cloudfront.net IN TXT "yes" _i_am_tld.higashikawa.hokkaido.jp IN TXT "yes"
    - jefftk 6y ago
      This requires sites to opt in before it works, right? I think this would have been hard to introduce, because it requires so much coordination.
      - Dylan16807 6y ago
        Isn't opting in how almost everything got on the list?
        jefftk 6y ago
        No: Mozilla wrote the initial list based on their understanding of TLDs, and they maintain it based on a combination of opt-in and people noticing that domains should be on the list. Have a look: https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat
  - deleted 6y ago
    [deleted]
cadence- 6y ago
This is the first time I hear about https://publicsuffix.org/ https://publicsuffix.org/ Will definitely check it out. Maybe that will help me solve this problem. Thanks a lot!

by jefftk 6y ago

gomox 6y ago

Fascinating. I had never heard of this, and cloudfront.net is in there, which might provide a clue as to why Google only blacklisted our subdomain and not the whole thing (imagine that!). Is there any downside to being on this list?

jefftk 6y ago
> Is there any downside to being on this list? If example.com were on list then a cookie set on a.example.com couldn't be read on b.example.com. In this case that would probably be a good thing, since the subdomains represent independent sites, but if a site were erroneously added that could be a problem (mail.yahoo.com and groups.yahoo.com should share login cookies, for example). The list was originally created to handle cookies, but more recently it's been used for other notions of "site", like cache sharding.

kps 6y ago

> the public suffix list is (sadly) how you communicate that to browsers Sadly, indeed. Had they never heard of DNS?

jefftk 6y ago
How would you propose handling this with DNS? Here are some things it covers: * a.example.com and b.example.com are the same site * a.co.uk and b.co.uk are not the same site * a.cloudfront.net and b.cloudfront.net are not the same site * a.higashikawa.hokkaido.jp and b.higashikawa.hokkaido.jp are not the same site * a.example.higashikawa.hokkaido.jp and b.example.higashikawa.hokkaido.jp are the same site There is a proposal to do something similar using response headers and .well-known urls: https://github.com/privacycg/first-party-sets https://github.com/privacycg/first-party-sets
- folmar 6y ago
  _i_am_tld.cloudfront.net IN TXT "yes" _i_am_tld.higashikawa.hokkaido.jp IN TXT "yes"
  - jefftk 6y ago
    This requires sites to opt in before it works, right? I think this would have been hard to introduce, because it requires so much coordination.
    - Dylan16807 6y ago
      Isn't opting in how almost everything got on the list?
      - jefftk 6y ago
        No: Mozilla wrote the initial list based on their understanding of TLDs, and they maintain it based on a combination of opt-in and people noticing that domains should be on the list. Have a look: https://publicsuffix.org/list/public_suffix_list.dat https://publicsuffix.org/list/public_suffix_list.dat
- deleted 6y ago
  [deleted]

cadence- 6y ago

This is the first time I hear about https://publicsuffix.org/ https://publicsuffix.org/ Will definitely check it out. Maybe that will help me solve this problem. Thanks a lot!