3 ms·
Couldn't this be done in DNS? The same way zone delegations appear in there, a way to encode what's a public suffix? For example (I'm bad at DNS) _suffix.gitl
by remram 5y ago
Couldn't this be done in DNS? The same way zone delegations appear in there, a way to encode what's a public suffix?
For example (I'm bad at DNS)
_suffix.gitlab.io TXT "type=public,cookies=restrict,cross-origin=forbid"
would tell everyone that remram44.gitlab.io is under the gitlab.io public suffix, and how to deal with cookies etc?
- nly 5y ago1. Nobody would adopt it. 2. clients would need to do extra DNS queries, which introduces latency
- remram 5y agoI don't know about 1. Very few people have to adopt it, people who operate public suffixes like github.io and gitlab.io, and those people already spend a lot of effort on security (which currently means getting a separate domain, getting registered in the PSL, dealing with various HTTP security headers, etc). Deploying a DNS record is not much more effort than HTTP headers, and it's easier to understand than cors-related headers. There is a problem of number of queries. One extra is not very bad (connecting to a website already requires many queries, for CDN, ads, analytics, ...) but if you have to query all parent domains I can see how that might not scale.