3 ms·
The real reason is avoiding user-generated content from stealing authentication cookies. If worldmaker.github.com can run a little bit of javascript to add @wor
by yencabulator 3y ago
The real reason is avoiding user-generated content from stealing authentication cookies. If worldmaker.github.com can run a little bit of javascript to add @worldmaker as admin to all the user's repositories on github.com, well, that's a problem.
- WorldMaker 3y agoBoth reasons are true. Also, relatedly, "stealing perceived authenticity": if a user sets up "help.github.com" or "about.github.com" or "wwww.github.com" and then runs a scam from it, it looks like GitHub is running the scam.