5 ms·
This is of course true! It just takes an incident like this to get ones head out of ones ass and actually do it. :)
by ericselin 1y ago
This is of course true! It just takes an incident like this to get ones head out of ones ass and actually do it. :)
- hiatus 1y agoOne can only imagine the other beginner mistakes made by this operator.
- shadowgovt 1y agoEveryone learns somehow.
- kbolino 1y agoWell, you're responding to him, so questions or suggestions are probably better than speculation. My comment about vitriol was more directed at the HN commenters than Eric himself. Really, I think a discussion about web infrastructure is more interesting than a hatefest on Google. Thankfully, the balance seems to have shifted since I posted my top-level comment.
- hiatus 1y ago> Well, you're responding to him, so questions or suggestions are probably better than speculation. I suspect the author is unaware of their other blindspots. It's not 2001 anymore. Holding yourself out as a hosting provider comes with some baseline expectations.
- deleted 1y ago[deleted]
- lcnPylGDnU4H9OF 1y ago> baseline expectations Do you have more details? That sounds interesting.
- kbolino 1y agoThe good news is, once known, a lesson like this is hard to forget. The PSL is one of those load-bearing pieces of web infrastructure that is esoteric and thanklessly maintained. Maybe there ought to be a better way, both in the sense of a direct alternative (like DNS), and in the sense of a better security model.
- chrismorgan 1y agoThere’s some value in the public suffix list being shared, with mild sanity checking before accepting entries: it maintains a distinction between site (which includes all subdomains) and origin (which doesn’t). Safe Browsing wants to block sites, but if you can designate your domain a public suffix without oversight, you can bypass that so that it will only manage to block your subdomains individually (until they adjust their heuristics to something much more complicated and less reliable than what we have now).
- neon_erosion 1y agoThis is the kind of thing that customers rely on you to do _before_ it causes an incident.
- ericselin 1y agoThe thing is, for users, having a separate domain wouldn't have made any difference without the PSL. And you cannot get on there before you're big enough - which I'd say is roughly at the same time as you start grabbing the attention of scammers.