35 ms·

So… you were hosting user generated content on the same TLD as your website, without using the PSL, and you blamed G when things went south? By putting UGC on

• ericselin 1y ago
  Many commenters are implying that there is a security issue here, and that I'm putting everyone in danger. That is quite frankly a pretty absurd claim to just casually make. I'm of course very curious to hear more details on what the security risk here actually would be? Do you think I'm reading/writing sensitive data to/from subdomain-wide cookies? Also, yes, the PSL is a great tool to mitigate (in practice eliminate) the problem of cross-domain cookies between mutually untrusting parties. But getting on that list is non-trivial and they (voluntary maintainers) even explicitly state that you can forget getting on there before your service is big enough.
  • rgj 1y ago
    I am not implying you’re putting “everyone” in danger. I’m merely implying that you’re putting your own service in danger by allowing clients to act like a trusted subdomain like controlpanel.statichost.eu, .secure, or Unicode similarities of www.
    • ericselin 1y ago
      Ok, I see. You mean the possibility of users impersonating statichost.eu itself. That is actually a good point, and the exact reason why user subdomains are required to have a dash in them. Edit: Also, only ASCII is allowed. :) I guess control-panel.statichost.eu is still possible, of course, but that already seems like a pretty long shot.