> GitHub ran into the same problem when they started supporting GitHub pages. I think this passage is the main reason for the GitHub switch: «Because Pages sit

> GitHub ran into the same problem when they started supporting GitHub pages. I think this passage is the main reason for the GitHub switch: «Because Pages sites may include custom JavaScript and were hosted on github.com subdomains, it was possible to write (but not read) github.com domain cookies» This is well know cookie security problem: if you have live at x.example.co.uk you can set cookies for example.co.uk and co.uk itself. This is usually evident in organizations like universities that let their departments have their own subdomains run by different software. Usually the root domain contains dozens of unrelated cookies. Mozilla is addressing this with the public suffix list [1], but I think a more solid solution is needed. [1] https://publicsuffix.org/ https://publicsuffix.org/