upvote

points

by swiftcoder3 hours ago |
comments
upvoteby troyrollo6 minutes ago|
next
[-]
The public suffix list is a stupid hack that should be replaced by formal protocols allowing boundaries to be defined by either DNS entries, or a file on the web server.
reply
upvoteby OkayPhysicist1 hours ago|
prev|
next
[-]
The real problem is that we'd have to add a wildcard to the public suffix list. That's it.

The public suffix list is the big list of all the URL suffixes that should not imply shared ownership of all their subdomains. For example the line

com

says "XYZ.com" and "ABC.com" should not be assumed to be controlled by the same entity.

Problem is, all 1st level domains registered to the .name TLD should be added to the list, and that's a lot of domains. The correct answer, IMO, would be to add a wildcard

*.name

but that would involve updating all the code that relies on the public suffix list to support said wildcard.

reply
upvoteby toast034 minutes ago|
parent|
[-]
*.name isn't a good solution either, because the vast majority of registrations are at the second level.

If you want to do it properly, you really do need to include all of the second level domains that have more than one third level registrant. And update that periodically as domains expire... there might be three registrants under .example.name today, but if they all (or all but one) stop paying, example.name is no longer a public suffix and it should be removed.

reply
upvoteby OkayPhysicist24 minutes ago|
parent|
[-]
Having "no cookies shared between subdomains" as a restriction on the entire TLD isn't completely beyond the pale. There are other TLDs that have restrictions, like HTTPS being required for .dev
reply
upvoteby tylergetsay3 hours ago|
prev|
[-]
wouldn't that be a problem with a lot of other domains? like locality domains
reply
upvoteby timeinput3 hours ago|
parent|
next
[-]
It definitely is. <ingress>.k8s.<mydns>.com regularly confuses what password I want to use if I have different authentication per ingress. More commonly if I run something else at <name>.<mydns>.com firefox and chrome are both happy to offer up my password for <other service>.<mydns>.com.

Closed. Wont fix.

reply
upvoteby OkayPhysicist1 hours ago|
parent|
prev|
next
[-]
We solve that problem with the public suffix list. The problem is there's a lot of .name domains, each of which would need to be added to the list.
reply
upvoteby mixdup2 hours ago|
parent|
prev|
[-]
yes, but other locality domains are fairly static and well-known

.co.uk wouldn't have the same problem because everyone knows that combo is a TLD in and of itself. with a seemingly infinite possible combinations of blah.name that could be a TLD itself, or, might just be a subdomain of .name, it gets really weird

reply
upvoteby toast025 minutes ago|
parent|
[-]
> with a seemingly infinite possible combinations

Verisign claimed approximately 22,000 third level domains [1] in July 2026. I don't see an estimate of the number of shared second level domains, but it's finite. The current public suffix list includes 10414 names [2]; so at maximum, the list would approximately triple in size --- not ideal, but feasible.

[1] https://itp.cdn.icann.org/en/files/consensus-policies/fessen...

[2] including some with wildcards, re: your other post

reply