PSA: Always use a separate domain for user content

Re:PSA: Always use a separate domain for user content by yafinder on Friday October 10, 2025 @12:15PM (#45540610)

For something that you think is a de-facto standard, public suffix list seems kinda raw to me for now.

I checked it for two popular public suffixes that came to mind: 'livejournal.com' and 'substack.com'. Both weren't there.

Maybe I'm mistaken, it's not a bug and these suffixes shouldn't be included, but I can't think of the reason why.

[ Parent | on HN ]

Re:PSA: Always use a separate domain for user content by jeroenhd on Friday October 10, 2025 @12:22PM (#45540669)

I don't know about LiveJournal, but I don't believe you can host any interactive content on substack (without hacking substack at least). You can't sign up and host a phishing site, for instance.

User-uploaded content (which does pose a risk) is all hosted on substackcdn.com.

The PSL is more for "anyone can host anything in a subdomain of any domain on this list" rather than "this domain contains user-generated content". If you're allowing people to host raw HTML and JS then the PSL is the right place to go, but if you're just offering a user post/comment section feature, you're probably better off getting an early alert if someone has managed to breach your security and hacked your system into hosting phishing.

[ Parent | on HN ]

Re:PSA: Always use a separate domain for user content by asddubs on Friday October 10, 2025 @06:51PM (#45544742)

The public suffix list interferes with cookies. So on a service like livejournal, where you want users logged in across all subdomains, it's not an option

[ Parent | on HN ]