Yeah kinda heard about pages thing.
And the other thing is nothing new to me.
If you mean how cookies can be set on subdomains while Origins are completely different you are right. One more badly described in standards feature (sorts by path making cookie tossing very easy)
Blogger blogs are published under blogspot.com, and managed under blogger.com; I'm sure being in the public suffix list may help protect against some abuse, but Blogger (Google) is doing the right thing by keeping user content and administration in different domains.
Ever wonder why GitHub Pages were moved from username.github.com to username.github.io, citing security concerns, but username.blogspot.com continues to be available?
Ever wonder why www.example.co.uk can set cookies on example.co.uk, but not on co.uk?
The answer is that browsers ship something called the Public Suffix List: http://publicsuffix.org/list/, which includes blogspot.com and *.uk, but not github.com.