It has weird interactions with some modern browser features. For example domain isolation doesn't apply between subdomains of the same TLD, so john.smith.name and drew.smith.name don't get isolation in naive implementations.

▲

troyrollo an hour ago | parent | next [-]

The public suffix list is a stupid hack that should be replaced by formal protocols allowing boundaries to be defined by either DNS entries, or a file on the web server.

▲

OkayPhysicist 3 hours ago | parent | prev | next [-]

The real problem is that we'd have to add a wildcard to the public suffix list. That's it.

The public suffix list is the big list of all the URL suffixes that should not imply shared ownership of all their subdomains. For example the line

com

says "XYZ.com" and "ABC.com" should not be assumed to be controlled by the same entity.

Problem is, all 1st level domains registered to the .name TLD should be added to the list, and that's a lot of domains. The correct answer, IMO, would be to add a wildcard

*.name

but that would involve updating all the code that relies on the public suffix list to support said wildcard.

▲

toast0 an hour ago | parent [-]

*.name isn't a good solution either, because the vast majority of registrations are at the second level.

If you want to do it properly, you really do need to include all of the second level domains that have more than one third level registrant. And update that periodically as domains expire... there might be three registrants under .example.name today, but if they all (or all but one) stop paying, example.name is no longer a public suffix and it should be removed.

▲

OkayPhysicist an hour ago | parent [-]

Having "no cookies shared between subdomains" as a restriction on the entire TLD isn't completely beyond the pale. There are other TLDs that have restrictions, like HTTPS being required for .dev

	▲	toast0 21 minutes ago \| parent [-]
		Having it imposed on existing registrants after the fact really is beyond the pale, IMHO. It'd be one thing if it was there since the beginning, like https for .dev, but it would probably break existing sites if you add it after the fact.

▲

tylergetsay 4 hours ago | parent | prev [-]

wouldn't that be a problem with a lot of other domains? like locality domains

▲

timeinput 4 hours ago | parent | next [-]

It definitely is. <ingress>.k8s.<mydns>.com regularly confuses what password I want to use if I have different authentication per ingress. More commonly if I run something else at <name>.<mydns>.com firefox and chrome are both happy to offer up my password for <other service>.<mydns>.com.

Closed. Wont fix.

▲

OkayPhysicist 3 hours ago | parent | prev | next [-]

We solve that problem with the public suffix list. The problem is there's a lot of .name domains, each of which would need to be added to the list.

▲

mixdup 3 hours ago | parent | prev [-]

yes, but other locality domains are fairly static and well-known

.co.uk wouldn't have the same problem because everyone knows that combo is a TLD in and of itself. with a seemingly infinite possible combinations of blah.name that could be a TLD itself, or, might just be a subdomain of .name, it gets really weird

	▲	toast0 an hour ago \| parent [-]
		> with a seemingly infinite possible combinations Verisign claimed approximately 22,000 third level domains [1] in July 2026. I don't see an estimate of the number of shared second level domains, but it's finite. The current public suffix list includes 10414 names [2]; so at maximum, the list would approximately triple in size --- not ideal, but feasible. [1] https://itp.cdn.icann.org/en/files/consensus-policies/fessen... [2] including some with wildcards, re: your other post