I personally think the public suffix list should be replaced by zero sharing even amongst subdomains, and if you want to talk between x.y.example.org and example.org you can use CORS just like any other cross-domain request.

▲

londons_explore a day ago | parent [-]

I think the real challenge is the millions of sites which rely on the existing behaviour.

	▲	JoshTriplett a day ago \| parent \| next [-]
		Do it for every new TLD. Do it for every new domain in an existing TLD. Add an opt-in for security, then start pushing for the security measure, then get browsers to start carrot-and-stick enforcing it... It's possible to make things better.
	▲	sgammon 19 hours ago \| parent \| prev [-]
		Ah yes the millions they broke with CORS