Hacker News Reader

Comment by radley | Hacker News Reader

I think subdomain user accounts are going to be an issue over the long term.

Also, you guys should make a better blacklist for account names. I was able to claim "blog.substack.com". (It's ok to delete that account).

https://github.com/marteinn/The-Big-Username-Blacklist

Ahh thanks. I hope you don’t mind if we boot that one.

How do you foresee sub domains being a problem otherwise?

SEO will see each account as a separate domain, so your primary site ranking will be low. Further, there's too many ways for user subdomains to be mistaken or conflict with company products and promotions. It's usually best to reserve subdomains for company needs — you never know what you'll need 5-10 years from now.

It's also a potential cross-domain attack vector if you let your users insert arbitrary code. See, for example, why github pages was switched from `.com` to `.io`: https://github.com/blog/1452-new-github-pages-domain-github-...

All really good points. Thanks for the feedback.

I also ended up with "mail.substack.com" (along with mail@substack.com) while testing. I couldn't see an admin site, but I did get a confirmation email.

Please delete the account (and my apologies for the hassle).

Nice.

If one can grab "admin", "webmaster", or one of several others, she can also get SSL certificates for the domain.

It looks like basic https://substack.com link doesn't work without the "www" prefix.

Yes. This is our dns provider not bending the rules to work nicely with Heroku, which doesn’t play well with apex domains (but is handling our SSL.)

Would love a tip if anyone knows an easy way to fix this properly.

You really should just switch to a DNS provider that does ALIAS-style apex domains like Route 53. GoDaddy as DNS provider will be a mistake you will almost certainly eventually regret, given enough time.

Oh wow, GoDaddy for authoritative DNS?

Yeah, seriously, spend $1/month and use Route 53 or somebody -- anybody -- else.

Reply on news.ycombinator.com