Comment by tylerchr | Hacker News Reader

Comment by tylerchr | Hacker News Reader

I see the value of this, but I find the wisdom of it to be highly questionable for anything but the highest-level TLDs.

For example, it enumerates the domains of many US state school districts:

  k12.pr.us
  // k12.ri.us  Removed at request of Kim Cournoyer <netsupport@staff.ri.net>
  k12.sc.us
  // k12.sd.us  Bug 934131 - Removed at request of James Booze <James.Booze@k12.sd.us>
  k12.tn.us
  k12.tx.us
  k12.ut.us
  k12.vi.us
  k12.vt.us
  k12.va.us
  k12.wa.us
  k12.wi.us
  // k12.wv.us  Bug 947705 - Removed at request of Verne Britton <verne@wvnet.edu>
  k12.wy.us

These seem like awfully specific subdomains to be hardcoded into general-purpose software and entirely reasonable ones to want to set a cookie on or otherwise treat as not-TLDs. The list itself includes evidence of this in the form of exclusions due to bug reports and even makes this point specifically in the case of Hawaii:

  // k12.hi.us  Bug 614565 - Hawaii has a state-wide DOE login

It’s regrettable that browser vendors, even generally responsible ones like Mozilla, feel an incentive to do this.

You think that's bad? Take a look at cn-northwest-1.eb.amazonaws.com.cn or s3.dualstack.us-east-2.amazonaws.com. There are 22 monstrosities like that.

If everything was a neat tidy standardized set of TLDs, the PSL wouldn't exist.

But it isn't. PSL allows computers to understand political, social, financial, and arbitrary decisions that have an impact on security.

For example, uk.com has no legitimate right to be a TLD. But someone managed to get enough other people to buy subdomains that we have to treat it as such. If we refuse to do so, it harms end users and not uk.com.

This could never happen because you get things like github/lab pages which gives you a subdomain which you can run JS on. Anyone could create a new public suffix at any time.

And if they're aware of the implications, they add it to the list of public suffixes when they do create one.

github.io and gitlab.io are on that list, for example.

> It’s regrettable that browser vendors, even generally responsible ones like Mozilla, feel an incentive to do this.

The 'supercookie' problem they mention does seem to warrant the effort though, even for these 3rd level hosts.

Can't recall which TLD it was under but there was a fairly high profile example of this a few years back.

k12.XX.us isn't a state school district, it's an organization of school districts within the state. For example, I used to work for ggusd.k12.ca.us (they no longer publicize that domain), and there were other districts registered under that heirarchy too.

It wouldn't be ok for my school district to have set a cookie for all school districts within the state, and that's why k12.XX.us would make sense to be in the list.

Reply on news.ycombinator.com