Hacker News Reader

I know about the public suffix list - I was wondering about the wildcard specifically. In the very issue you linked to, as of 2025, it seems this was still unresolved...:

> We have no plans to modify the .name entries at this point in time. We are aware of the implications of adding a wildcard, therefore we won't.

View on HN

Yeah, apparently they both (used to) offer unbounded registrations of 3LDs and unbounded registrations of 2LDs? So if I see j.doe.name, the only way to find out if "doe.name" is a public suffix or not, i.e. if I should (not) be able to set a cookie on it, would be to email the registrar?

So does that mean that in practice, .name domains were always treated by browsers like regular 2LDs, meaning the cookie and origin protection was always broken for those domains?

Doesn't sound like good news for the guy in the OP...

I'm just saying that they have discussed the situation. They seem to have no answer and for cookies and similar things the answer probably is "maybe don't run security critical web stuff in the third level under .name".

IIRC orgs like letsencrypt also use the PSL for rate limits, so there are probably more issues that are not browser-based.

Reply on news.ycombinator.com