The Public Suffix List Is a Disaster

Firstly, incredible post. Secondly, wow, this is completely shocking to me to read.

I had no idea that firstly this even existed as a problem and how important of an issue it is. Thanks for shining light on a very dark and obscure part of the internet that plays a deeper role than we acknowledge. It's actually sad to see that the volunteers have been abandoned to do this public service that everyone benefits from with zero support.

I agree with your #1 recommendation for a solution. There should be support and better governance.

TL/DR: Ethereum nameserver provider applied to be in PSL, and had great trouble getting in, as it had dozens of malicious domains. They had to stop serving malicious domains to get in (the horrors!)

I can kinda see where the both parties come from.

On one side, browsers use PSL to harden security - by sandboxing sites, restricting shared cookies, etc.. a.example.com and b.example.com could share SameSite cookies and browser cache, but once added to PSL, they no longer can. Under that interpretation, it's strictly better to have PSL to be as large as possible, because the bigger the list is, the more secure the web is.

On other side, a lot of security-related tools use PSL to attribute bad behavior. For example if a.example.com is found to contain malware, a lot of services would mark entire "example.com" hierarchy as malicious, including "b.example.com"; but with PSL inclusion, it's only "a.example.com" which is suffering, while "example.com" itself and "b.example.com" having clean reputation.

That second use has an opposite effect - it actually decreases security of the web with each PSL entry. Every malware author would love to be on that list - "a123.malware.xyz" is marked malicious? No problem, switch to "a124.malware.xyz" which (thanks to PSL) is not burned yet. I am sure this is why getting on PSL list is so hard, and am I am sure that it's that isolation was the real motivation for author's effort, not "user security".

That said, I agree with author's 1st point - it would be nice to have official charter and governance structure for something as important as PSL.

But the 2nd point, "All PSL submissions are automatically merged after passing linter tests, without justification or further exposition."? Hell no. PSL should embrace being a security privilege it is, and behave accordingly. For example, if a DNS domain provider routinely serves malware and does not respond to the take-down requests, it should be kicked off the list. That one-off "no malware on subdomains" check should be automated and applied periodically to all PSL entries.