subtls VS psl-problems

Thanks, that’s a helpful summary. I knew about the ed25519 issue (but not the others) from writing this: https://github.com/jawj/subtls

🧪 Experiment - See this page fetch itself, byte by byte, over TLS. Learn about TLS by seeing how a page is downloaded.

Ryan Sleevi has written about this before on Hacker News and here's his list https://github.com/sleevi/psl-problems

It's definitely possible that Ryan would consider using this for HN a reasonable choice, because it's mostly cosmetic, but in general you should just not add more dependencies.

Before you begin to make use of the PSL, consider some of its problems: https://github.com/sleevi/psl-problems

FWIW, the link above successfully convinced me and a coworker not to use the PSL.

(googler here, but this is my opinion)

I think there's a big abstraction gap between what we use domains for and what they were supposed to be used for, in a way that we shouldn't assume any ownership only based on the domain itself.

For instance you can have a number of sites that use separate domains but are owned by the same entity (N domains for 1 party). You could also have the same base domain being used for several unrelated parties, think hosting a store on Shopify (1 domain for N parties). This is so ambiguous that even inside the browser you have two different implementations on the way you handle this attribution, one for cookies and one for Single-Origin Policy.

There's a good write up about this problem at https://github.com/sleevi/psl-problems. Sometimes I wonder how the web got here with the amount of kludge that we have to carry.