Add m.b to Public Suffix List?

Manton’s recent post about indirectly got me thinking about the Public Suffix List… I’m not sure what’s involved or if the juice is worth the squeeze but would it make sense to try and get added to the Public Suffix List?

Own your own domain is encouraged but for those who don’t, could someone include code in to hijack cookies from or perform cross site scripting attacks on other subdomains (such as or

I’ve got no real clue… just flagging it for smarter minds than me to think about :slightly_smiling_face:

I can’t see why not. It looks easy enough based on the pull request for including to the list.

I looked at this a couple years ago but couldn’t decide if there were any drawbacks, for example if we want to have a shared commenting system between blogs that might need cookies. However, in that example, we’d need it to work with custom domains anyway, so perhaps it’s not an issue.

Another aspect I was confused about is why popular blog hosts like Tumblr and aren’t on the list. Maybe if I knew the answer to that I’d be more confident about making the change.