itchio / itch.io

:bug: Public itch.io issues tracker and documentation - use support instead for private information!
https://itch.io/support
241 stars 27 forks source link

Add the `itch.io` Domain to the Public Suffix List #1636

Open Mega-JC opened 3 months ago

Mega-JC commented 3 months ago

(This is presented as a feature request since no other issue template was fitting) Is your feature request related to a problem? Please describe. itch.io allows people to host their own pages under <name>.itch.io/*, with those pages having a certain degree of customization. Under those subdomains, a publisher's project can be accessed under a custom /path (a project name), and in some cases run directly on the web. This issue looks at a potential security concern.

Describe the solution you'd like While this level of customization may not be exhaustive, it would make sense to add the itch.io domain to the public suffix list (https://publicsuffix.org/, submission under https://github.com/publicsuffix/list) for security reasons.

According to Wikipedia, Cloudflare (which itch.io appears to rely on) may use the list for per-site rate limiting, which may also be relevant.

Describe alternatives you've considered N/A

Additional context It's something I noticed other businesses do, despite them offering only limited customization to their users (e.g. Notion with .notion.site).

Note however that the inclusion process is thorough and often time-consuming. Nonetheless. if further freedoms and levels of customization are planned in the future for itch.io users, it would make sense.