search

publicsuffix / list

The Public Suffix List
https://publicsuffix.org/
Mozilla Public License 2.0
1.97k stars 1.2k forks source link

Add Clever Cloud's domains for customers #1974

Closed judu closed 3 months ago

judu commented 3 months ago

Checklist of required steps

Submitter affirms the following:

For Private section requests that are submitting entries for domains that match their organization website's primary domain, please understand that this can have impacts that may not match the desired outcome and take a long time to rollback, if at all.

To ensure that requested changes are entirely intentional, make sure that you read the affectation and propagation expectations, that you understand them, and confirm this understanding.

PR Rollbacks have lower priority, and the volunteers are unable to control when or if browsers or other parties using the PSL will refresh or update.

(Link: about propagation/expectations)

Description of Organization

Clever Cloud provides hosting services. (see https://www.clever-cloud.com/) As part of hosting, Clever Cloud provides the privately-owned cleverapps.cc and cleverapps.tech domains for dev purposes. Customers can use a subdomain of cleverapps.cc and cleverapps.tech for free. These domains records are managed by Clever Cloud and will point towards our own infrastructure.

The same happens for some domains in *.services.clever-cloud.com, which we use to offer object storage services, like:

Clever Cloud also provides services using a uniquely generated domain under some subdomains, like:

Reason for PSL Inclusion

This is a follow-up for https://github.com/publicsuffix/list/pull/634

All subdomains of cleverapps.tech, cleverapps.cc and *.services.clever-cloud.com are considered mutually-untrusting parties/clients. Since the domains can be used "for free", we need to protect against cookie-sharing attacks and being reported to security databases when bad users use them for fraudulent purposes. (We have active detection processes and automated responses to phishing reports from security companies, but it's an ever evolving game.)

As such we request that it is added to the private section of the Public Suffix List.

Number of users this request is being made to serve: around 150k at the moment.

DNS Verification via dig

dig +short TXT _psl.cleverapps.cc
"https://github.com/publicsuffix/list/pull/1974"
dig +short TXT _psl.cleverapps.tech
"https://github.com/publicsuffix/list/pull/1974"
dig +short TXT _psl.services.clever-cloud.com
"https://github.com/publicsuffix/list/pull/1974"

Results of Syntax Checker (make test)

============================================================================
Testsuite summary for libpsl 0.21.5
============================================================================
# TOTAL: 3
# PASS:  3
# SKIP:  0
# XFAIL: 0
# FAIL:  0
# XPASS: 0
# ERROR: 0
============================================================================
Making check in tests
  CC       common.o
  CC       test-is-public-all.o
  CC       test-is-public.o
  CC       test-is-cookie-domain-acceptable.o
  CC       test-is-public-builtin.o
  CC       test-registrable-domain.o
  CCLD     test-is-cookie-domain-acceptable
  CCLD     test-is-public
  CCLD     test-is-public-builtin
  CCLD     test-is-public-all
  CCLD     test-registrable-domain
PASS: test-is-public-builtin
PASS: test-is-public
PASS: test-is-cookie-domain-acceptable
PASS: test-registrable-domain
PASS: test-is-public-all
============================================================================
Testsuite summary for libpsl 0.21.5
============================================================================
# TOTAL: 5
# PASS:  5
# SKIP:  0
# XFAIL: 0
# FAIL:  0
# XPASS: 0
# ERROR: 0
===========================================================================
simon-friedberger commented 3 months ago

Hi @judu! I'm not sure what happened here. Did you change the PR template? Was something wrong with it? There should be 10 "tasks" (checkboxes).

judu commented 3 months ago

Hi @simon-friedberger I removed some comments so it would be easier to re-read myself before sending the PR. I may have removed too much by mistake. Let me check it again and put back the missing ones! :pray:

EDIT: Done.

simon-friedberger commented 3 months ago
judu commented 3 months ago

Hum, I thought that having owned these domains for at least 7 years was enough. I'll fix that.

Fixed the sorting.

judu commented 3 months ago

Expiration is fixed.

dnsguru commented 3 months ago

Hum, I thought that having owned these domains for at least 7 years was enough. I'll fix that.

Hear you on that. We found that many registries omit the creation date more frequently than the expiry date, so this fuzzed the benefit of domain age in the process.

We end up with requestors sometimes skuttling their plans or ghosting their project that they had requested an entry for, whcih creates a debris field in the PSL, so we hope to see the longer future term as a signal of the commitment of the project requesting the entry being stable.

The practical reason for the 2+y rule is related to the future of the domain name and it remaining registered and active.