5 ms·

Does githubnext.com read as a phishing-adjacent third party to anyone else? Why not deploy as next.github.com subdomain?

• oogali 4y ago
  Likely for a security-driven reason: it’s primarily a marketing site that shouldn’t have access to the .github.com cookie space.
  • idan 4y ago
    Bingo
• IshKebab 4y ago
  This happens all the time because setting up an entirely new domain yourself is way less work than asking the internal IT team to set up a subdomain for you. If the GitHub IT team is reading this then yes, that means you failed.
  • tomschlick 4y ago
    I'd imagine it's less about setup complexity and more about reducing the attack surface of the main domain where any number of mistakes on the subdomain could expose a vulnerability for the main domain as well.
    • IshKebab 4y ago
      Not in my experience. It's about avoiding bureaucracy.
• idan 4y ago
  Used to be that way! But actually for security reasons, it was better for us to operate out of a separate domain. The github.com domain is very locked down for good reason. Also, various boring realities around SSL termination made deployment difficult in a github.com domain. This was the expedient solution. Not phishing!