Princeton S* Network Systems - Latest Comments in CoralCDN Lesson: The great naming conflation of the Web

Re: CoralCDN Lesson: The great naming conflation of the Web

trusts — Fri, 13 Nov 2009 20:08:35 -0000

Mike, that's a good point. I was listening to the radio last evening, and there is a group trying to do a .GAY top level domain. I thought it was interesting, because the person who is promoting that idea owns a for-profit business that plans on purchasing most of the popular domain names if .GAY gets the go ahead.

Re: CoralCDN Lesson: The great naming conflation of the Web

Mike Freedman — Fri, 13 Nov 2009 19:27:30 -0000

I'm not too worried about that. Much is just domain squatting anyway...

Re: CoralCDN Lesson: The great naming conflation of the Web

Mike Freedman — Wed, 07 Oct 2009 11:20:14 -0000

Hi oobx,

Actually, the cookie issue is much less a security issue if you are a website that is trying to explicitly use CoralCDN for cached content. You should just specify that your code uses the full origin name when setting cookies: www.yoursite.com.nyud.net, instead of just setting a default of the domain.tld (i.e., nyud.net) for "ease of use". This is good security practice anyway: the principle of least privilege and all. Then a user from evil.com.nyud.net can't read cookies set to www.yoursite.com.nyud.net, as it fails the same origin policy check.

The problem I raise above is more when a website is being accessed by a Coralized URL and they are not similarly security conscious, so that they default to using the domain.tld, instead of the full origin name.

Let me know if that assuages your concern.

Re: CoralCDN Lesson: The great naming conflation of the Web

oobx — Sat, 03 Oct 2009 00:42:04 -0000

I was just turned on to Coral and was pretty jazzed about it until I read your post. Google app engine as a CDN is what led me to Coral. GAE should not be subject to such security issues. I've not read your other posts; so please excuse my ignorance of firecoral, etc.

In trying to comprehend the scope of the security issues you raise, I conclude that only cookies set by nyud.net-cached content are vulnerable. So, I just use coral cache for images and truly static content.

But, what's to stop evildoer from linking to my script that sets cookies? Nothing. But, how would he gain the trust of the user in order for the user to click on the nyud.net link? Then, how would evildoer track that click and convince the user to go to the malicious site to hijack data?

Coral CDN sounds like a great asset for bandwidth-poor folks. I hope you can improve upon it. As is, it seems very workable so long as developers understand the caveats such as security and the potential to skew statistics.

Thanks for raising the issue.