alt Hacker NewsIronically, this might be at least partially because the internal security controls at Cloudflare for using or provisioning new domains/subdomains is so difficult and arduous that the team decided the fastest way to go to market is to get an entirely new domain. Possible bonus that the official bug bounty program won't apply either, since it's on a new domain so any vulnerabilities found won't have to be paid out (as much).
Replies
AndrewKemendo • today at 8:27 PM
I’d argue this is exactly why this happened and why the poster is correct but missing the point:
Your organizational management is the problem not the technology
If you can’t coordinate internally to roll out a proper domain then I question how well your teams are managed
Why is this so, so common? They're subdomains. They're free. It's not hitting anybody's budget to publish a new DNS entry. If someone has permission to publish anything in your name, they probably should be able to go make themselves a subdomain.