Sites that allow users [to have significant control over] personalised subdomains are also problematic for things like NoScript and other whitelisting tools. Since I have github.com permitted, all the subdomains inherit that permission.
I'm not even sure what a good model/UI would be to selectively white/blacklist subdomains.
I'm not even sure what a good model/UI would be to selectively white/blacklist subdomains.