Top all-time · #8207
Sasha Romijn
Personal blog · mxsasha.eu/postssecurityweb
Sasha Romijn's personal blog at mxsasha.eu covers security and web. Since 2017, 10 different Hacker News readers have linked it 11 times, most often “Taking down a European network with a TLS certificate”. It is still writing: the last post was on 2026-10-30, and you can follow it by feed.
Too few sampled comments (4) to say how often HN recommends it.?
Why HN links it
HN commenters cite Sasha Romijn's cookie guide, which covers how browsers scope cookies to domains and subdomains, when discussing cookie domain behaviour in IE and Chrome and session fixation risks.
Summarised by Claude from a sample of 4 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Internet infrastructure, security research, and other technical writing by Sasha Romijn.
Most-linked posts?
- Taking down a European network with a TLS certificate4 people · 4 mentions · first linked 2026-04-29
- /blog/2014/03/04/definitive-guide-to-cookie-domains/2 people · 3 mentions · first linked 2017-11-14
What Hacker News says?
> There was a time when IE misbehaved. Not sure if this fixed in Edge: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c... . Pretty sure that was fixed in Edge and IE (as a security issue).
Comment linking /blog/2014/03/04/definitive-guide-to-c..
on “Chrome 69: “www.” subdomain missing from URL”Submitted A 14-month responsible disclosure with the RIPE NCC as a story · 3 points
HN discussionAccording to this blog post[0], IE misbehaves with cookies and allows breaking SOP. The spec says that a cookie flagged with the domain "domain.com" is supposed to only be valid for requests to "domain.com" and not "subdomain.domain.com". A cookie that is intended to be valid for all subdomains is supposed to have a preceding dot, like ".domain.com". Older versions of IE (That may still be in use) will treat "domain…
Comment linking /blog/2014/03/04/definitive-guide-to-cookie-domains/
on “Chrome 69: “www.” subdomain missing from URL”Submitted Taking down a European network with a TLS certificate as a story · 2 points
HN discussionThis is not true unless the cookie is specifically marked to be domain-wide. There was a time when IE misbehaved. Not sure if this fixed in Edge: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...
Comment linking /blog/2014/03/04/definitive-guide-to-cookie-domains/
on “Chrome 69: “www.” subdomain missing from URL”Submitted Cross-site scripting vulnerabilities lead to a RIPE NCC RPKI exploit chain as a story · 2 points
HN discussionSubdomain can set a cookie for root domain [0] and that can lead to session fixation attacks. Cookies are not subject to CORS. [0]: https://www.mxsasha.eu/blog/2014/03/04/definitive-guide-to-c...
Comment linking /blog/2014/03/04/definitive-guide-to-cookie-domains/
on “GitHub Community Forum”Submitted Taking down a network with a TLS certificate: my RIPE NCC RPKI exploit chain as a story · 2 points
HN discussionSubmitted Rooting Home Assistant through MeshCore: XSS attacks with a LoRa node name as a story · 1 points
HN discussionSubmitted Taking down a European network with a TLS certificate as a story · 1 points
HN discussionSubmitted Root from the parking lot: OpenWRT XSS through SSID scanning (CVE-2026-32721) as a story · 1 points
HN discussion