From 15ac0da4620adf179639afed4c57dcc0d51e408f Mon Sep 17 00:00:00 2001 From: Srdjan Date: Fri, 21 Aug 2026 13:31:53 +0200 Subject: [PATCH 1/2] Update content domain in the domain separation RFC Updates content domain in the domain separation RFC from proposed `filone.com` to adopted `filonecontent.com` --- rfcs/2026-07-user-data-domain-separation.md | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/rfcs/2026-07-user-data-domain-separation.md b/rfcs/2026-07-user-data-domain-separation.md index b754d95..02d6a35 100644 --- a/rfcs/2026-07-user-data-domain-separation.md +++ b/rfcs/2026-07-user-data-domain-separation.md @@ -28,9 +28,9 @@ This is a well-established pattern: AWS serves user data from `amazonaws.com`, n ## Design -1. **Register a dedicated data domain** — proposed: `filone.com`. Regional S3 endpoints become `.s3.filone.com` (e.g. `eu-west-1.s3.filone.com`). +1. **Register a dedicated data domain** — adopted: `filonecontent.com`. Regional S3 endpoints become `.s3.filonecontent.com` (e.g. `eu-west-1.s3.filonecontent.com`). 2. **Nothing but user data lives on this domain.** No console, no marketing pages, no email. Publish a null MX and restrictive SPF/DMARC records so the domain cannot be used to send mail. -3. **Add the domain to the [Public Suffix List](https://publicsuffix.org/).** With `filone.com` (or `s3.filone.com`) listed as a public suffix, browsers treat each subdomain as an independent site — cookies cannot be scoped across subdomains, and reputation systems that respect the PSL (including Safe Browsing) can flag an individual subdomain rather than the whole domain. +3. **Add the domain to the [Public Suffix List](https://publicsuffix.org/).** With `filonecontent.com` (or `s3.filonecontent.com`) listed as a public suffix, browsers treat each subdomain as an independent site — cookies cannot be scoped across subdomains, and reputation systems that respect the PSL (including Safe Browsing) can flag an individual subdomain rather than the whole domain. 4. **Migration.** Presigned URLs sign the `Host` header, so existing `*.s3.fil.one` URLs cannot be redirected (a redirect changes the host and breaks the SigV4 signature). Regional providers serve **both** domains during a deprecation window at least as long as the maximum presigned URL expiry, with `fil.one` endpoints removed thereafter. Console, docs and SDK-generated endpoint URLs switch to the new domain immediately. ## Alternatives Considered @@ -41,8 +41,7 @@ This is a well-established pattern: AWS serves user data from `amazonaws.com`, n ## Open Questions -- Is `filone.com` the right domain? -- PSL scope: list `filone.com` itself or `s3.filone.com`? +- PSL scope: list `filonecontent.com` itself or `s3.filonecontent.com`? ## Evaluation Criteria From 55e0678c42e14e8ef53fc889b21a43beaa44c156 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miroslav=20Bajto=C5=A1?= Date: Tue, 1 Sep 2026 11:14:01 +0200 Subject: [PATCH 2/2] final tweaks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - `s3..filonecontent.com` - PSL at `filonecontent.com` Signed-off-by: Miroslav Bajtoš --- rfcs/2026-07-user-data-domain-separation.md | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/rfcs/2026-07-user-data-domain-separation.md b/rfcs/2026-07-user-data-domain-separation.md index 02d6a35..d116691 100644 --- a/rfcs/2026-07-user-data-domain-separation.md +++ b/rfcs/2026-07-user-data-domain-separation.md @@ -10,7 +10,7 @@ Status: Experimental Regional provider S3 endpoints currently live at `.s3.fil.one` — the same registrable domain as our "front of house" properties: the console at `app.fil.one` and the website at `www.fil.one`. -These endpoints serve untrusted, user-controlled content: uploaded objects, presigned URLs, and (in future) potentially browsable/static content. This is a problem because domain reputation systems operate at *registrable domain* granularity, not subdomain: +These endpoints serve untrusted, user-controlled content: uploaded objects, presigned URLs, and (in future) potentially browsable/static content. This is a problem because domain reputation systems operate at _registrable domain_ granularity, not subdomain: - **Blocking blast radius.** A single user uploading illegal content or hosting phishing pages via any regional provider can get `fil.one` flagged by Google Safe Browsing, ISP/national DNS blocklists, and corporate proxies. This would take down the console, website, docs and company support email in one shot — for all regions. - **Independent operators.** Each region is run by an independent entity with its own abuse handling and response times. Fil One cannot guarantee how quickly any given region remediates abuse, yet today all regions and Fil One itself share fate through the one domain. @@ -28,9 +28,9 @@ This is a well-established pattern: AWS serves user data from `amazonaws.com`, n ## Design -1. **Register a dedicated data domain** — adopted: `filonecontent.com`. Regional S3 endpoints become `.s3.filonecontent.com` (e.g. `eu-west-1.s3.filonecontent.com`). +1. **Register a dedicated data domain** — adopted: `filonecontent.com`. Regional S3 endpoints become `s3..filonecontent.com` (e.g. `s3.eu-west-1.filonecontent.com`). 2. **Nothing but user data lives on this domain.** No console, no marketing pages, no email. Publish a null MX and restrictive SPF/DMARC records so the domain cannot be used to send mail. -3. **Add the domain to the [Public Suffix List](https://publicsuffix.org/).** With `filonecontent.com` (or `s3.filonecontent.com`) listed as a public suffix, browsers treat each subdomain as an independent site — cookies cannot be scoped across subdomains, and reputation systems that respect the PSL (including Safe Browsing) can flag an individual subdomain rather than the whole domain. +3. **Add the domain to the [Public Suffix List](https://publicsuffix.org/).** With `filonecontent.com` listed as a public suffix, browsers treat each subdomain as an independent site — cookies cannot be scoped across subdomains, and reputation systems that respect the PSL (including Safe Browsing) can flag an individual subdomain rather than the whole domain. 4. **Migration.** Presigned URLs sign the `Host` header, so existing `*.s3.fil.one` URLs cannot be redirected (a redirect changes the host and breaks the SigV4 signature). Regional providers serve **both** domains during a deprecation window at least as long as the maximum presigned URL expiry, with `fil.one` endpoints removed thereafter. Console, docs and SDK-generated endpoint URLs switch to the new domain immediately. ## Alternatives Considered @@ -39,10 +39,6 @@ This is a well-established pattern: AWS serves user data from `amazonaws.com`, n - **PSL entry on `s3.fil.one` without a new domain.** Helps cookie isolation, but many blocklists and filters key on the registrable domain regardless, so `fil.one` remains exposed. - **A separate domain per regional operator.** Maximum isolation between regions, but fragments the product experience, complicates SDK/endpoint configuration, and multiplies domain operations overhead. Could be a future refinement on top of this proposal. -## Open Questions - -- PSL scope: list `filonecontent.com` itself or `s3.filonecontent.com`? - ## Evaluation Criteria - A reputation incident on the data domain (simulated or real) has zero impact on `fil.one` availability, search listing, or email deliverability.