“As it stands right now, hosting custom user content under a subdomain is simply a security suicide” (by @vmg) github.com/blog/1466-yummy-c…