2020-01-16 UTC
# 
[dmitshur] so the high level problem is when example.com has no idea what IndieAuth is, but lets certain people control certain pages. then, if a user has full control over example.com/foo/ but no control over example.com or any other pages, they can still control the entire example.com domain. is that right?