2020-07-15 UTC
# 
[fluffy] I think the relative harm caused by the top-level domain adding an endpoint is a lot less than the relative harm caused by spoofing exploits. Like, if a domain admin is seeing that hey, everyone’s using IndieAuth! Here’s a new endpoint to use! doesn’t actually hurt anything, assuming users are still able to log in to the things they log into.