Isolate online play entries with subdomains

[curiousdannii]

The comp allows for arbitrary Javascript code to be uploaded and run from the main comp domain. This is a substantial security risk. The play online pages should be put on a separate subdomain, and ideally isolated from each other on different subdomains.

[jmacdotorg]

This is a very good point - you're not the first to call this out, and as such I'm more wont to give it some attention.

[jmacdotorg]

Let's aim to get this solved by October 1.

The first thing to investigate is whether having lots of subdomains, e.g. [game-id].play.ifcomp.org, would work with Lets Encrypt.