In response to concerns that someone could set up a phishing subdomain on a legit primary domain
@jessmahler @rowan @ibagail @DialMforMara @Anke They’d have to alter the registry info (either at the registrar itself or by controlling the network that the target user is on) in order to set up another subdomain and actually get it to function. If they can do that, they don’t need the subdomain – they can alter the records for the primary.
@ibagail The owner of example.com automatically owns http://www.example.com, whatever.example.com, blah.blah.blah.example.com, etc. In the case of YouTube, YouTube.com is the building and www is one floor of the building.
They can let someone else use some floors if they want to, but no one can just grab http://www.youtube.com
That said, it is possible for YouTube to set up different websites with and without www. It’s not common, and most sites choose not to in order to avoid confusion, but it does happen.