A lot of platforms like fly.io, Heroku, vercel, etc. have more or less the same simple host pattern. The pattern seems to be:
{random-string}{domain}
Some reasons are obvious like:
1. Using the same subdomain allows for a single wildcard cert
2. The random string label probably helps to avoid collisions, protect privacy, security, etc.
What other reasons would this common pattern be used?
Another note: we use `on-aptible.com` for our hosted app domains, separate from `aptible.com` for an important security reason: it is a second line of defense in avoiding cookie/CORS attacks (the first line of defense being setting cookies we control in a single subdomain and avoiding wildcards for CORS).
A related important measure for a PaaS using a single domain for subdomains owned by different accounts is to register that domain on the Public Suffix List [0], which prevents "supercookies" being set across these separately-owned subdomains.
[0] https://publicsuffix.org/