Where the term comes from The same-origin paradigm is the web's security and privacy model for roughly 30 years. In Alex Komoroske's telling, it grew up by accident: the stateless web, then cookies, then the question of which URLs get the cookies, then the notion of a site or origin — with JavaScript and local storage later inheriting the same boundary. [^bb2c42aa-478f-5c9a-ac26-e83a54c63127@1564] What it assumes - Each origin is an isolated island: it cannot see other origins' data. - But it sees everything you put into it — data goes in, and the origin can do whatever it wants with it. Why it matters in this material Komoroske treats the same-origin paradigm as a tiny, early technical decision that shaped an entire era. It is great for safety (clicking a link is safe), but its consequence is data gravity leading to aggregation: because lives are integrated but origins are not, you become the orchestrator, copy-pasting between apps. Faced with a cool startup versus Google Calendar, you pick the one that already holds your data. Data accumulates where it already exists, incumbents become massive, and the Coasean floor rises — features below a size threshold can never be prioritized, so entire classes of useful software cannot exist. [^bb2c42aa-478f-5c9a-ac26-e83a54c63127@1564] He pairs this diagnosis with his iron triangle — a safe system can have only two of untrusted code, sensitive data, and network access — and argues that breaking it via information flow control, confidential computing, and open attested runtimes is the leverage point for replacing the paradigm. [^bb2c42aa-478f-5c9a-ac26-e83a54c63127@1771] - The same-origin paradigm is the web's 30-year security and privacy model, adopted by accident. - Each origin is an isolated island that cannot see other origins' data but sees everything you enter. - It drives data gravity and aggregation, strengthening incumbents and raising the Coasean floor. - Komoroske proposes replacing it with contextual flow control built on confidential computing and open attested runtimes.