"Easier" is a relative. And in this case relatively small.
The server and DNS configuration you need for a subdomain is identical to what you need for separate domain. Possibly slightly more to manage if you are using the "naked" domain because of the DNS issue with not supporting CNAME records on the naked domain.
If you already have a wildcard SSL certificate for the subdomain a separate domain might be more work because you need a new cert and you don't if you stick with a subdomain.
The most work is actually buying the domain.
Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork.
There are security implications galore, mostly due to the same-origin policy. Books can and have been written about web security; if you're writing webapps, you need to read one.
My feeling is that it's like computer security, you can bleat all you like about how the millions of developers have to magically know this stuff, or you can build it in by default.
One method works, one doesn't.
But keep on telling people to read a book, for all the good it will do.
Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork.
It's not that bad.
It is slightly annoying that the procurement rules don't let sysadmins buy multi-year domain registrations---not even for .gov domains.
Ultimately, there's nothing stopping a federal employee or contractor from buying another domain except ignorance of good infosec practices. Even a .gov domain isn't all that expensive---$400/year is a drop in the bucket of federal spending.
And how far removed is the sub-team that manages this specific content posting part of the web content from the DNS team/process/red-tape to even make the inquiry about how to?
Dev: "Can I have a domain?"
Me: "Sure"
10 minutes later done
In government I imagine you need a procurement order which needs to be approved. And my anecdotal experience has been that the dev teams don't always take high priority in those queues.
I'm sure it's not as hard as I made it out to be but it is certainly not as straight forward as many of us are used to.
It's not really linked to private vs public. It's more of an organisation size question. I can guarantee that if you were working in a megacorp it would be the same issue
I work in a megacorp. Can confirm. Have to file tickets, and they have to seek approvals for either delegation of server allotments and subdomains or new dns pointers or worse.
I regularly need to host internal applications accessible by other staff and often just do so from my machine during the daytime and send them updated IP addresses/ports where they can access them... boss didn't even think it was possible...
Yeah. I imagine the government processes are pretty convoluted.
Some of the tools are temporary mind you, and it's much quicker to run the temp tool on my machine through the local network for a couple of weeks than to spend a few days waiting on resource allocation and then getting it shut down afterward.
Some of them are scheduled to be merged into larger projects that will seek out the necessary permanent resources... in time.
And things always take their time. It's my first excursion into such a large company and it is boggling at times. Things that would be small flaws in a smaller business are magnified 10, or 100x.
It's actually worse than you made it out to be. In order to buy a dotgov domain, you not only need your management's approval (and since it's "representing the department to the public" that chain goes very high up) you also need to convince GSA (the registrar for dotgov) that you have a need for a new domain. It's not fun unless you're 18f under the Obama administration, and they don't count.
The server and DNS configuration you need for a subdomain is identical to what you need for separate domain. Possibly slightly more to manage if you are using the "naked" domain because of the DNS issue with not supporting CNAME records on the naked domain.
If you already have a wildcard SSL certificate for the subdomain a separate domain might be more work because you need a new cert and you don't if you stick with a subdomain.
The most work is actually buying the domain.
Then again, this is government we are talking about so buying a $10 domain is probaly three weeks worth of paperwork.