Brander says same-origin makes centralisation mandatory. Because 1) trust, data trapped in services, and infra are tied to domains, 2) SOP makes those domains points of centralisation. I don't understand the necessity of that outcome Brander posits. Ad 1) Yes, domains are nodes of coalescence. They're not scarce though, maybe not everyone can get their preferred one, and there's a theoretical limit, but not scarce. Harder to arrange, because registering presupposes things like banking/credit cards, and it isn't permissionless in many places. So we put our stuff on someone else's domain, a silo. So are we talking about the hurdle of getting a domain really? Same is true for infra, running your own hosting is doable, and it is more permissionless than getting a domain. Again it may be too high a threshold for many. So it's a [[Technologie kleiner dan ons 20160818122905]] issue rather than centralisation, the centralisation is not unavoidable but a likely outcome because of that tech threshold.
Ad 2) SOP is something enforced in browsers/apps, it's not controlled by the domains you visit, right? There's an attack surface of course if you disable (parts of) it. I disable SOP to make this annotation for instance. It moves the trust question though when you disable SOP selectively.