Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security.txt (2017)

securitytxt.org

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Security.txt (2017)

#21

Post by wycy »

stedaniels wrote: post #17
wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

Is been an RFC for almost a decade, RFC5785 [0]. Mattias Geniar has a good write up on it [1]. [0] https://tools.ietf.org/html/rfc5785 [1] https://ma.ttias.be/well-known-directory-webservers-aka-rfc-...

Interesting. I guess I've been out of the web dev scene for a little over a decade now, so that makes sense.

Re: Security.txt (2017)

#22

Post by DyslexicAtheist »

the8472 wrote: post #15
DyslexicAtheist wrote: post #9

I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…

How many of those mails were actually encrypted?

majority wasn't.

Re: Security.txt (2017)

#23

Post by linkmotif »

DyslexicAtheist wrote: post #9

I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…

Great write-up, thanks for sharing your real-world experience.

Re: Security.txt (2017)

#24

Post by system2 »

amaccuish wrote: post #20
wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

FYI .htaccess shouldn't generally be publically readable, as it's for your webserver, not the public. It's also only relevant to the directory it's in, hence why it's not in a separate directory.

nginx is your friend.

Re: Security.txt (2017)

#25

Post by cabaalis »

amaccuish wrote: post #20
wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

FYI .htaccess shouldn't generally be publically readable, as it's for your webserver, not the public. It's also only relevant to the directory it's in, hence why it's not in a separate directory.

Why are dotfiles generally considered "hidden" and not to be served (such as .htaccess, .env, etc) but .well-known is expressly intended to be served? It should have just been named well-known, IMO.

Re: Security.txt (2017)

#27

Post by Leace »

heyjudy wrote: post #8

On one-side: Wouldn't it be simpler and more effective to just have a link to a public key and email address for security reporting? And on other other: what's with this domain-specific metadata? If semantic metadata were the issue, why not solve it more generally with RDF or something that's a part of a greater, more uniform solution that people actually deploy and people actually use? All these little extra files a…

> On one-side: Wouldn't it be simpler and more effective to just have a link to a public key and email address for security reporting?

Well, that's what in a security.txt file basically, contact address and encryption key.

> And what about a standard for contact phone numbers given a website?

Use tel URI in Contact field.

Re: Security.txt (2017)

#28

Post by geofft »

cabaalis wrote: post #25
amaccuish wrote: post #20

Earlier quoted context omitted.

FYI .htaccess shouldn't generally be publically readable, as it's for your webserver, not the public. It's also only relevant to the directory it's in, hence why it's not in a separate directory.

Why are dotfiles generally considered "hidden" and not to be served (such as .htaccess, .env, etc) but .well-known is expressly intended to be served? It should have just been named well-known, IMO.

Because that made it unlikely to collide with existing / claimable uses. Consider https://github.com/well-known or https://instagram.com/well-known .

Re: Security.txt (2017)

#29

Post by z3t4 »

drej wrote: post #12

Yes please! Last year, I discovered a severe security flaw on a couple dozen websites and the sheer communication of this was super painful. I can't just e-mail someone at hi@foobar.com, I'd usually have to send an e-mail along the lines of "Can you give me a contact for your admin/security guy? I have something here and I can't quite disclose it just now." The response rate was extremely low. If you just give me a s…

> Can you give me a contact for your admin/security guy?

That's what spammers,scammers and sales-people do. Just describe how to repeat the issue. Most of the time they will forward to the right person. Don't expect to hear anything from them.

Knowing that someone have been into your house (server) and sneaked around is very uncomfortably, so don't expect even a thank you.

Re: Security.txt (2017)

#30

Post by dev_256 »

DyslexicAtheist wrote: post #9

I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…

What if it was required to encrypt the message? Do you think the number of spam would go down?
Post reply on HN