Security.txt (2017) • Hacker News Board

Re: Security.txt (2017)

#51

Post by ezrast » Thu, Feb 14, 2019, 1:14 AM UTC

jolmg wrote: post #46

stedaniels wrote: post #17

Earlier quoted context omitted.

Is been an RFC for almost a decade, RFC5785 [0]. Mattias Geniar has a good write up on it [1]. [0] https://tools.ietf.org/html/rfc5785 [1] https://ma.ttias.be/well-known-directory-webservers-aka-rfc-...

Neither seems to explain why these files aren't just placed in root, like robots.txt. What's the point of having a subpath? The RFC says: > 2. Why /.well-known? It's short, descriptive, and according to search indices, not widely used. This gives reasoning for the name of the subpath, but not its existence.

To minimize collisions, and so we're not retreading this argument in another ten years: https://news.ycombinator.com/item?id=19063727

Re: Security.txt (2017)

#52

Post by jolmg » Thu, Feb 14, 2019, 2:00 AM UTC

ezrast wrote: post #51

jolmg wrote: post #46

Earlier quoted context omitted.

Neither seems to explain why these files aren't just placed in root, like robots.txt. What's the point of having a subpath? The RFC says: > 2. Why /.well-known? It's short, descriptive, and according to search indices, not widely used. This gives reasoning for the name of the subpath, but not its existence.

To minimize collisions, and so we're not retreading this argument in another ten years: https://news.ycombinator.com/item?id=19063727

Ok, yeah. It occurs to me that websites might want the whole path to be variable text, maybe user defined.

This would also answer the question I've had for so long as to why Wikipedia chose to have /wiki/ before article titles in their URLs. I guess it was so that the article https://en.wikipedia.org/wiki/robots.txt did not collide with their robots.txt file.

Would've been nice if that explanation were included in the RFC.

Re: Security.txt (2017)

#53

Post by bmn__ » Thu, Feb 14, 2019, 9:52 AM UTC

pmlnr wrote: post #14

webmaster@domain.com No need to overcomplicate this. .well-known is a terrible idea by the way, a or would make much more sense.

is for a single resource, .well-known is for a whole site.

Re: Security.txt (2017)

#54

Post by bmn__ » Thu, Feb 14, 2019, 9:53 AM UTC

the8472 wrote: post #19

pmlnr wrote: post #14

webmaster@domain.com No need to overcomplicate this. .well-known is a terrible idea by the way, a or would make much more sense.

not everything HTTP serves HTML

The `Link` header exists which is the moral equivalent of the `link` element in HTML. That way you can express link relations on resources whose representations do not have hyperlinks. Example:

    HTTP/1.1 200 OK
    Content-Length: 153054
    Content-Type: image/webp
    Link: ;
      rel="next"; title="next image in album"

See https://tools.ietf.org/html/rfc8288

Re: Security.txt (2017)

#55

Post by krmbzds » Thu, Feb 14, 2019, 3:29 PM UTC

I have been thinking of a similar idea, but for warrant canaries.

Re: Security.txt (2017)

#56

Post by ChrisGranger » Sun, Feb 24, 2019, 8:35 PM UTC

1nvalid wrote: post #48

And the discussion from Troy Hunt... https://twitter.com/troyhunt/status/1082890150223302657

> 8,582 websites in the Alexa Top 1M implementing a security.txt file

I count 6460 sites on the linked list, and loads of these are subdomains on tumblr.org, so I wonder what the number of actual TLDs using security.txt is...