Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security.txt (2017)

securitytxt.org

Post reply on HN
Print view View original

11–20 of 56 posts

Re: Security.txt (2017)

#11

Post by mormegil »

DyslexicAtheist wrote: post #9

I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…

Reminds me of all the “dubious security vulnerability” stories on the Old New Thing blog, e.g. https://blogs.msdn.microsoft.com/oldnewthing/20111215-00/?p=... where MSFT needs to investigate obviously bogus “security problems” just to be sure they didn’t miss anything important.

Re: Security.txt (2017)

#12

Post by drej »

Yes please!

Last year, I discovered a severe security flaw on a couple dozen websites and the sheer communication of this was super painful. I can't just e-mail someone at hi@foobar.com, I'd usually have to send an e-mail along the lines of "Can you give me a contact for your admin/security guy? I have something here and I can't quite disclose it just now." The response rate was extremely low.

If you just give me a security.txt, at least I know I can disclose something and I have some level of certainty that the e-mail will be read.

Re: Security.txt (2017)

#13

Post by wycy »

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

Re: Security.txt (2017)

#15

Post by the8472 »

DyslexicAtheist wrote: post #9

I understand and welcomed the initiative when it was first discussed. Meanwhile I've implemented it on a couple of domains and hat it running for all of 2018. Last month I removed it all again (the sites still have a responsible disclosure link but not at a standardized URI). It was a massive waste of time for me to engage with a group of " unknowns " -without prior relationship- who now had a channel to fast-track i…

How many of those mails were actually encrypted?

Re: Security.txt (2017)

#16

Post by AndyMcConachie »

drej wrote: post #12

Yes please! Last year, I discovered a severe security flaw on a couple dozen websites and the sheer communication of this was super painful. I can't just e-mail someone at hi@foobar.com, I'd usually have to send an e-mail along the lines of "Can you give me a contact for your admin/security guy? I have something here and I can't quite disclose it just now." The response rate was extremely low. If you just give me a s…

The people who know about and will use security.txt are probably not going to be the people who you now have problems communicating with.

I'm willing to bet that 10 years after this is standardized the percentage of HTTP/S domains hosting security.txt files will be around 1%. And that 1% will be websites that are mostly already doing the right security things.

Re: Security.txt (2017)

#17

Post by stedaniels »

wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

Is been an RFC for almost a decade, RFC5785 [0].

Mattias Geniar has a good write up on it [1].

[0] https://tools.ietf.org/html/rfc5785

[1] https://ma.ttias.be/well-known-directory-webservers-aka-rfc-...

Re: Security.txt (2017)

#18

Post by fb03 »

wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

.well-known is also used for ACME for auto-certificate generation and renewal.

I still would like to know the backstory around this folder, just like OP.

Re: Security.txt (2017)

#20

Post by amaccuish »

wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

FYI .htaccess shouldn't generally be publically readable, as it's for your webserver, not the public. It's also only relevant to the directory it's in, hence why it's not in a separate directory.
Post reply on HN