Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security.txt (2017)

securitytxt.org

Post reply on HN
Print view View original

41–50 of 56 posts

Re: Security.txt (2017)

#41

Post by dddddaviddddd »

josefresco wrote: post #40
wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

I was working on a shared hosting environment (EIG) and saw this newly created directory (well-known) and promptly freaked. I viewed that dir and inside was "acme-challenge" and I freaked even more, thinking my client had been hacked. Was very happy to see this was not a hack, but found the naming conventions very odd.

Used by the Let's Encrypt client to verify site ownership.

Re: Security.txt (2017)

#42

Post by Kalium »

DyslexicAtheist wrote: post #32
dev_256 wrote: post #30

Earlier quoted context omitted.

What if it was required to encrypt the message? Do you think the number of spam would go down?

I haven't explicitly tried to enforce encryption, but probably the drive-by style reports would require extra steps that their automation might not handle. So probably a good first filter. But then I'm still no wiser since the ability to use pgp isn't a qualifier regarding knowledge of the engineer or quality of their report. It seems that the underlying problem is that those that do good work in this space don't sca…

What you're describing is a lot like the bug bounty program I ran for a previous employer. It was mostly low-effort scans and "reports" templated from something a big company had made public once. No understanding of if not using HSTS was actually a vulnerability, just the expectation of burp -> report -> $$$.

There were a handful of genuinely good contributors, but probably under 10% of reports.

Re: Security.txt (2017)

#43

Post by chrisweekly »

wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

Auth0 also uses a "/.well-known/" URL path prefix as the default location for public keys.

Re: Security.txt (2017)

#44

Post by josefresco »

dddddaviddddd wrote: post #41
josefresco wrote: post #40

Earlier quoted context omitted.

I was working on a shared hosting environment (EIG) and saw this newly created directory (well-known) and promptly freaked. I viewed that dir and inside was "acme-challenge" and I freaked even more, thinking my client had been hacked. Was very happy to see this was not a hack, but found the naming conventions very odd.

Used by the Let's Encrypt client to verify site ownership.

I know that now ;-) but it was about 5 minutes of panic until I found my answer on Google.

Re: Security.txt (2017)

#45

Post by cyphar »

fb03 wrote: post #18
wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

.well-known is also used for ACME for auto-certificate generation and renewal. I still would like to know the backstory around this folder, just like OP.

It's a standard directory with an RFC and all[1] and is widely used for a whole bunch of things, not just LetsEncrypt (such as WebDav).

[1]: https://tools.ietf.org/html/rfc5785

Re: Security.txt (2017)

#46

Post by jolmg »

stedaniels wrote: post #17
wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

Is been an RFC for almost a decade, RFC5785 [0]. Mattias Geniar has a good write up on it [1]. [0] https://tools.ietf.org/html/rfc5785 [1] https://ma.ttias.be/well-known-directory-webservers-aka-rfc-...

Neither seems to explain why these files aren't just placed in root, like robots.txt. What's the point of having a subpath?

The RFC says:

> 2. Why /.well-known? It's short, descriptive, and according to search indices, not widely used.

This gives reasoning for the name of the subpath, but not its existence.

Re: Security.txt (2017)

#47

Post by KloudTrader »

drej wrote: post #12

Yes please! Last year, I discovered a severe security flaw on a couple dozen websites and the sheer communication of this was super painful. I can't just e-mail someone at hi@foobar.com, I'd usually have to send an e-mail along the lines of "Can you give me a contact for your admin/security guy? I have something here and I can't quite disclose it just now." The response rate was extremely low. If you just give me a s…

For us we just put it in the footer :D

Like this: https://kloudtrader.com/security

Re: Security.txt (2017)

#49

Post by manigandham »

Companies who take security seriously will already have appropriate links available, a hackerone profile, and will respond to admin/security/support@ email addresses

This doesn't really add anything for companies that already do that, and wont change anything for companies that don't.

Re: Security.txt (2017)

#50

Post by cestith »

wycy wrote: post #13

Why the /.well-known/ subdirectory? Is this a commonly used directory for web dev things? From what I recall, items like robots.txt and .htaccess normally just go in the current directory.

It's used for a number of other things, from proof of control for cert issuers to information for OIDC. One of its main advantages is that it's self-describing. That is, it's a well-known place to put this sort of metadata about a site.
Post reply on HN