4 ms·

Should surely be .well-known/security.txt, or if not explain why not. rfc5785 "Defining Well-Known Uniform Resource Identifiers (URIs)" [edit: I see the FAQ s

Should surely be .well-known/security.txt, or if not explain why not. rfc5785 "Defining Well-Known Uniform Resource Identifiers (URIs)" [edit: I see the FAQ says that, while the linked Internet Draft says it goes at top-level like robots.txt]

baby 9y ago
Ahhh. That explains why lets encrypt does it!
- gerdesj 9y ago
  There's also Netscape's (?) email autodiscover mechanism with a .xml file served from there that describes how to do POP/IMAP/SMTP etc. However, despite /.wellknown/ being a bit of a standard, you'd be amazed at how many mechanisms you have to support to get autodiscover to work for all email clients. As it turns out SRV DNS records are also a bit of a standard for publishing pointers to services, and TXT records, and RANDOMLY_NAMED_RECORDS because updating your server n resolver to support another record type is such fun. I actually think we are almost there now: DNS to find it and /.wellknown/ to describe it.
  - Spivak 9y ago
    SRV records are extremely popular outside of the web. I really wish they would get more adoption. It's such a clean solution. We could have avoided the entire need for SNI if browsers supported service records.
    - gerdesj 9y ago
      I love SRV records but they are really just TXT with an API! PTR is A in a weirdly named domain ... SNI avoidance is a weird one and you are probably right but SNI is only important (hah!) if you consider that we should all be using IPv6 by now and have billions of address per host to play with 8) The rest of the world gets uptight about TLDs but there is one - relating to ENUM - that no one seems to mention and get upset about. If they did, instead of crapping on about whether Brazil or a US company owned "amazon" for example, then I'll give you (nearly) free telephone calls and a load of big Telcos will implode. Except they wont and the world will move on to the next logical step where all internet connections are no longer considered a sub-function of a telephone connection and the notion of a "leased line" is an anomaly. Whoops, got carried away there. As you say - SRV should get more love.
      - xorcist 9y ago
        > they are really just TXT with an API No, they're really not. An SRV record points to a hostname, not an arbitrary string. You can do lookups in one RTT, not two.
skybrian 9y ago
A bit off-topic, but I don't understand the popularity of hidden directories for what should be human-visible files. Why be intentionally obscure rather than discoverable?
- dasil003 9y ago
  To avoid namespace collisions. It's not discoverable in any case because no one has a directory listing as their homepage.
lioeters 9y ago
I had only seen ".well-known/" used by Let's Encrypt, and wasn't aware that it was part of a larger (proposed) standard. Thank you for mentioning it. For others who are interested, here a detailed description: https://tools.ietf.org/html/rfc5785 https://tools.ietf.org/html/rfc5785

baby 9y ago

Ahhh. That explains why lets encrypt does it!

gerdesj 9y ago
There's also Netscape's (?) email autodiscover mechanism with a .xml file served from there that describes how to do POP/IMAP/SMTP etc. However, despite /.wellknown/ being a bit of a standard, you'd be amazed at how many mechanisms you have to support to get autodiscover to work for all email clients. As it turns out SRV DNS records are also a bit of a standard for publishing pointers to services, and TXT records, and RANDOMLY_NAMED_RECORDS because updating your server n resolver to support another record type is such fun. I actually think we are almost there now: DNS to find it and /.wellknown/ to describe it.
- Spivak 9y ago
  SRV records are extremely popular outside of the web. I really wish they would get more adoption. It's such a clean solution. We could have avoided the entire need for SNI if browsers supported service records.
  - gerdesj 9y ago
    I love SRV records but they are really just TXT with an API! PTR is A in a weirdly named domain ... SNI avoidance is a weird one and you are probably right but SNI is only important (hah!) if you consider that we should all be using IPv6 by now and have billions of address per host to play with 8) The rest of the world gets uptight about TLDs but there is one - relating to ENUM - that no one seems to mention and get upset about. If they did, instead of crapping on about whether Brazil or a US company owned "amazon" for example, then I'll give you (nearly) free telephone calls and a load of big Telcos will implode. Except they wont and the world will move on to the next logical step where all internet connections are no longer considered a sub-function of a telephone connection and the notion of a "leased line" is an anomaly. Whoops, got carried away there. As you say - SRV should get more love.
    - xorcist 9y ago
      > they are really just TXT with an API No, they're really not. An SRV record points to a hostname, not an arbitrary string. You can do lookups in one RTT, not two.

skybrian 9y ago

A bit off-topic, but I don't understand the popularity of hidden directories for what should be human-visible files. Why be intentionally obscure rather than discoverable?

dasil003 9y ago
To avoid namespace collisions. It's not discoverable in any case because no one has a directory listing as their homepage.

lioeters 9y ago

I had only seen ".well-known/" used by Let's Encrypt, and wasn't aware that it was part of a larger (proposed) standard. Thank you for mentioning it. For others who are interested, here a detailed description: https://tools.ietf.org/html/rfc5785 https://tools.ietf.org/html/rfc5785