3 ms·
Yes please! Last year, I discovered a severe security flaw on a couple dozen websites and the sheer communication of this was super painful. I can't just e-mai
by drej 8y ago
Yes please!
Last year, I discovered a severe security flaw on a couple dozen websites and the sheer communication of this was super painful. I can't just e-mail someone at hi@foobar.com, I'd usually have to send an e-mail along the lines of "Can you give me a contact for your admin/security guy? I have something here and I can't quite disclose it just now." The response rate was extremely low.
If you just give me a security.txt, at least I know I can disclose something and I have some level of certainty that the e-mail will be read.
- AndyMcConachie 8y agoThe people who know about and will use security.txt are probably not going to be the people who you now have problems communicating with. I'm willing to bet that 10 years after this is standardized the percentage of HTTP/S domains hosting security.txt files will be around 1%. And that 1% will be websites that are mostly already doing the right security things.
- z3t4 8y ago> Can you give me a contact for your admin/security guy? That's what spammers,scammers and sales-people do. Just describe how to repeat the issue. Most of the time they will forward to the right person. Don't expect to hear anything from them. Knowing that someone have been into your house (server) and sneaked around is very uncomfortably, so don't expect even a thank you.
- KloudTrader 8y agoFor us we just put it in the footer :D Like this: https://kloudtrader.com/security https://kloudtrader.com/security