3 ms·

Bogus reports are an issue security.txt or not. The single and only thing the file provides is a trivially discoverable way to get the contact/submission inform

Bogus reports are an issue security.txt or not. The single and only thing the file provides is a trivially discoverable way to get the contact/submission information for security issues, should they matter for whoever posted the file. That's it. Why make people search for 10min when they can be at a standardized location.

theamk 7y ago
Because then the automated scanners find it too, and send automated reports? It is just like spam - cheap to send, expensive to read - except you cannot throw it out right away because it may contain actual vulnerability.
- AmericanChopper 7y ago
  The real reason you can’t throw it out right away is because if somebody reports a security issue to you, no matter how bullshit it is, you can’t just outright dismiss it at the risk of a snarky blog coming out attacking your security integrity. Even if the blog is complete nonsense, not everybody who reads it will know that, so the risk to reputation is too high. Bug bounties are almost completely full of incredibly low-effort scanner spam. A company can easily end up wasting huge amounts of its precious security budget getting report spammers to leave them alone. You absolutely never want to do anything to attract those kinds of people to your business, unless you have very carefully weighted up the costs and benefits first. I honestly think most of the effort that goes into bug bounties and things like security.txt is just busy work for security charlatans who don’t know any better way to be spending their time.
- Avamander 7y ago
  Are you saying automated scanners can't find your other pages? You can also put a submission URL with a captcha in the security.txt file.
  - comfydragon 7y ago
    If I'm understanding correctly, when "automated scanners" is mentioned here, what's meant is tools that someone runs directly, which scan the software/device and generate loads of red flags. Having a security.txt file makes it that much easier for the tool (or the user) to report the issue, valid or not.
    - Avamander 7y ago
      You are correct, but only finding the contact details is easier, submission can still have a high difficulty, methods against spam.

theamk 7y ago

Because then the automated scanners find it too, and send automated reports? It is just like spam - cheap to send, expensive to read - except you cannot throw it out right away because it may contain actual vulnerability.

AmericanChopper 7y ago
The real reason you can’t throw it out right away is because if somebody reports a security issue to you, no matter how bullshit it is, you can’t just outright dismiss it at the risk of a snarky blog coming out attacking your security integrity. Even if the blog is complete nonsense, not everybody who reads it will know that, so the risk to reputation is too high. Bug bounties are almost completely full of incredibly low-effort scanner spam. A company can easily end up wasting huge amounts of its precious security budget getting report spammers to leave them alone. You absolutely never want to do anything to attract those kinds of people to your business, unless you have very carefully weighted up the costs and benefits first. I honestly think most of the effort that goes into bug bounties and things like security.txt is just busy work for security charlatans who don’t know any better way to be spending their time.
Avamander 7y ago
Are you saying automated scanners can't find your other pages? You can also put a submission URL with a captcha in the security.txt file.
- comfydragon 7y ago
  If I'm understanding correctly, when "automated scanners" is mentioned here, what's meant is tools that someone runs directly, which scan the software/device and generate loads of red flags. Having a security.txt file makes it that much easier for the tool (or the user) to report the issue, valid or not.
  - Avamander 7y ago
    You are correct, but only finding the contact details is easier, submission can still have a high difficulty, methods against spam.