3 ms·
Is this where that .well-known/security.txt could help or is that not workable? There are dozens of bounty like programs but authors have to opt-in to those.
by edoceo 7y ago
Is this where that .well-known/security.txt could help or is that not workable?
There are dozens of bounty like programs but authors have to opt-in to those.
You could also make a fork, with one commit to fix that issue publish with no fanfare. Then at least the fix is out there.
- actionowl 7y agoI think security.txt[1] would definitely help here! [1] https://securitytxt.org/ https://securitytxt.org/
- jedimastert 7y agoIt kinda depends on where in the dependency chain the vulnerability is. For instance, if someone found a security bug through Twitter's verification process, then a security.txt might be a good place to start. However, if the problem lies with the server software they're using, or the DB software, then emailing twitter won't really do all that much for everyone else using the software and you can't really expect Twitter to bring it up the chain, so to speak.
- technion 7y agoA recurrent discussion around security.txt is the question "would it actually solve the problem?". In this case, we've been advised the project's maintainer is MIA. A security.txt file containing a maintainer's email address wouldn't change anything, as WinonaRyder indicates they have already tried to contact them. Given we appear to be talking about a software product, it's also not clear whether security.txt would just contain contact details for a web developer not related to the software itself. There are many projects living on Github that can't use the /.well-known/ URL after even if they wanted to. That's assuming the author opted in to created a security.txt, which they would have to do in just the same way as any other program.