5 ms·

It’s cute but it generates a five line plain text file. I would argue that a better way to sell the idea would be to create an Apache and nginx module so you co

It’s cute but it generates a five line plain text file. I would argue that a better way to sell the idea would be to create an Apache and nginx module so you could specify this stuff from those config files. It would make adoption seem easier to more people.

danaris 6y ago
A lot of people have web hosting packages that don't give them direct access to the webserver configuration, but do let them upload arbitrary text files to their webroot.
- IgorPartola 6y ago
  Nothing prevents you from writing this file by hand. But for people who use shared hosting having a security.txt file is likely not as important as companies that run their own infrastructure. And adding yet another file to be deployed into the web root or to be served by your application is likely a touch more work than enabling the module and adding a line or three to the web server config. None of it is a lot of work, but in a sense using the web server’s config file is a lot less friction.
  - deleted 6y ago
    [deleted]
mjthompson 6y ago
Serving a 'text file' from a web server module seems to overcomplicate things in my view. More code || complexity == greater likelihood of bugs (including security bugs). As ironic as a security bug in a security.txt serving module would be, it's probably best we avoid that possibility and let the ordinary, highly scrutinised file serving code handle it instead.
- IgorPartola 6y ago
  If you want adoption, make it so easy that it’s harder to not include it. If you run an application, it will take lines of config to serve this file anyways. Might as well make it easy. And if you can’t make a bug free module that writes out 5 lines into a static file… probably shouldn’t be defining web standards.
  - nexuist 6y ago
    Conversely, if you are providing a web based service on the public Internet and can't be assed to drop a five line text file in your home directory, you probably should not be running a server on the public Internet.
coolreader18 6y ago
I think the text file generation is great - it is a standardized "syntax", so being able to just fill out your info in a webpage and getting the .txt to upload to a server (instead of having to "learn" the couple of keys to use for your values) really does make it painless.
dec0dedab0de 6y ago
That would make things much easier especially to have the expiration date automatically update. But also to set a default for all sites on a server. It would also be nice to have libraries for the popular frameworks
- IgorPartola 6y ago
  Yes! Make this a Django app and I will use it by default. Make me add it as a text file and I’ll forget to add it.
anaganisk 6y ago
Not everyone runs their own nginx and apache servers, like gazillion wordpress hosting site, so its better the cute way.

danaris 6y ago

A lot of people have web hosting packages that don't give them direct access to the webserver configuration, but do let them upload arbitrary text files to their webroot.

IgorPartola 6y ago
Nothing prevents you from writing this file by hand. But for people who use shared hosting having a security.txt file is likely not as important as companies that run their own infrastructure. And adding yet another file to be deployed into the web root or to be served by your application is likely a touch more work than enabling the module and adding a line or three to the web server config. None of it is a lot of work, but in a sense using the web server’s config file is a lot less friction.
- deleted 6y ago
  [deleted]

mjthompson 6y ago

Serving a 'text file' from a web server module seems to overcomplicate things in my view. More code || complexity == greater likelihood of bugs (including security bugs). As ironic as a security bug in a security.txt serving module would be, it's probably best we avoid that possibility and let the ordinary, highly scrutinised file serving code handle it instead.

IgorPartola 6y ago
If you want adoption, make it so easy that it’s harder to not include it. If you run an application, it will take lines of config to serve this file anyways. Might as well make it easy. And if you can’t make a bug free module that writes out 5 lines into a static file… probably shouldn’t be defining web standards.
- nexuist 6y ago
  Conversely, if you are providing a web based service on the public Internet and can't be assed to drop a five line text file in your home directory, you probably should not be running a server on the public Internet.

coolreader18 6y ago

I think the text file generation is great - it is a standardized "syntax", so being able to just fill out your info in a webpage and getting the .txt to upload to a server (instead of having to "learn" the couple of keys to use for your values) really does make it painless.

dec0dedab0de 6y ago

That would make things much easier especially to have the expiration date automatically update. But also to set a default for all sites on a server. It would also be nice to have libraries for the popular frameworks

IgorPartola 6y ago
Yes! Make this a Django app and I will use it by default. Make me add it as a text file and I’ll forget to add it.

anaganisk 6y ago

Not everyone runs their own nginx and apache servers, like gazillion wordpress hosting site, so its better the cute way.