5 ms·
security.txt is a flag that you may have a bug bounty program, and as a result are a potential source of revenue. It is time arbitrage between big companies ta
by mike_d 6y ago
security.txt is a flag that you may have a bug bounty program, and as a result are a potential source of revenue.
It is time arbitrage between big companies taking security seriously (willing to pay large bounties) and that amount being higher than a monthly or yearly wage in some internet-connected regions. If they throw enough nets into the sea all year, eventually one pays off and they end up living quite well.
- __throwawy9 6y agoPutting all of these files at root is going to be like have old rusty cars and stained mattresses in front of your house years from now. The web is not a junkyard.
- dmurray 6y agoThe proposal is to place the file at /.well-known/security.txt. And even if it wasn't, there is plenty of namespace room to put every file someone argues for in a 2-page RFC at root. After all, there are only 1024 low-numbered TCP ports and we haven't run out of those yet.
- __throwawy9 6y agoDon’t get me wrong; I dig file-based interfaces, but each time they add another file, it’s another request. And it’s Anglocentric to continue to unnecessarily put multiple English words into the path; those can’t be touched-up with a later RFC to support Japanese in the file content via a Lang attribute. The whole thing is shit bad, I’m sorry. Just come up with something that makes fucking sense for once.
- superkuh 6y agoWhat does it mean when I enabled this on my personal (for fun) websites years ago on a whim? I don't have a bug bounty program.