3 ms·
Honestly I think a "last reviewed date" or log of dates would be better because it aligns with the actual action that the hostmaster takes, and thus provides th
by infogulch 6y ago
Honestly I think a "last reviewed date" or log of dates would be better because it aligns with the actual action that the hostmaster takes, and thus provides the reader with the most relevant facts instead of an arbitrary promise of future validity.
- thw0rted 6y agoThis. They did a bad job of explaining why they chose an expiration date in the draft RFC[1]. > If information and resources referenced in a "security.txt" file are incorrect or not kept up to date, this can result in security reports not being received by the organization or sent to incorrect contacts, thus exposing possible security issues to third parties. Yes, the information could change after you write the file. No, it is not possible to know, when you write the file, at what future point the information will become incorrect. The document should have a "last reviewed" date, then the consumer can decide for themselves if it has been updated recently enough to be trustworthy. 1: https://tools.ietf.org/html/draft-foudil-securitytxt-11#section-6.3 https://tools.ietf.org/html/draft-foudil-securitytxt-11#sect...