12 ms·
Security.txt file now mandatory for Dutch government websites
- jruohonen 3y agoI hope other countries follow!
- redleader55 3y agoThis measure is useful, but only if there are people answering the phone/email/etc that understand how to deal with the report - ie. security folks. In many places, they will just add the contact of some administrative assistant that has no concept of security and no options to deal with the report.
- jruohonen 3y agoI agree, but probably still better than nothing?
- gumballindie 3y agoWell most domain names have an abuse email address attached. I emailed a few that belonged to (presumably) compromised hosts sending spam and had no reply and no change in spam volumes. These types of measures are only useful if acted upon.
- GTP 3y agoSimilar experience here. Years ago I got emails from Mozilla for a few days in a row about failed login attempts to my account from a certain IP. I did a WHOIS on that and I obtained that it belonged to Fastweb, it was likely some household's dynamic IP. I emailed the listed Fastweb's abuse email address a couple of times, but never got any reply. The login attempts stopped, but I would say probably because whoever was doing it figured out they weren't able to guess my password, not because Fastweb actually did something about it.
- androidas 3y agoReally cool. I’ve done responsible disclosure in the past and finding someone who’ll listen is probably the hardest part of it
- mtmail 3y ago20 years ago emailing webmaster@, hostmaster@, abuse@ went direct to a tech person. I think these days it's also redirected to customer service.
- whstl 3y agoIME sometimes you're lucky and it goes to a product manager, but then it is often put in the backlog with 100s other tasks.
- xdfil 3y ago[dead]
- chrismorgan 3y agoOr just rejected—even postmaster@ which is mandated in RFC 5321.
- KomoD 3y agoOh for sure, I'm sitting on a subdomain takeover at a pretty large company, I tried looking for an appropriate email or place to report it, found none so I just went the support route without any luck, just said they "will share it with the appropriate team", I've had control for over 2 months now.
- mtmail 3y ago> The aim is that, for example, ethical hackers can immediately contact the right person or department to tackle the vulnerability. We added such a file years ago. There's still some security researchers ("bug hunters") not aware of the standard and email other email addresses (info@, invoice@, data-protection@). Nobody has ever used the GPG key we list in the security.txt file. The email address we list (security@) hasn't received any significant spam.
- londons_explore 3y ago> and email other email addresses these are probably the people more interested in getting someone to sign off on a bug bounty than they are in getting hold of someone technical who might point out that the fact you can right click and edit the HTML to say "HACKED!!" isn't a bug...
- looping8 3y agoA lot of people just don't care about writing to the right address. I did work for a university and the most random people would get emails aimed at completely different departments, staff or even a different university. I don't mean old people or clueless young students, I mean some press contacts, some other academics and people like that.
- ldoughty 3y agoI very recently had a 'dont care about the write address' story -- which I think is worth remember for those of us that monitor some of these less-common but known-to-technical-people mailboxes.... When I had an issue with LastPass, the ONLY contact method they listed for support required you to log in and use their help form... Since I used federated login, only the browser extension was supported -- not website login... So.. I can't log into their website for support, but I have to log into their website for support... I went through a series of help@ support@ helpdesk@ contact@ and got bounces / "use our web form" responses... I then escalated to the other technical addresses like webmaster@ hostmaster@ until I finally tried to reach out to sales@ for the support issue... So sometimes people do intentionally write to 'the wrong address' because there's no 'right address' (that's publicly known/available).
- NoZebra120vClip 3y ago2.5.6. Hiring The "Hiring" field is used for linking to the vendor's security-related job positions. If this field indicates a web URI, then it MUST begin with "https://" (as per Section 2.7.2 of [RFC7230]). Hey, I just found a new way to job hunt!
- Gigachad 3y ago>If this field indicates a web URI, then it MUST begin with "https:// https://" Or what? What is the point of even specifying this? It's not like any human or bot is going to ignore the link if it starts with http:// http://
- londons_explore 3y agoI would be very dubious of applying to a security position with any company where the link started http:// http://...
- jenscow 3y agoWhy? They obviously need new expertise. Bricklayers don't avoid un-built houses.
- cmeacham98 3y agoSure, if you're planning on applying to a powerful enough position that you'd be able to effect significant change. But for most jobs, where you aren't going to be able to affect massive change, you'll want the security culture not to bad/nonexistent.
- radiator 3y agoIf it is a public job description why must it be https? Baseless criticism might tell more about yourself than about them.
- londons_explore 3y ago
- serial_dev 3y agoNever heard about security txt files until now, but it makes a lot of sense! Regulations are a hit or miss (e.g the cookie notification rules have some good parts but I wonder if there isn't any room for improvement in the current "visiting a website for 10 seconds and clicking whatever the big button is so that I see the content in interested in" status quo. This one is not obtrusive, easy to implement (though only developers care about this part) and solves the problem.
- b33j0r 3y agoHeard of it, but I’m still wondering why every RFC looks like it’s from 1998. We work with structured data all the time. Then I remembered the armistice between yaml and toml and how I’m still confused about why the python community was torn asunder. (lol. One looked like python to devs on mac/linux, and one looked like python to windows users who used INI a lot. Only a true scotsman uses plaintext, HTTP-style)
- chrismorgan 3y agoThere’s a lot of history involved, and a difference between authoring and publication formats. It’s only comparatively recently (2016–2019, can’t remember exactly and can’t be bothered looking it up) that they stopped having the canonical form of the published document being monospace plain text with fixed pagination. Now, it’s markup, and so it can readily be presented in quite different ways. Observe this security.txt RFC 9116 formatted in two different ways: https://datatracker.ietf.org/doc/html/rfc9116 https://datatracker.ietf.org/doc/html/rfc9116 https://www.rfc-editor.org/rfc/rfc9116.html https://www.rfc-editor.org/rfc/rfc9116.html
- eru 3y agoThe government making rules for its own subdivisions is different from those other regulations that constrain what private third parties can do. The linked article explicitly mentions that they _hope_ private companies will adopt this standard; but there's no mention of any regulatory requirement on them.
- midasuni 3y ago
- oefrha 3y agoThis has been discussed to death every time security.txt comes up, but in my experience it's been a great way to receive spam about bullshit "vulnerabilities" from low effort scanners operated by "security researchers". Much like how people publish email addresses online using human readable replacements (e.g. AT instead of @) to avoid spam, I'd rather put up a contact page that's easy for humans to find but nontrivial to automate.
- viraptor 3y agoMost of those are trivial to filter. Mentioning SPF or DKIM -> straight to the bin. Contains "critical" and "payment" -> straight to the bin. There's few patterns you'll find that will let you remove all the beg bounties.
- andersa 3y agoWhat if they're trying to report a critical issue with your payment processing?
- jagged-chisel 3y agoStraight to the bin. Obviously. >.<
- viraptor 3y agoHint for applying ideas from comments: read information and understand the main point behind it, consider how it applies to your situation, then if it's beneficial try to implement it in a way relevant to you. If you take comments like mine and try to implement them literally, that's stupid and it's on you.
- hypeatei 3y agoToo bad, it's not my financial info at risk anyways. ;)
- dns_snek 3y ago> Contains "critical" and "payment" -> straight to the bin. That sounds like an excellent way to accidentally filter out serious vulnerabilities. I'm glad you don't work for the vendor that received my urgent, critical (in all caps) unauthenticated remote code execution vulnerability report. They were very grateful that I reached out and resolved it under 72h.
- yread 3y agohttps://mijn.overheid.nl/security.txt https://mijn.overheid.nl/security.txt 404 but this one does exist https://www.ncsc.nl/.well-known/security.txt https://www.ncsc.nl/.well-known/security.txt
- wombarly 3y agoYour first link is incorrect, it should be: https://mijn.overheid.nl/.well-known/security.txt https://mijn.overheid.nl/.well-known/security.txt which redirects to the second one.
- jwilk 3y agosecurity.txt discussed on HN: 2017: https://news.ycombinator.com/item?id=15416198 https://news.ycombinator.com/item?id=15416198 (145 comments) 2019: https://news.ycombinator.com/item?id=19151213 https://news.ycombinator.com/item?id=19151213 (55 comments) 2021: https://news.ycombinator.com/item?id=26455493 https://news.ycombinator.com/item?id=26455493 (167 comments)
- milliams 3y agoI've just checked the UK's GDS advice and they have it as a "should": https://gds-way.cloudapps.digital/manuals/security-overview-for-websites.html#10-implement-security-txt https://gds-way.cloudapps.digital/manuals/security-overview-... They have more information at https://gds-way.cloudapps.digital/standards/vulnerability-disclosure.html https://gds-way.cloudapps.digital/standards/vulnerability-di... where they strengthen the advice by saving: As per the current policy, we only accept reports from services that have a security.txt file pointing to the security policy.
- PrimeMcFly 3y ago> As per the current policy, we only accept reports from services that have a security.txt file pointing to the security policy. So if their security.txt doesn't point to a service someone finds an issue with they won't respond?
- iLoveOncall 3y agoOr they will respond by slamming down your door at 6AM :D I take it as a way to say "don't even think of touching the services that don't have the security.txt file".
- londons_explore 3y agoI think it means "our team isn't responsible for services without a security.txt, so don't contact us about it"
- InCityDreams 3y ago>I've just checked the UK's GDS advice and they have it as a "should": Without forgetting that a UK 'should', is considerably different to a US 'should'. .nl? - I'll let you guys decide.
- plugin-baby 3y agoShould the title be “security.txt” instead of “Security.txt”?
- junon 3y agoMight be HN's auto-capitalization behavior when submitting.
- xdfil 3y ago[dead]
- fareesh 3y agoSeems like a vector for phishing / social engineering and scammers / advertisers
- aarong11 3y agoQuick, find every site with a security.txt and report it /s
- throwawaaarrgh 3y agoKeep in mind this is only mandatory for government websites. That's a pretty low bar. If I worked for the government, or even a company that had one clear way to contact security, I would love this. I honestly have no fucking idea how to directly contact security most of the time and that's insane because I actually want to help them. I don't care if they receive spam, I just want them to tell me how to contact them. Give me a captcha form, a phone number, an AOL Instant Messenger handle, I don't care.
- yard2010 3y agoHow about a fax number?
- omgwtfusb 3y agowelcome to Germany
- red-iron-pine 3y agoor Japan
- qwertox 3y agohttps://www.amsterdam.nl/security.txt https://www.amsterdam.nl/security.txt returns --- Contact: https://www.amsterdam.nl/privacy/informatiebeveiliging-gemeente-amsterdam/ https://www.amsterdam.nl/privacy/informatiebeveiliging-gemee... Expires: 2024-02-01T10:00:00.000Z Acknowledgments: https://www.informatiebeveiligingsdienst.nl/?s=hall+of+fame https://www.informatiebeveiligingsdienst.nl/?s=hall+of+fame Preferred-Languages: en,nl --- rfc9116 2.5.1. Acknowledgments The "Acknowledgments" field indicates a link to a page where security researchers are recognized for their reports. The page being referenced should list security researchers that reported security vulnerabilities and collaborated to remediate them. Organizations should be careful to limit the vulnerability information being published in order to prevent future attacks. If this field indicates a web URI, then it MUST begin with "https:// https://" (as per Section 2.7.2 of [RFC7230]).
- liotier 3y agoIsn't this what Whois is for ?
- hoofhearted 3y agoI’m working on a simple website generator for developers and content creators. I’ve already included everything a user would want for a complete website, including a robots.txt, sitemaps, perfect Lighthouse seo score, rich snippets, and a ton of other stuff. Should I consider adding an auto generated security.txt file along side the robots.txt file for users? Do you’all think a security.txt file is something users would want in 2023? Or would it look stupid and confusing? https://github.com/elegantframework/elegant-cli https://github.com/elegantframework/elegant-cli
- hoofhearted 3y agoI got a few upvotes so far, but no comments! Lol I may put out a few feelers, and put this topic up for a RFC and discussion on GitHub. It seems like an interesting new little web thing, and is super easy to implement. I just share the same concerns as others have mentioned with bots and spammers misusing this file.
- cuttysnark 3y agoIMO, including those generated .txt files is a small[ish] feat that's important to those that are looking for it, and benign to those that don't need it or know what it is. I suspect most users who use a site generator would be happy with more "automagic"—especially if it were 1. easy to config or turn off and 2. addressing important things like security-related contact info, or how a web-scraping bot should respect your domain. Also: "simple" generators often veer into "complicated" territory by adding crap features. Elegant appears to lack crap features; IMO, adding *.txt would not complicate or confuse.
- hoofhearted 3y agoHey thank you for the kind words!! No crap features here :) We have started with a basic clean foundation, and are now in the process of building up all the essential features an app owner would want, and none of the crap they wouldn't lol. I appreciate your feedback! I have opened an RFC and will be pushing this idea through the feature pipeline ASAP: https://github.com/orgs/elegantframework/discussions/55 https://github.com/orgs/elegantframework/discussions/55
- punnerud 3y agoI checked the top 20 most used websites in Germany (with .de), and number 20 on the list is the first to have it: https://www.focus.de/security.txt https://www.focus.de/security.txt Most used webpages: https://www.similarweb.com/top-websites/germany/ https://www.similarweb.com/top-websites/germany/
- raxxorraxor 3y agoI think Google suggested a path that was [URL]/.well-known/security.txt Perhaps the sites have something on there.
- punnerud 3y agoFacebook have the security.txt at root: https://facebook.com/security.txt https://facebook.com/security.txt Both Facebook and Apple also use [URL]/.well-known/security.txt The contact on Facebook don't work: https://www.facebook.com/whitehat/report/ https://www.facebook.com/whitehat/report/
- a2800276 3y ago"Dutch government websites must comply with the security.txt standard from 25 May. This is announced by the Digital Trust Center of the National Government." Somewhat ironically: https://www.digitaltrustcenter.nl/security.txt https://www.digitaltrustcenter.nl/security.txt The website of the Digital Trust Center returns 404
- Mattasher 3y agohttps://www.digid.nl/security.txt https://www.digid.nl/security.txt redirects to: https://www.ncsc.nl/.well-known/security.txt https://www.ncsc.nl/.well-known/security.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 # Domeinen van de Rijksoverheid kunnen met een 302 redirect verwijzen naar # het centrale bestand op https://www.ncsc.nl/.well-known/security.txt # omdat het NCSC het centrale meldpunt is voor kwetsbaarheden en incidenten # voor de Rijksoverheid. # # Dutch central government domains can redirect to the central file located # at https://www.ncsc.nl/.well-known/security.txt with a 302 redirect, # because NCSC-NL is the central point of contact for vulnerabilities and # incidents for the Dutch central government. Expires: 2024-01-31T22:59:00.000Z Canonical: https://www.ncsc.nl/.well-known/security.txt Policy: https://www.ncsc.nl/contact/kwetsbaarheid-melden Policy: https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd Contact: https://www.ncsc.nl/contact/kwetsbaarheid-melden Contact: https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd Contact: mailto:security@ncsc.nl Encryption: https://www.ncsc.nl/contact/pgp-key Preferred-Languages: nl, en Acknowledgments: https://www.ncsc.nl/wall-of-fame Hiring: https://www.werkenvoornederland.nl -----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.4.2 (Build 1298) Charset: utf-8 wsDVAwUBY+9c0P4Vd0fJc7lbAQpUmQwAwZ1vWyI1VKBChsciufRcvxy5zzMZMx6v YjD5CXuDV4GL+tRl7wClnQO023e3ZChTH69y7O3veS+5/zNVUvpyqJfS8pNzG0pA B4vea3fQ41t5UpCVYvPopIFiT1oeQJA9w4NqBD2+2jW5lS5L8k9xz192gWJvhxq8 mTukJXYDiJLzxKbUMHEG2GNaMeoRj5Pvgr8buzQELP0VZHfzF05Hr6NOoWvS6SRX KGW6rgg6fEUPcMTjBqn6gL/w82FXwrh93AmYkP/sBWP4It3NpbiNuazc5iynhhih +ZlfzsFV6agF4MZR0IQZ6X4jsCxKFrPIWW51/7W+PIDkqy6za/bDjDeiinid0HOC 2rro6N9FXSyxHz9nteMppd+YMTCt+Z67HONsssR+7ojxORGOs0rTcjUucaVikFJQ wAls9p+vuIzFRViQaXe3Nndspr1cCIu4z3ZfdkcWREQP7acOjNgbmeQOlH4jnYWq lNVMWzOncidAWM0nXcuYTjZagRAagthF =yC4A -----END PGP SIGNATURE----- Version: Encryption Desktop 10.4.2 (Build 1298) Charset: utf-8 wsDVAwUBY+9c0P4Vd0fJc7lbAQpUmQwAwZ1vWyI1VKBChsciufRcvxy5zzMZMx6v YjD5CXuDV4GL+tRl7wClnQO023e3ZChTH69y7O3veS+5/zNVUvpyqJfS8pNzG0pA B4vea3fQ41t5UpCVYvPopIFiT1oeQJA9w4NqBD2+2jW5lS5L8k9xz192gWJvhxq8 mTukJXYDiJLzxKbUMHEG2GNaMeoRj5Pvgr8buzQELP0VZHfzF05Hr6NOoWvS6SRX KGW6rgg6fEUPcMTjBqn6gL/w82FXwrh93AmYkP/sBWP4It3NpbiNuazc5iynhhih +ZlfzsFV6agF4MZR0IQZ6X4jsCxKFrPIWW51/7W+PIDkqy6za/bDjDeiinid0HOC 2rro6N9FXSyxHz9nteMppd+YMTCt+Z67HONsssR+7ojxORGOs0rTcjUucaVikFJQ wAls9p+vuIzFRViQaXe3Nndspr1cCIu4z3ZfdkcWREQP7acOjNgbmeQOlH4jnYWq lNVMWzOncidAWM0nXcuYTjZagRAagthF =yC4A -----END PGP SIGNATURE-----
- aequitas 3y agoTo get an idea of how well our government organisations get along with implementing this (and a lot of other basic security requirements, like TLS, IPv6, DNSSEC, etc) you can view these maps[0][1]. We maintain a set of open source tools to easily get you started[2]. If you would like help to have this for your country/government/organisation as well, feel free to contact us. [0] https://basisbeveiliging.nl/#/metric-progress/NL/municipality/internet_nl_wsm_web_appsecpriv_securitytxt https://basisbeveiliging.nl/#/metric-progress/NL/municipalit... [1] https://basisbeveiliging.nl/#/maps https://basisbeveiliging.nl/#/maps [2] https://gitlab.com/internet-cleanup-foundation/web-security-map https://gitlab.com/internet-cleanup-foundation/web-security-...
- sybercecurity 3y agoIs there an enforcement arm? As in, what if some agency decides not to do it for some reason - do they get sanctioned in any way? In the US Federal government, there are two I'm familiar with: budget and dragging agency heads in front of congress or the Executive Office and yelling at them. The first doesn't always work - cutting the budget of an important agency over what the press would call a "minor IT issue" doesn't look good (and counter productive). The second tends to work better.
- bux93 3y agoCentral government can force any covered entity to publish which standards they (do not) support, to produce an audit, and in the last instance, instruct them to comply. This is a specific provision on top of generic rules and regulations, where central government can step in the place of a lower government if they are non-compliant. Also, citizens (or NGOs) can sue entities (including central government) for non-compliance. For example, in 2022, the NGO Urgenda won a case against the Dutch government for not doing enough about climate change (less than needed to comply with international treaties), and now the political landscape is in turmoil because there's no consensus which polluters should stop polluting quite as much. In practice, the list of standards is just tacked onto procurement procedures. Since governments and contractors love to bicker, a missing security.txt can be something to hit the vendor over the head with (and withhold payment for a month, to make this year's budget).
- benatkin 3y agoThis is a win for GPG. Some, like the current PyPI maintainers, want to throw it out with no replacement. That's a terrible idea. And I don't see why it needs to be replaced completely.
- foxbyte 3y agoReally appreciated this article - it's high time the Dutch government websites took steps like these towards strengthening their security! Still, they could definitely do with a bit more user-friendly explanations, so everyone can understand the importance of initiatives like security.txt.
- logifail 3y agoUnless there's a way to mandate that the security team's contacts listed in security.txt actually respond in a timely manner to security-related messages that are sent to them, then I have a nagging feeling that: * well-run organizations won't benefit from doing this, since their security teams were already easy to reach and * poorly-run organizations won't become any better by doing this, because one text file doesn't fix a broken org
- JohnFen 3y agoWhatever happened to just having the standard "abuse@domain.name" email address?
- qawwads 3y ago1. Find a vulnerability 2. Contact the website maintainer to report it 3. Get swatted, harrassed by cops, sued, and jailed over it. No thank.
- baknu 3y agoThe formal news release on this from the Dutch Standardization Forum can be found here: https://forumstandaardisatie.nl/nieuws/securitytxt-mandatory-dutch-government https://forumstandaardisatie.nl/nieuws/securitytxt-mandatory... Note that you can test if a website has valid security.txt with the Internet.nl test tool: https://en.internet.nl/article/securitytxt-test-toegevoegd/ https://en.internet.nl/article/securitytxt-test-toegevoegd/