5 ms·
2.5.6. Hiring The "Hiring" field is used for linking to the vendor's security-related job positions. If this field indicates a web URI, then it MUST begin wi
by NoZebra120vClip 3y ago
2.5.6. Hiring
The "Hiring" field is used for linking to the vendor's security-related job positions. If this field indicates a web URI, then it MUST begin with "https://" (as per Section 2.7.2 of [RFC7230]).
Hey, I just found a new way to job hunt!
- Gigachad 3y ago>If this field indicates a web URI, then it MUST begin with "https:// https://" Or what? What is the point of even specifying this? It's not like any human or bot is going to ignore the link if it starts with http:// http://
- londons_explore 3y agoI would be very dubious of applying to a security position with any company where the link started http:// http://...
- jenscow 3y agoWhy? They obviously need new expertise. Bricklayers don't avoid un-built houses.
- cmeacham98 3y agoSure, if you're planning on applying to a powerful enough position that you'd be able to effect significant change. But for most jobs, where you aren't going to be able to affect massive change, you'll want the security culture not to bad/nonexistent.
- radiator 3y agoIf it is a public job description why must it be https? Baseless criticism might tell more about yourself than about them.
- londons_explore 3y agoBecause you care about privacy and other people knowing you're looking at the job postings? Because you don't want a man in the middle modifying the job ad to say "must be 7 feet tall to apply"? And finally because security should be the default unless there is a good reason to do it some other way. It's a bit like having an unpainted car because you're going to drive it in dry places where it won't rust... Unless there is a benefit to an unpainted car, most people take the painted car...
- eru 3y agoIf you want to claim that you are compliant (perhaps it's a tick mark somewhere), then you need to follow the rules. Btw, if you want to start with "http:// http://" just declare it to be not-a-web URI. Eg say it's a git URI.
- NoZebra120vClip 3y agoSection 5.7 of the same RFC actually lays out the reasoning and security considerations for mandating https. I'm not sure where "web URI" is defined, but I am pretty sure that a Git URI uses "git://" and Git-via-http is still a "web URI" method.
- nicce 3y agoThere are quite many browser-supported protocols which are not http or https, which can be used also for malicious purposes. HTTPS is probably the only protocol which is guaranteed to show content from the claimed source.
- galleywest200 3y agoNot FTPS or SFTP?
- nicce 3y agoFunnily these protocols are not supported by the Chromium or Firefox anymore.
- BenjiWiebe 3y agoSFTP (sort-of-FTP over SSH) was never browser supported afaik. I'm not sure about FTPS (FTP over SSL/TLS), did browsers support it when they supported regular FTP?
- NoZebra120vClip 3y agoI am not sure why it's relevant whether methods are supported by GUI browsers at all (please refer to URIs by method, not "protocol"); because the security.txt is likely to be parsed automatically (since it is, of course, not HTML) and indeed, "tel:" and "mailto:" are both somewhat apt methods to be invoked by a company who's hiring/receiving reports, and doesn't want/need a website for it. So yeah, it is important that this part of the RFC specify a difference between "web" and "non-web" URIs, because the authors of security.txt are free to use any URI method that makes sense.
- qwertox 3y agoAn unsecure http GET could be modified and redirect the interested person to a fake site, even if the original target would do nothing but redirect to its https-variant. It does make sense.
- thisgoesnowhere 3y agoI'm convinced the people commenting on this article are just contrarians. "How could you possibly have standards" isn't a very interesting conversation yet here we are having it at scale.
- GoblinSlayer 3y ago>An unsecure http GET could be modified and redirect the interested person to a fake site You don't have a threat model, do you?
- justsomehnguy 3y ago"Beware of the leopard"
- PMunch 3y agoInteresting implication that the field can contain a non-web URI. I just imagine seeing a `file://` URI and the application procedure is to somehow get your CV onto their server.
- mcny 3y agoThat is one way to show your commitment to “encourage career growth” I guess? Assuming someone who works at the company would have easier access to someone who has access to the server in question…
- pncnmnp 3y agoAs a recent college grad, I was struggling to find job interviews this year and decided to be a bit creative. I scoured Google for humans.txt files containing job openings, and discovered a couple of relevant ones, such as Expensify's (https://www.expensify.com/humans.txt https://www.expensify.com/humans.txt) and my favorite from Tumblr (https://www.tumblr.com/humans.txt https://www.tumblr.com/humans.txt). Expensify even got back to me for an interview! My hope is that one of these days, I will stumble upon a company that hides secret job openings in their .plan files - accessible through the finger protocol (https://en.wikipedia.org/wiki/Finger_(protocol) https://en.wikipedia.org/wiki/Finger_(protocol)) :) See: "finger @lsc.mit.edu" and "finger seattle@graph.no" for some examples.