3 ms·
There are quite many browser-supported protocols which are not http or https, which can be used also for malicious purposes. HTTPS is probably the only protoco
by nicce 3y ago
There are quite many browser-supported protocols which are not http or https, which can be used also for malicious purposes.
HTTPS is probably the only protocol which is guaranteed to show content from the claimed source.
- galleywest200 3y agoNot FTPS or SFTP?
- nicce 3y agoFunnily these protocols are not supported by the Chromium or Firefox anymore.
- BenjiWiebe 3y agoSFTP (sort-of-FTP over SSH) was never browser supported afaik. I'm not sure about FTPS (FTP over SSL/TLS), did browsers support it when they supported regular FTP?
- NoZebra120vClip 3y agoI am not sure why it's relevant whether methods are supported by GUI browsers at all (please refer to URIs by method, not "protocol"); because the security.txt is likely to be parsed automatically (since it is, of course, not HTML) and indeed, "tel:" and "mailto:" are both somewhat apt methods to be invoked by a company who's hiring/receiving reports, and doesn't want/need a website for it. So yeah, it is important that this part of the RFC specify a difference between "web" and "non-web" URIs, because the authors of security.txt are free to use any URI method that makes sense.