7 ms·

"Dutch government websites must comply with the security.txt standard from 25 May. This is announced by the Digital Trust Center of the National Government." S

"Dutch government websites must comply with the security.txt standard from 25 May. This is announced by the Digital Trust Center of the National Government." Somewhat ironically: https://www.digitaltrustcenter.nl/security.txt https://www.digitaltrustcenter.nl/security.txt The website of the Digital Trust Center returns 404

Mattasher 3y ago
https://www.digid.nl/security.txt https://www.digid.nl/security.txt redirects to: https://www.ncsc.nl/.well-known/security.txt https://www.ncsc.nl/.well-known/security.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 # Domeinen van de Rijksoverheid kunnen met een 302 redirect verwijzen naar # het centrale bestand op https://www.ncsc.nl/.well-known/security.txt # omdat het NCSC het centrale meldpunt is voor kwetsbaarheden en incidenten # voor de Rijksoverheid. # # Dutch central government domains can redirect to the central file located # at https://www.ncsc.nl/.well-known/security.txt with a 302 redirect, # because NCSC-NL is the central point of contact for vulnerabilities and # incidents for the Dutch central government. Expires: 2024-01-31T22:59:00.000Z Canonical: https://www.ncsc.nl/.well-known/security.txt Policy: https://www.ncsc.nl/contact/kwetsbaarheid-melden Policy: https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd Contact: https://www.ncsc.nl/contact/kwetsbaarheid-melden Contact: https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd Contact: mailto:security@ncsc.nl Encryption: https://www.ncsc.nl/contact/pgp-key Preferred-Languages: nl, en Acknowledgments: https://www.ncsc.nl/wall-of-fame Hiring: https://www.werkenvoornederland.nl -----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.4.2 (Build 1298) Charset: utf-8 wsDVAwUBY+9c0P4Vd0fJc7lbAQpUmQwAwZ1vWyI1VKBChsciufRcvxy5zzMZMx6v YjD5CXuDV4GL+tRl7wClnQO023e3ZChTH69y7O3veS+5/zNVUvpyqJfS8pNzG0pA B4vea3fQ41t5UpCVYvPopIFiT1oeQJA9w4NqBD2+2jW5lS5L8k9xz192gWJvhxq8 mTukJXYDiJLzxKbUMHEG2GNaMeoRj5Pvgr8buzQELP0VZHfzF05Hr6NOoWvS6SRX KGW6rgg6fEUPcMTjBqn6gL/w82FXwrh93AmYkP/sBWP4It3NpbiNuazc5iynhhih +ZlfzsFV6agF4MZR0IQZ6X4jsCxKFrPIWW51/7W+PIDkqy6za/bDjDeiinid0HOC 2rro6N9FXSyxHz9nteMppd+YMTCt+Z67HONsssR+7ojxORGOs0rTcjUucaVikFJQ wAls9p+vuIzFRViQaXe3Nndspr1cCIu4z3ZfdkcWREQP7acOjNgbmeQOlH4jnYWq lNVMWzOncidAWM0nXcuYTjZagRAagthF =yC4A -----END PGP SIGNATURE----- Version: Encryption Desktop 10.4.2 (Build 1298) Charset: utf-8 wsDVAwUBY+9c0P4Vd0fJc7lbAQpUmQwAwZ1vWyI1VKBChsciufRcvxy5zzMZMx6v YjD5CXuDV4GL+tRl7wClnQO023e3ZChTH69y7O3veS+5/zNVUvpyqJfS8pNzG0pA B4vea3fQ41t5UpCVYvPopIFiT1oeQJA9w4NqBD2+2jW5lS5L8k9xz192gWJvhxq8 mTukJXYDiJLzxKbUMHEG2GNaMeoRj5Pvgr8buzQELP0VZHfzF05Hr6NOoWvS6SRX KGW6rgg6fEUPcMTjBqn6gL/w82FXwrh93AmYkP/sBWP4It3NpbiNuazc5iynhhih +ZlfzsFV6agF4MZR0IQZ6X4jsCxKFrPIWW51/7W+PIDkqy6za/bDjDeiinid0HOC 2rro6N9FXSyxHz9nteMppd+YMTCt+Z67HONsssR+7ojxORGOs0rTcjUucaVikFJQ wAls9p+vuIzFRViQaXe3Nndspr1cCIu4z3ZfdkcWREQP7acOjNgbmeQOlH4jnYWq lNVMWzOncidAWM0nXcuYTjZagRAagthF =yC4A -----END PGP SIGNATURE-----
smcleod 3y ago
Wouldn't it be beveiliging.txt?
- teekert 3y ago
  Us Dutchies, in contrast to the French, don't come up with new words. Our language is Englishifying more and more.
  - vanderZwan 3y ago
    We've always been strongly influenced by our big three neighbors (UK, France and Germany). I remember reading somewhere that before WW2 France was our biggest "cultural influencer" (for example, we spelled helicopter "hélicoptère", until the Canadians liberated us). It's probably not surprising that WW2 made German less popular, and the Anglosphere more popular afterwards.
  - sebstefan 3y ago
    Cesses de téléverser des billevesées sur hackernews, Hollandais Notre langage est parfait
    - WJW 3y ago
      > sur hackernews "nouvelles de pirates", sûrement? :)
      - deleted 3y ago
        [deleted]
      - sebstefan 3y ago
        GAZETTE du BIDOUILLEUR
    - teekert 3y ago
      Excuse moi, je suis een baquette.
  - mathstuf 3y ago
NVQXE23I 3y ago
You are looking in the wrong place. https://securitytxt.org/ https://securitytxt.org/ proposes to create a text file called security.txt under the .well-known directory of your project. So, the URL becomes: https://www.digitaltrustcenter.nl/.well-known/security.txt https://www.digitaltrustcenter.nl/.well-known/security.txt This returns a 200 (via 302).
- moffkalast 3y ago
  Ironically, that information is apparently not well known.
  - archerx 3y ago
    It's "well known" if you've manually set up SSL certs for a site using certbot. But yea I agree it's a weird choice to put it there instead of the same place as humans.txt, robots.txt and etc.
    - onlypositive 3y ago
      I wasn't going to add one but I might actually put one in my root just out of spite. Devs need to stop demanding other devs jump through pointless hoops.
      - withinboredom 3y ago
        On linux, there is a ~/.config directory, yet devs who think they know everything still pointlessly litter my home directory... Don't litter your web root either ;)
    - _nalply 3y ago
      Au contraire, it's the other way around. It makes more sense to put favicon.ico, robots.txt and humans.txt in .well-known, but that's life, these files are legacy. (shrugs)
    - xp84 3y ago
      Iirc “they” decided that all new standards for “specific URLs you may want to serve for a particular purpose” will be under /.well-known. Robots is grandfathered because it’s super old and established and thus crazy to move. There won’t be anymore “at the root” standards.

Mattasher 3y ago

https://www.digid.nl/security.txt https://www.digid.nl/security.txt redirects to: https://www.ncsc.nl/.well-known/security.txt https://www.ncsc.nl/.well-known/security.txt -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 # Domeinen van de Rijksoverheid kunnen met een 302 redirect verwijzen naar # het centrale bestand op https://www.ncsc.nl/.well-known/security.txt # omdat het NCSC het centrale meldpunt is voor kwetsbaarheden en incidenten # voor de Rijksoverheid. # # Dutch central government domains can redirect to the central file located # at https://www.ncsc.nl/.well-known/security.txt with a 302 redirect, # because NCSC-NL is the central point of contact for vulnerabilities and # incidents for the Dutch central government. Expires: 2024-01-31T22:59:00.000Z Canonical: https://www.ncsc.nl/.well-known/security.txt Policy: https://www.ncsc.nl/contact/kwetsbaarheid-melden Policy: https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd Contact: https://www.ncsc.nl/contact/kwetsbaarheid-melden Contact: https://english.ncsc.nl/contact/reporting-a-vulnerability-cvd Contact: mailto:security@ncsc.nl Encryption: https://www.ncsc.nl/contact/pgp-key Preferred-Languages: nl, en Acknowledgments: https://www.ncsc.nl/wall-of-fame Hiring: https://www.werkenvoornederland.nl -----BEGIN PGP SIGNATURE----- Version: Encryption Desktop 10.4.2 (Build 1298) Charset: utf-8 wsDVAwUBY+9c0P4Vd0fJc7lbAQpUmQwAwZ1vWyI1VKBChsciufRcvxy5zzMZMx6v YjD5CXuDV4GL+tRl7wClnQO023e3ZChTH69y7O3veS+5/zNVUvpyqJfS8pNzG0pA B4vea3fQ41t5UpCVYvPopIFiT1oeQJA9w4NqBD2+2jW5lS5L8k9xz192gWJvhxq8 mTukJXYDiJLzxKbUMHEG2GNaMeoRj5Pvgr8buzQELP0VZHfzF05Hr6NOoWvS6SRX KGW6rgg6fEUPcMTjBqn6gL/w82FXwrh93AmYkP/sBWP4It3NpbiNuazc5iynhhih +ZlfzsFV6agF4MZR0IQZ6X4jsCxKFrPIWW51/7W+PIDkqy6za/bDjDeiinid0HOC 2rro6N9FXSyxHz9nteMppd+YMTCt+Z67HONsssR+7ojxORGOs0rTcjUucaVikFJQ wAls9p+vuIzFRViQaXe3Nndspr1cCIu4z3ZfdkcWREQP7acOjNgbmeQOlH4jnYWq lNVMWzOncidAWM0nXcuYTjZagRAagthF =yC4A -----END PGP SIGNATURE----- Version: Encryption Desktop 10.4.2 (Build 1298) Charset: utf-8 wsDVAwUBY+9c0P4Vd0fJc7lbAQpUmQwAwZ1vWyI1VKBChsciufRcvxy5zzMZMx6v YjD5CXuDV4GL+tRl7wClnQO023e3ZChTH69y7O3veS+5/zNVUvpyqJfS8pNzG0pA B4vea3fQ41t5UpCVYvPopIFiT1oeQJA9w4NqBD2+2jW5lS5L8k9xz192gWJvhxq8 mTukJXYDiJLzxKbUMHEG2GNaMeoRj5Pvgr8buzQELP0VZHfzF05Hr6NOoWvS6SRX KGW6rgg6fEUPcMTjBqn6gL/w82FXwrh93AmYkP/sBWP4It3NpbiNuazc5iynhhih +ZlfzsFV6agF4MZR0IQZ6X4jsCxKFrPIWW51/7W+PIDkqy6za/bDjDeiinid0HOC 2rro6N9FXSyxHz9nteMppd+YMTCt+Z67HONsssR+7ojxORGOs0rTcjUucaVikFJQ wAls9p+vuIzFRViQaXe3Nndspr1cCIu4z3ZfdkcWREQP7acOjNgbmeQOlH4jnYWq lNVMWzOncidAWM0nXcuYTjZagRAagthF =yC4A -----END PGP SIGNATURE-----

smcleod 3y ago

Wouldn't it be beveiliging.txt?

teekert 3y ago
Us Dutchies, in contrast to the French, don't come up with new words. Our language is Englishifying more and more.
- vanderZwan 3y ago
  We've always been strongly influenced by our big three neighbors (UK, France and Germany). I remember reading somewhere that before WW2 France was our biggest "cultural influencer" (for example, we spelled helicopter "hélicoptère", until the Canadians liberated us). It's probably not surprising that WW2 made German less popular, and the Anglosphere more popular afterwards.
- sebstefan 3y ago
  Cesses de téléverser des billevesées sur hackernews, Hollandais Notre langage est parfait
  - WJW 3y ago
    > sur hackernews "nouvelles de pirates", sûrement? :)
    - deleted 3y ago
      [deleted]
    - sebstefan 3y ago
      GAZETTE du BIDOUILLEUR
  - teekert 3y ago
    Excuse moi, je suis een baquette.
- mathstuf 3y ago

NVQXE23I 3y ago

You are looking in the wrong place. https://securitytxt.org/ https://securitytxt.org/ proposes to create a text file called security.txt under the .well-known directory of your project. So, the URL becomes: https://www.digitaltrustcenter.nl/.well-known/security.txt https://www.digitaltrustcenter.nl/.well-known/security.txt This returns a 200 (via 302).

moffkalast 3y ago
Ironically, that information is apparently not well known.
- archerx 3y ago
  It's "well known" if you've manually set up SSL certs for a site using certbot. But yea I agree it's a weird choice to put it there instead of the same place as humans.txt, robots.txt and etc.
  - onlypositive 3y ago
    I wasn't going to add one but I might actually put one in my root just out of spite. Devs need to stop demanding other devs jump through pointless hoops.
    - withinboredom 3y ago
      On linux, there is a ~/.config directory, yet devs who think they know everything still pointlessly litter my home directory... Don't litter your web root either ;)
  - _nalply 3y ago
    Au contraire, it's the other way around. It makes more sense to put favicon.ico, robots.txt and humans.txt in .well-known, but that's life, these files are legacy. (shrugs)
  - xp84 3y ago
    Iirc “they” decided that all new standards for “specific URLs you may want to serve for a particular purpose” will be under /.well-known. Robots is grandfathered because it’s super old and established and thus crazy to move. There won’t be anymore “at the root” standards.