5 ms·

Been in or around tech my whole life and this is the first time I've heard of security.txt. This article is trying to shame or something over what even https://

Been in or around tech my whole life and this is the first time I've heard of security.txt. This article is trying to shame or something over what even https://securitytxt.org/ https://securitytxt.org/ is calling "A proposed standard..."?

Aurornis 2y ago
The “fail to serve” wording in the headline is unnecessarily rage-baity. It’s an interesting proposal, but trying to shame people into adopting proposed things is more likely to generate groans and disinterest in 2025 than to win converts.
- technion 2y ago
  I see these sort of things as a signal. I would personally encourage use internally, because I would like to signal towards the right sort of researchers. But when you conflate that with some sort of expectation or "minimum effort" and try to shame people with it you signal something else, particularly to people who disagree with the value of said standard. I've had people show me my domains on "DNSSEC Hall of shame" site and my opinion of that site's existence lowers every time.
  - tptacek 2y ago
    Well, I mean, it's a self-parodying site, since almost every common domain you type into it fails the test. People calling you out for flunking on that site are saying something important about themselves, not about your security practice.
- spyc 2y ago
  People who spent hours finding the right security contacts for companies without luck would likely disagree. The key failure is not the single missing file, but that security contacts are too hard to find and the effect that has.
  - tatersolid 2y ago
    My org doesn’t host a security.txt file because the security@example.com email address been standardized since 1997: https://www.rfc-editor.org/rfc/rfc2142 https://www.rfc-editor.org/rfc/rfc2142
    - spyc 2y ago
      That's not a good reason to not host the file.
PeterWhittaker 2y ago
That website misrepresents the RFC in a way that I can only describe as deliberate and egregious. To quote the RFC itself, "This document is not an Internet Standards Track specification; it is published for informational purposes." In other words, someone had an interesting and possibly good idea, and did the non-trivial to get it published as an RFC (getting even informational RFCs take considerable effort) and now someone (else?) is trying to misrepresent its status. As said in another comment, "nothing burger". Also, {click,flame}bait.

Aurornis 2y ago

The “fail to serve” wording in the headline is unnecessarily rage-baity. It’s an interesting proposal, but trying to shame people into adopting proposed things is more likely to generate groans and disinterest in 2025 than to win converts.

technion 2y ago
I see these sort of things as a signal. I would personally encourage use internally, because I would like to signal towards the right sort of researchers. But when you conflate that with some sort of expectation or "minimum effort" and try to shame people with it you signal something else, particularly to people who disagree with the value of said standard. I've had people show me my domains on "DNSSEC Hall of shame" site and my opinion of that site's existence lowers every time.
- tptacek 2y ago
  Well, I mean, it's a self-parodying site, since almost every common domain you type into it fails the test. People calling you out for flunking on that site are saying something important about themselves, not about your security practice.
spyc 2y ago
People who spent hours finding the right security contacts for companies without luck would likely disagree. The key failure is not the single missing file, but that security contacts are too hard to find and the effect that has.
- tatersolid 2y ago
  My org doesn’t host a security.txt file because the security@example.com email address been standardized since 1997: https://www.rfc-editor.org/rfc/rfc2142 https://www.rfc-editor.org/rfc/rfc2142
  - spyc 2y ago
    That's not a good reason to not host the file.

PeterWhittaker 2y ago

That website misrepresents the RFC in a way that I can only describe as deliberate and egregious. To quote the RFC itself, "This document is not an Internet Standards Track specification; it is published for informational purposes." In other words, someone had an interesting and possibly good idea, and did the non-trivial to get it published as an RFC (getting even informational RFCs take considerable effort) and now someone (else?) is trying to misrepresent its status. As said in another comment, "nothing burger". Also, {click,flame}bait.