News for hackers. Stuff that matters.
Re:Security.txt (2017) by heyjudy on Wednesday February 13, 2019 @06:07AM (#19152143)
On one-side: Wouldn't it be simpler and more effective to just have a link to a public key and email address for security reporting?

And on other other: what's with this domain-specific metadata? If semantic metadata were the issue, why not solve it more generally with RDF or something that's a part of a greater, more uniform solution that people actually deploy and people actually use? All these little extra files and custom formats creates a hodgepodge of muck.

If anything, downloadable artifacts and contact information especially, through metalink or RDF, need to be annotated with public keys and/or cryptographic hashes where available. And what about a standard for contact phone numbers given a website? The list of metadata idea is endless, hence the need to complicate the web the least and to do it thoughtfully, in a standard manner.

It's nice when a website is well-laid out and everything is where you expect, but having semantic metadata in a mechanically-queryable form is even more valuable... a data "API" for assembling public information uniformly reduces work for almost everyone.

Re:Security.txt (2017) by Leace on Wednesday February 13, 2019 @08:42AM (#19152939)
> On one-side: Wouldn't it be simpler and more effective to just have a link to a public key and email address for security reporting?

Well, that's what in a security.txt file basically, contact address and encryption key.

> And what about a standard for contact phone numbers given a website?

Use tel URI in Contact field.