Re:Security.txt (2017)
by AndyMcConachie on Wednesday February 13, 2019 @07:23AM
(#19152493)
The people who know about and will use security.txt are probably not going to be the people who you now have problems communicating with.
I'm willing to bet that 10 years after this is standardized the percentage of HTTP/S domains hosting security.txt files will be around 1%. And that 1% will be websites that are mostly already doing the right security things.
> Can you give me a contact for your admin/security guy?
That's what spammers,scammers and sales-people do. Just describe how to repeat the issue. Most of the time they will forward to the right person. Don't expect to hear anything from them.
Knowing that someone have been into your house (server) and sneaked around is very uncomfortably, so don't expect even a thank you.
Re:Security.txt (2017)
by KloudTrader on Wednesday February 13, 2019 @03:06PM
(#19156437)
For us we just put it in the footer :D
Like this: https://kloudtrader.com/security
Last year, I discovered a severe security flaw on a couple dozen websites and the sheer communication of this was super painful. I can't just e-mail someone at [email protected], I'd usually have to send an e-mail along the lines of "Can you give me a contact for your admin/security guy? I have something here and I can't quite disclose it just now." The response rate was extremely low.
If you just give me a security.txt, at least I know I can disclose something and I have some level of certainty that the e-mail will be read.