News for hackers. Stuff that matters.
Re:Security.txt (2017) by stedaniels on Wednesday February 13, 2019 @07:26AM (#19152507)
Is been an RFC for almost a decade, RFC5785 [0].

Mattias Geniar has a good write up on it [1].

[0] https://tools.ietf.org/html/rfc5785

[1] https://ma.ttias.be/well-known-directory-webservers-aka-rfc-...

Re:Security.txt (2017) by jolmg on Wednesday February 13, 2019 @12:19PM (#19154657)
Neither seems to explain why these files aren't just placed in root, like robots.txt. What's the point of having a subpath?

The RFC says:

> 2. Why /.well-known? It's short, descriptive, and according to search indices, not widely used.

This gives reasoning for the name of the subpath, but not its existence.

Re:Security.txt (2017) by ezrast on Wednesday February 13, 2019 @08:14PM (#19158830)
To minimize collisions, and so we're not retreading this argument in another ten years: https://news.ycombinator.com/item?id=19063727
Re:Security.txt (2017) by jolmg on Wednesday February 13, 2019 @09:00PM (#19159041)
Ok, yeah. It occurs to me that websites might want the whole path to be variable text, maybe user defined.

This would also answer the question I've had for so long as to why Wikipedia chose to have /wiki/ before article titles in their URLs. I guess it was so that the article https://en.wikipedia.org/wiki/robots.txt did not collide with their robots.txt file.

Would've been nice if that explanation were included in the RFC.

Re:Security.txt (2017) by wycy on Wednesday February 13, 2019 @07:37AM (#19152557)
Interesting. I guess I've been out of the web dev scene for a little over a decade now, so that makes sense.