The “security.txt” proposal reached last step in the IETF process

Re:The “security.txt” proposal reached last step in the IETF... by rahuldottech on Wednesday December 11, 2019 @05:18PM (#21767378)

For the uninitiated: https://securitytxt.org/

Original HN thread: https://news.ycombinator.com/item?id=15416198

[ Parent | on HN ]

Re:The “security.txt” proposal reached last step in the IETF... by blue_shirt on Wednesday December 11, 2019 @05:46PM (#21767608)

At one point in time I believe there was also a discussion on why somebody was removing it from their site. I'm having a hard time finding it currently and remember it being for excessive contacts from people using automated tools to scan their site.

Edit: Found it, https://news.ycombinator.com/item?id=19152145

[ Parent | on HN ]

Re:The “security.txt” proposal reached last step in the IETF... by DyslexicAtheist on Wednesday December 11, 2019 @06:11PM (#21767789)

there is a draft (from November 27, 2019) that makes the presence of a disclosure policy (using security.txt) mandatory on gov domains:

"Binding Operational Directive 20-01 Develop and Publish a Vulnerability Disclosure Policy" https://cyber.dhs.gov/bod/20-01/

> Create a security.txt15 file at the “/.well-known/” path16 of the agency’s primary .gov domain. This file must include the Policy and Contact fields, as specified in the Internet-Draft.17

[ Parent | on HN ]