News for hackers. Stuff that matters.
Re:Security.txt by jensenbox on Sunday March 14, 2021 @04:57PM (#26459093)
I was literally going to craft a file and plop it on my site until I hit the "required expiration". I understand why it is there but think it should be optional. I think a better idea would be to steal from DNS and use TTL and serial numbers (maybe just standard http last-modified is enough?) - the point is "this stuff might be stale, reprocess it".

The last thing I need is one more thing to have to remember and update.

By the looks of it, a few others feel it is non-critical and have just skipped it too.

Re:Security.txt by JimDabell on Sunday March 14, 2021 @09:39PM (#26461654)
> I think a better idea would be to steal from DNS and use TTL and serial numbers (maybe just standard http last-modified is enough?)

HTTP already has an Expires header: https://tools.ietf.org/html/rfc7234#section-5.3

Re:Security.txt by JamisonM on Sunday March 14, 2021 @11:46PM (#26462426)
Seems like a better solution that would accomplish the actual goal would be "refresh-after" where you could specify how many days a client should wait until asking again.

Zero maintenance required but still gives a rate-limiting and time window function.