What does it mean when I enabled this on my personal (for fun) websites years ago on a whim? I don't have a bug bounty program.
Re:Security.txt
by __throwawy9 on Sunday March 14, 2021 @07:18PM
(#26460523)
Putting all of these files at root is going to be like have old rusty cars and stained mattresses in front of your house years from now.
The web is not a junkyard.
The proposal is to place the file at /.well-known/security.txt.
And even if it wasn't, there is plenty of namespace room to put every file someone argues for in a 2-page RFC at root. After all, there are only 1024 low-numbered TCP ports and we haven't run out of those yet.
Re:Security.txt
by __throwawy9 on Sunday March 14, 2021 @09:57PM
(#26461777)
Don’t get me wrong; I dig file-based interfaces, but each time they add another file, it’s another request.
And it’s Anglocentric to continue to unnecessarily put multiple English words into the path; those can’t be touched-up with a later RFC to support Japanese in the file content via a Lang attribute.
The whole thing is shit bad, I’m sorry. Just come up with something that makes fucking sense for once.
It is time arbitrage between big companies taking security seriously (willing to pay large bounties) and that amount being higher than a monthly or yearly wage in some internet-connected regions. If they throw enough nets into the sea all year, eventually one pays off and they end up living quite well.