Subject: [art] One more thing about draft-foudil-securitytxt

From: Mark Nottingham <[email-masked]>
Date: Thu, 14 May 2020 13:28:01 +1000

It looks like it's becoming common practice for security.txt files to put *other* things in the /.well-known namespace.

For example:

"Signature: https://www.patreon.com/.well-known/security.txt.sig" on www.patreon.com
"Signature: https://www.patreon.com/.well-known/security.txt.sig" on 1password.com

It might be good to mention that URLs in security.txt fields should not be in .well-known space unless registered for that purpose.

Cheers,

--
Mark Nottingham   https://www.mnot.net/

---

From: Benjamin Kaduk <[email-masked]>
Date: Wed, 13 May 2020 20:48:42 -0700

Hi Mark,

> It might be good to mention that URLs in security.txt fields should not be in .well-known space unless registered for that purpose.

I've been going through and tabulating the last-call comments today, so
I'll be sure to add that to my summary writeup.

Thanks,

Ben

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 14 May 2020 08:38:41 -0400

Hi Mark,

I agree with that observation and will add a GitHub issue to track
this. However, the example mentioned ("Signature") was part of earlier
drafts and were intended to be registered in the "well-known"
namespace as mentioned here:
https://tools.ietf.org/html/draft-foudil-securitytxt-04#section-7.1

The most recent draft no longer uses external signatures and replaces
this with inline PGP signatures.

Thanks

---

From: Mark Nottingham <[email-masked]>
Date: Fri, 15 May 2020 09:27:43 +1000

Thanks! My concern is mostly that other folks might see the old approach and copy it.

Cheers,

> On 14 May 2020, at 10:38 pm, Yakov Shafranovich <[email-masked]> wrote:
> 
> Hi Mark,
> 
> _______________________________________________
> art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/art