Subject: [Last-Call] security.txt

From: dyslexicatheist <[email-masked]>
Date: Wed, 11 Dec 2019 23:39:37 +0000

Hello *,

I have implemented this for some clients and documented my experience here:
https://news.ycombinator.com/item?id=19152145

it seems that there is renewed pressure to get this draft signed off due to the latest BOD draft: (from November 27, 2019) that makes the presence of a disclosure policy (using security.txt) mandatory on gov domains:

"Binding Operational Directive 20-01 Develop and Publish a Vulnerability Disclosure Policy" https://cyber.dhs.gov/bod/20-01/

it seems gov domains are already banking on this becoming a standard. I personally believe there is 0 value in standardizing this.

> Create a security.txt15 file at the “/.well-known/” path16 of the agency’s primary .gov domain. This file must include the Policy and Contact fields, as specified in the Internet-Draft.17

best regards
~DA

Sent with [ProtonMail](https://protonmail.com) Secure Email.