Subject: [saag] Proposal for "security.txt"

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 15 Oct 2017 21:59:29 -0400

[I am posting this as per my emails with the sec ADs]

Ed Foudil and others within the security community are working on an
Internet draft proposing a new standard for providing security contact
information via a standard file, similar to robots.txt. The draft can
be found here:
https://tools.ietf.org/html/draft-foudil-securitytxt-00

Additional resources here:
https://securitytxt.org/
https://github.com/securitytxt/security-txt

Nevil Brownlee (the Independent Submissions Editor) has indicated that
this document is not a good candidate for the independent stream, so
the question now is whether this can be something that fall under the
security area.

EKR has suggested that this may be a good topic to add to the upcoming
SEC-DISPATCH meeting at IETF 100 in Singapore.

Thanks,
Yakov

---

From: Carsten Bormann <[email-masked]>
Date: Wed, 18 Oct 2017 23:04:55 +0200

Surely, this needs to be under /.well-known?
(RFC 5785)

Grüße, Carsten

> On Oct 16, 2017, at 03:59, Yakov Shafranovich <[email-masked]> wrote:
> 
> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 18 Oct 2017 15:15:01 -0600

> https://github.com/securitytxt/security-txt

Related:

https://blog.liftsecurity.io/2013/06/02/security-md-improved-security-disclosure/

Peter

---

From: Jeffrey Walton <[email-masked]>
Date: Wed, 18 Oct 2017 17:55:47 -0400

> SEC-DISPATCH meeting at IETF 100 in Singapore.

We already have RFC 2142, MAILBOX NAMES FOR COMMON SERVICES, ROLES AND
FUNCTIONS. It provides a security@ address.

But it would be nice to have have something simple, like a robots.txt,
to establish domain boundaries. That is, a subdomain can indicate
*.example.com does not apply to the subdomain for the purposes of a
security context used in PKIX.

Jeff

---

From: Martin Thomson <[email-masked]>
Date: Thu, 19 Oct 2017 09:45:37 +1100

> SEC-DISPATCH meeting at IETF 100 in Singapore.

Yes, this seems appropriate.  Going through this process will ensure
that comments like Carsten's - a view I share - are considered and
addressed.