Subject: Re: [saag] Proposal for "security.txt"

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 18 Oct 2017 21:42:18 -0000

This issue has been raised via Github and the consensus is that this
file should be under .well-known. That change will be reflected in the
next draft.

See:
https://github.com/securitytxt/security-txt/issues/3

Thanks

On Wed, Oct 18, 2017 at 5:04 PM, Carsten Bormann <[email-masked]> wrote:
> Surely, this needs to be under /.well-known?
> (RFC 5785)
>
> Grüße, Carsten
>
>> On Oct 16, 2017, at 03:59, Yakov Shafranovich <[email-masked]> wrote:
>>
>> [I am posting this as per my emails with the sec ADs]
>>
>> Ed Foudil and others within the security community are working on an
>> Internet draft proposing a new standard for providing security contact
>> information via a standard file, similar to robots.txt. The draft can
>> be found here:
>> https://tools.ietf.org/html/draft-foudil-securitytxt-00
>>
>> Additional resources here:
>> https://securitytxt.org/
>> https://github.com/securitytxt/security-txt
>>
>> Nevil Brownlee (the Independent Submissions Editor) has indicated that
>> this document is not a good candidate for the independent stream, so
>> the question now is whether this can be something that fall under the
>> security area.
>>
>> EKR has suggested that this may be a good topic to add to the upcoming
>> SEC-DISPATCH meeting at IETF 100 in Singapore.
>>
>> Thanks,
>> Yakov
>>
>> _______________________________________________
>> saag mailing list
>> [email-masked]
>> https://www.ietf.org/mailman/listinfo/saag
>>
>

---

From: Robert Kisteleki <[email-masked]>
Date: Tue, 7 Nov 2017 17:03:43 +0100

Maybe a silly question, but the way I see it there's no such thing (sec
dispatch) on the agenda. Am I doing it wrong?

Also: there's a draft, there's a github page and there's also a separate
domain for this proposal. At least two of them are not in sync with each
other. So I'm a bit confused about where discussion is taking place and
what is the current authoritative version.

Robert

On 2017-10-19 00:45, Martin Thomson wrote:
> On Mon, Oct 16, 2017 at 12:59 PM, Yakov Shafranovich
> <[email-masked]> wrote:
> Yes, this seems appropriate.  Going through this process will ensure
> that comments like Carsten's - a view I share - are considered and
> addressed.
>

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 7 Nov 2017 11:26:32 -0500

Sent from my mobile device

> On Nov 7, 2017, at 11:03 AM, Robert Kisteleki <[email-masked]> wrote:
> 

No, I can add in the agenda from the SecDispatch chairs into the overall SAAG agenda.  SAAG should take about 50 minutes and then will switch to SecDispatch.  We are running SecDispatch as an experiment at this meeting.

Best,
Kathleen

---

From: Paul Wouters <[email-masked]>
Date: Mon, 27 Nov 2017 10:44:38 -0500

> https://tools.ietf.org/html/draft-foudil-securitytxt-00

This seems like a terrible idea.

If a web service is compromised before a researcher finds it, the security.txt
could have been modified to NOT alert the actual security staff of this
web service. It might even alert the hackers to wipe the server for fear of
being identified. So any researcher would have to attempt to reach the proper people
via an out-of-band security method anyway and they MUST NOT use the security.txt
file for this.

Doing something in RDAP for a security contact similar to how we have abuse contacts
seems like a much better idea.

Paul

---

From: Michael Richardson <[email-masked]>
Date: Mon, 27 Nov 2017 12:13:19 -0500

> web service. It might even alert the hackers to wipe the server for

You have have identified that the contents need to be digitally signed!

So security.txt needs to be security.txt.asc/security.smime or some other
clearsigned digital signature format. The keys to verify this need to be in DNS(SEC).

At which point, I think one might as well move the contents into TXT records.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-