Re: [Last-Call] Last Call: <draft-foudil-securitytxt-08.txt> (A Method for Web Security Policies) to Informational RFC

[Paul Wouters <paul@xxxxxxxxx>]

How do you know it can from there ? I see lots of hits for the published contact security@xxxxxxxxx, eg

https://www.bbc.com/backstage/security-disclosure-policy/

https://medium.com/@dr.spitfire/a-fight-for-duplicate-marked-bug-story-of-bbc-hall-of-fame-16f9c8215315

You even publish that same email address in a DNS TXT record with a mailto: link.

It seems more that you added the address at yet another location with the same contact information? So I am a bit confused how you reached your conclusion that people found that email address via this drafts mechanism.

Paul

Sent from my iPhone

On Dec 12, 2019, at 04:23, Neil Craig <Neil.Craig@xxxxxxxxx> wrote:

Hello

Via Twitter, I’ve become aware that there’s an upcoming vote on "draft-foudil-securitytxt-08.txt (A Method for Web Security Policies) to Informational RFC”, https://tools.ietf.org/html/draft-foudil-securitytxt-08.

I’d like to add a note in favour of ratification from a BBC perspective. We adopted the security.txt standard (https://www.bbc.co.uk/.well-known/security.txt, https://www.bbc.com/.well-known/security.txt) in August 2018 and have seen some very significant benefit from it, as evidenced in our public acknowledgements page: https://www.bbc..com/backstage/security-disclosure-policy/acknowledgements. All but the very first vulnerability on that page was reported via security..txt and for every acknowledged vulnerability, there are around 5 more which are duplicates or which, on inspection, don’t meet our scope requirements.

Some side benefits of deploying security.txt have been a raising of the profile of online security within the BBC and really fantastic engagement from the web security community, this has led to cooperation with several other organisations and individuals.

We would very much like to see security.txt ratified as a standard in order to promote the usual benefits, including consistency of usage, improved interoperability and adoption by mainstream applications and services.

As a potential third-party endorsement, I noticed recently that Shodan...io has now integrated security.txt detection and listing, see https://www.shodan.io/host/212.58.249.210 as an example.

I hope that’s useful. I’m very happy to provide any further information you might need, please just let me know if that’s the case.

Many thanks

Neil Craig

Lead Technical Architect

BBC Online Technology Group

London W12 | BC4 A3

--
last-call mailing list
last-call@xxxxxxxx
https://www.ietf.org/mailman/listinfo/last-call

-- 
last-call mailing list
last-call@xxxxxxxx
https://www.ietf.org/mailman/listinfo/last-call