Last call changes #183

nightwatchcyber · 2019-12-31T04:59:00Z

Added language and example regarding URI encoding (URI and the percent-encoding #176)
Add "Expires" field (Last Call: Consider adding expiration date field #181)
Changed language from "directive" to "field" (Last call: Change language around "directive" #182)
Addressing last call feedback (Last Call: Change title of the draft #175, Last call feedback: S. Moonesamy #179 and Last Call Feedback: SecDir review #180)
Clarifying order of fields (ABNF: allow lines at the end of the file #174)

EdOverflow · 2020-01-01T16:04:51Z

draft-foudil-securitytxt.md

-("security.txt") to help organizations describe the process for security
-researchers to follow in order to report security vulnerabilities.
+("security.txt") to help organizations describe their vulnerability disclosure practices
+in order to make it easier for researchers to report security vulnerabilities.


Suggested change

in order to make it easier for researchers to report security vulnerabilities.

to make it easier for researchers to report security vulnerabilities.

will change

EdOverflow · 2020-01-01T16:06:53Z

draft-foudil-securitytxt.md

 for organizations to communicate information about their security disclosure
-policies, which is not limited to email and also allows for additional features
+practices and ways to contact them, which is not limited to email and also allows for additional features


This sentence is too wordy.

Rewording this - being that we already mentioned this is intended for researchers to be consumed, I took that out and only left the part about the organizations.

EdOverflow · 2020-01-01T16:10:51Z

draft-foudil-securitytxt.md

 such as encryption. This format is designed to help
 assist with the security disclosure process by making it easier
 for organizations to designate the preferred steps for researchers to take
-when trying to reach out to them with security vulnerabilities.
+when trying to reach out to them with security vulnerabilities as well as provide
+additional information about their vulnerability disclosure practices useful to security researchers.


This sentence is too wordy. Needs rephrasing.

EdOverflow · 2020-01-01T16:11:13Z

draft-foudil-securitytxt.md

-that provides information for security researchers to assist
-in disclosing security vulnerabilities.
+that provides information for security researchers about the vulnerability disclosure
+practices of a particular organization in order to assist them in disclosing security vulnerabilities.


Suggested change

practices of a particular organization in order to assist them in disclosing security vulnerabilities.

practices of a particular organization to assist them in disclosing security vulnerabilities.

EdOverflow · 2020-01-01T16:17:15Z

draft-foudil-securitytxt.md

+This field MUST NOT appear more than once.
+
+~~~~~~~~~~
+Expires: Thu, 31 Dec 2020 18:37:07 -0800


Is the date arbitrary? Is it the implementer's sole discretion to set a realistic expiration date? How does one determine what a suitable expiration date is?

I added a reference to the staleness section from the security considerations section

EdOverflow · 2020-01-01T16:18:01Z

draft-foudil-securitytxt.md

-If this directive indicates a web URL, then it MUST begin with "https://"
+This field indicates a link to where the vulnerability disclosure policy is located.
+This can help security researchers understand
+the organization's vulnerability reporting practices.


Suggested change

the organization's vulnerability reporting practices.

the organization's vulnerability-reporting practices.

same question about the dash as above

EdOverflow · 2020-01-01T16:18:36Z

draft-foudil-securitytxt.md

-redirect if it leads to another domain or subdomain
-but SHOULD follow that redirect within the same domain name
-(but not different subdomain on the same domain).
+or redirect (as per section 6.4 of {{!RFC7231}}) to the security.txt file under the /.well-known/ path. If a "security.txt" file


Suggested change

or redirect (as per section 6.4 of {{!RFC7231}}) to the security.txt file under the /.well-known/ path. If a "security.txt" file

or redirect (as per section 6.4 of {{!RFC7231}}) to the security.txt file under the "/.well-known/" path. If a "security.txt" file

EdOverflow · 2020-01-01T16:22:09Z

draft-foudil-securitytxt.md

 a "security.txt" file grants or denies permission for security testing.
-Any such permission MAY be defined in a security or disclosure policy
-(as per {{policy}}) or a new directive (as per {{extensibility}}).
+Any such permission may be indicates in the company's vulnerability disclosure policy


Suggested change

Any such permission may be indicates in the company's vulnerability disclosure policy

Any such permission may be indicated in the company's vulnerability-disclosure policy

EdOverflow · 2020-01-01T16:23:16Z

draft-foudil-securitytxt.md

 HTTPS is being used.

 However, the determination of validity of such keys is out of scope
-for this specification. Implementors MUST establish other secure means to
+for this specification. Researches need to establish other secure means to


Suggested change

for this specification. Researches need to establish other secure means to

for this specification. Security researches need to establish other secure means to

will change

Actually, there is a typo there. It should be:

Suggested change

for this specification. Researches need to establish other secure means to

for this specification. Security researchers need to establish other secure means to

EdOverflow · 2020-01-01T16:24:11Z

draft-foudil-securitytxt.md

-automated scans.
+Security researchers should consult the organization's vulnerability disclosure policy, if available,
+and review the contact information and/or resources referenced within the "security.txt"
+file before submitting reports in an automated fashion or as resulting from automated scans.


Too wordy. Needs rephrasing.

joker314

The fix for #174 looks good!

A few punctuation things and also an ABNF problem.

joker314 · 2020-01-02T07:07:52Z

draft-foudil-securitytxt.md


-This text file contains multiple directives
-with different values. The "directive" is the first part of a field all the way up
+This text file contains multiple fields with different values. A field contains a name which is the first part of a field all the way up


For consistency with how the field "value" is introduced

Suggested change

This text file contains multiple fields with different values. A field contains a name which is the first part of a field all the way up

This text file contains multiple fields with different values. A field contains a "name" which is the first part of a field all the way up

joker314 · 2020-01-02T16:52:53Z

draft-foudil-securitytxt.md


 line             =  (field / comment) eol

 eol              =  *WSP [CR] LF

 field            =  ack-field /
+                    can-field /


I'm not sure about moving Canonical to here, because it can appear a maximum of one time (similar to Expires)

As per IETF feedback, this was changed so Canonical can appear multiple times. This was done to address the use case where multiple redirects point to the same file.

joker314 · 2020-01-02T18:33:56Z

draft-foudil-securitytxt.md

 of the file (as per {{canonical}}), and regularly monitor the file and
 the referenced resources to detect tampering.

-Security researchers SHOULD check the "security.txt" file including verifying
+Security researchers should triage the "security.txt" file including verifying
 the digital signature and checking any available historical records before using the information
 contained in the file. If "security.txt" file looks suspicious or compromised,


(Not introduced by this PR, but probably good to fix this typo). One of--

Suggested change

contained in the file. If "security.txt" file looks suspicious or compromised,

contained in the file. If a "security.txt" file looks suspicious or compromised,

Suggested change

contained in the file. If "security.txt" file looks suspicious or compromised,

contained in the file. If the "security.txt" file looks suspicious or compromised,

EdOverflow · 2020-01-13T12:15:22Z

draft-foudil-securitytxt.md

+When made available on HTTP servers, it MUST be placed under the
+/.well-known/ path (as "/.well-known/security.txt") {{!RFC8615}} of a domain name or IP address.
+For legacy compatibility, a security.txt file might be placed at the top level path (see {{weblocation}}).
+For file systems a "security.txt" file SHOULD be placed in the root directory of a particular file system.


Suggested change

For file systems a "security.txt" file SHOULD be placed in the root directory of a particular file system.

For file systems a "security.txt" file SHOULD be placed in the root directory of the file system.

I do not think "particular" is needed here.

EdOverflow · 2020-01-13T12:17:23Z

draft-foudil-securitytxt.md

+For legacy compatibility, a security.txt file might be placed at the top level path (see {{weblocation}}).
+For file systems a "security.txt" file SHOULD be placed in the root directory of a particular file system.
+
+On HTTP servers, the file MUST be accessed via the Hypertext Transfer Protocol (HTTP) 1.0 {{!RFC1945}} or higher version


Suggested change

On HTTP servers, the file MUST be accessed via the Hypertext Transfer Protocol (HTTP) 1.0 {{!RFC1945}} or higher version

On HTTP servers, the file MUST be accessed via the Hypertext Transfer Protocol (HTTP) 1.0 {{!RFC1945}} or a higher version

EdOverflow · 2020-01-13T12:18:24Z

draft-foudil-securitytxt.md

+For file systems a "security.txt" file SHOULD be placed in the root directory of a particular file system.
+
+On HTTP servers, the file MUST be accessed via the Hypertext Transfer Protocol (HTTP) 1.0 {{!RFC1945}} or higher version
+and the "https" scheme (as per section 2.7.2 of {{!RFC7230}}). It MUST have a Content-Type of "text/plain"


On HTTP servers, the file MUST be accessed via the Hypertext Transfer Protocol 1.0 or a higher version and the "https" scheme.

This sentence is quite difficult to follow. Especially with all the inline references. Might need rephrasing.

EdOverflow · 2020-01-13T12:23:57Z

draft-foudil-securitytxt.md

-or repository in which it is located, and not to any of its parent or sibling folders,
-or repositories. However, it will apply to all subfolders.
+in which it is located, and not to any of its parent or sibling folders.
+However, it will apply to all subfolders.


I would reword this as follows:

A "security.txt" file that is found in a file system MUST only apply to the folder in which it is located and that folder's subfolders. The file does not apply to any of the folder's parent or sibling folders.

nightwatchcyber added 2 commits December 30, 2019 23:40

last call changes

1435fbb

last call changes

73b7401

nightwatchcyber requested a review from EdOverflow December 31, 2019 04:59

EdOverflow reviewed Jan 1, 2020

View reviewed changes

more fixes

39a296d

joker314 requested changes Jan 2, 2020

View reviewed changes

This was referenced Jan 2, 2020

New field: Expires securitytxt/securitytxt.org#41

Closed

New field: "Expires" lirantal/express-security-txt#68

Open

nightwatchcyber added 3 commits January 5, 2020 15:14

fixes

bcef5d3

more last back fixes

26a3ea5

more lang fixes

8926a16

EdOverflow reviewed Jan 13, 2020

View reviewed changes

additional updates

28424b0

EdOverflow approved these changes Jan 21, 2020

View reviewed changes

nightwatchcyber merged commit cdd7b7c into securitytxt:master Jan 30, 2020

joker314 mentioned this pull request Feb 23, 2020

Allow Canonical to appear more than once securitytxt/securitytxt.org#44

Merged

	in order to make it easier for researchers to report security vulnerabilities.
	to make it easier for researchers to report security vulnerabilities.

	practices of a particular organization in order to assist them in disclosing security vulnerabilities.
	practices of a particular organization to assist them in disclosing security vulnerabilities.

	the organization's vulnerability reporting practices.
	the organization's vulnerability-reporting practices.

	or redirect (as per section 6.4 of {{!RFC7231}}) to the security.txt file under the /.well-known/ path. If a "security.txt" file
	or redirect (as per section 6.4 of {{!RFC7231}}) to the security.txt file under the "/.well-known/" path. If a "security.txt" file

	Any such permission may be indicates in the company's vulnerability disclosure policy
	Any such permission may be indicated in the company's vulnerability-disclosure policy

	for this specification. Researches need to establish other secure means to
	for this specification. Security researches need to establish other secure means to

	This text file contains multiple fields with different values. A field contains a name which is the first part of a field all the way up
	This text file contains multiple fields with different values. A field contains a "name" which is the first part of a field all the way up

	contained in the file. If "security.txt" file looks suspicious or compromised,
	contained in the file. If a "security.txt" file looks suspicious or compromised,

	contained in the file. If "security.txt" file looks suspicious or compromised,
	contained in the file. If the "security.txt" file looks suspicious or compromised,

	For file systems a "security.txt" file SHOULD be placed in the root directory of a particular file system.
	For file systems a "security.txt" file SHOULD be placed in the root directory of the file system.

Last call changes #183

Last call changes #183

Conversation

nightwatchcyber commented Dec 31, 2019

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joker314 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment