Re: [saag] results of IETF LC for draft-foudil-securitytxt-08 and next steps

[Yakov Shafranovich <[e-mail]>]

On Fri, Jul 3, 2020 at 2:33 AM Michael Richardson <[e-mail]> wrote:
>
>
> Benjamin Kaduk <[e-mail]> wrote:
>     >> >> My take:
>     >> >> We can't get publically anchored certificates for devices without DNS names,
>     >> >> such as those that might be found in your home on RFC1918 addresses.  The
>     >> >> teddy cam can still have a securitytxt on it to report issues.
>     >>
>     >> > That seems pretty aligned with my best guess, involving cases where https
>     >> > was not possible (whether because it's going via filesystem access and not
>     >> > web, or the device only has an IP address and not a name, or whatever).
>     >>
>     >> Okay, but if the teddycam at 192.168.1.104, has a security.txt, then it can
>     >> only apply for reporting vulnerabilities in *that* TeddyCam, since other
>     >> Teddy Cams would be at different addresses, according to section 3.1.
>
>     > Yes ... but any vulnerabilities in that one would also be expected to be
>     > present in other instances of the same model, and if the contact point is
>     > at the manufacturer, the manufacturer can do the right thing?
>     > I feel like you have a downside in mind that I'm failing to spot...
>
> If a security.txt applies *only* to the web resource where you found it,
> then that means it doesn't generalize to the other instances of that device.
> That sounds dumb, and it is, but that's what I'm reading in section 3.1
>

The concern was that in a case where different parts of a website may
be owned by different customers, we didn't want customer A claiming
authority over customer B. This is well illustrated by Amazon's setup
for S3 where "domain.s3.amazonaws.com" is the same thing as
"s3.amazonaws.com/domain/".

With that being said, the intent is that the "Policy" directive can
point to an expanded policy document that would add more information
about scope. So in the case of the Teddy Cam, the "security.txt" file
would provide the absolute minimum but the policy directive can add
additional information.

Thanks