Re: [saag] Comments on draft-foudil-securitytxt-04

[Yakov Shafranovich <[e-mail]>]

On Tue, Jan 8, 2019 at 7:39 PM Paul Wouters <[e-mail]> wrote:
...
> If http://example.com is compromised, and you grab http://example.com/security.txt,
> then whether the content of security.txt points to an HTTP or HTTPS resource is
> meaningless.

I want to clarify one point that Ed Foudil discussed with me: are we
assuming that this proposal is intended for *vulnerability disclosure*
or for *incident response*? Specifically, as per CERT's guide (section
1.2.8):
https://resources.sei.cmu.edu/asset_files/SpecialReport/2017_003_001_503340.pdf

"Sometimes the term “Incident Response” is used synonymously with
Vulnerability Response. These two concepts are related, but different;
Vulnerability Response specifically indicates responding to reports of
product vulnerabilities, usually via the CVD process, whereas Incident
Response is more general and can also include other security events
such as network intrusions."

This proposal originates from the security research community and is
geared towards vulnerability disclosure, and not necessarily things
like reporting an active compromise - although it can be used for that
purpose. Perhaps that's where the disconnect is.

Yakov