[Secdispatch] Review of draft-foudil-securitytxt

[Kathleen Moriarty <[e-mail]>]

Hello,

I have agreed to act as draft shepherd for
https://datatracker.ietf.org/doc/draft-foudil-securitytxt/?include_text=1.
As such, I did a review of the draft and have some questions.  Overall, I
think this is a positive step towards providing a consistent path for
security disclosure information dissemination.  Thanks for your work on
it.  I still need to look through list discussions as part of the shepherd
responsibilities.

Section 3:

I'd prefer to see that TLS is required in with the statement:
   the instructions MUST be accessible via the Hypertext
   Transfer Protocol [RFC1945] as a resource of Internet Media Type
   "text/plain" with the default charset parameter set to "utf-8" per
   section 4.1.3 of [RFC2046].

And since that's really hard to enforce, I think using RECOMMENDED at a
minimum here and in many of the places SHOULD appears in the document would
be better.  I know the meaning is similar, but I think it sounds a bit
stronger.


It looks like it is permissible to retrieve the file using HTTP only from
examples.  This has probably been discussed, but I am curious as to the
reasons.

Section 3.8 seems odd as most would look to a companies job listings rather
than use this as a source for information that should be timely.  The
vulnerability disclosure procedures are likely to be static for long
periods of time and hiring isn't necessarily.

4.3.  Internal hosts READS:

   A .security.txt file SHOULD be placed in the root directory of an
   internal host to trigger incident response.

The .security.txt doesn't trigger the response, but rather provides
information on the steps for disclosure with the organization, correct?

-- 

Best regards,
Kathleen