Add security.txt #100

New Issue

Our website is https://www.pvv.ntnu.no, not https://pvv.ntnu.no
The RFC, section 3, specifies that the file MUST be placed under .well-known, and not in the top-level as done here. The top-level is permitted in addition to the "proper" one for legacy purposes, but I don't think we should use it.

Also, .well-known will now live in the bekkalokk-config, rather than the website, as soon as Drift/pvv-nixos-config#79 is fixed and merged.

I think the canonical name is a bit off. - Our website is https://www.pvv.ntnu.no, not https://pvv.ntnu.no - [The RFC](https://www.rfc-editor.org/rfc/rfc9116), section 3, specifies that the file MUST be placed under .well-known, and not in the top-level as done here. The top-level is permitted in addition to the "proper" one for legacy purposes, but I don't think we should use it. Also, .well-known will now live in the bekkalokk-config, rather than the website, as soon as https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/79 is fixed and merged.

oysteikt commented

2024-09-15 23:43:40 +02:00

I think you're commenting on outdated information. 95a634c9d5 is no longer a part of the main branch, and the file have been modified as part of Drift/pvv-nixos-config#79. There is no longer any canonical name present, and it's been correctly placed.

I think you're commenting on outdated information. 95a634c9d5 is no longer a part of the main branch, and the file have been modified as part of https://git.pvv.ntnu.no/Drift/pvv-nixos-config/pulls/79. There is no longer any canonical name present, and it's been correctly placed.

felixalb commented

2024-09-15 23:55:49 +02:00

Aha, yup, I followed the link in the comment above, oops!
4e5093618e/hosts/bekkalokk/services/well-known/root/security.txt looks good!
We should probably have some clear security policy / review process documented in English on the wiki, but that is a difficult policy thing and not a required technical thing, so it can wait.

Apologies for the mess :)

Aha, yup, I followed the link in the comment above, oops! https://git.pvv.ntnu.no/Drift/pvv-nixos-config/src/commit/4e5093618e3a04f2afd00c4e0ef789da3f6455b5/hosts/bekkalokk/services/well-known/root/security.txt looks good! We should probably have some clear security policy / review process documented in English on the wiki, but that is a difficult policy thing and not a required technical thing, so it can wait. Apologies for the mess :)

oysteikt closed this issue

2024-10-20 23:30:27 +02:00

Sign in to join this conversation.