You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Christopher Schultz <ch...@christopherschultz.net> on 2020/09/01 17:01:12 UTC
security.txt
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
All,
I'd like to propose that we publish a security.txt[1] file on our web
site under /.well-known/security.txt and /security.txt
This file contains information we all already know, but it's in
obviously "proprietary" locations on our web site and might not easily
be found by someone who maybe doesn't speak English, etc.
Here's my proposed content:
Contact: security@tomcat.apache.org
Contact:
https://tomcat.apache.org/security.html#Reporting_New_Security_Problems_
with_Apache_Tomcat
Acknowledgments: https://tomcat.apache.org/security.html
Preferred-Languages: en
Canonical: https://tomcat.apache.org/.well-known/security.txt
Hiring: https://tomcat.apache.org/getinvolved.html
If there are no objections, I'll add it to the site repo, soon.
What's the best way to make sure that the same file ends up in
/.well-known/security.txt and /security.txt? Can git link them
together or something like that?
- -chris
[1] https://securitytxt.org/
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl9OflcACgkQHPApP6U8
pFhy7g//bvd5hO/QTg+HJyJ1pRY4DCZUtssratL9iwoXNWmRz5toO6XM+Hj3Bh0U
4VOV5pMl+dN6DhSvuUSDXumnkF6RFMPYFjs15TvC5BaMbt7jlwfNtez7ByrVimOm
BX9KLsXHgjE04Z4nnqp0S+bXdig5bBTtDLPH9woQOOJfx+4LFyPPUMBaKVzxIh2h
3VAv1vkUCmwfqzY5jJKxERQBzhYwBzuxOe1dL+qtXZGs6R8++OltX5GH1qYks8PR
28A8SDp+YWrMEEMkv0vUIle3lmEpzEa3+hujFHhMjxPM3q80d9r1XR7B+T3SodEo
1udOfBMRG6MGU9OiFD+s8vYgVt2BBBSCTzoeuNQkkf2kbzpeFYChjv7mM4ghBSyy
6y8Cz5O8HHQwroaxrkbhf1iIlNDdV0zQ+vd1C3EmhiZosD/bWhIL9q0RFzkY5QIY
d4U2AN2Q6r9Wd12jS7ELjKy2q/BshJktEjdHs0HQUvYP26zOK9AVtH/ojFLmfXf8
E+8TxLX2Wr3e6VyaGOJayeofSeeWEs0a4kxzfTB1ChQ/tG/SBJACCYS12cCq1XIn
nKzkNm1ftbNDgH2IxSfvAPl1m9SzoSO3RJwibrV1bwstahtbvgALHP5raGzZ8Mxo
+piQmPr1YKwxcvQWE3X/aZOv2YryjnbXKCdHixieZu+rU4f7j6M=
=qHDh
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: security.txt
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Mark,
On 9/1/20 14:38, Mark Thomas wrote:
> On 01/09/2020 18:01, Christopher Schultz wrote:
>> All,
>>
>> I'd like to propose that we publish a security.txt[1] file on our
>> web site under /.well-known/security.txt and /security.txt
>>
>> This file contains information we all already know, but it's in
>> obviously "proprietary" locations on our web site and might not
>> easily be found by someone who maybe doesn't speak English, etc.
>>
>> Here's my proposed content:
>>
>> Contact: security@tomcat.apache.org Contact:
>> https://tomcat.apache.org/security.html#Reporting_New_Security_Proble
ms_
>>
>>
with_Apache_Tomcat
>> Acknowledgments: https://tomcat.apache.org/security.html
>> Preferred-Languages: en Canonical:
>> https://tomcat.apache.org/.well-known/security.txt Hiring:
>> https://tomcat.apache.org/getinvolved.html
>>
>> If there are no objections, I'll add it to the site repo, soon.
>
> +1
>
>> What's the best way to make sure that the same file ends up in
>> /.well-known/security.txt and /security.txt? Can git link them
>> together or something like that?
>
> The site is in svn.
Oh, right. I modify the site so rarely I forget it hasn't migrated to Gi
t.
> A rewrite rule?
Sure. Shall I put an .htaccess file into the site's repo, then, at the
top-level?
RedirectPermanent /security.txt /.well-known/security.txt
?
Aah, there's already a top-level .htaccess file. I'll just add to that
one.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl9QSTsACgkQHPApP6U8
pFiAGxAAhw/9IDGM7BbNCMGzhPkQwFrB8z+2rm25rmpJBYwYU/ZcnnIbky5Olz1x
83oygeQKTofmllEvZoAqyQEr3woFH2MZWL7/qluvCKhHpnxDBsYb6wYNX3pX9L1H
SXHb237GiUEbKYLpwYtjjxOWQwbjTCGNm7fHtSW2X0luyvzjHDZd38WsIBI+JvRS
KtYUwPTvzpRYWxzdx8feojUp+IUGrU6OUs39rYnbtNcgpZ7bpfmwFhH40K6BXjcb
AzW1bIYWpyA2AeQw0jGoXPvReDwn3iOR4aO/IUSdTTWuVD8Tw+ChFDcWkcqcYXq/
lYkA+p/ceM+qBzCXxQK/rvjmN5DQZ1y7P3sHJBRvqCp/lcmK/JNFfzo0+e0sR3Yc
ltSLqRKgdnvcNO8BRE1PJiz+b7S6Du8/OB66/byQduwacUUbz7pPxlNu1CkwKxh8
a5DGwiYnG5tAthbf512ASgWkFtU97et9JOwv0TXiTfVF9DVxw3Fp+6a1Akkh1+hZ
Ebsliwp0FcAb8K6lhdNjG7LJik5vQrqCfJ6tJchwpmsCqfMCXb1+dApv6fFlTP0a
Uf30XwzJkNX/uPqP1AAPFetUVBJScHwwNf5WH+/FtK1M15Ykj7hjPPNMFY1ej3Hp
fdWaiP3LfZV8gR8HM4V5MM8OPkIKc0mUWxVs1WDSA46e4+Cf4kU=
=aN45
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: security.txt
Posted by Raymond Auge <ra...@liferay.com.INVALID>.
On Tue, Sep 1, 2020 at 2:38 PM Mark Thomas <ma...@apache.org> wrote:
> On 01/09/2020 18:01, Christopher Schultz wrote:
> > All,
> >
> > I'd like to propose that we publish a security.txt[1] file on our web
> > site under /.well-known/security.txt and /security.txt
> >
> > This file contains information we all already know, but it's in
> > obviously "proprietary" locations on our web site and might not easily
> > be found by someone who maybe doesn't speak English, etc.
> >
> > Here's my proposed content:
> >
> > Contact: security@tomcat.apache.org
> > Contact:
> > https://tomcat.apache.org/security.html#Reporting_New_Security_Problems_
> > with_Apache_Tomcat
> > Acknowledgments: https://tomcat.apache.org/security.html
> > Preferred-Languages: en
> > Canonical: https://tomcat.apache.org/.well-known/security.txt
> > Hiring: https://tomcat.apache.org/getinvolved.html
> >
> > If there are no objections, I'll add it to the site repo, soon.
>
> +1
>
> > What's the best way to make sure that the same file ends up in
> > /.well-known/security.txt and /security.txt? Can git link them
> > together or something like that?
>
> The site is in svn.
>
> A rewrite rule?
>
As in https://svn.apache.org/repos/asf/tomcat/site/trunk/xdocs/.htaccess
- Ray
>
> Mark
>
> >
> > -chris
> >
> > [1] https://securitytxt.org/
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: dev-help@tomcat.apache.org
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>
--
*Raymond Augé* <http://www.liferay.com/web/raymond.auge/profile>
(@rotty3000)
Senior Software Architect *Liferay, Inc.* <http://www.liferay.com>
(@Liferay)
Re: security.txt
Posted by Mark Thomas <ma...@apache.org>.
On 01/09/2020 18:01, Christopher Schultz wrote:
> All,
>
> I'd like to propose that we publish a security.txt[1] file on our web
> site under /.well-known/security.txt and /security.txt
>
> This file contains information we all already know, but it's in
> obviously "proprietary" locations on our web site and might not easily
> be found by someone who maybe doesn't speak English, etc.
>
> Here's my proposed content:
>
> Contact: security@tomcat.apache.org
> Contact:
> https://tomcat.apache.org/security.html#Reporting_New_Security_Problems_
> with_Apache_Tomcat
> Acknowledgments: https://tomcat.apache.org/security.html
> Preferred-Languages: en
> Canonical: https://tomcat.apache.org/.well-known/security.txt
> Hiring: https://tomcat.apache.org/getinvolved.html
>
> If there are no objections, I'll add it to the site repo, soon.
+1
> What's the best way to make sure that the same file ends up in
> /.well-known/security.txt and /security.txt? Can git link them
> together or something like that?
The site is in svn.
A rewrite rule?
Mark
>
> -chris
>
> [1] https://securitytxt.org/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
Re: security.txt
Posted by Coty Sutherland <cs...@apache.org>.
On Tue, Sep 1, 2020 at 1:01 PM Christopher Schultz <
chris@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> All,
>
> I'd like to propose that we publish a security.txt[1] file on our web
> site under /.well-known/security.txt and /security.txt
>
> This file contains information we all already know, but it's in
> obviously "proprietary" locations on our web site and might not easily
> be found by someone who maybe doesn't speak English, etc.
>
> Here's my proposed content:
>
> Contact: security@tomcat.apache.org
> Contact:
> https://tomcat.apache.org/security.html#Reporting_New_Security_Problems_
> with_Apache_Tomcat
> Acknowledgments: https://tomcat.apache.org/security.html
> Preferred-Languages: en
> Canonical: https://tomcat.apache.org/.well-known/security.txt
> Hiring: https://tomcat.apache.org/getinvolved.html
>
> If there are no objections, I'll add it to the site repo, soon.
>
+1 :D
> What's the best way to make sure that the same file ends up in
> /.well-known/security.txt and /security.txt? Can git link them
> together or something like that?
>
I'd guess a rewrite rule like Mark suggested.
> - -chris
>
> [1] https://securitytxt.org/
> -----BEGIN PGP SIGNATURE-----
> Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl9OflcACgkQHPApP6U8
> pFhy7g//bvd5hO/QTg+HJyJ1pRY4DCZUtssratL9iwoXNWmRz5toO6XM+Hj3Bh0U
> 4VOV5pMl+dN6DhSvuUSDXumnkF6RFMPYFjs15TvC5BaMbt7jlwfNtez7ByrVimOm
> BX9KLsXHgjE04Z4nnqp0S+bXdig5bBTtDLPH9woQOOJfx+4LFyPPUMBaKVzxIh2h
> 3VAv1vkUCmwfqzY5jJKxERQBzhYwBzuxOe1dL+qtXZGs6R8++OltX5GH1qYks8PR
> 28A8SDp+YWrMEEMkv0vUIle3lmEpzEa3+hujFHhMjxPM3q80d9r1XR7B+T3SodEo
> 1udOfBMRG6MGU9OiFD+s8vYgVt2BBBSCTzoeuNQkkf2kbzpeFYChjv7mM4ghBSyy
> 6y8Cz5O8HHQwroaxrkbhf1iIlNDdV0zQ+vd1C3EmhiZosD/bWhIL9q0RFzkY5QIY
> d4U2AN2Q6r9Wd12jS7ELjKy2q/BshJktEjdHs0HQUvYP26zOK9AVtH/ojFLmfXf8
> E+8TxLX2Wr3e6VyaGOJayeofSeeWEs0a4kxzfTB1ChQ/tG/SBJACCYS12cCq1XIn
> nKzkNm1ftbNDgH2IxSfvAPl1m9SzoSO3RJwibrV1bwstahtbvgALHP5raGzZ8Mxo
> +piQmPr1YKwxcvQWE3X/aZOv2YryjnbXKCdHixieZu+rU4f7j6M=
> =qHDh
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>