Update RTD security docs #3641
Update RTD security docs #3641
Conversation
| @@ -34,6 +34,8 @@ | |||
| url(r'^$', HomepageView.as_view(), name='homepage'), | |||
| url(r'^support/', SupportView.as_view(), name='support'), | |||
| url(r'^security/', TemplateView.as_view(template_name='security.html')), | |||
| url(r'^.well-known/security.txt', | |||
There was a problem hiding this comment.
Do we need this? Who uses it? How?
(I read the RFC at https://tools.ietf.org/html/rfc5785 but I don't understand the use case)
There was a problem hiding this comment.
I should have put more details. A security.txt file is not yet a standard but may be. It has been submitted to become an RFC. The goal of it is that it is a standard place where a security researcher can find the right place to disclose an issue.
docs/security.rst
Outdated
|
|
||
| You may use this `PGP key`_ to securely communicate with us and to verify signed messages you receive from us. | ||
|
|
||
| .. _PGP key: http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x71337C3047A1B066 |
There was a problem hiding this comment.
I believe this is my PGP key, and I'm not confident I still have access to it. Perhaps we should generate a new one via keybase or something, perhaps that we can share with the team?
There was a problem hiding this comment.
Oh, if you don't have access to it that is definitely a problem. I'll create a new one and share the key.
| Security issue archive | ||
| ~~~~~~~~~~~~~~~~~~~~~~ | ||
|
|
||
| It's only a matter of time... |
|
The |
| @@ -0,0 +1 @@ | |||
| Policy: https://docs.readthedocs.io/en/latest/security.html | |||
There was a problem hiding this comment.
Reading the official page, https://securitytxt.org/ I found that there are more fields we can add here:
Contact:
Encryption:
Acknowledgements:
Policy:
Signature:
Hiring:
Contact, Ecryptation and Signature are good candidates I think.
RichardLitt
added
the
PR: work in progress
|
I have generated the new GPG key and I'll push an update here once it has been received by the key servers. |
davidfischer
added
PR: ready for review
and removed
PR: work in progress
|
The key has been updated and this is ready to go. |
|
🎆 |
Fixes #3637