Subject: [Tools-discuss] securityheaders.io for ietf.org

From: "Eggert, Lars" <[email-masked]>
Date: Tue, 5 Apr 2016 15:46:20 +0000

We might want to do something about this:
https://securityheaders.io/?q=https%3A%2F%2Fietf.org%2F

Lars

---

From: Chris Morrow <[email-masked]>
Date: Tue, 05 Apr 2016 16:03:12 -0400

At Tue, 5 Apr 2016 15:46:20 +0000,
Eggert, Lars wrote:
> 
> [1  <multipart/signed (7bit)>]
> [1.1  <text/plain; us-ascii (7bit)>]

https://www.ssllabs.com/ssltest/analyze.html?d=ietf.org&s=2001%3a1900%3a3001%3a11%3a0%3a0%3a0%3a2c&latest

is securityheaders.io busted? (or is qualys busted?) Y U So Different?

> Lars
> [1.2 Message signed with OpenPGP using GPGMail <application/pgp-signature (7bit)>]
> No public key for 54B5C309BF70C157 created at 2016-04-05T11:46:20-0400 using RSA
> [2  <text/plain; us-ascii (7bit)>]
> -- 
> Tools-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-discuss
> 
> Please report datatracker.ietf.org bugs at http://tools.ietf.org/tools/ietfdb
> Please report tools.ietf.org bugs at http://tools.ietf.org/tools/issues or
> send email to [email-masked]

---

From: Chris Morrow <[email-masked]>
Date: Tue, 05 Apr 2016 16:09:34 -0400

At Tue, 05 Apr 2016 16:03:12 -0400,
> is securityheaders.io busted? (or is qualys busted?) Y U So Different?

Oh, so oddly bing and google don't show HSTS at least... though
another site I do control does show hsts and gets a better score on
securityheaders.io.

-chris

---

From: "Eggert, Lars" <[email-masked]>
Date: Wed, 6 Apr 2016 05:31:22 +0000

> is securityheaders.io busted? (or is qualys busted?) Y U So Different?

They check different things? securityheaders.io focuses on HTTPS content security parameterization, ssllabs.com on the TLC configuration.

Lars

---

From: "Eggert, Lars" <[email-masked]>
Date: Wed, 6 Apr 2016 05:36:27 +0000

On 2016-04-06, at 7:31, Eggert, Lars <[email-masked]> wrote:
> TLC configuration

TLS :-)

---

From: Eric Rescorla <[email-masked]>
Date: Wed, 6 Apr 2016 08:19:13 -0300

On Wed, Apr 6, 2016 at 2:36 AM, Eggert, Lars <[email-masked]> wrote:

> TLS :-

TLC is also awesome, however.

-Ekr

---

From: Chris Morrow <[email-masked]>
Date: Wed, 06 Apr 2016 10:51:33 -0300

At Wed, 6 Apr 2016 08:19:13 -0300,
Eric Rescorla wrote:
> 
> [1  <text/plain; UTF-8 (7bit)>]

it is sorely missed from many parts of the https-landscape.  I had
thought ssllabs was testing for HSTS and content-security-headers and
frame/xss/etc in the past, sadly they don't now :(

-chris