security.txt expires date

[Tealk]

Requirements

• This is a bug report, and if not, please post to https://lemmy.ml/c/lemmy_support instead.
• Please check to see if this issue already exists.
• It's a single bug. Do not report multiple bugs in one issue.
• It's a frontend issue, not a backend issue; Otherwise please create an issue on the backend repo instead.

Summary

the date would have to be adjusted:
https://github.com/LemmyNet/lemmy-ui/blob/main/src/server/handlers/security-handler.ts#L14

Lemmy Instance Version

0.19.2

Lemmy Instance URL

https://rollenspiel.forum/

[Nutomic]

Does that endpoint even make sense in this way? Most admins are probably not aware of it, and dont configure these email addresses. If anything the email should be provided through an env var, and if none is provided then no security.txt is served. The expires field is documented here. I guess we could auto-generate a date one year in the future, but thats completely arbitrary so maybe it should also be supplied via env.

To be honest I would rather remove the security.txt entirely and leave it to instance admins to serve their own via nginx.

[Tealk]

Reading the mail address from .env makes sense, because the ones given there do not exist for me either.

I would continue to offer the file, because security problems are more likely to be reported in the project via Contact: mailto:[email protected] or the repo here instead of the admin who offers the service. Most of them will not be able to fix much of it in the lemmy code.

[Nutomic]

The Lemmy footer has a link to the source code which has a way to report security issues. There is also a link to join-lemmy.org which lists additional contact methods. So I dont think the email is necessary, Im not even sure if its working or if anyone ever used it.

cc @dessalines

[Tealk]

Line 7 could then also be changed to:

`Contact: https://github.com/LemmyNet/lemmy-ui/security/advisories/new