EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·Aug 26·5 min read
76% of 623 EU software vendors have no security.txt ahead of the CRA 24h rule
TL;DR
A recent scan revealed that 76% of 623 European software vendors do not have a security.txt file, which is crucial for reporting vulnerabilities. This lack of compliance poses significant risks as the EU Cyber Resilience Act mandates rapid reporting of security incidents starting next month.
✦ Why It Matters
Ensure your organization publishes a security.txt file to comply with upcoming EU regulations and facilitate vulnerability reporting.
Key Takeaways
- Implement a security.txt file on your domain immediately.
- Designate a clear contact method for vulnerability reports.
- Stay informed about the EU Cyber Resilience Act requirements.
- Prepare for potential public disclosures of vulnerabilities.
How It Works
The security.txt file is accessed via a simple HTTP GET request to the path /.well-known/security.txt. If the server responds with HTTP 200 and includes a 'Contact:' line, it indicates that the vendor is prepared to receive vulnerability reports.
This mechanism allows researchers to quickly identify how to report issues.