Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update security.md (digest, private key, RSASSA-PKCS1-v1_5) #1082

Closed
wants to merge 4 commits into from

Conversation

sventiffe
Copy link

Closes #1080
Closes #1079

@ClearlyClaire
Copy link
Contributor

I think the digest part is a bit misleading because the examples are about GET requests, which would typically not involve a Digest header.

Split the initial example into GET requests (without digest) and POST/other requests (with digest)
@sventiffe
Copy link
Author

Fair point. Separated the explanations for digest into a separate section.

Before investing more time, just to clarify: are you generally interested in a contribution? Based on first hands experience I believe the documentation should be fixed (given the growing interest in Mastodon and probably also in the tooling ecosystem) and I am happy to iterate over this PR. But I should have asked earlier.

@trwnh
Copy link
Member

trwnh commented Nov 26, 2022

@sventiffe I just added 57d1d76 to #1060 -- does this commit address your concerns, or are there improvements that could be made in your opinion? To summarize, the examples now include both GET and POST, with the POST example calling out the need for digest.

EDIT: Added a few more commits to clarify use of RSA with SHA256 and fix the public key vs private key mixup.

@sventiffe
Copy link
Author

@trwnh it largely addresses my concerns (your changes/PR are a little bit challenging to navigate as it is really a lot of pending changes bundled into one PR). I left one comment about the error in the doc of signing the string with the public key (it needs to be the private one).

On a meta level: I am not familiar with the governance structure of this project, the reviewers/approvers and regular contributors. I would however strongly suggest to get documentation improvements out in smaller chunks if that allows faster updates. Given that there are probably a lot of people joining the ecosystem now. 🏒 😄 cc @Gargron

Thank you folks for the hard work! I have no particular feelings about my PR, please close if not needed.

@trwnh
Copy link
Member

trwnh commented Nov 26, 2022

Well, they are small chunks, but they keep building up on account of there being no one to merge them quickly...

@trwnh trwnh mentioned this pull request Dec 16, 2022
@Gargron Gargron closed this in #1110 Feb 7, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
3 participants