Skip to content

Clarify non-HTTP protocols and the use of port 80 - #207

Merged
mlazzeri merged 3 commits into
masterfrom
ftp
Oct 9, 2016
Merged

Clarify non-HTTP protocols and the use of port 80#207
mlazzeri merged 3 commits into
masterfrom
ftp

Conversation

@konklone

@konklone konklone commented Oct 9, 2016

Copy link
Copy Markdown
Contributor

This updates the OMB compliance guide page to clarify that:

  • Only HTTP-based protocols are covered by M-15-13. DNS, FTP, etc. are not covered.
  • No one needs to cut off port 80. Redirects are fine, and mitigating the security impact of this behavior is what HSTS is for.

These are both in response to confusion observed in agencies.

@mlazzeri
mlazzeri merged commit db963af into master Oct 9, 2016
@alex

alex commented Oct 9, 2016

Copy link
Copy Markdown
Contributor

Acking that this LGTM.

@alex
alex deleted the ftp branch October 9, 2016 17:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@konklone @alex @mlazzeri