Re: About www.debian.org/security (/dsa) HTTP caching

--000000000000beb2e1065756bfa6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hi again,

To add some more notes regarding this:

There is a third party feed that is up to date at least now and does not
get served with any "problematic" HTTP caching headers at
https://www.mail-archive.com/[email protected]/mail=
list.xml,
that can serve as a workaround for some. But an official Debian service
would of course be preferable. This one is served with an ETag to address
some angles of caching, maybe that would work for the mentioned Debian feed
and page too?

Also, I see that the mail-archive.com RSS feed is generated by MhonArc per
comments in the feed. This seems to be the same software that generates the
official Debian mailing list archives. Maybe MHonArc could be configured to
provide a feed directly at lists.debian.org?

Ville

On Fri, 24 Jul 2026 at 10:35, Ville Skytt=C3=A4 <[email protected]> =
wrote:

> Hello!
>
> I noticed that the https://www.debian.org/security/ page and the
> https://www.debian.org/security/dsa feed are served with HTTP headers
> that allow their content to be cached up to 24 hours by clients or
> intermediate proxies/caches (see details at end of this mail).
>
> Considering the information at these URLs is security related as it lists
> advisories, I was wondering if it is intentionally configured this way?
>
> I understand that the page and the feed are not the primary sources for
> this information but the debian-security-announce mailing list is, but
> especially the feed is likely something through which its consumers expec=
t
> to see relatively up to date info. I gather the website is built every 4
> hours, so as it stands it could be that the info is 4 hours + 24 hours +
> (whatever the feed client's own delay happens to be at that point) old wh=
en
> it is delivered to the user.
>
> This could be alleviated client side by forcing the fetch ignoring the
> cache-control/expires, but not all clients have an option to do that. For
> example, the Slack RSS app does not,
> https://slack.com/help/articles/218688467-Add-RSS-feeds-to-Slack
>
> So, maybe consider if the max-age/expires for these pages could be
> shortened?
>
> $ date
> Fri Jul 24 10:23:40 AM EEST 2026
> $ curl -sI https://www.debian.org/security/ | grep -E
> 'cache-control|expires'
> cache-control: max-age=3D86400
> expires: Sat, 25 Jul 2026 07:23:46 GMT
> $ curl -sI https://www.debian.org/security/dsa | grep -E
> 'cache-control|expires'
> cache-control: max-age=3D86400
> expires: Sat, 25 Jul 2026 07:23:51 GMT
>
> Cheers, Ville
>

--000000000000beb2e1065756bfa6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hi again,<div><br></div><div>To add some more notes regard=
ing this:</div><div><br></div><div>There is a third party feed that is up t=
o date at least now and does not get served with any &quot;problematic&quot=
; HTTP caching headers at=C2=A0<a href=3D"https://www.mail-archive.com/debi=
[email protected]/maillist.xml">https://www.mail-archiv=
e.com/[email protected]/maillist.xml</a>, that can =
serve as a workaround for some. But an official Debian service would of cou=
rse be preferable. This one is served with an ETag to address some angles o=
f caching, maybe that would work for the mentioned Debian feed and page too=
?</div><div><br></div><div>Also, I see that the <a href=3D"http://mail-arch=
ive.com">mail-archive.com</a> RSS feed is generated by MhonArc per comments=
 in the feed. This seems to be the same software that generates the officia=
l Debian mailing list archives. Maybe MHonArc could be configured to provid=
e a feed directly at <a href=3D"http://lists.debian.org">lists.debian.org</=
a>?</div><div><br></div><div>Ville</div></div><br><div class=3D"gmail_quote=
 gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, 24 Ju=
l 2026 at 10:35, Ville Skytt=C3=A4 &lt;<a href=3D"mailto:ville.skytta@upclo=
ud.com">[email protected]</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rg=
b(204,204,204);padding-left:1ex"><div dir=3D"ltr"><div>Hello!</div><div><br=
></div><div>I noticed that the=C2=A0<a href=3D"https://www.debian.org/secur=
ity/" target=3D"_blank">https://www.debian.org/security/</a> page and the=
=C2=A0<a href=3D"https://www.debian.org/security/dsa" target=3D"_blank">htt=
ps://www.debian.org/security/dsa</a> feed are served with HTTP headers that=
 allow their content to be cached up to 24 hours by clients or intermediate=
 proxies/caches (see details at end of this mail).</div><div><br></div><div=
>Considering the information at these URLs is security related as it lists =
advisories, I was wondering if it is intentionally configured this way?</di=
v><div><br></div><div>I understand that the page and the feed are not the p=
rimary sources for this information but the debian-security-announce mailin=
g list is, but especially the feed is likely something=C2=A0through which i=
ts consumers expect to see relatively up to date info. I gather the website=
 is built every 4 hours, so as it stands it could be that the info is 4 hou=
rs + 24 hours + (whatever the feed client&#39;s own delay happens to be at =
that point) old when it is delivered to the user.</div><div><br></div><div>=
This could be alleviated client side by forcing the fetch ignoring the cach=
e-control/expires, but not all clients have an option to do that. For examp=
le, the Slack RSS app does not,=C2=A0<a href=3D"https://slack.com/help/arti=
cles/218688467-Add-RSS-feeds-to-Slack" target=3D"_blank">https://slack.com/=
help/articles/218688467-Add-RSS-feeds-to-Slack</a></div><div><br></div><div=
>So, maybe consider if the max-age/expires for these pages could be shorten=
ed?</div><div><br></div>$ date<br>Fri Jul 24 10:23:40 AM EEST 2026<br>$ cur=
l -sI <a href=3D"https://www.debian.org/security/" target=3D"_blank">https:=
//www.debian.org/security/</a> | grep -E &#39;cache-control|expires&#39;<br=
>cache-control: max-age=3D86400<br>expires: Sat, 25 Jul 2026 07:23:46 GMT<b=
r>$ curl -sI <a href=3D"https://www.debian.org/security/dsa" target=3D"_bla=
nk">https://www.debian.org/security/dsa</a> | grep -E &#39;cache-control|ex=
pires&#39;<br>cache-control: max-age=3D86400<br>expires: Sat, 25 Jul 2026 0=
7:23:51 GMT<br><div><br></div><div>Cheers, Ville</div></div>
</blockquote></div>

--000000000000beb2e1065756bfa6--