Hello! I noticed that the https://www.debian.org/security/ page and the https://www.debian.org/security/dsa feed are served with HTTP headers that allow their content to be cached up to 24 hours by clients or intermediate proxies/caches (see details at end of this mail).
Considering the information at these URLs is security related as it lists advisories, I was wondering if it is intentionally configured this way? I understand that the page and the feed are not the primary sources for this information but the debian-security-announce mailing list is, but especially the feed is likely something through which its consumers expect to see relatively up to date info. I gather the website is built every 4 hours, so as it stands it could be that the info is 4 hours + 24 hours + (whatever the feed client's own delay happens to be at that point) old when it is delivered to the user. This could be alleviated client side by forcing the fetch ignoring the cache-control/expires, but not all clients have an option to do that. For example, the Slack RSS app does not, https://slack.com/help/articles/218688467-Add-RSS-feeds-to-Slack So, maybe consider if the max-age/expires for these pages could be shortened? $ date Fri Jul 24 10:23:40 AM EEST 2026 $ curl -sI https://www.debian.org/security/ | grep -E 'cache-control|expires' cache-control: max-age=86400 expires: Sat, 25 Jul 2026 07:23:46 GMT $ curl -sI https://www.debian.org/security/dsa | grep -E 'cache-control|expires' cache-control: max-age=86400 expires: Sat, 25 Jul 2026 07:23:51 GMT Cheers, Ville
