Hi again, To add some more notes regarding this:
There is a third party feed that is up to date at least now and does not get served with any "problematic" HTTP caching headers at https://www.mail-archive.com/[email protected]/maillist.xml, that can serve as a workaround for some. But an official Debian service would of course be preferable. This one is served with an ETag to address some angles of caching, maybe that would work for the mentioned Debian feed and page too? Also, I see that the mail-archive.com RSS feed is generated by MhonArc per comments in the feed. This seems to be the same software that generates the official Debian mailing list archives. Maybe MHonArc could be configured to provide a feed directly at lists.debian.org? Ville On Fri, 24 Jul 2026 at 10:35, Ville Skyttä <[email protected]> wrote: > Hello! > > I noticed that the https://www.debian.org/security/ page and the > https://www.debian.org/security/dsa feed are served with HTTP headers > that allow their content to be cached up to 24 hours by clients or > intermediate proxies/caches (see details at end of this mail). > > Considering the information at these URLs is security related as it lists > advisories, I was wondering if it is intentionally configured this way? > > I understand that the page and the feed are not the primary sources for > this information but the debian-security-announce mailing list is, but > especially the feed is likely something through which its consumers expect > to see relatively up to date info. I gather the website is built every 4 > hours, so as it stands it could be that the info is 4 hours + 24 hours + > (whatever the feed client's own delay happens to be at that point) old when > it is delivered to the user. > > This could be alleviated client side by forcing the fetch ignoring the > cache-control/expires, but not all clients have an option to do that. For > example, the Slack RSS app does not, > https://slack.com/help/articles/218688467-Add-RSS-feeds-to-Slack > > So, maybe consider if the max-age/expires for these pages could be > shortened? > > $ date > Fri Jul 24 10:23:40 AM EEST 2026 > $ curl -sI https://www.debian.org/security/ | grep -E > 'cache-control|expires' > cache-control: max-age=86400 > expires: Sat, 25 Jul 2026 07:23:46 GMT > $ curl -sI https://www.debian.org/security/dsa | grep -E > 'cache-control|expires' > cache-control: max-age=86400 > expires: Sat, 25 Jul 2026 07:23:51 GMT > > Cheers, Ville >
