dev-security
dev-security copied to clipboard
Indicator colours (values)
From Lucas Garron: be very careful about the use of colors/security indicators [...] not to conflate security properties with recommendations/best practices.
Good point, I've currently grouped them into:
- Good: But we may have some additional notes to make it even better.
- Notice: Probably ok, but at the same time it could be better.
- Error: You really need to fix this.
I think we should still be opinionated, and give clear/simple instructions... where the "error" indicators should be rare, and the improvement from Notice to Good can be rewarding.
As to the "Extra download (already in trust store)" error... I've changed this to a Notice, as it's not really broken... for reference, this came from ssllabs.com, where the problem is a slower connection (more data to transfer and parse).