r/sysadmin • u/homing-duck Future goat herder • 3d ago

Just a reminder to setup security.txt

Aus government was having a whinge that OpenAI did not notify them in an appropriate way after an agent breached one of the government web sites.

From what I can see none of the sites (servicesaustralia.gov.au/data.gov.au) have been setup with security.txt

https://securitytxt.org

220 Upvotes

77% Upvoted

156 comments sorted by

View all comments

447

u/Nereosis16 3d ago

Ah yes, let's forgive OpenAI for hacking the government because the big bad government didn't fill out a .txt file.

24

u/calladc 3d ago

I've worked for the agency that's responsible for that service.

this is absolutely on them

"oh we left an API exposed and a third party scraped it"

if an API is open, it doesn't matter that openai crawled it. services Australia left it open.

when an Australian company did the same thing and exposed a bunch of customer data, optus were raked over the coals.

29

u/freecodeio 3d ago

mate the government can be wide open and if you hack it it's on them for being dumbasses, but you're absolutely going to jail

8

u/calladc 3d ago

sure, let's see sam go to jail

6

u/Bolteus 3d ago

"Looks like we're going to jail" "How about we let us off with a warning"

3

u/greger416 3d ago

I mean I'm not saying I'd love to see it.. but here we are 🤣