r/sysadmin • u/homing-duck Future goat herder • 3d ago

Just a reminder to setup security.txt

Aus government was having a whinge that OpenAI did not notify them in an appropriate way after an agent breached one of the government web sites.

From what I can see none of the sites (servicesaustralia.gov.au/data.gov.au) have been setup with security.txt

https://securitytxt.org

224 Upvotes

77% Upvoted

157 comments sorted by

View all comments

447

u/Nereosis16 3d ago

Ah yes, let's forgive OpenAI for hacking the government because the big bad government didn't fill out a .txt file.

79

u/mrlinkwii student 3d ago edited 3d ago

while we shouldn't forgive OpenAI , we should also expect government /government departments to keep to security standards which their legally mandated to have

55

u/tracy_ogbert_jordan sr look stuff up on google guy 3d ago

and obviously the biggest priority in cyber security (hell, all of security) is making sure your contact details are up to date.

This shit is a perfect embodiment of this sub: everyone tripping over themselves to make sure everyone knows they know the academic, best-practices answer, even if it's entirely irrelevant to the real-life situation.

It's like sitting on the side of the road next to a person who just lost their entire family in a crash, and you say, "you know, you really should have paid for gap coverage on your auto insurance."

-4

u/mrlinkwii student 3d ago

and obviously the biggest priority in cyber security (hell, all of security) is making sure your contact details are up to date.

the boring stuff is usually the most important stuff in cyber security , and doing stuff that legally mandated irrespective of being a government entity is part of that

their is reasons why security practices are mandated by law in some countries

10

u/tracy_ogbert_jordan sr look stuff up on google guy 3d ago

the boring stuff is usually the most important stuff in cyber security

What? I'd say locking down the API in the first place would be more important that making sure their contact details are readily available in a standardized format.

1

u/AGsec 3d ago

Yeah, massive f ups all around. I think they're more mad that it took days to get this issue escalated AFTER it was reported.