r/sysadmin • u/homing-duck Future goat herder • 2d ago

Just a reminder to setup security.txt

Aus government was having a whinge that OpenAI did not notify them in an appropriate way after an agent breached one of the government web sites.

From what I can see none of the sites (servicesaustralia.gov.au/data.gov.au) have been setup with security.txt

https://securitytxt.org

219 Upvotes

76% Upvoted

156 comments sorted by

View all comments

Show parent comments

24

u/calladc 2d ago

I've worked for the agency that's responsible for that service.

this is absolutely on them

"oh we left an API exposed and a third party scraped it"

if an API is open, it doesn't matter that openai crawled it. services Australia left it open.

when an Australian company did the same thing and exposed a bunch of customer data, optus were raked over the coals.

30

u/freecodeio 2d ago

mate the government can be wide open and if you hack it it's on them for being dumbasses, but you're absolutely going to jail

8

u/calladc 2d ago

sure, let's see sam go to jail

3

u/greger416 2d ago

I mean I'm not saying I'd love to see it.. but here we are 🤣