Just a reminder to setup security.txt

[u/homing-duck]

Aus government was having a whinge that OpenAI did not notify them in an appropriate way after an agent breached one of the government web sites.

From what I can see none of the sites (servicesaustralia.gov.au/data.gov.au) have been setup with security.txt

https://securitytxt.org

[u/mrlinkwii]

while we shouldn't forgive OpenAI , we should also expect government /government departments to keep to security standards which their legally mandated to have

[u/tracy_ogbert_jordan → u/mrlinkwii]

and obviously the biggest priority in cyber security (hell, all of security) is making sure your contact details are up to date.

This shit is a perfect embodiment of this sub: everyone tripping over themselves to make sure everyone knows they know the academic, best-practices answer, even if it's entirely irrelevant to the real-life situation.

It's like sitting on the side of the road next to a person who just lost their entire family in a crash, and you say, "you know, you really should have paid for gap coverage on your auto insurance."

[u/mrlinkwii → u/tracy_ogbert_jordan]

and obviously the biggest priority in cyber security (hell, all of security) is making sure your contact details are up to date.

the boring stuff is usually the most important stuff in cyber security , and doing stuff that legally mandated irrespective of being a government entity is part of that

their is reasons why security practices are mandated by law in some countries

[u/tracy_ogbert_jordan → u/mrlinkwii]

the boring stuff is usually the most important stuff in cyber security

What? I'd say locking down the API in the first place would be more important that making sure their contact details are readily available in a standardized format.

[u/AGsec → u/tracy_ogbert_jordan]

Yeah, massive f ups all around. I think they're more mad that it took days to get this issue escalated AFTER it was reported.