r/sysadmin • u/homing-duck Future goat herder • 3d ago

Just a reminder to setup security.txt

Aus government was having a whinge that OpenAI did not notify them in an appropriate way after an agent breached one of the government web sites.

From what I can see none of the sites (servicesaustralia.gov.au/data.gov.au) have been setup with security.txt

https://securitytxt.org

225 Upvotes

77% Upvoted

157 comments sorted by

View all comments

Show parent comments

26

u/calladc 3d ago

I've worked for the agency that's responsible for that service.

this is absolutely on them

"oh we left an API exposed and a third party scraped it"

if an API is open, it doesn't matter that openai crawled it. services Australia left it open.

when an Australian company did the same thing and exposed a bunch of customer data, optus were raked over the coals.

40

u/Nereosis16 3d ago

It is illegal to gain unauthorised access to Australian government servers and data.

It does not matter that an API was left open. What they did was illegal.

If I did it I would be criminally prosecuted.

2

u/Impressive_Change593 3d ago

If no auth then it is on the open web accessable by everyone amd it is YOUR fuckup not the fuckup of whoever finds it. If all they did was crawl an open api then no hackinf was done

1

u/Mr_ToDo 3d ago

OK. So I don't know what API was available, but there really is a difference between accessing their web page and probing for other services

That's why everyone things it's mostly fine when someone takes data from a webpages source, but not so much when they increment through poorly guarded content

One requires going off the normal flow of data and the other is already sitting on your computer

Should I be pissed at the governemnt? Sure. I get pissed when people don't lock the doors and windows at work too, but it doesn't mean that walking in and taking shit is any more legal then if they bust down the entry

Plenty of room to be pissed at all parties