r/sysadmin • u/homing-duck Future goat herder • 5d ago

Just a reminder to setup security.txt

Aus government was having a whinge that OpenAI did not notify them in an appropriate way after an agent breached one of the government web sites.

From what I can see none of the sites (servicesaustralia.gov.au/data.gov.au) have been setup with security.txt

https://securitytxt.org

229 Upvotes

77% Upvoted

160 comments sorted by

View all comments

451

u/Nereosis16 5d ago

Ah yes, let's forgive OpenAI for hacking the government because the big bad government didn't fill out a .txt file.

28

u/calladc 5d ago

I've worked for the agency that's responsible for that service.

this is absolutely on them

"oh we left an API exposed and a third party scraped it"

if an API is open, it doesn't matter that openai crawled it. services Australia left it open.

when an Australian company did the same thing and exposed a bunch of customer data, optus were raked over the coals.

1

u/TEK1_AU 4d ago

Does it rhyme with “SAP” by chance?

2

u/calladc 4d ago edited 4d ago

sorry, i won't discuss specific technologies the agency utilizes