4 ms·

While it might be nice to claim authorship of a website you're proud of building, the main impact of adding this would be it'd provide an easy mechanism for bot

While it might be nice to claim authorship of a website you're proud of building, the main impact of adding this would be it'd provide an easy mechanism for bots and attackers to harvest data about the people and tech behind something on the internet. Knowing that "Name: Jimbob Smith" was on the team is incredibly useful to anyone who wants to phish access credentials.

867-5309 4y ago
exactly, best example I've seen: https://abbey-decorators.co.uk/humans.txt https://abbey-decorators.co.uk/humans.txt
jsty 4y ago
Between the "About Us" / "Team" / ... company website pages and LinkedIn profiles, I'd wager a majority of white-collar employees already have much more than the contents of Humans.txt linking back to details of their employment
- psychphysic 4y ago
  Yes but this is easily harvested. Ironically, by design this would make that far easier. You could probably work out my mother's maiden name from Facebook, but I wouldn't make a SecurityQuestions.txt file and chuck it on websites I make.
  - elcomet 4y ago
    Yes but social engineering doesn't really scale, does it? You need to craft each message manually and adapt it to each company. The name search might not be the most complex part
    - AstralStorm 4y ago
      You would be surprised what people (in receptions in particular) sometimes let slide when you know the name and where some person is employed.
      - elcomet 4y ago
        Yes but that's why I say it doesn't scale if you have to go there in person. So having an automated way of getting names is not particularly helpful. The hard and time-consuming part is going there in person or calling the company.
- bootsmann 4y ago
  LinkedIn actually has very strong safeguards in place on their API to prevent such automated crawling.
  - belter 4y ago
    Those "safeguards" are called Premium Business, Sales Navigator Core, Recruiter Lite and LinkedIn Learning ;-)
    - LinuxBender 4y ago
      And all of those are abused heavily by debt collectors, investigators and many others.
- belter 4y ago
  https://www.google.com/humans.txt https://www.google.com/humans.txt https://www.netflix.com/humans.txt https://www.netflix.com/humans.txt
gempir 4y ago
I agree. At my company we have a humans.txt that is not hosted in public and we only add first names to a list. So you kinda remember who was involved over the years. I think that is a nice touch and has no privacy issues.
diegof79 4y ago
Yes, the security implications of this information is the first thing that came to my mind while reading the site. At my current company, we received many phishing attempts trying to impersonate people from IT (including phone calls). LinkedIn, CrunchBase, Glassdoor, and others gives you much more data about a company’s employees. But, ironically, leaving a humans.txt file makes things easier for bots.
shit_game 4y ago
Absolutely. Something that many people may forget or not realize is just how much of the Internet's traffic consists of bots - benevolent, malevolent, or benign. If you've ever made a machine's IP public and logged the IPV4 traffic, it's harrowing and sobering. The results of publicly available information on the Internet is outright terrifying if you are unfortunate enough to register a domain without WHOIS privacy protections through your registrar. The entire IPV4 space is constantly probed by bots and zombies for common vulnerabilities and data mining opportunities, and providing a humans.txt would only be serving any included information to bad agents on a silver platter. robots.txt is already a voluntary "standard", meaning that any agent accessing it must volunteer to respect it - providing more information to automated agents would certainly follow the same unspoken rule. I think it's noble and fair for the people behind online content to wish to be recognized if they wish, but I would absolutely abstain from putting my name in any document like a humans.txt.
- funstuff007 4y ago
  Indeed, we have pages on our site that are north of 95% bot traffic. And they're not junk or honeypot pages. The humans on this page often represent hi value prospects we seek to convert. B2B2C service.

867-5309 4y ago

exactly, best example I've seen: https://abbey-decorators.co.uk/humans.txt https://abbey-decorators.co.uk/humans.txt

jsty 4y ago

Between the "About Us" / "Team" / ... company website pages and LinkedIn profiles, I'd wager a majority of white-collar employees already have much more than the contents of Humans.txt linking back to details of their employment

psychphysic 4y ago
Yes but this is easily harvested. Ironically, by design this would make that far easier. You could probably work out my mother's maiden name from Facebook, but I wouldn't make a SecurityQuestions.txt file and chuck it on websites I make.
- elcomet 4y ago
  Yes but social engineering doesn't really scale, does it? You need to craft each message manually and adapt it to each company. The name search might not be the most complex part
  - AstralStorm 4y ago
    You would be surprised what people (in receptions in particular) sometimes let slide when you know the name and where some person is employed.
    - elcomet 4y ago
      Yes but that's why I say it doesn't scale if you have to go there in person. So having an automated way of getting names is not particularly helpful. The hard and time-consuming part is going there in person or calling the company.
bootsmann 4y ago
LinkedIn actually has very strong safeguards in place on their API to prevent such automated crawling.
- belter 4y ago
  Those "safeguards" are called Premium Business, Sales Navigator Core, Recruiter Lite and LinkedIn Learning ;-)
  - LinuxBender 4y ago
    And all of those are abused heavily by debt collectors, investigators and many others.
belter 4y ago
https://www.google.com/humans.txt https://www.google.com/humans.txt https://www.netflix.com/humans.txt https://www.netflix.com/humans.txt

gempir 4y ago

I agree. At my company we have a humans.txt that is not hosted in public and we only add first names to a list. So you kinda remember who was involved over the years. I think that is a nice touch and has no privacy issues.

diegof79 4y ago

Yes, the security implications of this information is the first thing that came to my mind while reading the site. At my current company, we received many phishing attempts trying to impersonate people from IT (including phone calls). LinkedIn, CrunchBase, Glassdoor, and others gives you much more data about a company’s employees. But, ironically, leaving a humans.txt file makes things easier for bots.

shit_game 4y ago

Absolutely. Something that many people may forget or not realize is just how much of the Internet's traffic consists of bots - benevolent, malevolent, or benign. If you've ever made a machine's IP public and logged the IPV4 traffic, it's harrowing and sobering. The results of publicly available information on the Internet is outright terrifying if you are unfortunate enough to register a domain without WHOIS privacy protections through your registrar. The entire IPV4 space is constantly probed by bots and zombies for common vulnerabilities and data mining opportunities, and providing a humans.txt would only be serving any included information to bad agents on a silver platter. robots.txt is already a voluntary "standard", meaning that any agent accessing it must volunteer to respect it - providing more information to automated agents would certainly follow the same unspoken rule. I think it's noble and fair for the people behind online content to wish to be recognized if they wish, but I would absolutely abstain from putting my name in any document like a humans.txt.

funstuff007 4y ago
Indeed, we have pages on our site that are north of 95% bot traffic. And they're not junk or honeypot pages. The humans on this page often represent hi value prospects we seek to convert. B2B2C service.