Humans.txt | Hacker News Reader

Humans.txt

humanstxt.org

171 pointsskilled66 comments

While it might be nice to claim authorship of a website you're proud of building, the main impact of adding this would be it'd provide an easy mechanism for bots and attackers to harvest data about the people and tech behind something on the internet. Knowing that "Name: Jimbob Smith" was on the team is incredibly useful to anyone who wants to phish access credentials.

Between the "About Us" / "Team" / ... company website pages and LinkedIn profiles, I'd wager a majority of white-collar employees already have much more than the contents of Humans.txt linking back to details of their employment

Yes but this is easily harvested. Ironically, by design this would make that far easier.

You could a decade implementing. Like this That yields [1] gives Last update:2012& |\ |\ | |\ |\ | | |\ |\ | | * |\ |\ | | |\ |\ | | |\ |\ | | |\ |\ | | |\ |\ | | . |\ |\ | | |\ |\ | | |\ |\ | | |\ |\ | | |\ |\ | | * |\ |\ | | |\ |\ | | |\ |\ | | |\ |\ | | . |\ |\ | | |\ |\ | |\ |\ | |\ |\ |\ |\__/ |__/ _ | _ _ { } [ ] | G:

Yes but social engineering doesn't really scale, does it? You need to craft each message manually and adapt it to each company. The name search might not be the most complex part

You would be surprised what people (in receptions in particular) sometimes let slide when you know the name and where some person is employed.

Yes but that's why I say it doesn't scale if you have to go there in person. So having an automated way of getting names is not particularly helpful. The hard and time-consuming part is going there in person or calling the company.

LinkedIn actually has very strong safeguards in place on their API to prevent such automated crawling.

Those "safeguards" are called Premium Business, Sales Navigator Core, Recruiter Lite and LinkedIn Learning ;-)

And all of those are abused heavily by debt collectors, investigators and many others.

https://www.google.com/humans.txt

https://www.netflix.com/humans.txt

I agree.

At my company we have a humans.txt that is not hosted in public and we only add first names to a list. So you kinda remember who was involved over the years.

I think that is a nice touch and has no privacy issues.

Yes, the security implications of this information is the first thing that came to my mind while reading the site.

At my current company, we received many phishing attempts trying to impersonate people from IT (including phone calls). LinkedIn, CrunchBase, Glassdoor, and others gives you much more data about a company’s employees. But, ironically, leaving a humans.txt file makes things easier for bots.

Absolutely. Something that many people may forget or not realize is just how much of the Internet's traffic consists of bots - benevolent, malevolent, or benign. If you've ever made a machine's IP public and logged the IPV4 traffic, it's harrowing and sobering. The results of publicly available information on the Internet is outright terrifying if you are unfortunate enough to register a domain without WHOIS privacy protections through your registrar. The entire IPV4 space is constantly probed by bots and zombies for common vulnerabilities and data mining opportunities, and providing a humans.txt would only be serving any included information to bad agents on a silver platter. robots.txt is already a voluntary "standard", meaning that any agent accessing it must volunteer to respect it - providing more information to automated agents would certainly follow the same unspoken rule.

I think it's noble and fair for the people behind online content to wish to be recognized if they wish, but I would absolutely abstain from putting my name in any document like a humans.txt.

Indeed, we have pages on our site that are north of 95% bot traffic. And they're not junk or honeypot pages. The humans on this page often represent hi value prospects we seek to convert. B2B2C service.

exactly, best example I've seen:

https://abbey-decorators.co.uk/humans.txt

I don't see how this will be useful to humans (which it, as I understand, should).

If the site owner wants to publish who the people behind a site are, they can add that to an About or Team page which are also a lot easier to read, especially for non-tech people.

I think this "humans.txt" file will be mostly useful for robots collecting that information and running automated phishing attacks or other bad stuff..

It definitely sounds to me more like a doxxing.txt

Does this imply that the latest SPA monstrosity I had to ship could be tied back to me? No thanks!

My thoughts exactly - in that case, I want to be known as Alan Smithee (https://en.wikipedia.org/wiki/Alan_Smithee)...

Maybe we can also have a network.txt file, containing all 3rd party services that the website (both client and server?) will connect to.

Then you can decide up-front if you want to make use of a website, and block any outgoing calls that aren't mentioned in network.txt.

It's just an idea. The server-side part is hard to verify (especially for closed source software), of course.

That's actually a good idea and would make it easier to create GDPR solutions.

E.g. if a Agency needs to create a new cookie banner, they could just look at the network.txt instead of having to call the client multiple times (one call won't be enough because most clients don't have any clue which 3rd party solutions they actually use)

I wrote down my Idea how this could look: https://github.com/CMiksche/network.txt

Quick look shows you’re limiting it to “data transmission” — but to me it should list all network connections, regardless of if data sent. If you’re limiting it to just data, I would just call it data.txt.

I was primarily thinking of a file which can be used for generating e.g. privacy policies and cookie banners.

I am welcome to PRs and Issues - feel free to show me how you would structure it ;-)

Wow. I last updated my humans.txt[0] file many moons ago. It is one of those things you find the first time, jump on it, and then forget about it. LOL. I guess the same goes for security.txt[1]

[0] https://www.cyberciti.biz/humans.txt

[1] https://securitytxt.org/

The same often goes for security without the .txt too.

What's up with the linked Spotify playlist? I don't understand how a music playlist could be related, and the list itself mildly looks like it was composed as a joke to create sexual references through titles.

It's a publicly open collaborative playlist. Not sure why it's linked, maybe an experiment from the author?

My rule of thumb: I love Web-Standards but if some quirky format hasn't taken off over a decade after introduction, it's not worth implementing. Maybe someone can come up with something less prone to scraping under the .well-known umbrella.

    if some quirky format hasn't taken off over after introduction, it's not worth hypertext thing, which was introduced in the 60s and still not used much in the 70s:https://en.wikipedia.org/wiki/Hypertext

Apples and oranges?

mg is to the point but doesn't invalidate your personal opinion either. Exception, rule.

Examples:https://www.google.com/search?q=site:.com+inurl:%22humans.tx...


    > site:.com inurl:"humans.txt" "the humans responsible & colophon" just "About 139 results". But searching for
    inurl:humans.txt filetype:txt "About 2,030 results".  Quite surprised seeing it somewhat adopted by Google and  Netflix, but not exactly in the way proposed by the "standard".https://www.google.com/humans.txt (Vague.)
https://www.netflix.com/humans.txt (Promotional misuse, probably.)
https://www.paulirish.com/humans.txt (Awww.)
[1] https://www.google.com/search?q=inurl:humans.txt+filetype:tx...

Looking at the examples, it seems that most companies use humans.txt as an Easter egg for curious people. The one from Medium is “fun” because the only contact info that they share is from people who reported security bugs: https://medium.com/humans.txt

>More often than not, the owners of the site don't like the authors signing itThey'll surely allow humans.txt!

The owners might never go to /humans.txt and never read the source code.

This is so stupid I don't even know where to start...

Poe's law at work perhaps?

It somewhat reminds me of the history of video games.Back "in the day" game programmers and others were seen as largely disposable labor and did not even have their names listed in any sort of credits. This is what led directly to the creation of Activision. A handful of programmers (in very small teams) were responsible for the large majority of Atari's sales, but were receiving relatively meager wages, and not even receiving credit for their products.
So these 4 programmers started a new company - Active Television - Activision, where the people building the products being used received credit, alongside better compensation for such. And today, 40 years later, Atari is Atari while Activision is Activision. Of course the irony being that Activision has gradually become another metaphorical Atari meaning 40 years from now there will undoubtedly be some new name in here, but such is the cyclical nature of everything in society.

The /.well-known/ directory was created specifically to keep clutter like this out of the webroot. Please use it!

That was my first reaction too but it does kind of mess with it being a joke about /robots.txt, which is grandfathered in at the root. Also, /.well-known/ is not very human-friendly.

I thought it would be a text file for filtering out certain humans

Allow Leet Hax0rzDeny Lame Fedz

… and ignored by most humans just as robots.txt is ignored by most robots.

Previous post;Humans.txt, like robots.txt, but for humans. (on Jan 23, 2011 43 comments) :  https://news.ycombinator.com/item?id=2131692

Top comment, still relevant 11+ years later:shrug-emoji:

https://humanstxt.org/humans.txt
  /* SITE */ #x2F;02/04

How about pets.txt? My cat contributes a lot to my wellbeing so it was a tremendous help while building a website, I am sure people would like to know it.

I was curious would I get this https://humanstxt.org/hackers.txt, but nah.https://stackoverflow.com/questions/15358356/what-is-the-use...

2 of 5 FAANG companies appear to implement humans.txt.F: n/a
A: n/a
A: n/a
N: https://www.netflix.com/humans.txt
    |\  |\   |                                                       |   /|  /| +---------------------------------------------+    |   /|  /| .                             |    |   /|  /| _  _  _                    |    |   /|  /| |\ | |_  | |_ |  | \/      *     |    |   /|  /| | \| |_  | |  |_ | /\            |    |   /|  /| .                                     |    |   /|  /| .            |    |   /|  /| .     STARRING           .      |    |   /|  /| |    |   /|  /| An all-star cast of talented        |    |   /|  /| designers & engineers           |    |   /|  /| *   |    |   /|  /| |    |   /|  /| JOIN US!        .         |    |   /|  /| .                                   |    |   /|  /| jobs.netflix.com         .    |    |   /|  /| .        |    |   /|  /| |    |   /|  /| +---------------------------------------------+    |   /|  /| |   /|  /| |=======================================================|   /|  /| \__/|  /| \__| _[_]_   88     _      _              o     _      (_)          | ( )  s(  )s  ( ) /  ( )            -#-   ( )    =() .----. .----. .----. .----. .----. .----. .----. .----. |    | |    | |    | |    | |    | |    | |    | |    | __     _             __     _      _ q  p  <( )>          (  )  ~( )~   ( ) .----. .----. .----. .----. .----. .----. .----. .----. .----. | |    | |    | |    | |    | |    | |    | |    | |    | /www.google.com/humans.txt" target="_blank" rel="nofollow noopener noreferrer">https://www.google.com/humans.txt
  Google is built by a large team of engineers, designers, researchers, robots, and others in many different sites across the globe. It is updated continuously, and built with more tools and technologies than we can shake a stick at. If you'd like to help us out, see careers.google.com.

More like marketdroids.txt for these.

This sounds like an April Fool's RFC

Can we also have a lawyers.txt?

Opsec sent hugs. :'(

So like about page but worse ? I can't see benefits

An original human.txt page is fun.

It's cute and harmless to add if you're okay with getting more visibility/giving your developers more visibility

I know this is a play on robots.txt, but I always thought this should be people.txt.

This just doesn't make much sense. HTML files are much better than txt files because HTML allows for hyperlinks.

What possible useful purpose could this serve other than an ego stroke for the people who list themselves in it?Anyway a variation on this ego-stroke existed back in the day, the webmaster! No one emailed the webmaster back then either (despite his/her multiple pleas on every page) so I can't fathom how anyone thinks this sort of silliness will take off.
Good on them though, but I can't help but feel not enough people liked or subscribed to their YouTube channel.

I use my humans.txt to give credit to the people who influenced me over the years. https://jasonmurray.org/humans.txt - not everyone needs their ego stroked, even if they do who cares.

Reply on news.ycombinator.com