3 ms·
If you really wanted to sandbox a machine you’d offline cache the packages and not give it any physical route to the internet, not via a jump box, not via a pro
by doawoo 2mo ago
If you really wanted to sandbox a machine you’d offline cache the packages and not give it any physical route to the internet, not via a jump box, not via a proxy, nothing.
This was poorly executed.
- anon7000 2mo agoI don’t really know how these training runs operate in reality. But I assume it’s using a lot of raw GPU power directly. It’s hard for me to visualize how exactly you’d go about completely cutting off these datacenter and cloud resources from the internet without actually going there, unplugging the WAN connection, and physically typing out what you need to happen on the cluster. It seems like whatever virtualized sandboxes they have are not enough. But it’s equally hard to imagine their SWEs jumping on a plane to a data center to do this work locally
- queenkjuul 2mo agoThey literally gave it a proxy to the internet (artifactory). The only thing between the model and the internet was Artifactory. You can take far greater measures to lock down external traffic than just that. An offline package cache (aka artifactory WITHOUT its own internet access) likely would have precluded this whole thing.
- doawoo 2mo agoThis is a company with insane amounts of money, they can afford to fly techs wherever they need to for as long as they need to be there. Air gapped environments are nothing new and they're standard practice for sensitive applications.