3 ms·

Did I understand it correctly that OpenAI internal repo is accessible via public Internet? I would expect any company with more than a few dozen developers wou

by fg137 14d ago

Did I understand it correctly that OpenAI internal repo is accessible via public Internet? I would expect any company with more than a few dozen developers would host their code on prem behind a VPN, let alone a company like OpenAI which has very valuable proprietary knowledge

saagarjha 14d ago
https://en.wikipedia.org/wiki/BeyondCorp https://en.wikipedia.org/wiki/BeyondCorp
thwarted 14d ago
> I would expect any company with more than a few dozen developers would host their code on prem (Ignoring what "on prem" means these days with so much being hosted and run on computers you don't own/physically control) Then you would be surprised. The threshold is probably multiple hundreds or thousands of developers, way more than "a few dozen". The lure of github purely because it's github is strong, and since Microsoft owns github now it falls under the "no one has been fired for choosing Microsoft" vendor selection logic.
- fg137 14d ago
  You can use GitHub Enterprise on prem. Gitlab also has multiple self host options.
  - thwarted 14d ago
    I used github as an example. It's not about what's available, it's about what's appropriate/expected to be used at any given scale and what those thresholds are. I question that there is anyone who says "well, we have 30 engineers now, it's time to start bringing things in-house and on-prem". I assert that the reasons/logic to do so are divorced from the size of the org (except where size of the org influences the dollar amount shown on an invoice, which can push it in either direction). But, even if the hosting of the code is locked down behind a VPN, the nature of it requires copying it somewhere else, perhaps to a laptop that gets lost/stolen. But that is an attack vector and risk that is not addressed by having the revision control only accessible via VPN (although it may provide access auditing capabilities to help mitigate/observe where copies of the code exist).

by fg137 14d ago

saagarjha 14d ago

https://en.wikipedia.org/wiki/BeyondCorp https://en.wikipedia.org/wiki/BeyondCorp

thwarted 14d ago

> I would expect any company with more than a few dozen developers would host their code on prem (Ignoring what "on prem" means these days with so much being hosted and run on computers you don't own/physically control) Then you would be surprised. The threshold is probably multiple hundreds or thousands of developers, way more than "a few dozen". The lure of github purely because it's github is strong, and since Microsoft owns github now it falls under the "no one has been fired for choosing Microsoft" vendor selection logic.

fg137 14d ago
You can use GitHub Enterprise on prem. Gitlab also has multiple self host options.
- thwarted 14d ago
  I used github as an example. It's not about what's available, it's about what's appropriate/expected to be used at any given scale and what those thresholds are. I question that there is anyone who says "well, we have 30 engineers now, it's time to start bringing things in-house and on-prem". I assert that the reasons/logic to do so are divorced from the size of the org (except where size of the org influences the dollar amount shown on an invoice, which can push it in either direction). But, even if the hosting of the code is locked down behind a VPN, the nature of it requires copying it somewhere else, perhaps to a laptop that gets lost/stolen. But that is an attack vector and risk that is not addressed by having the revision control only accessible via VPN (although it may provide access auditing capabilities to help mitigate/observe where copies of the code exist).