Hacker News Reader

Monitoring that didn't take days to notice unauthorized external traffic would probably be a good start

I see.

I had the impression that "days" is already good as these things go, "months" being more common.

Months to recognize traffic escaping a sandbox you set up yourself?

No, unauthorised traffic across a firewall in general.

This involved some lateral movement, ie. traffic didn't just cross the intended sandbox border. Is that kind of thing simpler to detect than an intrusion?

The lateral movement was outside OAI's network. The security sandbox should have had an offline package cache and a strict internet whitelist. Detecting unauthorized traffic seems like one of the highest priorities of designing a security sandbox.

Reply on news.ycombinator.com