[flagged]
Mercor says it was hit by cyberattack tied to compromise LiteLLM
11–20 of 62 posts
Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM
#12Earlier quoted context omitted.
Docker is not a strong security boundary and shouldn't be used to sandbox like this https://cloud.google.com/blog/products/gcp/exploring-contain...
Compared to what? Which one is superior? Running npm on your dev machine? Or running npm inside Docker? I would always prefer the latter but would love to know what your approach to security is that's better than running npm inside Docker.
Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM
#13Earlier quoted context omitted.
Docker is not a strong security boundary and shouldn't be used to sandbox like this https://cloud.google.com/blog/products/gcp/exploring-contain...
Compared to what? Which one is superior? Running npm on your dev machine? Or running npm inside Docker? I would always prefer the latter but would love to know what your approach to security is that's better than running npm inside Docker.
By all means, run your npm in docker, but please stop telling others it's a secure way to do so.
Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM
#14[flagged]
Docker is not a strong security boundary and shouldn't be used to sandbox like this https://cloud.google.com/blog/products/gcp/exploring-contain...
Confusingly, Docker now has a product called "Docker Sandboxes" [1] which claims to use "microVMs" for sandboxing (separate VM per "agent"), so it's unclear to me if those rely on the same trust boundaries that traditional docker containers do (namespaces, seccomp, capabilities, etc), or if they expect the VM to be the trust boundary.
Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM
#15[dead]
Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM
#16This is a good reminder that any tool handling sensitive data — even internal ones — needs to be transparent about where data goes. The assumption that SaaS tools protect your data is getting harder to defend.
I use llms to read the privacy policies that are too long to read. They guarantee almost nothing, unless you go out of your way to get an sla
Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM
#17Earlier quoted context omitted.
Compared to what? Which one is superior? Running npm on your dev machine? Or running npm inside Docker? I would always prefer the latter but would love to know what your approach to security is that's better than running npm inside Docker.
Read this: https://kayssel.substack.com/p/docker-escape-breaking-out-of...
So the worst case is that you are back to running npm on your host. Right?
Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM
#18Earlier quoted context omitted.
Compared to what? Which one is superior? Running npm on your dev machine? Or running npm inside Docker? I would always prefer the latter but would love to know what your approach to security is that's better than running npm inside Docker.
By all means, run your npm in docker, but please stop telling others it's a secure way to do so.
I only said it is a defense-in-depth measure.
I definitely want to know how is it worse than running npm directly on the host
Re: Mercor says it was hit by cyberattack tied to compromise LiteLLM
#19Earlier quoted context omitted.
By all means, run your npm in docker, but please stop telling others it's a secure way to do so.
I only said it is a defense-in-depth measure. I definitely want to know how is it worse than running npm directly on the host
Those aren't the only options, my dude.