OpenAI L7 engineer says firm can't build IP-whitelisted egress VLAN, experts say IP allow-lists are obsolete
arthurcolle · x · 2026-09-27
- The quoted post: someone asked an L7 engineer at OpenAI whether they could build an isolated VLAN with strict outbound 443 and an IP whitelist; the answer was they can't and don't know how.
- The retweeted take by cramforce: with large chunks of the internet running behind a small number of IPs, IP allow-lists are largely useless — at best they work for destination IPs you own and that are single-use.
- Safer alternatives: SNI-based allow-listing, and if domain fronting is a concern, the only secure route is MITM-ing TLS while enforcing a Host header allow-list — stricter rules you should enforce anyway.
- Relevant to sandboxing agent egress traffic; highlights a gap between expectations and big-company internal network isolation.
Related event: OpenAI L7 engineer reportedly unable to set up isolated VLAN(2 posts)→
More from coding & agent
- Dev: We'll soon forget how bad hand-written code used to be — facontidavide · 2026-09-27
- A Classical Operating Manual for Spotting Bad-Faith Arguments in Public Forums — Promptmethus · 2026-09-27
- CS grad spent 3 days writing a parser that Claude could build in 20 seconds — deepakns · 2026-09-27
- Creator spends $3,000 remaking 301 viral video effects with Claude Opus 5.5, open-sources all prompts — yihui_indie · 2026-09-27
- 282 viral Claude Opus 5.5 videos with exact prompts open-sourced on GitHub — yihui_indie · 2026-09-27
- Who is building an agent-first programming language optimized for correctness, not humans? — burny_tech · 2026-09-27