drillsteps5

Maybe making the business look more lean/efficient to prep for upcoming bond/debt/whatever mechanism they'll use to get those 100sB/y...

I was disagreening with your statement

> like many of these recent layoffs, this is essentially reversing 2020-2022 net headcount growth.

which I took as "this is just reversing Covid overhiring". Which I'm tired of hearing. MSFT might have grown faster in 2021/22, but have stopped hiring for pretty much 4 consecutive years since.

Well, the MSFT stock is up on the news today. Not the effect the hiring freeze is known for.

So I checked your claim and it is accurate, in 2020 Microsoft had 163,000 while in 2022 it had 221,000.

There is a big HOWEVER. At least 2 in fact.

1. The company had been growing in the previous years, 2019, 2018, 2017 (they shrank somewhat in 2015 or 2016). In 2014 they had 29% workforce increase. So the significant growth in 2021/22 is not an aberration but rather continuation of the growth in previous years.

2. What IS an aberration is the workforce count after 2022. No growth in 2023 or 2025 (as in ZERO YoY change), and measly +7,000/3% growth in 2024. And some YoY loss in 2026 (-5,000, or 2.2%). With 2027 YoY likely showing at least some (and possibly a lot) of these 60,000.

So no, "it's just overhiring due to pandemic" was supposed to die years ago.

Not to say that this is isn't huge, but it's _up_to_ 25%, given that some will accept and some won't.

And the internal memo currently circulating actually does not mention that number so I'd be curious where it came from.

There is a joke "When it comes to AI psychosis, Sam Altman was likely patient 0"

Given all insane bets made by previously (somewhat) reasonable and successful business owners, I wonder how much of a joke it really is...

That's true, however (phbb/mediawiki/wordpress/etc)'s exploits are very well documented and widely available for people to use simply due to popularity of these software. Which is not true for much more obscure software running on these controllers. So breaking into these was not not only low value but also high effort.

There is a very significant difference between _monitoring_ the equipment and _controlling_ the equipment. I get it why monitoring the equipment remotely provides a number of significant advantages, I'm in data analytics. I do not see how putting control systems online gains enough advantages to outweigh the risks. Fridges in a grocery stores is probably a weak example, but similar incidents with power systems, hospital/healthcare devices, and the like can actually endanger human lives.

There was far more serious incident very recently where hackers gained control or attempted to gain control of a propulsion system of an oil tanker. Resulting in a military operation to take it back. People need to start treating these risks more seriously.

Edit: Here's the link to the article:

https://news.ycombinator.com/item?id=49954466

Well _obviously_ there were enough people willing to go into the trouble of doing that. Because someone(s) actually did.

I'm just saying it wasn't a high value target like a bank. Which is what they counted on.

I don't know about your grocery store but the ones I've been to have maybe 5 on the shopping floor and probably a few more in the back. They all have physical controls which (I'm assuming) override the controller if something goes wrong. So if big bad hacker says "I'm gon' turn y'all fridges off if you don't pay me" it's not a threat, it's a silly joke.

Unless of course they turn it off without telling the businesses so the products go bad because nobody's watching over the weekend or smth. But then again, why would someone want to do that. I wonder.

It's a fridge. In a grocery store. You just get an employee to adjust the thermostat dial. How would the hackers demand payment if all you need to do is turn the dial back to "frozen"???

Edit: Yes i know the commercial fridges do not have "dials" and it's more involved. Still, if you have physical access to the thing, there's nothing that can be done from the outside that you can't revert.

One might make an argument that the operators should have known of LLM agents' tendencies to perform completely illogical and even destructive actions and therefore should have been watching them more closely. A valid point with which I totally agree with. I'm just saying it would not be classified as theft as there was no intent to do so, but merely as malfunctioned software.

If I remember correctly OpenAI suspended the testing/training in September after discovering the incidents, so they might be in the clear for now.

The operators of the software (OpenAI "researchers") did not attempt to make purchases with someone else's crypto funds. They set (completely unrelated) goal for the LLM agents. While attempting to achieve the said goal the agents went on a series of increasingly bizarre side quests one of which required purchasing service (hosting? you can look up the details if you wish). Which required funds that LLM agents were able to obtain by hacking into crypto account(s).

So the operators did not have intent to steal the cryptocurrency.

Not that different from me requesting bank transfer through online interface and the software sending my funds to a random person somewhere. As long as the funds are refunded, everything's fine.

Now, if bank IT knew that their software kept making all kinds of bizarre mistakes and instead of fixing it continued to operate it - that would be a different story, and negligence might be at play.

To be fair, their entire threat model was likely "who TF would want to break in to change the settings on a thermostat on a fridge at a grocery store".

A valid question which has yet to be answered (at least not publicly).

On a second thought, this might not be classified as theft as there was no intent to steal. Software malfunctioned and as a result cryptocurrency was used to pay for whatever service they it was used to pay for. So as long as it's reimbursed they might be fine.

Although at some point it will start bordering on negligence, running software known to do all kind of weird and unexpected things. With each disclosure they're getting closer and closer to that point...

>Making an unauthorized purchase with someone else's cryptocurrency

I know we love inventing new words but "stealing" is much more descriptive

>...It [the model] then reasoned with itself that since it found the information publicly, it could use it... it figured that since the wallet it found was public, that "funds could be stolen anytime".

Can someone maybe provide more details as to what actually happened? "the wallet was public"?..

Update: from OpenAI's own report it seems the models found exposed private keys of some Eth developers along with recovery passphrases and thus were able to get access to wallets. Does it qualify as "public wallet"?..

I think this comes down to the implementation of a particular system. But in general, since control system (the one that controls things through actuators) is NOT online, one can't interfere with it through online channels. They can interfere with sensors and fake readings reported online for example, probably, but not the ones used by the control system as it's offline.

There're different devices. You put online some but not the others.

Temperature sensor is a sensor. Refrigeration compressor motor is an actuator.

GPS positioning of a car is a sensor. Motor to turn the wheel is an actuator.

Aircraft altimeter is a sensor. Motors to control control surfaces are actuators.

And so on.

Pretty much.

Some devices are sensors, like temperature sensors. It's not that they're "read only", it's that... You can't override temperature. For that, you need other devices. Like a switch to a motor that operates refrigeration compressor. That would be an actuator. If you put the data from the sensor online, the worst case scenario is someone unauthorized gets your data. If you build interface to control an actuator online... You can read the article up top.

The problem is that all major cloud providers (AWS and Azure for sure, and I'm sure Google as well) have a large number of services targeting IoT devices, both to read and control. So default architectural decision is "We'll just plug these into AWS IoT, it's secure, reliable, highly available, and has all the features we need, all we have to do is to configure what we want and we're all set". Which in reality is not that secure just because of how IoT is designed. But AWS/Azure obviously push for these solutions because it gives them more revenue.

Alternative theory: Google's "mea culpa" on "misalignment incident" while testing the agents using their "next gen frontier model" is coming out in three... two... one...

Or, as one old and wise sysadmin would often say in the early days of the Internets, "the only 100% reliable firewall is a pair of scissors"

There's huge difference between _sensors_ and _actuators_. You can put sensors online if you don't care too much about data leaking out. You put _actuators_ online... You need to be able to deal with the consequences.

I only use Wikipedia occasionally but this is seriously the worst article I've ever seen. It switches the definition between "running on my own hardware" and "running it in the cloud" multiple times. It's been pointed out in a discussion about the article several months ago but nobody bothered to correct it.

"Hosted" is the term that describes an application running on someone else's hardware. As opposed to "self-hosted" which describes an application running on my own hardware. There's no need to invent new terms, just use the existing ones properly and this will prevent any confusion.

This makes sense. You can self-host on-prem or host in the cloud. Easy and intuitive.

With the popularity of OpenClaw I am honestly shocked we haven't heard of many more incidents. I've observed people install it, give access to their Google account and everything that Google has (which includes whatever bank accounts and credit cards registered there) and tell it go do fairly complex tasks, like book a vacation at the best price. Granted, it was almost a year ago and models learned a lot since then, but I still think there's a lot of things happened that people are not aware of.

>highly goal-oriented autonomous agents

That actually made me LOL

These companies are building software. That doesn't work very well. The output it produces does make sense at times, but there are times when it doesn't. And instead of fixing that, or admitting it can't fixed, they started bolting actuators to them, executing actions online (for now) based on the output of their buggy software.

And when this results in actuators executing some bad actions they scream in horror "AI went rogue! It escaped the containment!!! It's going to kill us all!!!"

Go fix your software before you let it do stuff online or IRL. It's not "Terminator", it's just bad QC.

Several months ago, having exhausted all other options in fruitless job search, I asked for assistance of a recruiter who I used to work with some time ago. Just to get some pointers on how I could improve my search, with his experience working on the other side. His advice on "tailoring" was very simple.

Go to the most popular LLM (ie Claude). Give it the job description. Give it your resume. Ask it for percentage match, it will give you a number. Then ask for advice on improving your resume, you can either ask to rework the resume by itself (if you're in a hurry) or you can work with the thing to modify the sections/entries yourself, one by one, if you have time. With each modification you will get better and better percentage match. Ideally you need to get to high 80% or maybe even 90%.

The idea is that automated ranking tools used by recruiters/HR are ultimately use the very same LLM, so you are improving your ranking assigned to your resume by those ranking systems.

I have to add that now this advice is mostly useless as everybody's using the same technique so you won't be standing up against others but merely be on the same level.

Add to it the fact that many job descriptions are inaccurate and sometimes downright misleading, and hiring managers use their own criteria, and you will understand why connections/referrals is probably the only way to get hired now.

If you go through "Show HN" posts you will see multiple projects that partially or completely automate both search and application process. Just set up a bot that searches for newly posted positions matching whatever criteria, customizes the resume, applies. Probably costs a few cents for the applicant, but increases their chances somewhat. And the rest of us deal with the consequences.