I'm going to make a potentially bold claim here. This depends _heavily_ on what the threshold of "rarely" is, and whether we actually _love_ to make these processes.
In the case of people before process, as stated in the Agile Manifesto, the process is begat _from_ the people in many cases. That doesn't mean it shouldn't be questioned, but when the chimney sweeps that built the process are saying "I don't want to go back to things that are similar to the way that gave me mesothelioma", I don't think it's fair to write them off as the minority.
Every team I have been on that has been effective has had a few common traits:
- Teams stay relatively small so if problems are big then they divide and conquer with teams of teams so that they can:
- Bite off problems that they can fit in their heads which allows them to:
- Meet often not to just speak out loud with nobody really listening, but instead to actually coordinate and plan concrete steps that progresses the problem. And they can make daily adjustments not just because they are a small focused team but because they also:
- avoid backlogs, feature lists and similar documentation where possible since these things give them momentum in the direction they thought they were going when these products were created and not in the state the problem is in now.
Each of these things fight, well, math. Communication is a math problem. If everyone is talking to everyone about everything then you have a non-polynomial growth problem. Designing the big problem perfectly from the start is NP. Divide and conquer doesn't give you a perfect solution, but it gives you a really good one and it gives it to you in reasonable time. Splitting the task, and the team, and minimizing the communication, and accepting the loss in finding the perfect solution that triggers, is all needed for divide and conquer. We never accept that though so it turns back into an NP problem and something ends up dropping. Time, quality, capability or, unfortunately often, the whole thing fails. Similarly, if you put things on a backlog then prioritizing that backlog is again NP and that is especially bad if there is one massive team backlog from all sources. Backlogs become dead idea bins because it isn't possible to organize them efficiently so stop wasting time on them. If your team is properly sized they know what is needed now so they can make the next small step and they can optimally design and implement that step in their piece of the bigger problem. They will get done quickly and have a good product as opposed to getting done never because of the pursuit of the perfectly coordinated and communicated solution.
If you divide and conquer properly then the communication/process you use at each team's level becomes so obvious that every formalized system out there becomes silly. Let the team do whatever works for them. They are small and nimble and learn to talk to each other so no need to slam a process at them that makes them a machine.
Is this in opposition to what I said? I consider process that is [a) done by the folks in that team and b) revised on a regular basis] to be a form of healthy communication while being efficient.
Not every response has to be in opposition! I was clarifying more what I think is effective: divide and conquer, constrained communication (a requirement of divide and conquer), minimized process products, iterative development, etc, and that these general ideas are essentially all that is required, not a formal process. I was also, likely badly, trying to point out that if these basics are kept in mind the formal process artifacts and steps really aren't needed. Small, focused, iterative teams are so in sync that forcing them to speak a foreign language (a formalized process) is probably a hindrance.
As I write, I clarify my own ideas. If I'm being honest I'm probably writing this more for me to better understand what really has worked than as a response. I hope it generates a good response and makes me think and refine more and I hope it makes others do the same, but really, selfishly!, I am doing this for me I guess to help me focus on these things in the future.
So, with that I think this may be where I am really trying to go with this. Maybe we are missing the point with these things. Maybe we should hammer in these math concepts, NP growth, gradient descent (iterative development) and how to measure when teams and problems are breaking because of the math so that we can understand and address the root issue better. I have ever heard anyone explain that NP math concepts and gradient descent dominate the reasons why teams fail or succeed, but the evidence is everywhere. Push the why and how to spot it and less the prescriptive how? Maybe a more effective set of things the industry could be pushing are simpler checks: how big are your teams? How many problems are they thinking about at a time? How many levels of teams do you have compared to the size of the organization? Can each member of a team articulate that team's goal? Can they articulate what their team is currently, this minute, working on? Can the team above them articulate how the goals of the teams below them fit together to solve the problem they were given? Are teams talking when they shouldn't? (We so focus on teams not talking that we often miss that talking too much is kind of a bigger deal). That kind of thing. More management and organization and less process and product oriented.
Ok, if we're not being at all charitable with the language used by the hosts of the data, let's be equally uncharitable with OpenAI.
- If "OpenAI" means the company acting on behalf of the company, why were they even looking to do this?
- If "OpenAI" means they were acting as a proxy for bad actors, what actions do we take to handle that?
- If "OpenAI" means they were accidentally breaching this system, in what sense does that distinction even matter, in terms of the outcome? If I build a nuke by accident without eng. due diligence, am I legally liable?
Hell, we're really getting to the point where the damages that could be caused are like an arsonist in California on a 100F day with 100MPH winds. Who cares who's liable, they are going to burn half the damned state down and cause damage far in excess of their assets. If you don't want to suffer from it, you're going to have to find much better defense measures.
> If you don't want to suffer from it, you're going to have to find much better defense measures.
So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable?
ETA: There are absolutely burn bans in place in the scenario you're talking about, and common sense prevents those from lighting fires otherwise. In the absolute extreme case that someone _ACCIDENTALLY_ set a fire, without negligence, we have a due process system to handle that. When I see evidence of this for the massive amounts of capital flowing into these companies, I'll gladly eat my words.
> So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable?
There are literally hundreds of thousands of script kiddies poking around at servers all the time. Cloudflare stops 99.99% of them. You're still left with many entities from states to hobbists trying to crack your system after they've gotten past the CDN and captchas. If OpenAI got through, then somebody else could too. Somebody malicious even.
I appreciate when white hats inform companies, governments, and the public about their successful exploits. It helps keep the whole internet safer - even if just by waking up lax server admins.
> I appreciate when white hats inform companies, governments, and the public about their successful exploits.
Except it took 3 months for OpenAI to notice they did! OpenAI is not a white hat doing pentesting, but someone that is putting random materials on fire to see if they smell. Reckless, stupid, and criminal.
So what? OpenAI may be a problem, but the security of a government website rests on the administrators of that government website. Not on attackers playing nice.
> So if someone opens your unintentionally unlocked front door and steals your laptop, you don't care who's liable?
I'm not the person you're responding to, but...
If I hear my neighborhood has started to become targeted by people checking houses for unlocked doors and stealing stuff, I think an appropriate response for me is to ensure it is difficult or impossible for me to "inadvertently" leave my own doors unlocked so my stuff doesn't get stolen, and also to encourage or perhaps even enforce[1] my neighbors to ensure their doors are always locked to make this sort of theft impossible and remove the temptation for that sort of crime.
If you knew that there are 2 specific well known people in your neighborhood that are walking around trying to open doors and steal stuff - is your suggested solution for everyone to improve own security? I would say its far more economic to get the 2 people to stop or at the very least be more careful?
It's more like there are two locksmiths who try to open any door when someone pays them. Should we make them check if the person calling them is the home owner?
Yes, but it needs to be done the right way so legit customers don't get rejected, and you can't do things like make everyone mail them a photo of their ID because they could sell that to a thief or credit card scammer. Or someone could break into their office and take it. Or they sell it and pretend it was stolen.
And when you start talking about regulation the two locksmiths will say the best way to do it is ban lockpicking tools so they can keep them away from other less ethical people, or ban other locksmiths coming from the next town over.
If I found out this metaphor for neighborhood windows was actually a window into massive amounts of institutional data, then no, I don't want someone to talk me out of getting more security on my kitchen window.
Continuing with your metaphor - sure get more security - you likely can never eliminate a threat. But if the bad actors are reigned in at a systemic level, you can get away with a lock on your window instead of steel bars.
I'm of a view that in a society we are better off when we all can get away with lighter individual protections as otherwise, thos who cannot afford the necessary security end up suffering.
I clearly have committed the mortal sin of an imperfect analogy, which in this case may not even be relevant, as the article in question implies that the data wasn't left "unlocked."
But giving you the benefit of the doubt, what's the crime for actually breaking into a car that was left unlocked and taking things?
ETA: and furthermore, what crime is worse? And should it be?
He probably cares more about still having a laptop.
What are you getting at? Nobody’s saying that OpenAI aren’t or shouldn’t be liable for what their agents do. What I am implying above is that this is being blown out of proportion, especially since the article I’m seeing is about a politician saying things that he thinks will poll well with the anti-AI crowd.
Perhaps, yes, you could argue that "accessed" and "hacked" have a different intent.
However, Australia is showing itself to be one of the few countries to have a backbone against big tech. Still open to investment and setting policies towards new data centres, starting to debate copyright law reform, already implemented R16 social media bans.
"The AI agent encountered repeated blocks while seeking information from the government portal but found ways around them, ultimately gaining unauthorised access to other areas."
Your comment immediately gave more credence to OpenAI than him. I don't agree that's appropriate because OpenAI has a vested interest in that narrative and I attempted to challenge it in a way that doesn't default to OpenAI. The article in question is not from a publication I trust to be able to handle the technical details in a way that will resonate with their average audience.
> At a press conference in Sydney, Marles said the incident itself was “relatively minor” and that it appeared no personal health information had been accessed.
OK, the Chinese models have also hacked people. What exactly do you expect law enforcement to do.
While in the OAI case we can easily treat it as a law enforcement action. When Iran does it? What are you going to do start a war?
The forest in this analog is the internet. As you well know it is filled with threat actors that don't give two shits about your laws. You have been warned. It's your fault when you get burned and have exactly zero recourse.
In the OAI case where we can easily treat it as a law enforcement action, that's a far cry from "who cares who's liable." If the OAI case can be a law enforcement action, we're on the same page. The fact that sovereign nations don't land under our jurisdiction is not an argument against following up or restricting those that do. OAI is the only matter I'm commenting on.
Tying Sam to a post, calling him a witch, and burning some wood in the general vicinity for what OAI has pulled is a legitimate action.
The thing is this has zero effective power in stopping this ball that is all ready rolling. It's like the first time a buffer overflow was discovered and used illegally. If that person had been caught and been put in a meat grinder it has had zero effect on the exploits of future buffer overflows. A huge number of people mad at OAI (rightfully so, I want to be sure you understand that) think this will have any preventative effect for what is coming. It will not. A new era of risk is here. Worse if you just watched the the great orange idiot he's yelling full steam ahead, so expect very little to no action by the US government on this.
I simply find it completely absurd that instead of finding it great that these AI agents are finding security bugs for free, people are whining about banning the AI. What on earth is that even? What do they want then? Security by obscurity and pretending not to care about weaknesses?
I don't disagree with you - but I am curious as to the amount of power and effort that goes into something like this. I suspect that these hacks into systems are carried out by many agents, running on many MW of compute for a long time - how many actors have access to resources like that ?
In Australia we have some experience with this scenario (usually with higher temperatures) and some of the measures we have found effective are “total fire bans”, “jail the arsonists for extended periods of time”, and for negligent companies whose insufficient vigilance caused the fire specifically, “levy steep fines” and “find in favor of the plaintiff in class-action lawsuits for significant fractions of the company’s net worth”. Perhaps these measures could be of use here!
There using this framing to get the public used to the idea that LLMS can do all of this on there own without direct instruction. So criminals can hide there behavior behind agents.
If you dog bites the postman, you are liable, even if you didn't tell or encourage you dog to do it. You are responsible for your dog's actions.
You get to pay the postman's medical bills, you may get fined, and your dog may get put down - especially if this isn't the first time it's bitten someone.
OpenAI has "bitten the postman" many many times, and it's "owners" have boastewd about it and used it in their marketing.
How many more times should society allow this to happen before we say "enough" and hold Sam Altman and the board responsible and make them pay restitrution, and put it down?
If Albanese actually had a spine (as claimed elsewhere in this discussion), Sam and the board will be getting an invoice for all the time/expertise spend investigating this intrusion, and restitution for everybody who's
PII and PHI was exposed. (Although I suspect a good deal of responsibility for the data exposure rests with the people who designed and deployed the system that was breached. )
Yes, this is why all discussion about "safeguards" is maddening to me. They are simply committing crimes, and people should go to jail. I guarantee that OpenAI will stop worrying about "alignment" when people simply go to jail for hacking and theft.
Why the hell should we be charitable to companies who have no issue in looting everything in the public commons AND the pirate commons, for their exclusive benefit?
Or more pointed at OpenAI, "we're a nonprofit... LOL JUST KIDDING LOOT EVERYTHING!"
- I assume that politician is the one / main person in charge of doling out payments. Does that mean they share guilt/responsibility for the result?
> to write a boring procedural speech while he was doing something (hopefully more useful).
- Is procedure not his job as a politician?
- If not, what is his job / the more useful thing?
> One of them is guilty, the other one is responsible, the conséquence [sic] should be in proportion to the gravity.
- Which is which?
- Which has more gravity and why?
- What consequences are you envisioning, in both cases?
- If, as I suspect, the consequences are lesser (proportionally) for the politician himself, what if any deterrents can be put into place to stop that behavior? After all, he manages his staff, in theory.
Of course they share responsibility. Pay scraps for slop, expect slop.
The more useful job of a politician may be similar to how managers in general have a "more useful" part of their jobs then publishing status report.
"Gathering information, making decisions, nudging others." Lobbying for their constituency (at best) or the people who paid for his campaign (at worse).
Or, heavens forbid, writing legislation on a topic that he knows something about, as opposed to whatever crap he had to slop about.
As I said, responsibility has to be shared. I would want neither the staff to be considered the sole problems, nor the polician career to be permanently halted because of this. (I know he's going to look stupid on the internet, and we'll all have a good laugh, but maybe he's also working on some serious stuff, and real people are going to pay real consequences because of what is, in the grand scheme of things, a minor blunder.
I'm more concerned about students not caring to learn to read because of AI.
> [post 1] "One of them is guilty, the other one is responsible"
> [post 2] "Of course they share responsibility."
I'm not following.
We're also still disregarding the fact that none of us can even prove that it was one of his staff that did this and not him, but your OP is worded like it's a given it was staff.
> The more useful job of a politician may be similar to how managers in general have a "more useful" part of their jobs then publishing status report. "Gathering information, making decisions, nudging others." Lobbying for their constituency (at best) or the people who paid for his campaign (at worse).
> Or, heavens forbid, writing legislation on a topic that he knows something about, as opposed to whatever crap he had to slop about.
Not sure about you, but I often find my job will oftentimes not always include the things I have the most experience in, and I'm expected to be able to rise to the occasion because I was hired to do so.
> As I said, responsibility has to be shared.
You said that? Because I read "one of them is guilty, the other one is responsible." If you mean that responsibility is synonymous here, why the distinction?
--
Revisiting my original questions that have gone unanswered:
- Is procedure not his job as a politician?
Given that you appear to have instead answered "If not, what is his job / the more useful thing?", I'm assuming "No", to which I disagree. If your answer is that "yes, procedure is part of his job", then I assert he failed to do his job here, regardless of how boring you find that job to be personally.
If the guilty/responsible distinction still holds, I'm still unclear as to what applies to whom.
> [post 1] "One of them is guilty, the other one is responsible"
> [post 2] "Of course they share responsibility."
> As I said, responsibility has to be shared.
Fair enough. I should have written that they share _blame_. I meant to highlight the difference between doing the bad deed, and being in a position where you have to take public responsibility for the bad deed.
> We're also still disregarding the fact that none of us can even prove that it was one of his staff that did this and not him, but your OP is worded like it's a given it was staff.
I have obviously no proof, but I'm pretty confident this is what happened.
The other option is that this very old busy man took the time to write this boring speech himself, also has the proficiency to use an LLM to write the boring speech, and that it's just a coincidence that he seems to be discovering the boring speach for the first time as he reads it in a boring procedural session.
Who knows ? Maybe that's what happened.
I've known underpaid parliamentary assistants, and I've known very old busy men, and the scenario where the very old busy man leaves that speech-writing to his parliamentary assistants , and discovers the speech for the first time as he roboticatly utters it in a session where he expects no one to listen, seems _vastly_ more realistic to me.
> Not sure about you, but I often find my job will oftentimes not always include the things I have the most experience in, and I'm expected to be able to rise to the occasion because I was hired to do so.
I suspect your job does not come with money to hire a staff to handle the menial and procedural parts of the job.
MPs _do_ have a budget for that, and the expectation that some people way under they paygrade will work on this kind of stuff.
> - Is procedure not his job as a politician?
I suspect we disagree on that, but to me, considering this kind of boring procedural talk as "part of a politician job" is akin to considering that "producing x64 assembly code" is part of a C-programmer's job.
Of course I expect him to delegate this part. And if there is a bug in the compiler (or, more likely, if there is a bug in one of the libs he's using), then who is to blame / guilty / responsible ?
I'm going to make a potentially bold claim here. This depends _heavily_ on what the threshold of "rarely" is, and whether we actually _love_ to make these processes.
In the case of people before process, as stated in the Agile Manifesto, the process is begat _from_ the people in many cases. That doesn't mean it shouldn't be questioned, but when the chimney sweeps that built the process are saying "I don't want to go back to things that are similar to the way that gave me mesothelioma", I don't think it's fair to write them off as the minority.