Skip to content
Continued

Era 05 · 2016–2022

Cloud & Intelligence Era

A shift from grabbing users to running operations precisely with data and algorithms, while compliance tightened across the board

Start
In 2016, AlphaGo and the launch of Douyin, and the passage of the Cybersecurity Law; the traffic dividend peaked
End
2022-11-30, ChatGPT was released; from 2023 on, large models reshaped the industry

Background and drivers

  1. Hardware: GPUs became the mainstay of AI compute, and cloud vendors released dedicated AI chips (such as Google's TPU, announced in 2016); phones grew powerful enough to run models locally.
  2. Networks: 4G reached full coverage, and 5G licenses were issued in 2019; short video and live streaming became the bulk of traffic.
  3. Capital: early on, capital chased AI and short video; later (2021-2022), platform regulation tightened and the industry turned to "cutting costs and raising efficiency".
  4. Users: growth peaked, and user time became what every platform fought over; the 2020 pandemic moved work, education and government services online at scale (health codes, remote meetings).
  5. Policy: the Cybersecurity Law (in effect 2017), GDPR (2018), the Data Security Law and the Personal Information Protection Law (2021), and the algorithmic recommendation rules (2022) turned compliance from "optional" into "a precondition for launch".

Pain points

  1. User acquisition was expensive, so each user had to see more, stay longer and convert better.
  2. Once a monolithic app was split into hundreds of microservices, deploying, scaling and troubleshooting all became extremely complex.
  3. Every business line reinvented the wheel, and data was scattered across their separate systems ("data silos").
  4. Cloud systems run 24/7, and a single failure affects tens of millions of users, so staffing it by hand is unrealistic.
  5. With iOS, Android, Web and mini programs running in parallel, the same feature had to be built several times over.
  6. Large-scale data abuse and breaches (the 2016 Xu Yuyu case, the 2018 Facebook-Cambridge Analytica scandal) left users no longer trusting.
  7. Ransomware, IoT botnets and open-source component vulnerabilities broke out on a massive scale (2016 Mirai, 2017 WannaCry, 2021 Log4Shell).
  8. Deep learning models needed separately labeled data and separate training for every task, which was costly and generalized poorly.

New technology and practices

  1. Recommendation algorithms and deep learning (CTR prediction, short-video recommendation feeds) and A/B testing -> pain point 1: content "finds" the user, and user time became the core metric.
  2. Cloud native: Kubernetes, service mesh, serverless and observability (logs, metrics, distributed tracing) -> pain point 2.
  3. The middle-platform strategy, data warehouses/data lakes and unified data platforms -> pain point 3.
  4. SRE (site reliability engineering; Google published the SRE book in 2016), error budgets and chaos engineering -> pain point 4: managing reliability with an engineering approach.
  5. Cross-platform frameworks (mini programs in 2017, Flutter in 2018), design systems, component libraries and TypeScript -> pain point 5: one design and one set of components, reused across platforms.
  6. Privacy compliance engineering: data grading and classification, data minimization, privacy policies and consent dialogs, and personal information impact assessments; plus "usable but invisible" data techniques such as federated learning and differential privacy -> pain point 6. At the legal level, three data laws responded.
  7. Zero-trust architecture, software supply chain security (dependency scanning, SBOM), and MLPS 2.0 covering cloud computing, IoT and mobile internet -> pain point 7.
  8. Pretrained models: the Transformer (2017), BERT (2018) and GPT-3 (2020), together with scaling laws -> pain point 8: pretrain one general model on huge amounts of data, then adapt it to various tasks. This led directly into the next era.

Roles of this era

  • Ops → SRE & platform engineeringDevOps Engineer (coming soon)

    Setting SLOs, managing Kubernetes clusters, building monitoring and alerting, and running on-call and incident reviews. The ops role page at `/roles/devops/` marks the "Ops → SRE" evolution.

  • FrontendFrontend Engineer

    Engineering tooling (Webpack, TypeScript), "big frontend" (mini programs, cross-platform), the BFF layer, and the development of component libraries and design systems.

  • BackendBackend Engineer

    Microservices and cloud-native development, increasingly wired into data compliance requirements (masking, permissions, auditing).

  • ProductProduct Manager

    Data-driven product managers looking at funnels, running experiments and driving growth; the "strategy product manager" emerged.

  • DesignInteraction Designer

    Design systems, design tokens, co-building component libraries with engineering, and measuring experience.

  • SecuritySecurity Engineer

    Expanding from offense and defense into compliance. New data security and privacy compliance roles appeared (the DPO under GDPR, the person in charge of personal information protection domestically), working on zero trust and supply chain security.

Security & law thread

  • ChinaPassed 2016-11-07, in effect 2017-06-01: the Cybersecurity Law of the People's Republic of China, which established the basic framework for the security of network operations, the protection of critical information infrastructure, and personal information protection (original 2016 version (in Chinese)(opens in a new window); amended in 2025, with the current version shown in the Large Model Era).
  • ChinaReleased 2019-05-13, implemented 2019-12-01: the MLPS 2.0 series of national standards (such as GB/T 22239-2019).
  • ChinaPassed 2019-10-26, in effect 2019-12-01: the Cryptography Law of the People's Republic of China (original text (in Chinese)(opens in a new window)).
  • ChinaPassed 2021-06-10, in effect 2021-09-01: the Data Security Law of the People's Republic of China (original text (in Chinese)(opens in a new window)).
  • ChinaPassed 2021-08-20, in effect 2021-11-01: the Personal Information Protection Law of the People's Republic of China (original text (in Chinese)(opens in a new window)).
  • China2021-07-02: the Cybersecurity Review Office launched a cybersecurity review of "Didi Chuxing", making cross-border data transfer and data security a top compliance concern for companies.
  • ChinaIssued 2021-12-31, in effect 2022-03-01: the Provisions on the Administration of Algorithmic Recommendation of Internet Information Services (Order No. 9 of the Cyberspace Administration of China and three other departments) (original text (in Chinese)(opens in a new window)).
  • ChinaIssued 2022-07-07, in effect 2022-09-01: the Measures for the Security Assessment of Cross-Border Data Transfers (Order No. 11 of the Cyberspace Administration of China) (original text (in Chinese)(opens in a new window)). The Provisions on Promoting and Regulating Cross-Border Data Flows of 2024-03-22 adjusted the applicable circumstances; the original text was not amended.
  • Global2018-05-25: the EU's GDPR began to apply.
  • GlobalIn March 2018, the Facebook-Cambridge Analytica scandal came to light.
  • Security incidents2016-08, the Xu Yuyu case (telecom fraud using leaked personal information), which directly spurred the domestic crackdown on crimes involving personal information.
  • Security incidents2016-10-21: the Mirai botnet attacked Dyn.
  • Security incidents2017-05-12: WannaCry ransomware broke out worldwide, affecting many universities and gas stations in China.
  • Security incidents2018-01-03: the Spectre/Meltdown processor vulnerabilities were disclosed.
  • Security incidents2021-12: Log4Shell (CVE-2021-44228) was disclosed.

Key events

  1. AlphaGo beat Lee Sedol 4:1

    Sources: en.wikipedia.org(opens in a new window)

  2. The Xu Yuyu case (she died on August 21; in July 2017 the ringleader was sentenced to life imprisonment)

    Sources: spp.gov.cn(opens in a new window)

  3. Douyin launched

    Sources: zh.wikipedia.org(opens in a new window)

  4. The Cybersecurity Law was passed (in effect 2017-06-01)

    Sources: flk.npc.gov.cn(opens in a new window)

  5. WeChat mini programs launched

    Sources: zh.wikipedia.org(opens in a new window)

  6. The WannaCry ransomware outbreak

    Sources: en.wikipedia.org(opens in a new window)

  7. "Attention Is All You Need" was published, introducing the Transformer

    Sources: arxiv.org(opens in a new window)

  8. The State Council released the New Generation Artificial Intelligence Development Plan (Guo Fa [2017] No. 35, issued July 8)

    Sources: gov.cn(opens in a new window)

  9. The Spectre/Meltdown vulnerabilities were disclosed

    Sources: arxiv.org(opens in a new window)

  10. The EU's GDPR began to apply

    Sources: eur-lex.europa.eu(opens in a new window)

  11. MIIT issued commercial 5G licenses

    Sources: cac.gov.cn(opens in a new window)

  12. The MLPS 2.0 national standards took effect

    Sources: openstd.samr.gov.cn(opens in a new window)

  13. The GPT-3 paper was published

    Sources: arxiv.org(opens in a new window)

  14. The Data Security Law and the Personal Information Protection Law were passed

    Sources: flk.npc.gov.cn(opens in a new window) · flk.npc.gov.cn(opens in a new window)

  15. A cybersecurity review of "Didi Chuxing" was launched

    Sources: cac.gov.cn(opens in a new window)

  16. The Log4Shell vulnerability was disclosed

    Sources: en.wikipedia.org(opens in a new window)

  17. The Provisions on the Administration of Algorithmic Recommendation of Internet Information Services took effect

    Sources: cac.gov.cn(opens in a new window)

  18. OpenAI released ChatGPT

    Sources: openai.com(opens in a new window)

On to the next era

Every business had to train its own model, and algorithms served only recommendation and recognition; at the same time, pretraining plus scaling laws proved that "one large enough model can do many things". At the end of 2022, ChatGPT let ordinary people use natural language to call on that general capability directly for the first time, and the industry's question shifted from "how do we train a specialized model" to "how do we use large models reliably, cheaply and compliantly".