devopsy.kinsta.cloud

Author: Bill Doerrfeld

  • Majority of Organizations Report Benefits From Low-Code Platforms

    Majority of Organizations Report Benefits From Low-Code Platforms

    Some IT departments are feeling the strain amid recent economic downturns. 2023 has already seen a disproportionately high degree of layoffs in the tech sector. As a result, there aren’t always enough software developers available to meet the demand. This has led some organizations to turn to new ways to upkeep morale and reduce burnout, retain productivity and do more with less.

    Low-code development is one solution that could help tackle rising application backlogs. Low-code/no-code platforms use reusable components to help engineers (and citizen developers) construct functional applications and internal workflows. Many teams report they are using low-code to rapidly deliver new features. A recent study from Microsoft found that 89% of CIOs and IT pros said low-code is effective in increasing efficiency.

    Microsoft Power Platform recently sponsored a study that surveyed 2,000 IT CIOs and IT professionals on their use of low-code platforms. According to the report, users benefitted from these platforms by modernizing legacy IT, improving efficiency and reducing costs, among other areas. Below, I’ll review some key takeaways from the Microsoft study and compare them with other perspectives.

    The Benefits of Low-Code Development

    The report showcased a slew of benefits from the use of low-code platforms. One is modernizing legacy applications—87% of CIOs and IT pros said low-code is very useful in helping their organizations modernize legacy applications. Solving the technical debt issue is top-of-mind, since 69% of IT leaders identified technical debt as a threat to innovation. Another key benefit is efficiency. The study found that developer efficiency with these platforms significantly increases over time, averaging 62% over three years.

    Low-code platforms are also a prime area to insert artificial intelligence and more automation into the software development process. Microsoft, which recently announced it was integrating ChatGPT into its Power Platform, reported that 87% of CIOs and IT pros said increased AI and automation embedded into low-code platforms would help them better use the full set of capabilities.

    Finally, a significant benefit is cost reduction. A full 87% of those surveyed said low-code is effective in helping reduce costs. These solutions could accelerate the completion of the software backlog, increasing efficiency and lowering the resources required to deliver. This comes at a time when cost optimization is critical to avoid rising cloud fees.

    How Are Companies Working With Low-Code?

    So, how are development teams actually working with these platforms? One common use case is improving data processes by streamlining integrations and having a centralized repository. In fact, 86% of CIOs and IT pros said low-code helped their organizations generate more accurate insights from their data. These data-driven insights have been used to help better serve customers and internal stakeholders.

    For example, ÖBB, an Austrian rail operator, leveraged a low-code platform to synchronize data and automate customer service inquiries with virtual agents. Other case studies report using Microsoft Power Platform for migration from legacy systems and reduced document processing lead time.

    Looking outside of the Microsoft report, however, not everyone is fully on board the low-code bandwagon. For example, the CEO of StackOverflow has expressed reservations because low-code platforms ultimately have a ceiling. With low-code, there’s a limit on customization, making it a less-than-ideal fit for experienced developers or technology-specific companies. Organizations must also mitigate the potential security repercussions of allowing business users to create applications, requiring new governance and policies. Low-code platform users may also fall victim to vendor lock-in and uneasy data retrieval—underscoring the need for open platforms with programmatic access.

    The Advantages of Low-Code Platforms

    Low-code solutions are a viable option to help clear items from the IT backlog, automate tedious processes and free up engineers to focus on more pressing matters. Some low-code/no-code tools also help democratize application development to those with different skill sets, thus bringing in new users to the development arena. And interest in low-code continues to pick up—Markets and Markets forecast a compound annual growth rate (CAGR) in the low-code development industry platform market of 28.1% to reach $45.5 billion by 2025.

    Naturally, the findings and case studies in this particular report are a bit skewed toward the benefits of using the Microsoft Power Platform. Nonetheless, it serves as an indication of the various advantages of low-code platforms. For more insights, you can read the full report here on the Microsoft Power Platform blog.

  • How To Keep Engineers Happy and Reduce Burnout

    How To Keep Engineers Happy and Reduce Burnout

    Software development can be a mentally taxing profession. It requires intense mental focus, often under heavy workloads, with unclear job expectations and a lack of control. And with recent labor shortages due to layoffs and resignations, teams may also be understaffed, making matters more complicated. These issues can compound and lead to prolonged excessive stress—that’s when burnout hits.

    In fact, one report found that 82% of developers surveyed indicated that they had experienced burnout in the last six to eight months. Some top causes of burnout include increased workload, a poor work culture and personal reasons. But whatever the cause, for 73% of these developers, burnout is negatively impacting their productivity or personal life. So, what can leaders do about it?

    I recently talked with Randall Degges, head of developer relations at developer security company Snyk, to learn how to address ever-present burnout issues in software development teams at scale. Snyk, which provides popular automated vulnerability detection tools, recently closed a staggering $196.5 million series G funding at a $7.4 billion valuation. With that kind of momentum, they must be doing something right. According to Degges, there are a handful of tactics to consider to prevent burnout, like ensuring developers are heard, not assigning tasks without context and making improvements to the DevOps workflow.

    Understanding Burnout

    Burnout is an ever-present issue, explained Degges. It’s common within any high-stress job where you’re on the hook for constantly delivering new features to support the business. Specifically, in software development, burnout can quickly arise when developers don’t feel they have a voice. Or worse, when they’re tirelessly producing software they know won’t ever see the light of day.

    A paper entitled Burnout in software engineering: A systematic mapping study took an interesting systematic approach and analyzed decades of research into burnout in software engineering. It found the following qualitative work-related factors to be most correlated with burnout. (Interestingly, the paper suggested machine learning might soon help produce more quantitative indicators of burnout.)

    causes of burnout diagram
    Causal-relationship of burnout, taken from ‘Burnout in software engineering: A systematic mapping study.’ (Deciphering this diagram gives me burnout!)

    7 Ways to Fight Burnout

    Since we know burnout is a pervasive problem, how can engineering leaders minimize the issue? Below, we’ll outline some specific strategies to consider and how they might help.

    1. Give Developers a Voice

    First, Degges encouraged leaders to ensure developers have a say in what they’re building. He recalled working within a large enterprise, sitting in a cubicle and having absolutely no say in the features his team was working on. This often included code they all knew would never make it into production.

    Slaving away on irrelevant work is never motivating. Instead, a good internal culture provides a comfortable atmosphere where developers can raise issues early on, said Degges, hopefully before leadership puts targets destined to fail on the roadmap.

    2. Provide More Context

    On that note, when decisions are made, don’t throw orders over the wall in a vacuum. Instead, Degges recommended providing more context into what you’re all creating. Giving visibility into the reason behind decisions will align everyone on project roadmaps and create a shared purpose. This helps foster a culture of empathy and listening to others, said Degges. (David Shackelford affectionally calls this attitude HugOps.)

    3. Optimize Communication Patterns

    Optimizing communication patterns for your working environment is also vital to encourage a healthy culture, said Degges. For example, this could equate to optimizing for the physical reality of distributed teams—no one should have to clock into daily standup at 4:00 a.m. If you are working under timezone constraints, Degges recommended adopting more asynchronous communication.

    For instance, his team relies heavily on Slack and provides dedicated channels for sharing ideas. They’ve also incorporated automation to summarize verbose Slack communications with a recap of conversations. In general, removing unnecessary meetings and optimizing communication patterns could greatly reduce the baggage an engineer might carry in their day-to-day work.

    4. Practice Internal Developer Relations

    As they say, practice what you preach. Many tech-driven companies have adopted a developer relations (DevRel) division to build a community with external developer consumers. But are you practicing DevRel internally? According to Degges, DevRel teams should act as a bridge between external and internal teams.

    “Our goal is to not only to think and empathize with customers but also to encourage internal people to be authentic community members themselves,” said Degges. This can equate to empowering internal employees with resources like mentoring, blog writing or speaking opportunities, he said.

    Additionally, other groups are emerging to help increase internal developer satisfaction. For example, platform engineering and developer productivity engineering (DPE) are being applied by many organizations to improve developer experience around internal tools and processes. Naturally, this will require working closely with internal developers to source feedback and make quality improvements.

    Another method to upkeep engineering morale is through automating away toil. And security vulnerability discovery is one area full of painstaking manual tasks. Half of applications have high-risk vulnerabilities, and new exploits in open source libraries are being discovered almost daily.

    As more software supply chain risks emerge, it’s challenging to keep up with the pace of vulnerability discovery and necessary software patching. Therefore, implementing real-time automated vulnerability detection, said Degges, can help remove many manual processes and free up energy to devote to other areas.

    6. Hire Based on the Work, Not the Interview

    Before developers even get the job, they can be put through high-stress on-the-spot tests during the interview process. Experiences here can set the tone for the entire engagement with the company. But activities like white-boarding algorithms are pretty disconnected from day-to-day work, said Degges. In his opinion, engineers should instead be hired based on the quality of their past performances and the work they’ve produced. This could be artifacts like their personal blog or contributions to open source projects.

    7. Apply Artificial Intelligence (AI)

    Lastly, what’s a tech blog post in 2023 without a mention of AI? Generative AI like ChatGPT has rocked the programming world and is being integrated into more development environments and engineering workflows. The future of AI looks very bright and is poised to help developers produce more with less time and resources.

    Of course, automated code generation will require sanity checks, but these tools can certainly help many ancillary functions. For example, Degges’ team is using ChatGPT to spin up content outlines and automate keyword research, helping support their educational content production.

    Soothing the Burnout

    Even with new tools emerging and a newfound emphasis on developer experience, burnout is still prevalent. A full 58% of developers and security professionals said they are currently experiencing burnout, according to a 2022 Cobalt study. This is, perhaps, due to the rapid release cadences of today’s software delivery.

    “In the past, it took months or years for new software updates to roll out. Now, developers only have a matter of weeks,” wrote Bill Mann, CEO of Styra, on Forbes. “Suffice it to say the stakes are high for today’s software teams.”

    Burnout is psychologically taxing and can negatively affect employee happiness and retention. Therefore, it’s an excellent idea for engineering leaders to take it seriously and consider what positive cultural changes they can make.

  • Managing Engineering Teams During Economic Downturns

    Managing Engineering Teams During Economic Downturns

    The tech industry has faced strong economic headwinds over the past year or so. We’ve seen thousands of layoffs at public tech companies, along with weak stock performances and a decline in venture capital funding. Although some analysts see light at the end of the tunnel, the current slump doesn’t seem like it’s quite over yet. As such, some IT leaders are learning to cope with a slashed budget and a leaner engineering team.

    Simultaneously, engineers commonly desire more flexibility from their employers, both in terms of remote working opportunities and flexible hours. In fact, only 15% of developers are working 100% on-site, according to The State of Tech Hiring 2023 survey, which surveyed 14,000 professionals. In addition to being open to flexible working conditions, some organizations are examining how their internal tools could be improved to increase developer experience and productivity. Amid a downturn, leaders might need to consider these new strategies and many others to maintain steady progress.

    I recently met with Amanda Richardson, CEO of CoderPad, to discuss tips to lead your engineering team during this downturn. According to Richardson, finding the right blend of contractors, remote work opportunities, and helpful tooling is necessary amid the current climate. Leaders can also adopt many creative methods to encourage productivity and motivate developers. Below, we’ll overview four ways technical leaders can build and sustain their teams.

    1. Consider Hiring Contractors Vs. Full-Time Developers

    Recruiters often struggle to fill highly technical positions like full-stack developers, backend developers or DevOps professionals. If a company can’t fill full-time roles, contractors are another valid option. According to Richardson, contractors provide companies with more flexibility because they are easier to hire and cut. These mercenaries could swoop in to pick up the slack by solving common tedious problems, like Salesforce integrations or less-sexy administrative work, she said.

    Of course, contractors don’t solve every need, and they’re not bought into the company’s vision. That being said, more and more companies are leaning toward contractors to help fill technical gaps. In fact, 63% of recruiters now say their company hires contingent workers for tech needs, up from 42% last year, the report found.

    2. Target Remote Work

    Work-life balance has become a top requirement among today’s engineering workforce. For example, remote working options rank as the third-highest priority when looking for work, right behind salary and flexible working hours. Many engineers work better without the interruptions and noise of a traditional office space, explained Richardson.

    Yet, the desire to work remotely is at odds with the policies of some large tech companies, who are attempting to push developers back into the office. Interestingly, this may present an opportunity for small-to-medium enterprises to embrace flexibility and get a leg up on the competition. “Give the people what they want,” said Richardson. “If you want to retain talent, remote work is what you must do.”

    3. Use Tools to Fill in the Gaps

    Another method for filling technical gaps amid a downturn is improving efficiency with new tools. For example, platform engineering is a strategy that aims to develop reusable, self-service platforms to manage internal infrastructure. Centralizing common automation and builds could bring more consistency to deployments and reduce grunt work, freeing up engineers and making them more productive.

    Of course, we’ve also seen a lot of interest in new generative AI technologies, as well as development automation using low-code/no-code platforms. According to Richardson, leveraging AI and new automations presents a newfound opportunity to empower the workforce. For example, ChatGPT can solve interesting challenges in the prototyping phase, like generating a mock database or co-authoring support materials. Technical experimentation is a critical aspect of any team, and new AI capabilities could help bolster and support the operational sides.

    4. Retain a Strong Culture

    Lastly, maintaining a vibrant culture is another strategy to help retain talent. Richardson suggested internal hackathons and coding challenges to bring teammates together in an organic way. An internal hackathon could also be organized to rethink internal processes, providing an outlet for engineers to suggest innovative solutions. There’s also the basic stuff, like daily standups or brown bag lunches, that can create a space to share ideas. “It takes a good leader to figure out what’s going to engage their team,” said Richardson. (One business owner I interviewed actually condoned cooperative gaming during work hours to build community and has seen moderate success with this approach).

    Final Thoughts

    Of course, the above suggestions are easier said than done, and it will take a leader with a keen understanding of their unique engineering team’s attitudes and requirements to find their own version of success. On that note, talent comes in many shapes and sizes and traditional education isn’t everything when assembling a development team. In fact, a full 59% of developers do not have a university degree in computer science, the CoderPad report found, indicating that leaders may have to be more flexible when it comes to recruiting.

    In general, following the above tips could be helpful when managing technical talent. Enabling the company to hire contractors and remote workers increases your potential talent pool, and investing in new tools and company culture could help retain workers. Considering half of today’s developers are considering a job change in the next year, leaders should act now to avoid high turnover before it negatively impacts their team’s output and morale.

  • How Developer Productivity Engineering (DPE) Enhances Software Delivery

    How Developer Productivity Engineering (DPE) Enhances Software Delivery

    Developer experience (DX) is in the zeitgeist, and for a good reason. Digital demands are increasing, yet the market faces cautious IT budgeting, workplace burnout, and high resignations. The idea is that quality developer experience can help keep the remaining talent happy and increase productivity. And organizations are considering many strategies for increasing DX, such as creating more usable interface interfaces, maintaining intuitive documentation and abstracting complexity with more automation and low-code.

    Another way to increase productivity is by slimming down the time it takes to test and deliver software. There are many potential hurdles in the way of deploying new code, and a cumbersome pipeline can easily take a programmer out of the flow. The practice of streamlining this toolchain is known by some as Developer Productivity Engineering (DPE). DPE focuses on improving developer productivity through accelerating DevOps processes, like CI/CD pipelines.

    I recently met with Hans Dockter, founder and CEO of Gradle, to understand the core tenants behind DPE. According to Dockter, the dialogue with the toolchain is a developer’s bread and butter, and optimizing this exchange is vital for quickly validating new ideas. Below, we’ll seek to understand what DPE is and how it might increase the pace of software delivery. We’ll also consider some methods for implementing DPE in practice.

    Roadblocks in the Development Toolchain

    Engineers are always experimenting with new feature development. “A developer needs to have a dialogue with their toolchain to see if their hypothesis makes sense,” explained Dockter. Yet, there are many potential barriers to instant feedback. For example, a toolchain may be comprised of code compilation, static code analysis, unit testing, performance testing, security testing and other checks. Running new changes through a CI/CD pipeline can take anywhere from a few seconds to minutes or hours. In his work, Dockter has even encountered teams that deal with a 24-hour feedback cycle time.

    Long wait times can be taxing as they demand users to switch contexts. Neuroscientists say that multitasking depletes glucose in the brain and leads to exhaustion. Similarly, Dockter argued that long waiting periods with the toolchain can take developers out of the flow and slow down the pace of software delivery. “You cannot have a good developer experience without good productivity.”

    Furthermore, he added that engineers often encounter untrustworthy signals from their toolchains. If testing suites produce too many false positives, for example, you can lose faith in the tooling altogether. This equates to a bad experience and may result in developers overlooking important signals that do matter.

    Understanding Developer Productivity Engineering (DPE)

    DPE is all about improving developer efficiency. And quickening the feedback cycle is one method to enhance developer productivity. According to Dockter, DPE applies a few strategies to streamline this feedback loop and shorten the timeframe:

    • Optimizing which tests are run: First, Dockter recommended only running tests relevant to the change at hand. Optimizing test selection can reduce bulky builds and significantly reduce the time it takes.
    • Caching: Caching is integral to any web application, so why not apply similar heuristics for the development pipeline? This could involve caching code that is not changed. “Changes are often incremental from one feedback cycle to the next. A lot of output is produced that can be reused,” said Dockter.
    • Predictive test selection: To automate test optimizations, Dockter recommended predictive test selection to understand which tests are sensitive to which areas of code. This would utilize an AI trained on release mechanics to help pinpoint what components the changes modify and, thus, what tests to run.
    • Test distribution: Another way to accelerate the pipeline is by distributing testing processing. Using multiple machines to test different areas simultaneously could greatly speed up the routine. Test distribution “is a modern approach to test parallelism that accelerates test execution by taking existing test suites and distributing them across remote agents to execute them faster,” wrote Marc Philipp and Hans Dockter in The Developer Productivity Engineering Handbook.
    • Monitor the toolchain: Lastly, it’s good to continuously monitor failure analytics to discover where the toolchain itself is causing trouble, said Dockter. On the side, CI/CD pipelines are not immune to security vulnerabilities and should be treated with the same security standards as other infrastructure.

    DPE principles have already been applied at DoorDash, LinkedIn, Netflix and other organizations.

    Benefits of Developer Productivity Engineering

    In the last few years, DX has moved from niche to mainstream, said Dockter. In fact, DX has even entered the C-suite, as certain companies have embraced the role of chief developer experience officer CDX). And with the emerging discipline of platform engineering, we’re seeing an even greater focus on streamlining internal DevOps workflows.

    And although platform roles may have been viewed as second-class engineers in the past, said Dockter, they are held in high esteem nowadays. “It’s as important as the other engineering work we’re doing,” he said. Developer productivity engineering seems to align with these principles, helping organizations manage the effects of an exponentially expanding code base. In the end, an investment in DPE, like platform engineering, could bring more satisfactory working conditions and accelerate the pace of software development.

    “DX is a transformative opportunity, but most companies invest incrementally. The economic benefits are transformative for companies developing infrastructure to get more output from their developers.”

  • How Database DevOps Fuels Digital Transformation

    How Database DevOps Fuels Digital Transformation

    In today’s real-time, hyperconnected reality, data is a core driver behind most digital strategies. User data is constantly gathered and shared across various technology backends and platforms—as is system performance data to inform engineers. Data is pivotal for everything, from generating machine learning models, refining user experiences and even supporting new data-centric services. But although data is a clear backbone to many enterprises, there is no clear winner regarding which database to use.

    Large organizations often find themselves supporting different database styles, from relational databases to NoSQL and distributed SQL. And as organizations continue to adopt multiple databases, safely managing the processing and storage of data becomes more challenging to enact at scale.

    I recently met with Jakub Lamik, CEO, Redgate Software, to understand the role DevOps, specifically database DevOps, is playing in advancing data-driven digital transformations. According to Lamik, applying DevOps practices for database management can improve performance, increase productivity and help organizations stay compliant. Below, we’ll consider the state of today’s data-driven digital transformations and highlight ways to improve how DevOps is applied to database management.

    State of Data-Driven Digital Transformations

    The 2022 StackOverflow Developer Survey found the most popular databases to be MySQL, PostgreSQL, SQLite, MongoDB and Microsoft SQL Server. But most often than not, businesses deploy more than one of these in production. Redgate’s 2021 State of Database DevOps report found that 70% of businesses had more than one DBMS in use, and 48% had teams working on three or more different databases.

    Engineers operate in increasingly hybrid and distributed technology environments. This isn’t for no reason—in fact, 90% of organizations said multi-cloud is helping them achieve their business goals. Lamik also notes a diverse array of software technologies in practice today, from multiple clouds to decoupled microservices architectures and database types. But the desire to work with diverse toolsets causes fragmentation, which could hinder software delivery efforts. For example, organizations want to deploy the same framework and similar methodologies across different databases, said Lamik, and have it be database- and cloud-agnostic.

    Tips to Improve Database DevOps Operations

    To increase the pace of software delivery, infrastructure automation is often needed. And like other roles, database professionals are increasingly trying to automate operations and free themselves from mundane tasks. So, what are some ways to streamline database DevOps? First off, Lamik encourages adopting a common approach across multi-database environments, using standard toolsets that are flexible and portable. “The organizations that standardize deployments across different database environments can increase the frequency and reliability of deployments,” he said.

    Catching and resolving errors quickly is also becoming increasingly essential to meet objectives. And although DevOps brings many advantages, the CI/CD pipeline has gaps. “Observability supported by intelligent automation is key to closing those security gaps,” said Lamik.

    Thus, he encouraged additional oversight and tracking of changes to ensure stability throughout the database deployment pipeline. Also helpful is encouraging collaboration with security professionals (also known as DevSecOps) and integrating security principles into the DevOps workflow to ensure the process is secure by design.

    Another element of database security involves the proper observability and classification of sensitive data. As Lamik describes, organizations must be careful to distinguish between data used for production purposes and data used for development purposes. Ensuring sensitive data is cataloged correctly is imperative to avoid production data from being breached or accidentally publicly exposed.

    Final Thoughts

    In summary, applying DevOps ideals to database management could be a boon for development efforts. For those who haven’t yet considered it, a DevOps transformation will pay dividends, says Lamik. Furthermore, a common management layer could help wrangle multiple database types and help adopt new emerging database types, such as Snowflake and Postgres. Yet, when acquiring new database toolsets, Lamik admitted it may not be a quick transition. He recommends a land-and-expand strategy rather than a top-down approach (which typically isn’t as effective in empowering individual developers).

    Commenting on the industry’s recent move toward platform engineering, Lamik sees it as the next evolution of DevOps. Whereas DevOps brought helpful toolsets to streamline deployment and digitization, platform engineering is taking these practices and productizing them to be reusable at scale across teams and departments, he explained.

    Also, in the new cloud-native stack, containers are designed to be ephemeral, causing engineers to craft workaround solutions to enable stateful storage on platforms like Kubernetes. Regardless of deployment, data must have proper backup and recovery controls as well. In this new cloud-native paradigm, the role of database professionals is changing, explained Lamik, and “APIs are becoming the focal point of communication.”

  • How Open Source Can Benefit AI Development

    How Open Source Can Benefit AI Development

    Enterprises are increasingly reliant upon open source software. A full 95% of IT leaders say open source tools are key to their enterprise infrastructure. Simultaneously, we’ve witnessed a sharp increase in the adoption of artificial intelligence (AI) and machine learning (ML). Most IT divisions want to take advantage of AI in some form, and open source technologies will likely be vital to these efforts.

    I recently met with Moses Guttmann, co-founder and CEO of ClearML, to understand the benefits of adopting open source software within the sphere of artificial intelligence. To Guttmann, open source has many benefits—the visibility it grants can equate to helpful feedback from the developer community, and transparency can inform new feature development and identify potential security gaps. There are also countless open source tools to help organizations develop and deploy ML models.

    Below, we’ll consider the benefits and potential drawbacks of incorporating OSS in AI development and explore ways to optimize the use of AI within an organization.

    Benefits of Using Open Source for AI

    AI has evolved in leaps and bounds. What was pure sci-fi a few years ago has become a reality through ChatGPT and other AI-powered platforms. The capabilities of AI are awe-inspiring, but Guttmann believes it still requires fine-tuning to move from entertainment purposes into a valid business driver.

    For example, custom ML models are difficult to construct from scratch, and generic APIs aren’t always that customized to the use case at hand to be valuable. Instead, Guttman foresees more and more organizations downloading open pre-trained models and retraining or customizing them to meet their specific needs.

    For software providers, there are many benefits to adopting an open source strategy. The visibility it creates helps evolve a project with feedback from the community, said Guttmann. This, in turn, helps organizations build better, more stable products. For example, ClearML adopts plenty of OSS to power their user interface, backend and other components, in addition to providing a popular open source CI/CD framework for ML workflows. “We’re true believers in the power of community and like to work with open source and contribute back to these projects,” said Guttman.

    Use Cases for Open Source in AI Development

    Open source software is powering innovation in many ways. And when it comes to AI, there are numerous open source projects to help accelerate AI development. Such projects encompass pre-trained models, data-structuring tools, frameworks to train models and AI deployment pipelines. For example, many open source machine learning frameworks can help engineers build and train their models from scratch. These free-to-use tools include TensorFlow, Keras, PyTorch, H2O, XGBoost and others.

    However, training models from scratch is time-intensive and complicated, said Guttmann. Instead, another option is to use pre-trained models accessible on GitHub or other repositories. Some popular examples are PaddleNLP and Natural Language Toolkit for natural language processing, OpenCV for machine vision and DeepFaceLab for deepfakes. There are also many open source Python packages that can structure and clean data for ML model training purposes.

    Open source software can also be applied to streamline the ML DevOps pipeline itself. AI requires intense processing and is typically deployed to its own computing environments. Infrastructure management around running and training AI is a promising area where open source could assist, said Guttmann. “Automating this process with an abstraction layer to allow data science and ML engineers to access product-grade hardware is a must,” said Guttmann.

    Potential Downsides of Open Source Usage

    Yet, of course, there are some potential downsides to using open source software within the field of AI. Supply chain attacks are still a persistent threat, and numerous open source software risks can present themselves. These include bad actors compromising a legitimate package, name confusion attacks, unmaintained software and untracked dependencies. License restrictions could also potentially block the inclusion of OSS in certain projects.

    Thankfully, the benefits of OSS appear to outweigh these concerns. Automated vulnerability scanning techniques can help detect known issues. It also helps that 89% of technology leaders see enterprise open source as more secure or as secure as proprietary software, according to a Red Hat report.

    Tips For Getting the Most From AI

    Open source is powering digital innovation on many fronts, including AI. But, simply looping in OSS isn’t the only aspect of fully leveraging AI—another will be the operationalization of ML management. The right automation infrastructure in place could enable the agility necessary to continuously retrain models. And since there are potential gaps in the CI/CD process, Guttmann recommended separating AI/ML from your normal CI/CD for security reasons.

    Guttmann also believes that, in general, companies should be more transparent around ML models, including sharing details behind their creation and visibility regarding the datasets fed into them. Overlooking this could lead to ethical concerns. Furthermore, limiting the “hallucinations” generative AI produces is another huge gap that must be bridged, said Guttmann. This could be solved by simply allowing the system to respond with “I don’t know,” instead of confidently spouting nonsense.

    In summary, open source could bring many benefits to bespoke AI/ML adoption. Many mature open source tools exist to enable engineers to create advanced AI and oversee the management and deployment of custom ML models. But the real test will be retaining this open creed by upholding visibility and transparency into the end creations.

  • Microsoft Power Platform Integrates ChatGPT: What This Means

    Microsoft Power Platform Integrates ChatGPT: What This Means

    Microsoft recently announced it integrated ChatGPT into its low-code Power Platform developer suite. This follows the news of ChatGPT-powered Bing search and Microsoft’s pledge to invest billions into its partner company, OpenAI.

    ChatGPT, the large language model (LLM), has reached viral status due to its ability to generate impressively complex textual outputs given simple prompts. And now, enterprises are hoping to cash in on its power. Microsoft’s inclusion of ChatGPT in its Power Virtual Agents and AI Builder tools will likely signal more native inclusion of AI models within other low-code development environments throughout the industry.

    However, not all is peachy in the world of generative AI. Users have compiled a laundry list of ChatGPT failures, ranging from simple arithmetic errors and inaccurate information to social biases and even one attempt to dissolve a journalist’s marriage. AI seems sure of itself, but the “hallucinations” it produces can be mind-bogglingly off-base. If such inaccuracies persist within production use cases, it could lead to false suggestions that confuse users and even harm a company’s reputation.

    Below, I’ll consider the implications of this new paradigm of AI-driven development, exploring the benefits and potential risks of incorporating LLMs into low-code development frameworks. We’ll also highlight how this may upset the competition and consider things leaders should keep in mind as they seek to leverage this new technology.

    Benefits of Incorporating ChatGPT

    Low-code development platforms (LCDPs) excel at abstracting complex functionalities into usable components. They typically offer drag-and-drop capabilities and reusable templates to enable citizen developers and professional programmers alike. And there are many potential benefits of incorporating ChatGPT into such a low-code environment. For example, as a feature within Power Virtual Agents, ChatGPT can be used to create chatbots that connect to public company resources and internal company data. This could help users seamlessly develop a contextually-aware AI trained on a company’s documents.

    Utilizing AI within low-code can spur development with deep inferences and guidance. Such AI assistance can drastically accelerate development efforts through enhanced auto-completion and intelligent insights, quickly generating boilerplate code and making suggestions more customized to the task at hand than your typical static templates.

    GPT-based chatbots leveraging AI trained on a company’s documents could be incredibly more valuable than an off-the-shelf model without context. In the realm of customer support, an in-house trained AI could be beneficial in summarizing company information and automating manual support activities. Providing a low-code means to generate such chatbots also brings advanced AI to a broader range of users. All in all, this could advance the pace of development, especially for mobile interfaces, automated workflows and contextually-aware chatbots.

    Implications For the Low-Code Space

    In the wake of ChatGPT, the market has been scrambling to respond. Tech giants have debuted their own generative AI to mixed reviews. And some, myself included, are left pondering how low-code and AI will coexist in this new era. Will natural language-driven code generation replace the need for programming entirely, whether it’s traditional or ‘codeless’?

    This remains uncertain. But what appears most plausible is that these recent developments will raise the bar throughout the software industry and augment how LCDPs are built and used. AI has the power to enhance LCDPs in a few ways, including augmenting the developer experience, training bespoke ML models and building more intelligent end-user experiences.

    Yet, with Microsoft funneling billions into AI research and development, it could be challenging for mid-size low-code platforms to keep pace without their own AI-driven workflows. Thus, the LCDPs that do not integrate robust AI of their own may lose out on new subscribers. Plus, engineers hoping to create AI models that run on internal datasets may prefer working with a larger cloud technology suite in which their data is natively stored.

    Downsides of AI-Infused Programming

    ChatGPT and other generative models are absolutely impressive, but the results can’t be 100% trusted. And at the time of writing, ChatGPT usage within PowerApps is still experimental, which is indicative of ChatGPT and generative AI in general—still in the experimentation phase.

    This doesn’t bode all that well for programmers relying on its outputs, given the potential for inaccuracies. Because although the results of ChatGPT sound authoritative, they are generated from knowledge scoured from the public web, which often contains bugs, errors and inefficiencies.

    The outputs of ChatGPT may even suggest entirely nonexistent features! This is, unfortunately, a current issue with geocoding API provider OpenCage. ChatGPT routinely recommends users integrate OpenCage’s “phone lookup service” for certain prompts. But … OpenCage doesn’t even offer this feature. The team has received so many complaints from angry developers that they even had to issue a statement explaining what happened.

    With AI code generation, the focus shifts from hardcoding toward creating and organizing prompts and debugging errors. And although it’s giving programmers newfound agility, it doesn’t solve all software development problems—namely, the DevOps side of the equation. There will still be friction in deploying code and piecing together an optimal architecture. Also, due to rising software supply chain vulnerabilities, code automation that loops in third-party dependencies must require careful security forethought. There’s also the chance of breaking changes and ongoing maintenance hurdles with any software.

    Another important element is that low-code requires governance to be secured correctly. No-code business users may not have the security oversight to understand the implications of spinning up new services. And when you add AI into the mix, the technical implications escalate. AI can result in ethical violations, and bots have been found to communicate anger and irrational ideas when poked and prodded.

    Are We All Just Hallucinating?

    ‘Hallucinating’ is when an AI model confidently spouts nonsense or inaccurate information. And although this is the case with some models currently, they are actively accepting feedback and being retrained. Over time, their outputs will improve. But for now, engineers should be aware that they are still under experimentation. As such, enterprises should use caution and test new AI innovations on internal processes first. And AI adoption must be governed carefully to avoid misconfigurations and abuse.

    AI is here, and the future is now. But although it’s dismantling some coding barriers, developers still have their work cut out for them. This reality is a win for low-code solutions offering standard software delivery pipelines and centralized collaboration features. If LCDPs can maintain pace with AI and embed it into their workflows, both sides should fare pretty well in this new era.

    Surprise — this entire article was written by ChatGPT. Just kidding! None of it was. I’m just tired of seeing this “gotcha” moment at the end of news segments…

    This post was written by a human.

  • Tips For Securing CI/CD Pipelines

    Tips For Securing CI/CD Pipelines

    Most development teams want to increase the pace of their software delivery. As such, continuous integration and delivery (CI/CD) has grown in importance, helping push code from build to production as seamlessly as possible. CI/CD pipelines often loop in many elements and may comprise a diverse stack of tools, automations and various languages. But because of this, the attack surface can be large. And as gaps in the CI/CD toolchain emerge, so do security concerns.

    In recent years, we’ve seen several high-profile cases where CI/CD environments were compromised. For example, take the Circle CI breach, in which a bad actor accessed Circle CI production systems. Others include the compromise of the SolarWinds build system and the Codecov breach. CI/CD security issues are alarming because so much control and automation are given to a pipeline. Unauthorized CI/CD access could be leveraged to publish malicious code or steal sensitive information.

    I recently met with Daniel Krivelevich, co-founder and CTO of Cider Security (acquired by Palo Alto Networks), to better understand the risks facing modern CI/CD. Krivelevich is a seasoned CI/CD security expert and co-author of the Top 10 CI/CD Security Risks framework, which OWASP adopted in late 2022. According to Krivelevich, there is a general lack of knowledge and visibility into these risks. “The CI/CD ecosystem as a whole is full of holes and opportunities for attackers,” he said.

    Below, we’ll review some of the risks that CI/CD pipelines face and offer general ways to mitigate some of these concerns. Hopefully, with greater security awareness around CI/CD threats, both tooling providers and users can begin to diffuse the potential of attacks against their systems.

    The Top Concerns Facing CI/CD Security

    The OWASP Top 10 CI/CD Security Risks framework covers the most impactful risks within modern engineering systems and gaps in CI/CD. It was informed by analyzing many attacks in recent years and was compiled with insights from numerous experts. Krivelevich hopes the framework will spark discussions around the mindset defenders should have when they’re looking to protect the modern engineering ecosystem. The top 10 risks are as follows:

    • CICD-SEC-1: Insufficient Flow Control Mechanisms
    • CICD-SEC-2: Inadequate Identity and Access Management
    • CICD-SEC-3: Dependency Chain Abuse
    • CICD-SEC-4: Poisoned Pipeline Execution (PPE)
    • CICD-SEC-5: Insufficient Pipeline-Based Access Controls (PBAC)
    • CICD-SEC-6: Insufficient Credential Hygiene
    • CICD-SEC-7: Insecure System Configuration
    • CICD-SEC-8: Ungoverned Usage of Third-Party Services
    • CICD-SEC-9: Improper Artifact Integrity Validation
    • CICD-SEC-10: Insufficient Logging and Visibility

    Before an organization can dissect these individual risks, however, they must overcome an even bigger problem—a critical lack of understanding regarding the CI/CD ecosystem and the many elements under the hood. Since CI/CD is not traditionally viewed as a security risk, this can result in insecure default configurations, insecure processes and systems not adopting a secure-by-design approach.

    “There’s a big gap between the level of understanding and opportunities attackers have and the knowledge defenders have over what attackers can do,” said Krivelevich. “Organizations traditionally have not been proactive enough in understanding this, unlike other elements that are more traditionally recognized as part of the attack surface. The main gap is a mindset shift.”

    Tips to Secure CI/CD

    So, knowing the above risks, what are some best practices to secure CI/CD pipelines? Krivelevich shared some tips to keep in mind.

    Bring CI/CD under the security umbrella. First, realize that CI/CD should be scrutinized. This will require an awakening in the community and more proactive effort than before. Krivelevich encouraged development teams to place it on their roadmaps and think about it.

    Map the attack surface. Before implementing security measures, you need to know what you’re protecting. Therefore, it’s a good idea to map your CI/CD environment and produce an inventory of assets. Cataloging the total surface area of dependencies and integrations is necessary to understand risks and helps mitigate CICD-SEC-10: Insufficient Logging and Visibility.

    Keep this updated regularly. Since the cadence of change is fast, teams will want constant visibility into their ecosystem and what’s under the hood. This may even lead to shadow IT, as per CICD-SEC-8: Ungoverned Usage of Third-Party Services. Therefore, Krivelevich recommended keeping a regularly updated inventory. This means continually mapping control systems, container registry artifacts, plugins and all other assets used as part of CI/CD.

    Protect the software supply chain. Many building blocks make up the modern software delivery process. But, some dependencies may be abused or contain malicious code, as per risk CICD-SEC-3: Dependency Chain Abuse. Dependencies within the CI/CD process may be prone to a host of open source vulnerabilities.

    Safeguard CI/CD credentials. CI/CD tools “possess secrets to most sensitive crown jewels in an organization,” Krivelevich explained. Therefore, access tokens and secrets related to CI/CD tools should be protected to avoid costly credential leaks. A zero-trust approach to CI/CD could help avoid CICD-SEC-2: Inadequate Identity and Access Management.

    By creating a virtual heat map of areas to address, organizations will be more informed and better equipped to assess risk. And according to Krivelevich, by implementing these best practices, defenders have a lot of power to raise security expectations in the CI/CD space. “When defenders and users become more diligent about security, the requirements from vendors will increase.”

    CI/CD is the Beating Heart, Don’t Let it Break

    “The engineering ecosystem and pipelines themselves are the beating heart of engineering,” said Krivelevich. And as this system becomes a larger part of what makes a business tick, it will be more heavily relied upon for mission-critical tasks and retaining agility.

    Yet, many building blocks comprise the contemporary software delivery process, and CI/CD pipelines can be a risky area due to the number of systems they touch. Further complicating things is the fact that the delivery ecosystem wasn’t traditionally viewed in security terms. This combination of many opportunities and limited security oversight makes CI/CD lucrative for attackers.

    Rectifying the top 10 risks is a relatively easy gap to address, said Krivelevich—what’s not so easy is the mindset shift required to take CI/CD security seriously. Organizations that invested deeply into microservices and rapid engineering processes will most likely be more susceptible to attacks, he added, since they typically use a diverse array of tools and a complex, integrated delivery process.

  • Day in the Life of a Chief Developer Experience Officer (CDXO)

    Day in the Life of a Chief Developer Experience Officer (CDXO)

    Developer experience (DX) has become essential to modern enterprise software development. As more companies become software companies, more are opening up their software both for internal reuse and externalized consumption. As part of this process, making developer-facing tools consumable and friction-free becomes more necessary to both perform well and stand out in the market.

    To oversee developer experience quality within an organization, an entire new role is beginning to emerge — the chief developer experience officer (CDXO). A CDXO is in charge of ensuring the intuitiveness of developer-facing toolsets and being an advocate for engineering needs. Such a focus could improve internal platform usability, like within platform engineering initiatives. Or, it may involve improving the developer experience for public or partner APIs through quality documentation, SDKs, libraries, forums, tutorials and more. A CDXO might interface with many departments to monitor and improve DX across the organization.

    Since the role is in its very early stages, few CDXOs exist. But I tracked down a few to gather insights on the emerging position—I had the unique opportunity to sync with Alessandro Cauduro, chief developer experience officer at Azion and Ivan Burazin, chief developer experience officer at Infobip. They both shared some fantastic insights on why DX is so important these days and what qualities make a good developer experience leader. Below, I’ll distill their wisdom and take a peek into the life of a CDXO.

    Why DX is Important

    First, it’s good to reiterate that developer experience is increasingly important for several reasons. Organizations want to build and ship applications faster and more securely. Yet, it can be difficult for programmers to keep up with new technology trends. “Technology is always changing, and developers are always having to try new things,” said Cauduro. “As a result, you rarely become an expert on a single platform.”

    Developer experience helps you get up and running quickly with new tools. The mindset is similar to user experience (UX) but more applicable to different interaction points like APIs, CLIs, SDKs, VSCode plugins, libraries or other developer-facing technologies. Improving usability for these packages helps ease the daily grind, increases productivity and can be a competitive advantage, said Cauduro. He added that a benchmark of great developer experience is when you don’t even have to read the documentation to understand what you have to do.

    “I think that developers are the lifeblood of innovation,” said Burazin. “They are the ones creating solutions and implementing transformative technologies. Yet, they are often let down when it comes to the tools they use to achieve this innovation, so providing a great developer experience is paramount if we want to foster that innovation as much as possible.”

    CDXO Roles and Activities

    So, what does a day in the life of a CDXO officer look like? What are some of their roles and responsibilities? According to Cauduro, the overarching goal is to put himself in the developer’s shoes—he constantly thinks about common developer workflows and considers how to create a seamless experience throughout the entire development life cycle.

    Next is spreading awareness throughout the company about DX principles and how to increase DX within their offerings. A CDXO will likely answer directly to executive leadership but might interface with many departments. A CDXO may direct teams to construct developer-specific tools, like libraries, documentation, SDKs and self-service environments. “DX is a mindset,” said Cauduro. “The whole company needs to be engaged in it.”

    “As with any C-level position, your job is on the one hand to make your team’s life easier in any way you can,” said Burazin. “And on the other to convey the developers’ issues or ideas to the company in hopes of nudging the company in the correct direction.”

    A CDXO may also oversee developer relations efforts, which focus on fostering a developer community. There are many ways to interface with partners and clients to exchange ideas on how to build against the platform, Cauduro explained. This includes promoting open source projects, encouraging user meetings or interacting on Discord and forums to provide answers to community questions.

    Qualities That Make a Good CDXO

    The CDXO position isn’t for everyone. So, what personality traits make a good candidate for the role? Here are some of the necessary qualifications for the type of work:

    • Experience as a programmer. A CDXO should have past experience as a professional developer. Engineering knowledge will help them understand the persona and empathize with their needs.
    • Leadership qualities. The role also requires leadership expertise, as a CDXO must have the ability to coordinate and influence many different areas of the company.
    • Creativity. Since the role is pretty nascent without a written path, it will require creativity. Having the ability to experiment, accept feedback and reiterate is also important, said Cauduro.
    • Empathy. Communication skills and empathy also go a long way. “Deep engineering knowledge crossed with great people skills is the mix you would need for such a task,” said Burazin.

    Developer Experience in Practice

    At Azion, Cauduro is interested in how its tools can help developers move solutions from the cloud to the edge more seamlessly. To that end, they’ve found that Jamstack fits well with the needs of edge computing. Thus, some of his efforts focus on making the process of deploying a Jamstack app to the edge as seamless as possible for engineers.

    While DX efforts have helped address development bottlenecks at Azion, the role of CDXO may not be necessary within all companies, admitted Cauduro. It’s more of a fit for API-first or SaaS companies that target developers as a primary consumer base. That being said, other companies can still benefit from a developer experience focus to enhance their internal IT platforms.

    At InfoBip, Burazin explained that developer experience efforts center around helping external developers consume the InfoBip API, an API for all communication channels, such as SMS, voice, WebRTC and more. Sitting under the CTO, Burazin helps run three teams and DX has its own department. Impressively, he reports revenue on self-service APIs has increased fivefold in the past two years.

    Burazin, also the co-founder of Codeanywhere, explained that his role is to “convey the worries or needs of the developer customers to management and help steer the ship in the right direction.” To discover those needs, he recommends ‘dogfooding’ what the customer is experiencing and streamlining the onboarding process to be as self-service as possible. He also recommends having measurable insights on metrics you can directly impact, like decreasing time from discovery to ‘hello world.’

    Final Thoughts

    Developer experience is becoming a unique selling point for technology companies—so much so that it’s entered the C-suite. “Whoever has the better DX will have the leading edge,” said Cauduro. For him, it’s about finding small things to optimize that remove pain points from the developer’s process.

    To summarize, the role of CDXO is still evolving and not set in stone. And, granted, many different labels are being applied to describe similar objectives. But to get an idea of what the CDXO role entails, some common activities include:

    • Considering the perspective of the developer.
    • Engaging the entire company to prioritize DX.
    • Overseeing the construction of DX-related assets and resources such as tutorials, documentation and guides.
    • Collecting feedback and reiterating platforms.
    • Overseeing developer relations and advocacy teams.

    Looking to the future, developer experience will likely become more of a necessity as developer-driven purchasing habits become a real revenue driver. “This bottom-up go-to-market motion will help awareness and increase sales,” said Burazin. And, to helm this movement, more companies may adopt DX within a C-suite title. But of course, the role may look different from company to company as DX is applied in different ways.

    “If we look at the largest technology companies, almost all of them have a developer experience department in their organization. And this is due to the fact that so much of a developer’s productivity is directly linked to their experience while working,” said Burazin. Things like internal developer portals and standard cloud deployments will help improve developer experience and help them focus on what they do best, which is coding, he said.

  • Strategies To Consider When Adopting Platform Engineering

    Strategies To Consider When Adopting Platform Engineering

    Platform engineering helps centralize the responsibilities associated with maintaining internal infrastructure. And it continues to be an emerging discipline—according to the 2023 State of DevOps Report, 51% of organizations have already adopted platform engineering within the last three years, and 93% said it’s a step in the right direction.

    I recently met with Hope Lynch, senior director of platform at Cloudbees, to gain some insights on implementing platform engineering. According to Lynch, platform engineering has emerged at a critical juncture. Developers are overloaded, burnout is on the rise and tooling sprawl is starting to rear its ugly head. To respond to these trends, platform engineering has emerged to take the heavy load off internal software infrastructure management. But the practice requires keenly balancing responsibility with control and treating the platform as a product.

    Interestingly, Lynch believes that many IT departments—whether they know it or not—are already implementing some form of platform engineering. They might just need to work out the kinks. Below, we’ll define platform engineering as it relates to DevOps and share some best practices to consider when rolling out (or reiterating) a platform engineering plan within your organization.

    State of DevOps and Platform Engineering

    So, what is the state of platform engineering and DevOps? Contrary to the salacious ‘DevOps is dead,’ headlines, Lynch doesn’t believe DevOps is going anywhere. Instead, platform engineering is helping overburdened developers, having emerged at a time when developers and operations seem to be at a crossroads.

    Developers are now responsible for coding, security, deployment and infrastructure maintenance. “Developers are talented and creative, but everyone has only so much capacity,” said Lynch. She believes platform teams can relieve some of these pressures by creating standard builds and common CI/CD pipelines. “I see it as a partnership between the DevOps teams and platform operations teams.”

    Lynch views DevOps as more of a practice than a specific job title. And although developers should have control over their DevOps toolchain, she believes they were granted too much responsibility. For example, the amount of effort required to search the market, talk to vendors, and try out tools can all add up significantly.

    By creating proven patterns and managing tools, platform engineering teams can help narrow down the options, working behind the scenes to ensure the platform is self-serviceable and continually updated. Of course, this partnership requires regularly collecting feedback to ensure platform teams are enhancing development workflows, not hindering them.

    Best Practices for Platform Engineering Adoption

    So, what are some best practices that enterprises can apply to their internal DevOps platforms? Lynch shared some areas platform engineering teams should focus on to improve their process. By following these tips, a platform can enhance DevOps principles within a company.

    • Be open to feedback from developers. As previously mentioned, platform engineering and development should be partners. Platform engineers should seek to gather as much feedback as possible from developers to improve their experiences and ensure the right DevOps tools are acquired.
    • Don’t control everything. As such, a degree of flexibility should be granted—you don’t want to mandate standardized adoption of all tools. Yet, you do want to decrease rogue tooling and sprawl. The platform team should thus work to find a balance and build trust.
    • Maintain a DevOps culture. When people discuss DevOps, they often talk about the tools and technology, not why DevOps came to be. “DevOps is here because we were trying to find a way to allow teams to work better together and be high-performing,” said Lynch. As such, we shouldn’t forget to include the people element here. Platform engineering should reinforce a healthy culture with positive dialogues and ensure work is “a fantastic place to be.”
    • Treat the platform as a product. When delivering internal-facing tools, your developers are your consumers. Thus, it’s a good practice to treat the platform as a product in its own right. This includes publishing roadmaps and eliciting feedback. “The platform team really needs to win the business of their internal customers, or else they’ll buy or use something else, which could cause shadow IT.”
    • Focus on increasing developer experience. As part of viewing internal developers as customers, platform teams should invest in improving the developer experience associated with using the platform. This means reducing friction and integrating new capabilities into preexisting workflows whenever possible.

    Goalposts For Platform Engineering Success

    For any new initiative to be successful, it must have goalposts and be measured in some capacity. The same is true for platform engineering. So, what are some goalposts that IT leaders should have in mind when introducing platform engineering? According to Lynch, some positive end results include collaboration and efficiency, cost analysis, cybersecurity and tooling centralization.

    • Collaboration and efficiency: First, platform engineering should improve work in the best way for everyone, says Lynch. “The people component is always there and should always be a priority,” said Lynch. To reach these goals, she recommends having the right conversations to co-discover bottlenecks in the value stream management of software development.
    • Cost optimizations: Secondly, platform engineering is an opportunity for garnering insight into usage rates, which could inform cloud cost analysis. Platform teams can implement specific policies, such as spinning resources up or down to reduce expenses.
    • Improved security: Platform engineering teams can be the first to test new products, giving them a unique opportunity to synchronize requirements with security teams. They can also take the reins of continually patching dependencies to reduce vulnerabilities.
    • Increasing consistency. In general, another benefit is centralizing tooling control. Because when tens and thousands of developers are each using their own tool, it becomes harder for teams to work together. While some cutting-edge technology organizations may seek to give developers control over the full cycle to increase agility, most will benefit from centralizing procurement and oversight, said Lynch.

    The Human Side of Platform Engineering

    “Platform engineering, when done right, furthers the principles of DevOps,” said Lynch. And interestingly, it may be the case that teams don’t even realize they are already doing platform engineering. Once they realize they are gravitating toward these ideals, it will be an even greater reinforcer for DevOps and DevOps principles, she said.

    Currently, the tech space is in a tricky spot, with rising layoffs and tightening budgets. At many organizations, fewer people are now expected to perform the same high caliber of work. As a result, we need to place more emphasis on retaining the remaining talent and boosting morale. This means caring about what the developer’s experience is like throughout the day and supporting the human side of DevOps. According to Lynch, platform engineering is a natural choice in these circumstances.