devopsy.kinsta.cloud

Author: Mike Vizard

Nerd/Noir Allies With DX to Improve Developer Productivity

Nerd/Noir today announced it has partnered with DX, a provider of a platform for measuring developer experience, to identify areas where organizations can improve developer experiences in less than six weeks.

The consulting firm plans to leverage the DevEx 360 platform created by DX to survey developers before recommending a plan.

Nerd/Noir CEO David Laribee said that approach will make it simpler for DevOps teams to pinpoint where changes to workflows will have the most impact on 25 different key performance indicators (KPIs).

In addition, DevOps teams will be able to compare their results against more than 120,000 anonymized data samples collected across multiple industries and sectors.

There’s a lot of focus on developer productivity these days, largely because more organizations realize the extent to which they have become dependent on software to drive revenue and improve profitability. The challenge is organizations can’t afford to hire an unlimited number of developers, so many are now embracing platform engineering as a methodology for managing DevOps workflows at scale.

Most DevOps teams track metrics, but they are generally focused on software engineering issues rather than actual developer productivity. Measuring developer productivity tends to be a less exact science. Once upon a time, an organization might have tracked the lines of code being written, but the total number of lines of code written may not be especially good. In more recent times, metrics have been developed that, among other things, keep track of how much time developers spend actually coding versus maintaining their software development environment.

The issue that organizations are contending with is that more responsibility for managing everything from development environments to provisioning and securing cloud infrastructure has shifted, and the cognitive load that each developer is required to carry has increased. Every minute developers spend on these tasks, however, is, in theory, one less minute developers are potentially spending writing the business logic that drives an application.

Of course, there’s no way developers are going to write business logic for eight hours straight every day, so there are maintenance windows. However, application development is as much art as it is science. No one knows for sure when inspiration might strike, but if developers are busy maintaining code that they created to provision infrastructure, the less probable it becomes for some flash of brilliant insight into how an application might be made better is likely to occur.

DevOps teams need to strike a delicate balance. Developers like to be able to experiment with new tools and platforms, so any approach to platform engineering that smacks of totalitarianism will be resisted, and IT leaders need to proceed with caution. If talented developers start heading for the exits, IT leaders will find it difficult to replace them because great developers, even in an economic downturn, are still difficult to hire and retain. The challenge and the opportunity are to convince developers to embrace changes to workflows based on their input versus imposing one that benefits the DevOps teams more than the developers those teams are supposed to support.

January 9, 2024
Five Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

LinkedIn

Fox Tech
New York, New York
Senior DevOps Engineer
$121,500 to $170,000

Dice.com

Chuwa America Corp
Austin, Texas
Adobe Experience Manager (AEM) Developer – DevOps
$120,000 to $140,000

Indeed.com

The Travelers Companies
Hartford, Connecticut
DevOps Engineer
$115,700 to $190,900

SimplyHired.com

Great Minds
Remote
Senior DevOps Engineer
$114,000 to $141,000

CareerBuilder.com

Caresoft
Concord, New Hampshire
DevOps Engineer
$100,000 to $150,000

January 8, 2024
Broadcom Survey Surfaces Slow but Steady VSM Progress

A survey of 501 business and IT leaders published this week found well over half (60%) have adopted some form of value stream management (VSM), but most of those efforts are still in the early stages, with 13% in planning, 25% having a pilot project and 23% applying VSM to a single project. Only 10% are applying VSM broadly across their application development initiatives.

Conducted by Dimensional Research on behalf of Broadcom, the survey found the most widely used VSM tools remain Excel spreadsheets (50%), followed by 42% using home-grown tools. Well over two-thirds (69%) share VSM metrics quarterly or monthly but only 9% indicate this data is being made available continuously, the survey finds.

Not surprisingly, only 36% said they have good or excellent visibility, while 21% characterize their visibility as either poor or a complete “black hole.”

Laureen Knudsen, chief transformation officer at Broadcom, said while VSM progress is being made, there is clearly much work to be done. To facilitate those efforts, Broadcom is now making available a VSM Maturity Model describing the five stages organizations will need to navigate before fully mastering VSM.

The primary reasons cited for adopting VSM include efficiency (79%), customer experience (71%), customer value (62%), profitability (60%) and alignment (44%). In general, organizations are adopting VSM to reduce redundant efforts, which should result in more profits from investments being generated faster, noted Knudsen.

Ideally, organizations should be able to surface business objectives within the context of the tools used to build and deploy applications, noted Knudsen. That approach will enable developers and the DevOps teams that support them to make better business decisions based on the dependencies that might exist between projects, she added. Otherwise, individual team members will make decisions without any understanding how they impact the business at all, said Knudsen.

Unfortunately, that lack of visibility is hard to achieve. The survey finds 85% of decisions are either made at the leadership level, or teams need leadership approval before implementing their decisions. Only 5.8% said decisions are made and implemented at the team level. That dependency on a centralized command and control model for managing application development is a direct result of an inability to collect and share relevant data with the teams working on various elements of a project, noted Knudsen.

In fact, the survey found only 11% of organizations don’t give employees business metrics by which they can achieve or measure products, even though 63% indicated they have metrics.

The more data a DevOps team has the more likely it becomes that the right decision will be made at the right time. Otherwise, factors that are more influenced by inherent biases that stem more from the role of the individual rather than the strategic objectives of the organization will have a bigger impact on how and when decisions are made.

Of course, VSM requires organizations to make investments in platforms capable of capturing and analyzing relevant data. The issue then becomes determining to what degree a VSM platform will provide a return on that investment in a way that results in more business objectives being achieved faster.

January 5, 2024
Checkmarx Report Details Havoc Caused by ‘Everything’ Package on NPM Registry

Checkmarx this week released a report detailing a package distributed via the NPM registry that cripples any machine that is used to download it.

Dubbed the “Everything” package, a user known as PatrickJS, also known as gdi2290, uploaded a package that has more than 3,000 sub-packages. Each sub-package is designed to split dependencies into chunks and to depend on all publicly available NPM registry packages, resulting in transitive dependencies that disrupt pipelines and exhaust storage space.

Following significant effort, The Everything package has since been removed from the registry, but the perpetrators did create a domain where they showcase their handiwork. Whether the Everything package was created as a joke to be played on developers or has some other malicious vandalistic intent is unclear.

Jossef Harush Kadouri, head of software supply chain security for Checkmarx, said these types of incidents are likely to happen from time to time because there is no process for reviewing packages prior to them being loaded into a registry. In fact, a similar incident previously occurred when a “no-one-left-behind” package by Zalastax that was dependent on every publicly available npm package was uploaded in the registry.

It’s only when an issue is identified that the maintainers of the NPM registry will remove a package. Those maintainers simply lack the resources and tools that would be required to scan every package, noted Harush Kadouri.

Heading into 2024, it will be incidents like these, along with vulnerabilities found in NPM packages, that will serve as an impetus for reviewing the workflows that make up an organization’s software supply chain. For well over a decade, developers have been downloading software components from various repositories with little to no regard for vulnerabilities. As more of those vulnerabilities are exploited, organizations that rely on that software are now requiring providers of applications to provide visibility into the provenance of the components used to construct it. The overall goal is to make it simpler to remediate applications, especially when a zero-day vulnerability is discovered.

In the meantime, organizations would be well-advised to curate a repository of software components that have been vetted. Developers can still readily access those components to build applications, but there should be fewer downstream application security issues if the components residing in that registry have been scanned. If developers are allowed to directly download packages and components from a public registry, it’s only a matter of time before an application security issue is going to arise.

Hopefully, as organizations adopt DevSecOps best practices, the number of application security issues encountered will steadily decline. Each organization will need to determine how far left to shift responsibility for application security toward developers, but one way or another, software supply chains need to be better protected.

Of course, the issue will ultimately be forced by regulations that are becoming increasingly more stringent. Once the first fines are levied, it won’t be long before just about every organization that builds and deploys software will quickly move to limit their liability as much as possible. The challenge and the opportunity now is to proactively secure software supply chains today before any remedy that might be imposed on an organization disrupts application development workflows tomorrow.

January 5, 2024
Skillsoft Survey Sees AI Driving Increased Need to Retrain IT Teams

More organizations than ever will need to invest in IT training as advances in artificial intelligence (AI) transform roles and responsibilities in the coming year.

A survey of 2,740 IT decision-makers conducted by Skillsoft, a provider of an online training platform, finds two-thirds (66%) were already dealing with skills gaps in 2023. As AI becomes more pervasively applied to the management of IT, that skills gap is only going to widen given the limited pool of IT professionals that have any experience using AI to manage IT.

Skillsoft CIO Orla Daly said it’s already apparent AI creates an imperative for training because there are simply not enough IT people with the requisite skills required. In fact, the survey finds nearly half of IT decision-makers (45%) plan to close skills gaps by training their existing teams. That training is crucial because the primary reason IT staff change jobs is a lack of growth and development opportunities, noted Daly.

While there is naturally a lot of consternation over the potential elimination of IT jobs, in the final analysis, AI will add more different types of jobs than it eliminates, adds Daly. Each of those jobs will require new skills that will need to be acquired and honed, she notes. “Training is the price of innovation,” said Daly.

In the meantime, there is much interest in finding ways to automate existing IT processes to create more time for IT teams to experiment with AI technologies, said Daly.

The report also finds well over half of IT decision-makers (56%) expect their IT budgets to increase to help pay for new platforms and tools, compared with only 12% expecting a decrease.

It’s not clear to what degree AI will transform the management of AI, but it’s already apparent that many manual tasks involving, for example, generating reports are about to be automated. The instant summarization capabilities that generative AI enables also promise to dramatically reduce the time required to onboard new members to an incident response team. Rather than having to allocate someone on the team to bring new members up to speed, each new member of the team will use queries framed in natural language to determine for themselves the extent of the crisis at hand.

In addition, many tasks that today require expensive specialists to perform might become more accessible to a wider range of organizations as, for example, more DevOps processes are automated. That doesn’t necessarily mean that DevOps as an IT discipline disappears as much as it leads to the democratization of best DevOps practices.

Each IT organization in the year ahead will need to determine to what degree to rely on AI to manage IT processes. It may take a while before IT teams have enough confidence in AI to rely on it to manage mission-critical applications but many of the tasks that today conspire to make the management of IT tedious will undoubtedly fade away. The challenge and the opportunity now is identify those tasks today with an eye toward revamping how IT might be managed in the age of AI tomorrow.

January 2, 2024
Five Great DevOps Job Opportunities

DevOps.com is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

CareerBuilder.com

Belcan Federal
Anaheim, California
Lead DevOps Engineer
$140,000 to $170,000

Dice.com

Trinity IT Services
Remote
DevOps Lead
$115,000 to $165,000

SimplyHired.com

EMMES Corp
Rockville, Maryland
DevOps Engineer
$115,000 to $145,000

Indeed.com

VyncaCare
San Francisco, California
DevOps Engineer
$110,000 to $140,000

LinkedIn

L3Harris Technologies
Colorado Springs, Colorado
Senior DevOps/AWS Specialist
$91,500 to $170,500

January 2, 2024
Senser Extends AIOps Reach to Manage SLOs and SLAs

Senser is extending the reach of its artificial intelligence for IT operations (AIOps) platform to now include an ability to define and maintain service level agreements (SLAs) and service level objectives (SLOs).

SLOs are a set of internal performance goals that require access to telemetry data from service level indicators (SLIs), while an SLA is a formal commitment to maintaining specific levels of service.

Senser CEO Amir Krayden said the company’s AIOps platform collects data from SLIs and then applies predictive AI models to enable IT teams to achieve SLOs and SLAs. The Senser AIOps platform leverages extended Berkeley Packet Filter (eBPF) and graph technology to gain visibility into the entire IT environment versus requiring IT teams to deploy agent software. Machine learning algorithms are then used to aggregate and analyze that data to define thresholds for predicting performance in addition to recommending benchmarks for tracking SLOs and SLAs.

That approach provides a single source of truth for identifying the actual level of service being provided based on a topology of the infrastructure, network, applications and application programming interfaces (APIs) that makes it possible to identify the root cause of issues and the potential impact of an outage for degradation of performance.

IT teams have been attempting to achieve and maintain SLAs and SLOs for decades, but given all the dependencies that exist in a distributed computing environment, it’s difficult to achieve that goal. Senser is making a case for applying AI within the context of a platform for automating the management of IT to define and maintain SLOs and SLAs to make it possible to consistently manage SLAs and SLOs in a way that reduces the level of cognitive load that would otherwise be required. Senser is also working toward adding generative AI capabilities to provide summaries that explain what IT events have occurred.

Collectively, the goal is to provide IT teams with a more efficient holistic approach to monitoring and observability that legacy platforms are not going to be able to achieve and maintain, said Krayden.

At the core of that capability is eBPF, a technology that allows software to run within a sandbox in the Linux microkernel. That capability enables networking, storage and observability software to scale at much higher levels of throughput because they are no longer running in user space. That’s especially critical for any application that needs to dynamically process massive amounts of data in near-real-time.

As the number of organizations running the latest versions of Linux continues to increase, more hands-on experience with eBPF will be gained. IT teams may not need to concern themselves with what is occurring in the microkernel of the operating systems, but they do need to understand how eBPF ultimately reduces the total cost of running IT at scale.

Ultimately, the goal is to reduce the current level of complexity that today makes effectively managing highly distributed computing environments all but impossible for IT teams to manually maintain in an era where the pace at which applications are being built and deployed only continues to accelerate.

December 21, 2023
Digibee Adds AI Tool to Accelerate Migration to Integration Platform

Digibee is leveraging artificial intelligence (AI) to make it simpler to migrate to its integrated platform-as-a-service (iPaaS) environment by converting code into a JavaScript Object Notation (JSON) format.

A translator tool created by Digibee invokes large language models (LLM) to convert that code into a JSON file that can then run on the Digibee Integration Platform.

Initially, that capability is being made available to facilitate migrations from the Mulesoft integration platform made available by Salesforce, with support for other legacy integration platforms planned for 2024.

Digibee CTO Peter Kreslins Junior said this approach reduced the level of time and effort required to switch platforms by using generative AI to map and refactor legacy integration code. That refactoring process doesn’t completely automate the reverse engineering of workflows, but it does substantially reduce the total cost of switching platforms by, for example, automating data migration and simplifying the transfer of configurations, he noted.

Generative AI also eliminates the need to rely on documentation or maps that either may be limited or non-existent, added Kreslins. Instead, all the integration patterns used can now be automatically discovered by an LLM, he added.

IT teams will still need to vet and test the code created by the translator tool, but overall, the speed at which any migration effort is made should be accelerated, thanks to the rise of generative AI, in 2024. Many organizations are locked into various platforms today simply because the effort required to rework the code that has been created to extend them has required either too much effort on their part or the contracting of expensive consultants. A migration project that might have taken a year or more can now be accomplished in a few days, said Kreslins. The overall goal is to reduce the current level of pain IT teams experience when migrating between platforms, he added.

It’s not clear if the rise of generative AI platforms that make converting code into other formats and languages simpler will drive a wave of migrations, but there are many organizations relying on legacy platforms that are not nearly as easy to use as more modern alternatives. As the time and effort required to make those transitions is reduced, more IT teams will be, at the very least, more open to considering their platform options. The providers of those legacy platforms will naturally have to invest in new capabilities much faster to discourage customers from migrating to another platform.

In the meantime, the amount of code that will need to be integrated is about to exponentially increase as developers rely more on LLMs to generate code. The downstream implications of that increased pace of application development for DevOps teams are profound. It’s not clear to what degree those teams can increase the level of scale at which they today manage application deployments.

The one thing that is clear is there is no going back because, so far as application development and deployment are concerned, the proverbial AI genie is out of the bottle.

December 20, 2023
Opsera Leverages AI to Simplify DevOps Platform Migrations

Opsera is leveraging a generative artificial intelligence (AI) model it built to enable DevOps teams to migrate from one platform to another.

Gregg Holtzrichter, chief marketing officer for Opsera, said the Hummingbird AI model makes it simpler to migrate source code from, for example, a Bitbucket on-premises continuous integration/continuous development (CI/CD) platform to GitHub.

Opsera originally developed Hummingbird as an orchestration engine that integrates DevOps workflows spanning multiple tools and platforms. The primary goal is to make it possible for DevOps teams to unify their workflows, said Holtzrichter.

At the same time, Opsera is now making it possible to leverage a generative AI model to reverse engineer the source code a DevOps team may have developed to extend the capabilities of a specific platform. That new code then makes it possible to significantly reduce the total cost of switching DevOps platforms, said Holtzrichter. As part of such an effort, Opsera is also now providing support for organizations looking to specifically migrate to GitHub Copilot and GitHub Actions.

It’s not clear how many DevOps teams might be looking to switch platforms, but with the rise of generative AI capabilities for writing code, interest in platforms such as GitHub has increased, noted Holtzrichter. In addition, support for platforms such as the on-premises edition of Bitbucket is being sunsetted by Atlassian as part of an effort to drive more customers toward the cloud edition of the CI/CD platform.

Regardless of the underlying platforms involved, generative AI promises to reduce the ability of any vendor to lock customers into a specific platform. As DevOps teams extended DevOps platforms over the past decade, many of them have discovered that the integrations they created and maintained made it all but impossible to switch platforms. With the ability to refactor much of that code based on the insights surfaced by the Opsera platform using generative AI, the time and effort required to switch platforms has been substantially reduced, noted Holtzrichter.

At its core, Opsera makes it possible to apply analytics to DevOps workflows as they become more complex. The number of dependencies that exist between various application modules, for example, makes it exceedingly difficult for DevOps teams to manually identify the impact a delay in one project might have on any number of other downstream projects.

The Opsera platform surfaces that intelligence by scanning all repositories and branches, including commit history and generating alerts and notifications whenever KPI thresholds or compliance requirements are exceeded. DevOps teams can also use the platform to assess their overall DevOps maturity using, for example, the DevOps Research and Assessment (DORA) metrics defined by Google. In addition, many organizations are keen to discover what best practices should be adopted by other application development teams.

Now that AI is being applied to that analytics capability, it’s become possible to extend the reach of the Ospera platform beyond analytics to include source code migration. Each organization will still need to determine whether such an effort is worth the remaining time and effort still required, but at the very least, most DevOps teams can take comfort in the fact they can now keep their options a lot more open.

December 19, 2023
Sonar Adds Secrets Detection to Code Analysis Portfolio

Sonar has added a secrets detection capability to its portfolio of tools for analyzing code and DevOps workflows.

Designed to be applied to both finding secrets in code repositories and as applications are developed using an integrated development environment (IDE), this capability is being added to SonarLint, SonarQube and the managed SonarCloud service to identify, for example, passwords, application programming interface (API) keys, encryption keys, tokens, database credentials and other private information.

Sonar co-CEO Olivier Gaudin said the goal is to eliminate secrets that are accidentally or maliciously stored in source code to improve software supply chain security.

While it’s important to discover secrets in codebases, Sonar is making a concerted effort to make it simpler for developers to discover secrets before they find their way into a codebase that is one step away from a production environment, noted Gaudin. The SonarLint static analysis tool the company provides can now discover secrets in microseconds using the syntactic and semantic analysis engines the company has now extended, he added. No developer is going to wait five to 10 minutes for a code scan to be completed, said Gaudin.

A Learn as You Code tool also explains how each secret found in a code segment poses a security risk. The overall goal is not only to remove secrets but, ultimately, reduce the number of instances where secrets are discovered in code, said Gaudin.

Most organizations today are at varying stages of embracing DevSecOps best practices to improve software supply chain security. It’s not clear how readily secrets management is being embraced as part of those modernization efforts, but as cybercriminals routinely scan for application secrets stored in clear text that can be used to compromise application security, the need to encrypt secrets becomes a higher priority.

There is, of course, no shortage of tools for detecting secrets. Sonar is now simply making a case for managing secret detection as part of a larger effort to reduce vulnerabilities in code that cybercriminals can exploit. That approach should help reduce the total cost of securing a software supply chain at a time when forthcoming regulations are going to make organizations that deploy software more accountable for application security.

In the meantime, thanks to the rise of generative artificial intelligence (AI), the volume of code that needs to be scanned will likely exponentially increase. The issue with general-purpose AI platforms such as ChatGPT is they were trained using code of varying quality that often contains vulnerabilities that are now sometimes incorporated into the code they generate. On the plus side, however, many developers have little to no application security expertise, so it’s just as feasible that ChatGPT will create more secure code than a human developer. Regardless of how the code was created, however, no one will know for sure how secure it is without scanning it first.

Hopefully, as AI progresses, the quality of the code being generated will only continue to improve. Until then, DevOps teams should continue to assume all code is suspect until proven otherwise.

December 18, 2023