devopsy.kinsta.cloud

Category: DevOps Culture

Cisco Extends Scope and Reach of Observability Platform

Cisco this week expanded the scope of its observability platform by adding predictive and generative artificial intelligence (AI) capabilities along with log analytics and a Core Web Vitals tool to make it simple to ensure web pages don’t lose their search engine ranking because of poor user experience.

In addition, Cisco is now leveraging extended Berkeley Packet Filters (eBPF) in the kernel of Linux operating systems to provide visibility into Kubernetes workloads and a session replay capability for cloud-native applications. In addition, Cisco has allied with Komodor, a provider of a Kubernetes management platform, to gain additional visibility into these environments.

Cisco also added digital experience monitoring (DEM) capabilities based on real user monitoring (RUM) and the full-stack observability it provides following its recent acquisition of Accedian, a provider of an analytics platform for monitoring end-user experiences.

Finally, Cisco added a Data Security Posture Management (DSPM) Observability module to the company’s Business Risk Observability platform based on the same core platform.

Announced at a Cisco Live EMEA event, these latest updates are part of an ongoing Cisco effort to extend the reach of its observability platform well beyond DevOps workflows.

Gregg Ostrowski, executive CTO for Cisco AppDynamics, said as part of that effort, Cisco is making it simpler to aggregate telemetry data for the AI for IT operations (AIOps) capabilities it provides by pulling directly from platforms such as Cisco ThousandEyes and Cisco DNA Center as well as from third-party partners such as VMware, Zabbix and ServiceNow. Similarly, Cisco is now leveraging eBPF to collect data from Kubernetes environments.

Ostrowski added that the overall goal is to reduce the amount of instrumentation effort that IT teams would have to undertake to instrument highly distributed IT environments.

There will still be a need to instrument applications, but the collection of telemetry data from the underlying IT infrastructure environment is going to be increasingly automated, he noted. In the meantime, it’s become less expensive to instrument applications using open source OpenTelemetry agent software, added Ostrowski.

In general, Cisco, in addition to enabling organizations to rationalize existing tools, is also making a case for improving collaboration by, for example, making use of natural language capabilities enabled by generative AI to launch queries and provide summarizations.

At the same time, Cisco is partnering to add additional capabilities, such as the ability to monitor machine learning algorithms via an alliance with Aporia and AS/400 systems via an alliance with Perform IT.

Ultimately, Cisco is betting that observability across the entire enterprise IT environment is going to become more unified as organizations increasingly look to correlate business processes with specific IT events, including indications of cybersecurity breaches. It’s not clear how far down that path enterprise IT organizations are just yet, but given the total cost of observing and monitoring IT environments today, there is more pressure than ever to find more cost-effective approaches to holistically managing IT. The challenge, as always, is unifying all the existing fiefdoms in IT organizations that have already embraced a wide variety of tools and platforms they are hesitant to give up.

February 9, 2024
How Can DevOps Teams Use Customer Intelligence Data?

Customer intelligence involves collecting and analyzing data about customers’ behaviors, preferences and needs. It helps businesses understand their customers better and tailor their products and services to meet customer demands. The data is gathered from various sources, such as customer feedback, web analytics, social media, purchase history and software usage metrics. The insights drawn from customer intelligence can be used to inform business strategy, product development and marketing efforts.

The goal of customer intelligence is to create a detailed understanding of the customer’s needs, preferences and habits. This information can be used to predict future behavior, improve customer service and drive sales. For instance, if a software company knows that a particular customer segment mainly accesses their software on mobile devices, the organization can improve their mobile support or create dedicated mobile applications for that customer segment.

How Can DevOps Teams Use Customer Intelligence Data?

There are several ways that a DevOps team can leverage the data gathered from customer intelligence.

Prioritizing Feature Development Based on Customer Feedback

When developing new features, it’s useful to analyze customer feedback to understand what features customers find most valuable and prioritize those for development. For instance, if feedback suggests that customers want a more intuitive user interface, the team can prioritize UI improvements.

By focusing on the features that customers find most valuable, DevOps teams can improve the usability and functionality of their products. This can lead to higher customer satisfaction and loyalty and, ultimately, increased sales. Additionally, prioritizing feature development based on customer feedback can help DevOps teams avoid wasting time and resources on features that customers don’t value.

Tailoring UX and UI Design Based on Customer Preferences and Behaviors

By analyzing data on how customers interact with their products, teams can identify pain points and areas for improvement. For example, if data shows that customers are having difficulty navigating the website, the team can redesign the navigation to make it more user-friendly.

Alternatively, if customers abandon their shopping carts at a certain point in the checkout process, the team can investigate and make necessary improvements.

Using Customer Data to Drive Personalization and Customization Features

Personalization is about tailoring the customer experience to the individual user, while customization is about giving customers the ability to tailor the product or service to their specific needs.

For instance, by analyzing data on a customer’s browsing and purchase history, a team could develop a feature that recommends products based on the customer’s past behavior. Or, if a customer frequently purchases a certain type of product, the team could create a feature that allows the customer to customize that product to their liking.

Leveraging Predictive Analytics to Forecast Future Customer Needs and Trends

Predictive analytics involves using historical data to predict future events. In the context of DevOps, this could mean using customer data to forecast future customer needs and trends.

For example, if data shows a growing interest in eco-friendly products, the team could anticipate this trend and start developing more eco-friendly products. Predictive analytics can also help teams identify potential issues before they become problems, allowing them to address those issues and improve the customer experience proactively.

Best Practices for Effectively Using Customer Intelligence in DevOps

Here are some best practices that DevOps teams can use to make the most of their customer intelligence data.

Integrate Customer Feedback Early and Often

Customer feedback from surveys, social media, and customer service interactions provides invaluable insights into what customers need, their pain points, and their preferences.

By integrating this feedback into the DevOps process, teams can better understand customer needs and develop products or services that address those needs effectively. Early integration of customer feedback allows teams to pivot and make changes more swiftly, thus saving time and resources.

It’s also important to obtain feedback regularly. Customers’ tastes and preferences evolve continuously, and their feedback reflects those changes. Feeding frequent customer intelligence into the development process ensures the DevOps team’s work stays aligned with the shifting customer landscape.

Leverage Analytics Tools

Analytics tools can help DevOps teams sift through large volumes of customer data and extract actionable insights. These insights can then be used to inform decision-making and drive innovation.

Some tools excel at data visualization, helping teams understand complex datasets through graphs and charts. Other tools excel at predictive analytics, helping teams forecast future trends based on historical data.

Choosing the right analytics tool depends on the specific needs of the DevOps team and the nature of the customer intelligence data they have at their disposal. The key is to leverage its capabilities fully to extract the most value from the customer intelligence data.

Ensure Data Quality and Relevance

Not all data is created equal, and if it is poor quality or irrelevant, it can lead to misguided decisions and wasted resources.

Data quality refers to the accuracy, completeness, consistency, and reliability of the data. DevOps teams should implement robust data quality checks to ensure that the customer intelligence data they’re using is of high quality.

Data relevance, on the other hand, refers to the data’s applicability to the task at hand. Not all customer intelligence data is relevant to every DevOps project. Teams need to carefully select the data that is most relevant to their specific project and ignore the rest.

Balance Quantitative with Qualitative Data

While quantitative data provides hard numbers and concrete facts, qualitative data offers deeper insights into customer attitudes, perceptions and behaviors.

Quantitative data can help DevOps teams identify trends, measure performance, and track progress over time. However, it often fails to explain why certain trends are occurring or why performance is changing.

It also can help DevOps teams understand the reasons behind the numbers. It can provide insights into why customers behave the way they do and what they truly think and feel about a product or service. Balancing quantitative with qualitative data gives DevOps teams a more holistic view of the customer landscape, enabling them to make more informed decisions.

Cross-Functional Collaboration

Customer intelligence data is valuable for all teams across the organization, not just DevOps. By collaborating with other teams, such as marketing, sales and customer service, the DevOps team can gain additional insights and perspectives.

Cross-functional collaboration also fosters a culture of data-driven decision-making across the organization. When all teams use customer intelligence to inform their work, the organization as a whole becomes more customer-centric, agile and innovative.

Conclusion

Successfully using customer intelligence data in software development allows teams to remain responsive to customer needs and increase the value of their products. DevOps teams need to integrate customer feedback early and often, leverage analytics tools, ensure data quality and relevance, balance quantitative with qualitative data,and foster cross-functional collaboration. By following these best practices, DevOps teams can use customer intelligence data to drive innovation and create products and services that truly resonate with customers.

Image source: Josh Sortino via Unsplash

February 9, 2024
Empowering Developers Fuels IT Resilience and Business Transformation
Developers are feeling the brunt of global economic pressures on their organizations to move digital transformation projects forward while having to do more with less. Adding to this pressure is the explosion of technologies like generative artificial intelligence (generative AI) and edge computing, which have made infrastructures more interesting and possibly more complex. The overall result is an increased mental load for developers tasked with bringing innovation to life while minimizing all the added complexity. And it’s DevOps teams who are carrying the weight of ensuring seamless integration, deployment and automation of new technologies. It’s incumbent upon IT leaders to give developers and DevOps teams a simplified, trustworthy data architecture to ease this burden if they want their modernization efforts to thrive.

It’s a difficult juggling act IT leaders know all too well — controlling costs and improving efficiency while increasing agility and resiliency. Management, budget and technology challenges have been causing digital transformation projects to be put on pause to avoid potential drawbacks or failures. In fact, 68% of organizations facing modernization challenges were forced to push digital transformation goals back by more than three months, with delays costing organizations $4.4 million on average.

Despite the hurdles — many of which were brought on by the COVID-19 pandemic — enterprises continue to focus on modernization: Nearly 60% said their key digitization goal is to improve business resilience and add AI-powered efficiency in the face of the evolving global economy. Recent research revealed that 53% of executives have already deployed some form of generative AI, with 45% forecasting that integration of automation and AI tech will catalyze a major transformation in their industry within the next five years.

The call to empower developers and DevOps teams is loud, and IT leaders should heed it.

Putting Developer Empowerment at the Top of the IT Agenda

Developers and DevOps teams must constantly adapt, from keeping up with changing market demands and customer expectations to navigating technology stack intricacies across a myriad of platforms, tools and frameworks. They also need to stay updated on the latest security practices throughout the development life cycle. Through it all, the pressure to innovate rapidly looms large.

Given their central role in today’s business, empowering the people who build and run modern applications must be a top IT investment priority. These investments have a synergistic payoff. They not only strengthen developers and DevOps teams, but the entire business reaps the benefits:
- When given the support and tools they need to successfully embrace new technologies and create new services, developers are empowered to take on new projects, implement new technologies and take advantage of growth opportunities. For example, cloud-based solutions, such as database-as-a-service (DBaaS) and containers-as-a-service (CaaS), offer developers vast opportunities to enhance their agility and efficiency to drive competitive advantage for their organization.
- Additionally, low- and no-code platforms, AI coding assistance and serverless computing allow IT to create opportunities for other business units to build their own services. This reduces reliance on developers for simpler tasks that line-of-business teams can accomplish themselves, freeing developers to focus on expediting innovation and helping to increase productivity across the organization.
Freeing Developers to Innovate With AI Increases Their Productivity

IT spending on AI is sure to evolve over the next few years. IDC predicts generative AI spend will reach $143 billion in 2027. Gartner recently stated that “while GenAI has not yet had a material impact on IT spending, investment in AI more broadly is supporting overall IT spending growth.” IT teams are working on their AI strategy and still need to better understand the role of generative AI or large language models (LLMs) before fully adopting them across the business. However, if one thing is clear to IT leaders today, it’s that AI can make developers more productive and speed up the pace of software development.

Furthermore, with AI, software development can be more efficient, accurate and adaptive, leading to faster development cycles, higher-quality applications and better user experiences. AI tools can assist developers in writing complex code, detecting and fixing issues faster and automating the testing process. AI can also offer many ways to enhance the overall DevOps process by automating repetitive tasks and analyzing workflow data to optimize processes.

As organizations aim to modernize and take advantage of generative AI, IT leaders should empower developers and DevOps teams to use it to simplify how they develop, deploy and run applications. By prioritizing the adoption of new technologies, such as cloud-native IaaS, AI, edge, mobile, serverless and low- and no-code computing, IT teams can help make DevOps teams more agile, cut down on costs and speed innovation.
February 8, 2024
How GitHub Approaches Internal Developer Experience

Developer experience (DX) has been the talk of the town, and for many reasons. Quality DX is intrinsically tied to increased productivity, velocity and developer happiness. Organizations that invest in DX tend to see efficiency improvements and less employee churn, contributing to reduced costs.

As such, much effort is being placed on ways to improve the experience developers have with their internal workflows and tools. But what are some good models of developer experience in practice? For that, let’s turn to GitHub.

GitHub, the ubiquitous code repository and version control platform, is naturally a developer-favorite tool. And internally, GitHub is constantly seeking to improve the experience its own developers have in building, deploying and maintaining software. Below, we’ll explore how GitHub approaches DX and instills these traits into its software development culture.

Allocating Time For Deep Work

The most crucial practice GitHub takes is allowing developers to enter the flow state and stay there. Dr. Eirini Kalliamvakou, staff researcher at GitHub, defines “deep work” as time blocked off intended for focus. “During that time, you experience as little interruption as possible,” she said. According to Kalliamvakou, employees at GitHub actively block off time for deep work — some teams even have “no-meeting Thursdays.”

There is research to support the benefits of allocating time for deep work. As I previously covered, one internal study of Microsoft employees found that developers who formally set aside focus time for coding experienced a significant boost in overall satisfaction and perceived productivity.

More recently, GitHub partnered with research group DX for a study, DevEx In Action, that assesses the observable outcomes of improving developer experience. Impressively, the results found that developers who dedicate significant time to deep work enjoy a 50% productivity boost.

Using AI Pair Programmers

It will come as no surprise that developers at GitHub dogfood GitHub Copilot, the AI-powered code completion tool built on OpenAI’s Codex. According to Jon Peck, senior manager, developer relations & enterprise advocacy at GitHub, Copilot is truly integrated into most of his daily tasks. “Copilot lives with me in any development environment I’m using,” he said.

Nowadays, the technology can enable complete, viable functions that are contextually and stylistically aware, he said. Furthermore, Copilot Chat now integrates into Jetbrains and VSCode, bringing it closer to the programmer’s accustomed development environment. Peck specifically highlights developer experience gains from using it for boring activities, such as building unit tests for new code or auto-summarizing the functionality of components.

Running Automation in the Background

Having more automation baked in is another way GitHub enhances its developer productivity and experience. “Developer-facing automation allows devs to stay in the flow longer, interrupting them only when something needs their attention,” said Peck.

For example, teams utilize GitHub Actions for all kinds of triggers, such as responses to new code commits or changing the state of issues, said Peck. Running asynchronous tests in the background and notifying the developer only if something breaks enables them to stay head-down in the code for more extended periods. Additionally, asynchronous communication around pull requests and code reviews can ensure teammates collaborate effectively on their own time.

These traits are often adopted in cloud-native software development cultures like GitHub. The more you can make tests and build processes run in the background, the better, explained Kalliamvakou. Plus, reducing notification fatigue is another way to ensure developers aren’t interrupted unless something really needs their attention.

Regularly Collecting Feedback

To optimize developer experience, it’s a good idea to collect developer feedback. For instance, at GitHub, their developer experience team regularly conducts internal surveys to surface areas for improvement — this helps gauge satisfaction with the amount of deep work developers are engaged in. Similarly, LinkedIn regularly collects qualitative input using an internal framework to gauge developers’ satisfaction with their tools.

GitHub also runs a newsletter to spread awareness about what new internal features they’re introducing and to regularly review the state of things. “When you introduce a developer experience initiative, you need to create awareness around it and track how people are responding over time,” said Kalliamvakou. Keeping an active tab on the success of these initiatives is a good health check to avoid burnout.

Shifting Security Left A Bit

Another area where GitHub focuses on improving developer experience is around security. Traditionally, systems perform security scanning after all code is committed. However, this can be a big pain to go back and fix, especially when you need to track down multiple dependencies and don’t have great visibility.

“The closer you get security scanning to the point where the vulnerability was created, the easier it will be to remediate it,” said Peck. Shifting left to detect potential vulnerabilities in the moment and offering “one-click to remediate” options can significantly enhance the developer experience. He also described how GitHub engineers dogfood GitHub’s advanced security features to perform things like ongoing secrets scanning, input sanitization and pattern-based analysis.

Making Processes Understandable and Intuitive

Interestingly, the DevEx in Action study found that developers who report a high degree of understanding of their code feel 42% more productive than those with low or no understanding. So then, how can we enhance our understanding of code?

Often, a developer might forget the context behind something they wrote last year, or something a teammate programmed might seem obfuscated. This is another area where AI could be utilized to generate documentation automatically. However, the future of code understandability goes beyond just static documentation.

“The trend is toward learnability right where they are, to keep them in the flow,” said Kalliamvakou. She indicates that AI-driven insights embedded into the IDE that explain what a program or function means make the developer workflow highly intuitive.

Offering Cloud-Based IDEs

Developers often run into the “works on my machine” problem, which can be a big developer experience hurdle. In essence, applications depend on far more than just the code — they are at the whim of the environment, local dependencies, its configurations, and the actual device running the program.

By using cloud-based IDE like Codespaces, said Peck, GitHub developers are able to spin up a container in the cloud and retain the same configurations. The benefit of this is that you can keep your local editing experience as well, he said.

Retaining An Engaged Developer Experience

According to Kalliamvakou, the benefits of developer experience are no longer just anecdotal — we now have real-world evidence to back up these claims. For instance, developers who find their work engaging feel 30% more productive, according to the aforementioned report.

It seems that having an AI coding assistant by your side trained on a large language model (LLM) can encourage developer satisfaction and productivity gains. Introducing AI-based tooling can help automate away some of the unfulfilling work, leaving more time for more engaging activities, said Kalliamvakou.

But although AI can solve many things, there will always be some degree of toil. Kalliamvakou recommends distributing grunt work across multiple employees and avoiding throwing it all on one person! At GitHub, the DevEx team also analyzes the efficiency of meetings to remove non-high-quality meetings, which can also benefit engagement.

February 8, 2024
DevOps Guide to Java Profiling
Java profiling is a technique used to understand the detailed behavior of a Java application. It involves monitoring and measuring various aspects of a program’s execution, such as memory usage, CPU utilization, thread execution and garbage collection.

Java profiling can be used in various stages of the software development life cycle (SDLC). During development, it can help identify bottlenecks and performance hotspots, which can then be optimized for better performance. In the testing phase, profiling can be used to verify that the application performs as expected under load. Finally, in production, profiling can be used to monitor application performance and detect potential problems before they affect users.

Java profiling tools provide insights into the Java Virtual Machine (JVM) and the application running on it. They allow developers to monitor thread execution, object creation, garbage collection and many other aspects of JVM operation. By using a Java profiler, developers can gain a deep understanding of the application’s performance characteristics and identify potential areas for optimization.

Why is Performance Tuning Important for DevOps?

Impact on Application Efficiency and Scalability

Performance tuning plays a vital role in DevOps by enhancing the efficiency and scalability of applications. Efficient applications use fewer resources, which reduces costs and allows for more users or larger workloads. Scalability is the ability of an application to handle increased workloads without a decrease in performance. By identifying and eliminating performance bottlenecks, DevOps teams can ensure that applications scale effectively as demand increases.

Relationship Between Performance and User Experience

Performance is directly related to user experience. A slow or unresponsive application can frustrate users and lead them to abandon the application altogether. By ensuring that applications perform well, DevOps teams can improve user satisfaction and retention. Furthermore, by monitoring application performance in production, DevOps teams can proactively identify and resolve issues before they impact users.

Cost Management and Resource Optimization

Performance tuning can also help with cost management and resource optimization. By optimizing application performance, DevOps teams can reduce the amount of computing resources required to run the application. This can result in significant cost savings, especially in cloud environments where costs are directly tied to resource usage.

Moreover, by understanding the application’s resource usage patterns, DevOps teams can make more informed decisions about resource allocation and capacity planning. This can help avoid over-provisioning, which leads to wasted resources, or under-provisioning, which can result in poor application performance.

Common Java Performance Issues

Memory Leaks

Memory leaks are a common performance issue in Java applications. A memory leak occurs when an application continuously allocates memory but fails to release it when it is no longer needed. Over time, this can lead to OutOfMemoryError exceptions and can cause the application to crash.

Java profiling can help identify memory leaks by monitoring the application’s memory usage over time. If the memory usage continuously increases even when the application is idle, this could indicate a memory leak. Profiling tools can also provide insights into the objects that are consuming the most memory, which can help locate the source of the leak.

Thread Contention and Synchronization Issues

Thread contention and synchronization issues can significantly impact the performance of Java applications. Thread contention occurs when multiple threads attempt to access a shared resource simultaneously, causing them to wait and leading to reduced performance. Synchronization issues, such as deadlock and livelock, can cause threads to become stuck, preventing them from making progress.

Java profiling can help detect thread contention and synchronization issues by monitoring the state and execution of threads. Profiling tools can show which threads are running, waiting or blocked and can provide a stack trace of each thread, which can help identify the cause of contention or synchronization issues.

Garbage Collection Overhead

Garbage collection is a key aspect of Java’s memory management, but it can also be a significant source of performance overhead. During garbage collection, the JVM pauses application execution to reclaim memory from objects that are no longer in use. If garbage collection occurs too frequently or takes too long, it can lead to application pauses and reduced performance.

Java profiling can help understand and optimize garbage collection behavior. Profiling tools can provide detailed information about garbage collection events, such as their frequency, duration and the amount of memory reclaimed. This information can help developers tune the garbage collector’s configuration to minimize its impact on application performance.

Resource Starvation

Resource starvation is another common performance issue in Java applications. It occurs when a system or process is unable to gain sufficient access to resources, leading to reduced performance or failure. In Java applications, resource starvation can be caused by factors such as insufficient memory, CPU, disk space or network bandwidth.

Java profiling can help detect and resolve resource starvation issues. By monitoring resource usage, profiling tools can identify when resources are becoming scarce and provide insights into the factors contributing to resource starvation. This information can help developers optimize resource usage and ensure the application has sufficient resources to perform effectively.

Key Features of Java Profiling Tools

Java profiling tools typically provide the following features:
- Ability to detect memory leaks: Memory leaks can be a significant issue in Java applications as they can lead to an out-of-memory error, disrupting the smooth running of the application. Profiling tools can help identify these leaks, allowing developers to fix them before they cause bigger issues.
- CPU profiling: This allows developers to see how much CPU time each method in their application is consuming. By identifying methods that are consuming a disproportionately high amount of CPU time, developers can optimize their code to improve its performance.
- Detailed thread profiling: This can help developers to identify synchronization issues, deadlocks, and other potential problems in multi-threaded applications. By providing this critical insight, profiling tools can help developers to create more efficient, high-performing applications.
Best Practices for Java Profiling

Here are some best practices to make the most out of your Java profiling efforts.

Identifying Key Performance Metrics

First and foremost, it’s essential to identify the key performance metrics that are most relevant to your application. The metrics you choose will depend on the nature of your application and its performance requirements. Some common metrics include response time, CPU usage, memory usage and garbage collection activity. By identifying these key metrics, you can use your profiling tools to monitor them and identify any potential issues.

Integrating Profiling in CI/CD Pipelines

Another best practice is to integrate profiling into your Continuous Integration/Continuous Deployment (CI/CD) pipelines. This allows you to catch performance issues early in the development process, before they become more difficult to fix. By regularly profiling your application during development, you can ensure that any changes you make don’t adversely affect its performance.

Profiling in Real-World Scenarios

While it can be useful to profile your application under controlled conditions, it’s also important to do so in real-world scenarios. This means profiling your application when it’s under load, when it’s dealing with real data, and when it’s running on the same hardware and software configurations as it will in production. By doing so, you’ll get a much more accurate picture of how your application performs in the real world.

Collaboration and Knowledge Sharing

Finally, Java profiling should not be a solitary activity. It’s important to share your findings and insights with your team, and to collaborate on solutions to any performance issues you identify. By doing so, you can build a culture of performance awareness within your team, and ensure that everyone is working towards the common goal of creating efficient, high-performing Java applications.

Java profiling is a vital part of the software development process. By understanding its key features and following best practices, you can use it to create applications that are efficient, high-performing and able to meet the demands of the modern world. So don’t underestimate the power of profiling—embrace it, and watch your Java applications reach new heights of performance.
February 7, 2024
OpenText Extends Tool for Auditing Source Code Using Machine Learning

OpenText this week updated a static analysis tool it provides to audit code using machine learning algorithms to provide deeper insights into on-premises IT environments.

Announced at the OpenText Security Summit 2024 conference, the latest generation of Fortify Audit provides additional artificial intelligence (AI) models capable of learning the unique attributes of custom source code.

The latest version of Fortify Audit Assistant also adds the ability to detect drift in a model and, if necessary, automatically refresh it. OpenText is now committing to refreshing those models every quarter.

The discriminant AI model from OpenText enables machine learning algorithms to learn how humans conducted an application audit to then run similar tests on other applications. Previously, Fortify Audit relied on the same core model to audit both on-premises and software-as-a-service (SaaS) applications based on data collected by OpenText. Fortify Audit Assistant now provides support for more than 30 language-specific models to improve testing performance.

Dylan Thomas, senior director for Fortify engineering and product for OpenText Cybersecurity, said this capability ensures that any sensitive data never leaves an on-premises IT environment.

The overall goal is to streamline the number of alerts that would otherwise overwhelm a DevSecOps team trying to identify the root cause of an issue, he added. For example, Fortify Audit Assistant will identify test code that is not vulnerable because it was never deployed in an actual production environment. That approach makes it easier for DevOps teams to prioritize which vulnerabilities to fix first in their source code using a lightweight AI model that still enables them to deeply scan source code, noted Thomas.

Historically, DevSecOps teams need to make a trade-off between lightweight approaches and deep scans of source code that is no longer required, he added.

As regulations pertaining to software supply chain security become more stringent the number of development teams that will be subject to some type of audit is only going to increase. The cost of failing an audit will also inevitably increase as regulatory bodies look to make examples of organizations that are not properly securing their software supply chains.

It’s not clear how aggressively organizations are embracing best DevSecOps practices to address myriad software supply chain security issues that were highlighted in an executive order issued by the Biden administration to Federal agencies. However, with the rise of AI and other forms of automation, it should become simpler to identify more vulnerabilities before they wind up being exploited in a production environment.

There will always, of course, be a need to secure production environments because there’s always a probability mistakes will be made. However, given the lax practices many organizations have employed to build and deploy applications, it’s probable the number of vulnerabilities that exist in production environments today is beyond counting. In many cases, the better part of valor might be to replace many of those applications entirely with ones built using DevSecOps best practices.

Regardless of the path to better application security chose the one thing that is certain is cybercriminals are only going to become even more adept at discovering those vulnerabilities.

February 6, 2024
IBM Adds Lower-Cost Linux Mainframe to Portfolio

IBM today made its most aggressive move yet in its quest to make mainframes running Linux more affordable, launching an entry-level platform starting at $135,000.

The IBM LinuxONE 4 Express is a pre-configured rack system that is based on the same 5.2Ghz IBM Telum processor that IBM uses in its Z16 series of mainframes.

In addition, the platform supports IBM Secure Execution, which is designed to thwart any attempt to decrypt data in the future using quantum computers.

IBM claims organizations that move Linux workloads from x86 servers to an IBM LinuxONE 4 Express can save over 52% on their total cost of ownership over five years.

The overall goal is to make it simpler for organizations to consolidate workloads that otherwise would need to be deployed across a distributed computing environment, she added. That approach ensures higher levels of availability for workloads that are increasingly processing massive amounts of data using two levels of physical and two levels of virtual cache in a way that consumes less energy, noted Tina Tarquinio, vice president of product Management for IBM Z and LinuxONE.

The IBM LinuxONE 4 Express also includes an integrated accelerator for running artificial intelligence (AI) inference engines using more than 6 TFLOPs compute capacity per chip.

IBM expects that as more organizations process sensitive data to drive AI applications, there will be increased interest in deploying applications in more secure on-premises IT environments, said Tarquinio. Mainframes provide a more cost-effective way to achieve that goal at a time when DevOps teams are embracing methodologies such as platform engineering to centralize the management of workloads, she added.

At the same time, increased reliance on automation is making it simpler for IT teams to rely on multiple types of platforms to optimally process workloads. That capability enables IT teams to make platform decisions that are based on fit-for-purpose best principles more easily, noted Tarquinio.

It’s not clear how many organizations will now be able to afford a mainframe when the initial cost of an x86 server is still much lower. But in the face of ongoing economic uncertainty, it seems more organizations are willing to consider all their options. The issue is that adding additional X86 servers is often viewed as the path of least resistance to increasing compute capacity.

Naturally, each IT team will need to decide what path forward makes the most sense for them, but as workloads continue to become more data-intensive, it’s clear that infrastructure requirements are changing. The more data that needs to be processed, the more challenging it becomes to maintain service level agreements that are based on maintaining specific levels of application performance, noted Tarquinio.

The challenge now is determining where best to run those workloads across an increasingly hybrid cloud computing environment that continues to offer more options as IT platforms evolve and expand.

February 6, 2024
Does Using AI Assistants Lead to Lower Code Quality?

The emergence of generative AI has permanently altered how code gets written — and due to the massive productivity boost, there’s no going back. According to GitHub, 92% of developers said they use AI tools, and developers complete tasks 55% quicker using Copilot, the popular LLM-based code generator.

Yet, new research has potentially upset the idea that AI assistants like Copilot are positively advancing software development without consequences. The report, conducted by GitClear, analyzed over 150 million lines of code over the last four years and found an upsetting uptick in code churn and a decrease in code reuse since the dawn of LLM-driven software development.

So, this begs the question: Does using AI assistants actually lead to lower code quality? Well, the answer is complicated. “I wouldn’t say that the report proves that AI assistants are reducing code quality since our data is correlational,” said Bill Harding, programmer and CEO at Amplenote & GitClear, the organization behind the aforementioned research. “But I would say that there is a confluence of indicators that show code quality decline at scale, starting around 2022 and accelerating in 2023.”

AI-Generated Code Increases Overall Volume

One potential contributor to lower code quality is the sheer amount of code produced. Since LLMs automate code generation, production is accelerated across the board. Without guardrails, generative AI will likely contribute to more technical debt.

“AI-enabled code development is going to have a major effect on coding, exponentially increasing the volume and velocity of code delivery, much of which we anticipate will be of lower quality and more bloated,” said Mehran Farimani, CEO, RapidFort.

In addition to quality concerns, there are also governance and security concerns to consider from the use of AI and surges of new code production. Some anticipate this will overwhelm security teams, which have already been struggling to keep pace. “Increased developer velocity is going to put security teams under even more pressure,” said Farimani. “The volume of scans will increase, the range of vulnerabilities that need to be addressed will increase and the patches that need to be applied will increase.”

Blindly Relying on AI Outputs

According to GitHub, developers accept code completions from Copilot 30% of the time. This percentage is likely to keep increasing as the LLM is trained on internal style and comfort with the tool increases. However, there is still the risk of developers blindly relying upon generative AI outputs without giving them the proper oversight, which could also affect code quality.

“I think there is a risk for lower quality code if a developer blindly relies on what an AI assistant generates,” said Rob Whiteley, CEO at Coder. “Generative AI tools have flaws, and if outputs are not verified, they can insert code that compiles but does not behave as a developer may have intended. It can also insert errors or bugs if not checked.”

How to Retain Code Quality in the AI Age

“I would not say that results of [the GitClear] study are conclusive,” said Dr. Eirini Kalliamvakou, staff researcher at GitHub. She believes the results are misleading since there is no way to know if an AI or a human authored the code that was analyzed for the study. That said, she acknowledged that “if we are helping people code faster, we should ask the question about code quality.” So, how do we retain the quality of all code, regardless of whether it’s human- or machine-generated?

Use Copilot Thoughtfully

The first recommendation is to use AI assistants thoughtfully. If you’re exhausted at the end of a long day, it’s a lot easier just to “hit tab” and accept an AI-generated auto-complete. But this might not be the best move. “When used thoughtfully and with oversight from the developer, I do think AI can improve the quality of a developer’s code by making suggestions and preventing human errors,” said Whiteley.

Apply the Same Code Reviews to AI-Generated Code

Additionally, development teams should be applying the same degree of rigor to AI-generated code, taking it through the same design review processes and security reviews as you would for any new application. “Just because you’re writing with Copilot doesn’t mean you should give up on code reviews, your linters, looking for security vulnerabilities and all that,” said Kalliamvakou.

Avoid Redundancy When Possible

Leaner code means efficiency boosts and cost-savings. “Much of code is redundant and AI can streamline that redundancy and offer interesting insights, but not without developers ensuring the suggestions the AI tool makes align with the code they are intending to write,” said Whiteley. “Similar to Gmail’s autocomplete sentence feature, AI can complete lines of code with accuracy, but only as long as it accurately guesses where you’re going with your sentence.”

Keep Tabs on the Impact on Quality

Multiple sources cited that around 30% of code is now AI-authored. Harding calls for more efforts to analyze the impact of AI generation on code quality. “It would benefit the greater good to get a clear and data-backed assessment of how quality fluctuates when developers hit ‘tab’ to accept an AI suggestion,” he said. This is a new field of study, and will require new metrics to fully monitor and appreciate the impact AI has on code quality.

Determine How To Measure Code Quality

Similar to the dearth of consensus on what exactly constitutes developer productivity, defining and measuring code quality is just as challenging. Therefore, Kalliamvakou recommends first defining what code quality means to your organization and what the metrics are. For instance, this could be the “number of defects.” Then, the next step would be to set up methods to alert developers about potential quality issues, she said.

The Bottom Line: AI Enhances Productivity…

AI assistants are changing the way code gets made, and much of this is for the better.

Most notably, AI can have a significant impact on enhancing productivity for up-and-coming or inexperienced developers. “If an enterprise makes technology like generative AI broadly available, then it can supplement the work and boost the productivity of the base of the talent pyramid,” said Whiteley. “Put simply, that investment massively impacts the broader organization, not just the top 1% of developers.” Even if such tools make a developer 20% more productive, they can have a truly transformative impact.

While the GitClear study doesn’t prove the culpability of AI assistants, it raises some interesting questions worth exploring, said Harding. Notably, is code becoming more repetitive? If so, that could have some negative outcomes for overall efficiency. “Code generated during 2023 more closely resembles an itinerant contributor, prone to violate the DRY-ness of the repos visited,” the GitClear report said.

… So, Assess Code Quality

“If leveraged correctly, generative AI will not lower the quality of code,” said Trisha Gee, lead developer advocate at Gradle, Inc. “However, it’s important that developers using this technology are critically evaluating AI-generated code rather than taking what AI suggests at face value. Code from generative AI may not always be ‘correct,’ be the best solution to a problem or match the code style of the codebase.”

My takeaway is that, yes, you can retain code quality while using AI assistants. However, this assessment comes with some strings attached. It will require an ongoing effort to sanitize the outputs of AI and instill the same checks we typically apply to manually-generated code.

Image source: https://vecteezy_futuristic-technology-concept-mixed-media-innovations-data_7019122_167-3.jpg

February 6, 2024
The Sky’s the Limit for Cloud Careers in 2024

The outlook for cloud careers in 2024 is strong. In fact, a recent report by media outlet CIO.com indicated cloud computing positions are at the top of the list that organizations in the tech space will be looking to fill in 2024.

The news will come as no surprise to those who have been following the development of cloud computing in recent years. Businesses in virtually every sector shifted from the data center to the cloud as they sought to find the flexibility and scalability digital transformation demanded.

The following areas of cloud expertise represent those careers that promise to be in high demand in the coming year.

The Cloud Architect

While reports show that cloud spending is on the rise, they also reveal businesses are wasting as much as 32% of their cloud budget. The cloud architect is there to help the client achieve meaningful digital transformation from their cloud expenditures. Additionally, a great cloud architect can reduce costs through optimal design while also promoting business agility.

To excel in their role, cloud architects must develop a deep understanding of business operations as well as available technology tools. Unlike the cloud engineer, who is focused on the hands-on work of building cloud networks, the architect focuses on understanding business needs and leveraging technology to support those needs.

Becoming a cloud architect requires developing business acumen. Architects must have the executive presence required for meeting with the C-suite, speaking their language and understanding their concerns. They must be able to present solutions, sell solutions and lead the teams that will ultimately build and deploy those solutions.

The Enterprise Architect

The enterprise architect extends the focus of the cloud architect to include infrastructure, processes and information systems. Their work flows from a deep understanding of the existing systems within an organization and the role they play in supporting operations. Just like the cloud architect, enterprise architects use their expertise to develop projects that deliver business value.

Enterprise architects also assist organizations in building teams that are competent in using and supporting cloud-based systems. They ensure key personnel are properly trained and resources remain accessible and secure.

According to a recent survey, 51% of executives reported the tech projects their organizations invested in during the past two years did not improve overall business performance. That sad fact is the reason enterprise architects will be in high demand in the coming year. Enterprise architects keep businesses from experiencing tech project failures that result in millions, if not billions, of dollars in loss.

The Security Architect

Organizations that experience security breaches suffer dire consequences. The average cost of data breaches in 2023 was $4.45 million. Beyond the financial costs, businesses also face the long-term implications of reputational damage. In some cases, breaches can result in lawsuits targeting business executives.

To guard against those risks, organizations are increasing their reliance on security architects. These specialists develop the methodologies necessary to repel the cyberattacks that have become common in the business world. Succeeding in this role requires a deep understanding of major cloud platforms, security best practices and trending security threats.

The Artificial Intelligence (AI) Architect

The agility, scalability and flexibility provided by cloud technologies, combined with near-unlimited computing capacity, have played a key role in the advancement and adoption of artificial intelligence (AI). AI architects are focused on helping organizations improve their business performance by designing systems to improve operations. Whether the goal is automation, increasing employee productivity, improving forecasts or other innovations, the AI architect will help companies design AI solutions that will help their clients’ operations and profitability.

A recent report estimated that 50% of IT leaders struggled with moving AI projects past the point of conception in 2023. AI architects are the people who know how to help organizations best leverage the benefits of AI technologies. AI architects need a full understanding of all the types of available AI technologies along with business acumen, leadership skills, sales skills and presentation skills.

The ever-increasing importance of cloud services combined with the lack of available talent means the four roles listed above are positioned to see excellent career growth in 2024. So, if you’re ready to embark on a new career path or continue on your journey, the sky’s the limit.

February 5, 2024
Five Great DevOps Job Opportunities

devopsy.kinsta.cloud is now providing a weekly DevOps jobs report through which opportunities for DevOps professionals will be highlighted to better serve our audience.

Our goal in these challenging economic times is to make it easier for DevOps professionals to advance their careers.

Of course, the pool of available DevOps talent is still relatively constrained, so when one DevOps professional takes on a new role it tends to create an opportunity for others.

The five job postings shared this week are selected based on the company looking to hire, the vertical industry segment and, naturally, the pay scale being offered.

We’re also committed to providing additional insights into the state of the DevOps job market. In the meantime, for your consideration:

Dice.com

Travelers
Hartford, Connecticut
DevOps Tech Lead
$133,500 to $220,300

Indeed.com

Lawrence Berkeley National Laboratory
San Francisco, California
Identity and Access Management DevOps Engineer
$126,900 to $214,140

SimplyHired.com

Workday
Pleasanton, California
Software Development Engineer
$112,500 to $204,000

LinkedIn

IBM
Denver, Colorado
DevOps Engineer
$110,100 to $161,100

CareerBuilder.com

Cognizant Technology Solutions
Oakdale, New Jersey
DevOps Manager – Technology Modernization
$95,500 to $212,600

February 5, 2024