Editorial Calendar for February 2016
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: SUSE announces a Red Hat Enterprise Linux fork after Oracle said a similar thing, and Sarah Silverman says OpenAI and Meta have stolen her words. (more…)
JFrog today announced it is adding a curation capability for open source software to its portfolio that will use metadata generated by binaries to identify malicious packages and software components that have licensing issues.
Sharan Hiremath, senior product manager for JFrog, said JFrog Curation is an extension of the JFrog Artifactory binary repository that the company provides to enable organizations to manage their software supply chains.
JFrog Curation also validates software packages against JFrog’s Security Research library of recorded Critical Vulnerabilities and Exposures (CVEs) and publicly available information to help establish a trusted repository of pre-approved, third-party software components.
That approach automatically employs the JFrog Xray scanning tool to eliminate the need to individually scan each package before developers employ them, said Hiremath.
Making sure open source software components are secure is often problematic because developers download them from public repositories that are frequently targeted by cybercriminals. There have now been more than 100,000 instances of malicious software packages discovered in repositories in the last year alone, noted Hiremath.
In addition, cybercriminals have become adept at creating fake repositories that mimic legitimate repositories; that can result in developers downloading software components infected with malware.
JFrog Curation takes the shift left concept of application security to the next level by automatically blocking the use of risky open source software packages, noted Hiremath. The JFrog platform will also surface advice on how to remediate any vulnerability discovered, in addition to creating an audit trail to enable organizations to comply with various regulatory mandates.
While open source software components reduce the cost of application development, from a cybersecurity perspective, it’s the wild, wild West, noted Hiremath. Organizations are trying to bring more discipline to the way software is constructed by adopting DevSecOps best practices, but they need an approach that doesn’t introduce any additional friction into the application development process, he added.
JFrog Curation addresses that issue by addressing cybersecurity and compliance issues before any open source component becomes part of the build, said Hiremath.
As regulations to hold organizations more accountable for the security of the software they deploy are being proposed around the world, it’s only a matter of time before organizations must revisit the security of their software supply chains. Cybercriminals have already proven how adept they are at injecting malware into software components that could be used in thousands of downstream applications. In the eyes of regulators, organizations that don’t scan open source software for malware and vulnerabilities are engaging in reckless behavior that will warrant stiff penalties.
The challenge is that, after giving developers free rein to develop software any way they see fit, organizations are now faced with a challenge that is as much cultural as it is technical. Automated processes will naturally play a key role in curbing aberrant behavior in application development, but there is, as always, no substitute for some good old-fashioned common sense.
Loft Labs has made available an open source software project that enables DevOps teams to programmatically create developer environments using a tool that runs entirely on a local client.
Lukas Gentele, Loft Labs’ CEO, said DevPod provides an alternative to cloud-based approaches such as Codespaces from GitHub that lock organizations into a specific platform for building applications.
Instead, DevPod can automatically spin up developer environments as code on any public cloud or on-premises IT environment that can run a devcontainer.json file, he added.
In addition, DevPod will also automatically put developer environments to sleep when not being used to reduce costs, noted Gentele. Other capabilities include support for prebuilds, Git and Docker credential synchronization.
DevPod was created by Loft Labs to streamline the development of a virtualization platform for Kubernetes clusters. The company is now making DevPod available as open source software that any DevOps team can use to manage developer environments as code more easily than complex server-side alternatives, said Gentele.
It also makes it easier for developers to switch between cloud-hosted and local environments as needed seamlessly, he noted. That’s critical because it enables organizations to reduce dependencies on cloud computing environments for writing code by allowing developers to use their local machine whenever they prefer, noted Gentele.
Despite the ubiquitous availability of cloud services, most developers continue to prefer to write code on a local machine. The challenge is that replicating a developer environment elsewhere to foster collaboration has been problematic. DevPod provides a means for developers to collaborate with each other and with software engineers without giving up the inherent flexibility a local development platform provides.
At a time when organizations are more dependent on software than ever, there is much more focus on developer productivity. DevOps teams have historically tended to focus on DevOps Research and Assessment (DORA) metrics that focus more on deployment frequency and mean-time-to-recovery than they do on developer productivity.
Of course, measuring developer productivity is an inexact science. An organization might once have tracked lines of code written to gauge productivity, but that is not especially good metric. In more recent times, metrics have been developed that, among other things, keep track of how much time developers spend actually coding versus maintaining their software development environment.
The issue that most IT leaders will immediately encounter is that every minute developers spend on these tasks, however, is one less minute they spend writing the business logic that drives an application.
Obviously, there’s no way developers are going to write business logic daily for eight hours straight; there are maintenance windows. However, application development is as much art as it is science. No one knows for sure when inspiration might strike, but if developers are busy maintaining code created to provision infrastructure, it’s less likely they’ll have a flash of brilliant insight that allows them to make an application better. The easier it is to spin up a development environment, the more likely it becomes that inspiration will one day turn into code that runs in an actual production environment.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Meta launches its much-leaked Threads microblogging app. A spinoff from Instagram, it’s already reached 30 million signups at the time of writing—even before it’s available in the EU. But how is Meta’s DevOps team making it scale? (more…)
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Red Hat Enterprise Linux (RHEL) goes closed source. Well—no, not really; but IBM’s lawyers are accused of skating so close to the edge of legality that they risk violating the GNU Public License. (more…)
We are all familiar with DevOps as a newer approach to software development. The concept is designed to enable developers and IT operations teams to work together. Platform engineering, on the other hand, is a more mature, older approach that has become new again.
Platform engineering, at its core, is the concept of productizing your internal development platforms to make it easier for developers to work. It is an emerging technology approach that can help accelerate the delivery of applications and the pace at which they produce business value. More recently, companies have grown their complex software architectures which have created silos for the teams that manage these various architectures. There may be multiple teams with various specialized skill sets and a single DevOps engineer who takes care of the continuous integration (CI) jobs to deploy and release to production.
Now let’s imagine that you have 10 squads that focus on building and maintaining different applications. Now all of these teams are building and operating 10 different platforms to run their applications, which creates inefficiency across the teams and reinforces silos. In this scenario, teams may spend half of their time building and maintaining the platforms instead of delivering business value. This creates a large cognitive load on developers.
This model becomes very hard to scale. Even though you have these squads managing their own infrastructure and platforms, you may find gaps because there is no centralized standard. So how do platform engineering concepts help with these complex landscapes and boost efficiency?
Platform engineers take all of the tools used to run an application across your various teams and standardize their usage. This enables self-service capabilities for your engineering organizations. Platform engineering can help centralize how you are deploying and running your applications across a complex software landscape. This includes not only the standardization of tools being used but also documentation and processes.
Establishing platform teams requires a consulting mindset and thinking about what resources, services and components can be centralized to better serve the rest of the organization. Some may refer to this as the center of excellence (COE) model, or simply IT for IT. This boosts efficiency and cuts down the time to delivery by providing a central set of tools and platforms for your engineering organization. Many may see platform engineering as a cost center, but the ROI is higher-quality releases, a standardized way of developing and delivering software and shorter delivery times.
In my consulting days, I worked for firms that focused on delivery for the Salesforce platform. We often had complex projects that we needed to deliver for large enterprise customers who had multiple applications integrating into their CRM. Each project team often had a different way of delivering and developing based on the customer’s needs. This created specialized skill sets, but we had no standard way of developing and delivering. Investing in a platform engineering team to support the delivery organization can add immense benefits for large consulting firms, enabling them to standardize the tools and platforms being used to run and deliver applications at scale.
Having a centralized place for your developers to go for process, documentation and tools to help them build and run applications can increase the speed at which they deliver. The efficiencies gained in having a smoother self-service flow for your developers and cutting down the delivery time are worth the investment. It brings significant long-term value that the customer will experience long after the engagement is completed, which can greatly impact future considerations for your firm.
IT services firms should find ways to align and centralize their technologies with platform engineering concepts. You may not be able to exactly build out an internal developer platform, but adopting some of the core concepts will help you be more efficient as an organization. For example, if you are an IT services firm specializing in delivering applications on the Salesforce platform, look for extensible DevOps platforms that can support your development organizations.
Also, look for ways to enable a self-service workflow to make it easier for your developers to work and scale. This may include investing in a platform engineering function to support the rest of the delivery organization. By establishing platform engineering concepts, you will be able to cut down the delivery time and create consistency in how you deliver and deploy applications for your customers.
In recent years, the world has witnessed a significant shift towards remote working, largely driven by global events such as the COVID-19 pandemic. This transformation has necessitated the adoption of new tools and strategies, with automation emerging as a key enabler of effective remote work.
So, what does automation mean in this context? Well, it’s the use of technology to carry out tasks with minimal human intervention. It’s a powerful tool that can streamline processes, boost efficiency and cut down on errors, making it an invaluable resource for companies navigating the complexities of remote work.
According to McKinsey, a whopping 58% of Americans now have the opportunity to work from home (WFH) at least one day per week. And 35% have the opportunity to WFH for the totality of their work responsibilities.
This shift has brought numerous benefits to both employers and employees. For employees, it means more flexibility, less commuting and a better work-life balance. For employers, it broadens the talent pool, cuts overhead costs and can even boost productivity. However, remote working also presents unique challenges, such as:
● Communication Barriers: In a remote work setup, maintaining clear and effective communication can be a challenge. Without face-to-face interactions, messages can be misunderstood or overlooked. This can lead to confusion, mistakes and a lack of cohesion within the team.
● Difficulty in Tracking Productivity: When employees are working from different locations, it can be difficult for managers to monitor their productivity. Traditional methods of tracking work, such as observing employees’ work hours, are not effective in a remote work setup.
● Maintaining Team Cohesion: Building and maintaining a strong team culture can be more challenging when employees are working remotely. Without regular in-person interactions, employees may feel isolated and disconnected from the team.
● Cybersecurity Concerns: Remote work often involves using personal devices and home networks, which may not have the same level of security as office networks. This can expose companies to increased cybersecurity risks.
Now, let’s delve into the ways automation plays a pivotal role in remote work.
Automation and Communication
In a remote work setup, effective communication is paramount. Automation tools such as Slack and Microsoft Teams facilitate better communication by automating tasks like scheduling meetings, sending reminders and translating messages.
These tools can also automate the process of organizing and archiving conversations, making it easier to retrieve information when needed. Additionally, they can automate the process of updating team members about project changes or important announcements. These features ensure that all team members are on the same page, enhancing collaboration, reducing the chances of miscommunication and ultimately leading to a more cohesive and efficient team.
Automation and Human Resources
Automation in human resources (HR) is a game-changer in remote work settings. HR automation software can streamline recruitment, automating resume sorting, interview scheduling and follow-up emails. It can also enhance onboarding, automating welcome emails and account setups.
Performance management can be improved with automated feedback collection and goal tracking. Furthermore, e-learning platforms can automate training assignments, progress tracking and certification issuance. This ensures a consistent, efficient and effective HR process regardless of location, enhancing the remote work experience.
Automation and Project Management
Project management can be a challenge in remote teams due to the lack of face-to-face interaction. Automation tools like Asana and Trello simplify this process by automating task assignments, tracking progress and generating reports.
These tools can also automate the process of setting deadlines, sending reminders for upcoming tasks and notifying team members about changes in project plans. This allows managers to keep track of projects in real time, ensures that deadlines are met and helps in identifying potential issues early on, making project management more efficient and effective.
Automation and Employee Monitoring
Monitoring employee productivity and performance is crucial in a remote work setup. Automation tools like Time Doctor and Toggl track time spent on tasks, providing valuable insights into productivity.
These tools can automate the process of generating productivity reports, tracking breaks and even monitoring website and app usage. This data can be used to identify bottlenecks, improve processes and ultimately increase productivity. It also allows managers to provide constructive feedback and tailor their management strategies to individual employees’ work habits.
Automation and Cybersecurity
Cybersecurity is a critical concern in remote work setups, which often involve multiple devices and networks. Automation plays a key role in maintaining security by detecting threats, installing updates and performing backups. Cybersecurity tools can automate the process of scanning for viruses, blocking malicious websites and encrypting data.
They can also automate the process of updating security protocols and alerting users about potential security threats. This ensures that data remains secure, protecting companies from potential security breaches and giving employees peace of mind to focus on their work.
Automation plays a crucial role in enabling effective remote work. By increasing efficiency, reducing errors and saving costs, automation not only makes remote work possible but also profitable. As the future of work continues to evolve, we should expect to see more and more of the remote working processes being handled by automation tools.
Integral this week launched an open source Robin AI project that leverages OpenAI’s generative pre-trained transformer (GPT) platform to review code changes and provide constructive feedback.
Integral is a data analytics platform used by health care providers. The company originally developed Robin AI using a set of Bash scripts to create a generative artificial intelligence (AI) tool to assist its internal development team.
Integral CTO John Kuhn said Robin AI is essentially a bot that functions like a coach for developers. It first reviews code and then surfaces optimization suggestions that developers can instantly apply, said Kuhn. It’s up to each developer to decide whether to accept those suggestions, but Integral is already using it to, for example, make sure all the code being written is human readable, he added.
Robin AI currently works best on JavaScript code repositories, but can be applied to any codebase residing in a Git repository. Integral has also already developed a GitHub Actions script.
In addition, as an open source project, Robin AI can be integrated with any number of generative AI platforms that might be built using more domain-specific large language models (LLMs), noted Kuhn.
Most developers are already using AI tools such as GitHub Copilot to write better code. Robin AI is now extending generative AI capabilities to the code review process as part of an effort to improve the quality of the code being written. In effect, it provides a means to surface common mistakes developers make and enables them to fix those before they are discovered by a colleague.
It’s not clear how much application development will be driven by AI, but Kuhn said he believes it’s only a matter time before the entire software engineering process is automated. As those advances are made, the cost of building applications will effectively drop to zero, he added.
Of course, not everyone in the application development community agrees with that assessment. But one thing that is clear is that generative AI capabilities will soon be pervasive. In fact, the next frontier will arguably involve integrating generative AI platforms with frameworks that make it possible to automatically apply suggestions and recommendations made by generative AI platforms across an entire enterprise IT environment.
In the meantime, DevOps teams should be evaluating generative AI technologies in terms of the capabilities they can provide today and their future potential. Many of the manual tasks that conspire to make application development and deployment tedious will become increasingly automated. DevOps teams committed to ruthlessly automating as many processes as possible will naturally be at the forefront of adoption. The challenge and the opportunity lies in determining whether AI platforms can be trusted or if a human must always be in the loop to ensure there are no unexpected outcomes.
After all, while AI can be applied to automate deployments, it’s not quite as clear whether they can be rolled back if a mistake is made.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Google complains to the FTC about Microsoft market abuses, and new graduates don’t know how to office. (more…)
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: GitHub touts unbelievable AI stats, and Intel’s beautiful open source typeface. (more…)