Category: Features

  • COVID-19: Don’t Sacrifice DevOps

    COVID-19: Don’t Sacrifice DevOps

    Like everyone else, I’ve been following COVID-19/Coronavirus issues. My focus is more on the IT impact of the disease and its status as a pandemic.

    Let’s start by saying it isn’t the end of the world. Yes, it’s serious. Yes, it will be disruptive. Yes, those impacted by the worst aspects of the disease will leave a hole. But when it is over, and the tide has swept by, the vast majority of people will still be here, still trying to do what they need to do.

    That includes ITOps/DevOps maintaining whatever you put in during the rush to work remotely. Some organizations will be happy to throw something up and then rip it back down, but most will not. Once they’ve worked out how to work remotely, they’ll want to keep that as an option. Some to offer more work/life balance to employees, others to have a backup plan in case of emergency. Ask any company in Katrina’s path, remote work plans born in emergencies tend to hang around.

    It is the nature of DevOps to be nimble and reactive, planning on improving things as time goes on. That’s a good feature of both DevOps and modern IT teams. But some things are less nimble than others, and the rush to remote work is going to show that in a hard way.

    The VPN chosen or expanded to enable remote workers is not likely to be swapped out easily or quickly. While there is a sense of urgency—if you follow /r/sysadmin or to a lesser extent, /r/DevOps on Reddit, you know that urgency may even be too gentle a word. Some management teams seem to be in panic mode—you are going to have to live with some of these choices for a while, don’t make them knee-jerk.

    Normally, an MSP is your friend when moving like this, offering expertise and knowledge your organization doesn’t have internally, and shortening both deployment and the learning curve. But consensus is that MSPs, laptop manufacturers and VPN vendors are going to be booked solid for the near term.

    So, choose software when you can. Not because software is better (truly for some functions it is worse), but because it is generally easier to replace. A software VPN can be expensive, but you’re not buying hardware that is a sunk cost. Consider short-term solutions such as Amazon Workspaces or possibly  Chrome Remote Desktop, old standbys like VNC or RDP (likely with VPN in both cases), file sharing with things such as Sharepoint or OneDrive. Later on, you can look at a Cloud NAS such as Nasuni, or a more solid remote access plan.

    Yes, all the suggestions above have things you need to worry about. No, not everything will be within your control. However, these things are easier to rectify on iteration than “We bought big solution X, and it doesn’t do Y, so we need to replace it.” Start with short-term solutions and improve them as you go–this is truly the DevOps way, but it is easy to lose as you’re looking for high-volume, perfect and urgent.

    IT workloads (particularly operations workloads) are going to increase for any organization that wasn’t already set up for broad remote work. There is no way around this fact. As someone suggested online, “Kiss your family, tell them you’ll see them in a couple months and get to it.”

    You’ve got this. The internet is loaded with information to help, places such as Spiceworks and Reddit have people willing to offer advice all day. Smaller MSPs are likely happy to talk with you as they attempt to grow their business. Determine what you need, how fast you need it and implement the best solution you can in the time available, aiming to improve it on the next iteration. And keep the wheels of business running.

    It’s a flu variant, not the black plague. Businesses that deal with this well will come out well. Right now, “Deal with it well” includes a lot of IT work: from continuity planning, to fast DevOps iterations, to getting people at home productive and supporting them through this.

    — Don Macvittie

  • Social Distancing in the Age of Automation

    Social Distancing in the Age of Automation

     

    An unintended consequence of COVID-19 is that the practice of social distancing might remain long after the threat posed by the virus subsides.

    It seems as if COVID-19 (aka the Coronavirus) has appeared out of nowhere. At the end of 2019, we were all unwrapping out holiday gifts and looking hopefully into a new decade. Now, in March of 2020, schools are closed for weeks, if not months, major tech conferences are canceled, the NBA has suspended the season and the shelves at Walmart and Costco are bare of daily essentials.

    We’ve gone from zero reported cases at the end of January 2020 to over 120,000 worldwide six weeks later. (See Figure 1, below).

    Total-cases-covid-19-who

    Figure 1: Total confirmed cases of COVID-19 as of March 12, 2020. Source:  By Our World in Data – OWID, CC BY 4.0.

    The World Health Organization (WHO) has declared that we are in a pandemic. COVID-19 is spreading around the globe and its spreading fast. People are dying from it. As of March 13, 2020, sources report that Italy had 1,016 deaths among the 15,113 cases of infection. Another source reports that in mainland China, at least 3,158 people died from the 80,778 infected. The number keeps growing. What’s amazing is that in November of 2019 there were no reports of deaths from COVID-19. To say that this is the stuff of science fiction made real is no understatement.

    Social Distancing as a Tactical Response to COVID-19

    COVID-19 is a contagious disease. The rate of infection is pretty high when people gather together in large groups. To address the risks, gatherings of over 250 people have been discouraged, if not banned outright by business and government. This tactic has been given a name, “social distancing.”

    Social distancing means that we keep our distance from large groups of people. As with any change in social behavior, there are economic impacts. Most people go to a workplace to do work. Take away access to the workplace and work stops, the economy comes to a halt. At least that’s how it was in the old days.

    Today we live in a wired world that makes online interactions as easy as a stroll down Main Street. As a result, many of us work online thus allowing commerce to continue even when access to the physical workplace is restricted. Yet, most of us—working online or not—are still tethered to a common, physical workplace, at least we were until COVID-19 kicked in. Now we’re going home and telecommuting. Once the threats posed by the virus have passed we’ll all go back to business as usual. This current episode of social distancing will be but a memory.

    Or will it?

    What if social distancing becomes a way of life that stays with us for the foreseeable future? What if we all just get so accustomed to social distancing—employer and employee alike—that we just stay home after this all blows over? What then? Think about it. It could very well happen and the implications are significant.

    Social Distancing Is Not New

    Social distancing has been a trend even before COVID-19 came along. Before the introduction of mass-produced private homes, people either lived in cities or in the rural countryside. Urban dwellers congregated in public spaces, Venice Beach, Boston Common or Central Park for example. They ran into each other walking down the street. They rideshared on mass transit.

    Then the automobile came along and social distancing set in. More people started to prefer riding in the isolation of the privately-owned automobile than on a crowded city bus or subway. The interstate highway system emerged to support the millions of new cars on the road. These highways and the 30-year fixed mortgage gave birth to suburban living. Also, television reduced movie-going to a predominantly entertainment experience. Who needs to see a newsreel in a movie theater when the news is getting piped into your television set every day?

    The suburban house became the castle of any man or woman who could cough up a relatively small down payment to buy one. The next thing you know the house becomes the social center: barbecues, cocktail parties, Super Bowl Sunday and legions of teenagers wreaking havoc at alcohol-fueled backyard pool-parties while their parents are out of town.

    Eventually, the introduction of video streaming (neé cable-based HBO) big-screen TVs, and movies on the demand made the family entertainment center a permanent fixture in residential house design. Finally, along comes high-speed internet and dad’s den gets replaced by dad’s home office and mom’s home office.

    But, we still had to go to the store to get stuff. Hence the rise of the shopping mall as a common ground in which to socialize. And, we still had to go to work to pay for it all … for a while, anyway, until Amazon comes along and brings social distancing to the shopping experience and telecommuting gizmos such as Slack, Zoom and a plethora of mobile apps make working from home a feasible way to conduct business. The only catch is that employers needed to get on board with telecommuting. Some did and some didn’t until COVID-19 started killing people. Now, they’re on board.

    Living in a Social Distancing World

    COVID-19 is forcing everyone to stay put. Every day an increasing number of companies are mandating that if you can work at home, you are to work at home. Late-night television shows are broadcasting empty theaters. There’s even talk of canceling the Democratic National Convention. It seems as if we’re all going home.

    The risk is that we just might stay there.

    Let’s face it, we’ve created a digital infrastructure that can support a situation in which most of the population of the developed world stays in a state of social distancing permanently. All the things required to make it happen are in place. Today, we can buy just about all we need online and have it delivered to our doorstep. An increasing number of the ordinary activities of daily life happens on the internet, everything from a casual chat on Skype to a game of cards with our friends on Trickster Cards, are typical. And yes, people have been having romantic interludes online since personal computers could support video conferencing.

    In the not-too-distant-future, home healthcare devices will do away with most visits to the doctor’s office. Soon, if we need to get somewhere, we’ll call a driverless vehicle to get us there. Manufacturing automation will continue to improve to the point where we won’t work in factories directly anymore. We’ll just control the robots that do work in the factories from computers in our home office.

    As finance and services continue to become a growing part of the economy, the work that industry requires can be done from home, too—quite easily in fact. Yes, we’ll still need human plumbers, electricians and nurses. But these workers will occupy a special place in a socially distanced world. They’ll be well vetted and well protected. 

    So, the long and short of it is that current events might very well be a harbinger of things to come. And, if anything, the hazards of COVID-19 are pushing forward the propensity to make social distancing the norm. When that happens the really big question to ask is this: If all of us are socially distanced by default and more of our interaction with, and understanding of, the world comes from that which we see and hear on cell phones, computers and television sets, how will we know what is real and what is well-contrived fiction? It’s an important question that deserves serious consideration. I hope we can answer it. Then, once answered, the even bigger question to ask is: Will we care?

    — Bob Reselman

  • Better Apps and Better Security When You Shift Left

    Better Apps and Better Security When You Shift Left

    Tens of thousands of people and hundreds of cybersecurity vendors descended on San Francisco at the end of April. While the RSA Conference was the primary draw, there are a number of peripheral events that go on throughout the week as well, such as the Cloud Security Alliance Summit, the CIO/CISO Interchange, BSides San Francisco and the Qualys Security Conference.

    I was able to attend some of the Qualys Security Conference and I had the opportunity to see Alex Mandernack, security solution architect for product management at Qualys, presenting on the need to shift left when it comes to cybersecurity.

    Mandernack outlined some of the issues organizations face today when it comes to security. Migrating to the cloud and embracing DevOps culture means more ephemeral, elastic environments and compressed development time frames. He pointed out that these trends make security more challenging, but also described the opportunity they present to change our approach to streamline and improve security.

    The Traditional Pipeline is Broken

    The traditional model of application development is much more linear. Each app team builds their own image—often in a silo or vacuum disconnected from other teams. Penetration testing is conducted on a sporadic or infrequent basis, and eventually the app is deployed. Vulnerability scans are run on the app in production, and issues or deficiencies are reported back to the developers to address or incorporate into the next build.

    The process is slow and cumbersome. It also has the potential to introduce redundancies that waste resources and make the organization less efficient. As companies embrace DevOps and move to the cloud, the traditional development pipeline simply doesn’t work—especially not for security.

    DevOps, and Cloud, and Containers — Oh My!

    The cloud and DevOps fundamentally change the development lifecycle. Development time frames are compressed, and the process is a self-feeding, iterative circle rather than a repeating linear approach. The traditional approach of identifying and resolving security issues after an application is deployed won’t work in a DevOps environment because by the time issues are identified and fixed, the app itself may have already moved on to the next version.

    Cybersecurity and the development pipeline have enough challenges with the cloud and DevOps, but there is also a newer technology trend that exacerbates the problem—containers. Containers are designed to get code quickly and to operate fast. They are also built for scalability—spawning and spinning down hundreds or thousands of containers constantly to keep pace with demand.

    There is a diverse array of tools and platforms associated with cloud, DevOps and containers. Organizations often employ a complex collection comprised of some combination of AWS, Azure, Docker, Kubernetes, OpenShift and others. The result can quickly become a black hole when it comes to security—which is why it’s important to push security left into the CI/CD pipeline.

    Shift Left to Help Security Teams Do Better

    In a DevOps culture, developers and security teams need to think about security sooner. It’s important to get the security tools into the process earlier. Thankfully, with the DevOps lifecycle and the tools commonly used within a DevOps environment, it can be done.

    For starters, companies should build a golden image. Developers shouldn’t have to patch and update the base operating system before they even start developing. The golden image takes a baseline operating system such as Ubuntu or CentOS, and completely patches and configures it so everyone has a standard, consistent image to develop on.

    With the golden image in place, the next step in shifting security left is to implement testing and scanning in the CI/CD pipeline. Put vulnerability information at the fingertips of developers as they’re developing and implement vulnerability gates in the pipeline to ensure that applications that don’t comply with policies and meet minimum requirements are not allowed to be deployed.

    New Role of the Security Team

    Part of shifting security left includes providing tools that make security self-service for the DevOps team. Automating actions with scripting, APIs and CI plugins ensures that security is simplified and streamlined to provide value for developers.

    In this shift left scenario, the security team has to redefine its role in the process. The security team is still vital, but rather than being the police or a roadblock in the development process, the role of security focuses on verifying and auditing the process. The security framework should have dashboards and live data that enable the security team to monitor activity and identify trends that may need further attention.

    Better Security, Faster

    There is often conflict between developers and security teams, but there doesn’t need to be. Mandernack stressed that developers don’t want to create insecure apps either.

    Shifting security to the left into the CI/CD pipeline streamlines the whole process. Ultimately, the result is higher quality, more secure applications that are developed faster.

    — Tony Bradley

  • DevSecOps Days Virtual Summit: The Best of Dev, Sec and Ops

    DevSecOps Days Virtual Summit: The Best of Dev, Sec and Ops

    We’re fresh off RSA Conference 2020 and the live version of DevOps Connect: DevSecOps Days, a daylong event packed with industry experts speaking on all things Dev, Sec, Ops and variations of the three. It was highly successful in both attendance and knowledge-sharing, so once again we’ve taken the entire event virtual and bringing it to you.

    The return of DevOps Connect: DevSecOps Days Virtual Summit will take place Thursday, March 26, at 10 a.m. EST. The all-day event will feature speaking sessions and panels focusing on digital transformation and disruption, with experts and practitioners discussing their company’s transformation to DevSecOps, the issues that have impeded their progress and how they get buy-in from all levels of the company.

    Our virtual summits are just like a real conference but without the hassle of traveling, tickets and crowds (and, this year, nasty coronaviruses). The online environment at DevOps Connect: DevSecOps Days Virtual Summit features a lobby, expo lined with booths full of downloadable resources, and an auditorium where attendees can watch sessions by Bryson Koehler and Jamil Farshchi, CTO and CISO of Equifax; Larry Macherrone, director of DevSecOps Transformation at Comcast; and other industry forward-thinkers to get an exclusive look into DevSecOps initiatives at large enterprises and organizations across industries.

    Here’s an at-a-glance lineup of our speakers:

    • Bryson Koehler, Equifax
    • Jamil Farshchi, Equifax
    • Dr. Amit Elazari, Intel
    • Jennifer Czaplewski, Target
    • Bill McArthur, TD Bank
    • Jasmine James, Delta Airlines
    • Charlene Li, author
    • Larry Maccherone, Comcast
    • Sladjana Jovanovic, TD Bank
    • Ross Clanton, executive consultant
    • Sean Davis, Equifax
    • Chris Roberts, Attivo
    • Chris Riley, Splunk
    • Alan Shimel, MediaOps
    • Mark Miller, Sonatype

    DevOps Connect: DevSecOps Days Virtual Summit is truly an all-day affair, with sessions running from 10 a.m. to 5 p.m. Eastern. The expo hall will be open throughout the event, giving attendees the opportunity to chat with vendor sponsors, download information and even take part in a scavenger hunt to win prizes including Amazon gift cards.

    Plus, those who register but can’t make the event will be able to access it later—all registered attendees will receive a link to access the virtual summit on-demand.

    Space is limited, so don’t wait. Register today for DevOps Connect: DevSecOps Days Virtual Summit to hear the best of what’s happening in the DevSecOps space from those who are actually doing it.

    — Charlene O’Hanlon

  • DevOps Deeper Dive: Mainframe Fallout from BMC’s Compuware Buy

    DevOps Deeper Dive: Mainframe Fallout from BMC’s Compuware Buy

    The acquisition of Compuware this week by rival BMC Software signals that the rate at which mainframe environments are being modernized might not be occurring fast enough to support a vibrant third-party tools provider ecosystem.

    Both BMC and Compuware were sold to private equity firms in 2018 and 2014, respectively. Thoma Bravo, which acquired Compuware, is now selling the company to KKR. BMC was acquired by KKR in 2018 from Bain Capital and Golden Gate Capital for $8.5 billion. BMC was originally taken private by investors in 2013.

    Other rivals in the mainframe category include CA Technologies, which was acquired for $18.9 billion by Broadcom last year, and Micro Focus, which includes software assets originally developed by Hewlett Packard Enterprise.

    BMC executives declined to comment on the merger and terms of the deal for Compuware were not disclosed.

    All these machinations by private equity investors doesn’t do much to inspire confidence among end customers, said Judith Hurwitz, president and CEO of Judith Hurwitz & Associates, a market research and IT consulting firm.

    “Private equity firms always have to eventually look for an exit,” she said. “In this case, one investor wanted out.”

    That leaves IT leaders in the unenviable position of not knowing whether the application development platform on which they have standardized might be around for the long haul, said Hurwitz.

    The challenge faced by third-party providers of application development tools in the mainframe space is largely two-fold. While the number of workloads running on mainframes continues to increase thanks mainly to availability of Linux on the platform, the number of organizations that have a mainframe has declined. The low end of the mainframe market has been eroded by high-end distributed systems. In addition, many applications that previously ran on a mainframe have been shifted into a public cloud.

    The second challenge these providers face is IBM, which is now a much more formidable competitor in the mainframe tooling sector. IBM has launched a series of initiatives to provide tools to modernize mainframe platforms using best DevOps practices as part of a larger digital business transformation initiative. However, regardless of the relative strengths of IBM’s DevOps portfolio, there will always be a significant base of mainframe shops that will prefer tools from IBM over those provided by a third-party rival.

    In a prepared statement shared via email, Barry Baker, vice president of IBM Z Software, said:

    Over the last 18 months, we’ve come a long way to expand the ecosystem for mainframe skills by bringing new tools to IBM Z and LinuxONE. Our goal remains unchanged – to make development on Z a common experience for all developers across the tech stack – not just mainframe developers. We’ve made significant progress toward this goal with the adoption of DevOps and industry-standard tools like Git and Jenkins on the platform, along with our own offerings including IBM Z Open Development and IBM Z Unit Testing. We took another step with Red Hat OpenShift on IBM Z, further enabling cloud developers to deploy z/OS applications using OpenShift without any special Z skills required.

    We continue to invest and over the next few months we’ll be unveiling even more tools across three focus areas: developer experience, automation and operations to truly deliver on our promise for a cloud native experience – and encourage our clients to watch this space.”

    Of course, all of IBM’s tooling rivals in the mainframe space have launched similar DevOps initiatives. The challenge they all face is the rate at which mainframe organizations are embracing DevOps may not be fast enough to sustain a vibrant third-party ecosystem. Not surprisingly, BMC has also been extending its reach to encompass distributed computing platforms. Competition among tooling vendors on those platforms is already fierce.

    There can be no doubt mainframes will continue to play a crucial role in IT. Most large enterprises are still dependent on mainframes to run some of their most mission-critical transaction processing applications. Less clear is to what degree those organizations intend to modernize those applications beyond simply making application programming interfaces (APIs) available for legacy applications. IBM, along with every provider of development tools for the mainframe, has been making a case of deploying new applications running on Linux on a mainframe because the total cost is lower than trying to connect those applications running on a distributed system to a legacy mainframe application.

    A recent global survey conducted by Vanson Bourne on behalf of Micro Focus suggests that argument is starting to resonate. Nearly two-thirds (63%) said some form of modernization was favored over the replacing and retiring of older COBOL-based systems in 2020.

    Regardless of how much economic sense that argument makes, however, the rate at which mainframe applications are being modernized will, at best, continue to be an extended process.

    — Mike Vizard

  • Commercial Objectives in the Age of Automation

    Commercial Objectives in the Age of Automation

    When I was 17 years old, back in 1971, I sold orange juice near a busy street corner in New York City. My job was to stand out in front of a fruit stand and dispense quarts of OJ from a machine. It was pretty simple: keep the hopper on the top of the machine filled with oranges and keep the supply of quart jars steady. Then, when a customer came by to make a purchase, I filled a quart jar with juice, took the customer’s money and rang up the sale in the cash register.

    That was my job, rain or shine, in warm weather or cold: keep the machine operational, give the customer the goods and collect the money. Other people had this job, too. Selling fresh-squeezed orange juice to the masses by way of a rather simple piece of automation technology kept us busy.

    But, here’s the thing. If my employer had to choose between me or the machine, he’d have chosen the machine every time. The machine was a gold mine. It made more orange juice in a minute than 10 human squeezers could have done in 10 times the amount of time. In fact, if my employer used humans, he would have lost money. The machine was key to his commercial success selling orange juice.

    Now, hold this thought while I move forward to recent times.

    In May of 2019, the rideshare service Uber went public. In order to issue shares on a public exchange, the company, as prescribed by law, needed to publish a prospectus describing its business model as well as how it intends to use the money it raised through the IPO.

    Every company that’s listed on a public stock exchange publishes a prospectus. Facebook has one, and so does Microsoft. Even World Wrestling Entertainment, the folks that produce action-packed events such as the WWE Super ShowDown and WrestleMania, has one. The prospectus is the way the SEC creates transparency into the finances and commercial strategies of a  company. If you take the time to read one, a prospectus will tell you a lot.

    So I did. I read the Uber prospectus and I found something very interesting on Page 10: “We are investing in technology to power the next generation of transportation. Our Advanced Technologies Group (‘ATG’) focuses on developing autonomous vehicle technologies, which we believe have the long-term potential to provide safer and more efficient rides and deliveries to consumers, as well as lower prices,” stated Uber.

    In other words, Uber is actively pursuing driverless technology as a key commercial objective. Why? Well, to answer this question let’s go back to my days in New York City playing trusty sidekick to the orange juice machine.

    Back then, in order for my employer to make money selling fresh-squeezed orange juice, he needed both me and the machine working in tandem to fulfill the commercial objective to turn some oranges and a glass jar into money. In terms of his commercial objective, I was the weak link in the chain. I got sick. I had bouts of adolescent unreliability. I moved on to greener pastures when better opportunities appeared. If he could have replaced me with a vending machine that sold fresh orange juice he would have. If I were in his shoes, I’d do the same thing. But at that time, orange juice vending technology was not as advanced as it is today. I was lucky, I guess.

    But, that was then and this is now. So let’s go back to Uber.

    Remember, the commercial objective of rideshare is to turn a moving vehicle into money. Right now this involves a cellphone, a human and a car. The cellphone provides the driver with passenger pickup information and routing instructions to get to a destination. The car provides the transportation. The human operates the car in response to and with the assistance of information coming from the cellphone.

    Right now humans are really good at operating motor vehicles and interacting with the cellphone and passengers very much in the same way I was really good at keeping the orange juice machine full of oranges and dispensing the product to customers. But, just as I was the weak link with the orange juice transaction, so is the human in a rideshare. The cost of a human can vary and things can get sticky in terms of legal matters that go with human employment. Yet, the risk is offset by profit the human produces, for now anyway. But, that can and will change. Take the human out of the equation and the profits go up and the risk goes down, provided the underlying automation technology is advanced enough to meet the demands of the situation.

    If you have any doubt that driverless technology will advance to the point where humans can be replaced, think back to how crappy voice recognition was in 1989. It was really, really bad. Now, voice recognition is really, really good, even in a variety of languages. Getting to that level of technical maturity only took 20 years. Now, imagine how good a driverless vehicle will be 10 years from today. I’ll wager it will be really, really good.

    Yes, some people will point to the current fatalities created by driverless automation to assert that human displacement won’t happen. But, if you have any doubt that it will, keep in mind that the were a lot of crashes early on when the Wright brothers took to the skies in 1903. Yet, by 1919 KLM was flying commercially. That’s a pretty dramatic accomplishment in terms of safety improvement for a technology.

    So the long and the short of it is, just as the owner of the fruit stand would have gladly chosen an orange juice vending machine over me, so too does Uber want to take the human driver out of the car. For all intents and purposes, a rideshare vending machine will be the preferred way to meet the commercial objective at hand.

    So, where does that leave humans?

    The conventional wisdom is that as human labor continues to get replaced by machine automation, there will be new, unimagined jobs for those displaced workers. I think otherwise.

    Consider this: around the 1880’s there were almost 200,000 horses in the City of New York. Now, if you can find 400, you’re lucky. Why? Because that much horse labor isn’t needed anymore. Some have gone onto other jobs, such as being a thoroughbred competitor at Aqueduct Racetrack or a tourist amusement pulling a carriage through Central Park, but as far as being the engine the moves street-cars, carriages and mounted pedestrians, that time has long passed. Horse labor no longer meets the commercial objectives of transportation.

    So too will it be with humans who earn a living driving a motor vehicle. They will be displaced. Only this time there is a very good chance that there will not be the number of new, unimagined jobs created that will meet the needs of the broad segment of the population being displaced. Yes, there will be new specialized work, but not at the scale necessary to absorb the number of those out of work. After all, once the automobile came along, the 200,000 horses left behind in New York City did not go on to become thoroughbred racers.

    The point of the analogy is this: the more specialized the work becomes, the more difficult it is to quickly acquire the skills necessary to do the work. For example, some displaced drivers might be able to become data scientists quickly, but a significant majority will not. To assume otherwise is folly.

    Addressing the issue of worker displacement due to advanced automation is a serious problem, one that deserves significant attention. Hopefully, we’ll figure out some solutions that have long term viability. Otherwise, we’re in for some big trouble because no matter what, businesses will continue to advance and embrace automation to meet their commercial objectives. As the saying goes, “an ounce of prevention is worth a pound of cure.”

    — Bob Reselman

  • You Still Have to Make Time for Maintenance

    You Still Have to Make Time for Maintenance

    I’m going to take a side trek today into home computing with applicability to IT. Bear with me.

    We maintain a pretty complex home network, as home networks go. With three NAS servers, a small one-box SAN, some web servers and connections to several hosted environments. We both work from home, and my business is contained in one of the NAS servers and some of those hosted environments, so it’s all necessary. Scheduling downtime with several people using the network darned near 24/7 is difficult. Not medium enterprise level of difficult, but still an issue.

    Two of our NAS servers each have a disk out. It happens, that’s why they’re NAS servers. In general, the only day that replacing the disks makes sense is Sunday, when things are a little slower (both in schedules and network usage) than normal. One of our web servers is just plain dead–but there’s info on there we have to get off. The code is mostly being replaced, but the data is collected over years and we need to see how much we can salvage.

    None of these things are shiny DevOps things. Yet, they still have to get done. Importantly, they have to get done when automated tools aren’t running across the network or counting on the NAS to be responsive. The rush isn’t huge, because there are off-site backups, but restoring a remote backup is a long-term proposition–weeks, not days in our current environment–so it must happen as soon as practicable.

    Don’t forget that with the drive to automate everything. If you own the hardware, it’ll need maintenance. If you own the software, same thing. If you need data to move platforms, it will take time. All things we kind of hand-wave in the DevOps world. They’re seen as bottlenecks, if seen at all. Generally, we don’t even consider maintenance issues until they impact DevOps, but we know they are going to happen so we should have a plan for how to deal with them.

    Those few of you whose entire environment is hosted in a cloud provider have an easier job of it, but eventually you will be asked to move cloud providers. As sure as the sun will rise tomorrow, something will drive a move away from your chosen platform. Normally TCO, but other factors play in, too. When that happens, the work will be more than “Find time for the NAS to rebuild without overly impacting everything else.”

    So, spend some time thinking about it. Do you have plans to make room for maintenance? Are you scheduling maintenance into release cycles? Are you coordinating releases with updates that are not required by this specific release?

    This is where dev (typically Agile/Scrum) meets ops (typically system/network maintenance), and it is every bit as important as what is normally seen as DevOps. Get it right and have fun, keep cranking stuff out. Get it wrong and struggle with the problems infrastructure issues can inflict upon your cool new update. One of our new websites outright stopped development when the web server went down–for a variety of reasons, but the catalyst was the loss of the original. We’re working out what to do about that.

    Meanwhile, we didn’t make time yesterday, so I’ll be replacing disks and tearing apart a web server in a much smaller window that is available today. See you when I poke my head back up. Hopefully, you’ll have better planning than we did.

    — Don Macvittie

  • Coronavirus Update: A Slowdown Already Occurring

    Coronavirus Update: A Slowdown Already Occurring

    I have been watching the real-time regional situation reports about the coronavirus from the Chinese medical association site ncov.dxy.cn (the same site the John’s Hopkins outbreak dashboard sources its data from) closely now since very close to the beginning of the outbreak, and my daily routine has been to snapshot the regional outbreak tallies and compare the numbers with previous data to discern the trends.

    The top-level executive summary is that while three nearby provinces have peaked now at around 3,000 cases of the coronavirus, the majority of the other provinces got up to a few hundred to a thousand cases. Cases are declining universally now as folks recover, and new case increases have slowed from the initial fast-spreading burst now down to a trickle outside of Hubei.

    The percentage of overall cases has gradually increased in locality from its initial widespread that saw half of all cases in Hubei Province centered in Wuhan now steadily inching up to closer to 90% (above 83%) of cases being centralized in Hubei and Wuhan. Essentially, the outbreaks were sporadic in small clusters and contained in the other provinces, and the counts are all going down—a positive sign. The only place it ever really saw huge unrestrained growth was in the city of Wuhan, where new cases continue to be diagnosed, but as I mentioned above, even that has seemed to be under control now, with the rate of overall new cases in an almost-steady linearly decline for two weeks now, as presumably, the containment seems to be working. The quarantine that many experts said was unlikely to succeed is showing every indication of actually succeeding.

    coronavirusThe graph above IMHO best describes the progression of the coronavirus. Ignore the big spike—that was a numeric anomaly from the redefinition of “clinically prescribed” cases situations where patients had pneumonia symptoms but test swabs indicated negative for the virus, presumably where health officials cleared the virus and only the symptoms from the induced pneumonia remains. They redefined the counting criteria and classification so that those patients could access care facilities, which is why the graph seems to spike—though this bureaucratic anomaly caused undue panic in many folks observing the numbers before the Chinese-language information about this redefinition reason percolated out and was translated as an explanation to international media. Overall, this graph illustrates what I saw from the regional counts: There was an initial rapid ramp up and then containment and a slow, steady decline in new case increases. The yellow line is suspected cases and the red line is confirmed tested cases. As you would expect, the suspected numbers led the confirmations by around a day.

    The situation right now is that really the only place case counts of the coronavirus are increasing is in Wuhan itself, with the greatest density of cases. Starting one to two weeks ago the cases rates finished their rapid expansion in the other provinces and began their long, slow, steady decline as patients recover, with a small number of fatalities. New cases seem to be fairly limited small clusters of one to 10 cases and isolated, as well as declining for weeks now.

    Internationally, the only trouble spot is the quarantined cruise ship in Japan, which seems to be acting as an incubator. I can tell you a lot about that ship because one of my co-workers’ parents are on board and I’ve been getting first-hand reports of what is going on. After a burst of cases last week on the ship, those in charge have fortunately decided to disembark the ship to national quarantine facilities set up by the passenger’s origin governments. This is good because conditions aboard were becoming pretty miserable, entertainment was limited and unlocking the porn and movie channels did little to appease the occupants, who were becoming frustrated with the limited food choices in particular. It was a terrible time for the staff—essentially on a jail ship forced to feed and the occupants. I’m told disembarking is due to begin over the next few days.

    Outside China, excepting the cruise, there were relatively few cases of non-direct secondary infection of the coronavirus that weren’t directly linked to someone who had been in Wuhan or in contact with someone from Wuhan. There were a few clusters of infection, particularly in one Hong Kong apartment building and another one in Singapore, but pretty much all the cases were primary contact up until now, so it seems international diligence and containment is holding.

    There is plenty for folks to be diligent about, but for now, there seems very little to panic about and every indication that this impossible quarantine is going to be studied as a model of how to respond in the future.

    Let me also pre-empt the inevitable distrust of the Chinese government some folks have to mention that the inevitable conspiracy fear-mongering and panic you see being spread in paranoid YouTube rants and misrepresentation clickbait is completely unfounded from the data and news sources I monitor. To quote a WHO press conference, “The Chinese authorities have shown exceptional transparency and openness in this outbreak.” Another expert I heard on the radio who worked on the earlier SARS outbreak noted that one of the key lessons learned in that incident was the importance of rapid and accurate information dissemination to control and respond to infection outbreaks, and the Chinese medical association seems to have taken this lesson to heart to not repeat those missteps with the coronavirus. The fact that I was able to monitor regional situation reports over the last two months is a clear indication of that.

    The folks who feel that somehow the Chinese government is sandbagging the numbers and the problem may be worse than indicated aren’t really acknowledging the stupidity of such a fiction. Misrepresenting the situation to their own medical professionals combatting the outbreak would not only be irresponsible and dangerous but also extremely unlikely and infeasible. There is little incentive to misreport, and such a fiction would need to involve concerted action from hundreds of thousands of medical professionals—and likely beyond the capabilities of even the Chinese bureaucracy; in the end, their government is as clumsy and bumbling as ours and it would require far too widespread a meddling to maintain consistency. The Chinese censors can stomp down and suppress anything that makes the bureaucrats jumpy, but it is likely incapable of producing such a coherent fiction across so many sources, sites and reports as would be required to fulfill the paranoid fantasies of wary folks. Not only is there no motive or gain, but there is also likely a huge disincentive and probably penalty for misreporting and misrepresentation, if the rapid fall from grace and dismissal of the bureaucrats who made the initial mistake and sandbagging of the numbers that led to the initial outbreak is any indication. As a matter of fact, the only indication I’ve seen with any substantive evidence of government information suppression was the blocking of the online lynch mobs for those bureaucrats who were at fault for the doctor who sounded the alarm’s arrest after that doctor tragically died. Anyone who would dare tamper with the numbers likely would face the same fate.

    There is by definition underreporting as the visibility to cases of the coronavirus with very mild symptoms or test errors or any number of other anomalies in mass counts, but the numbers from a macro level look promising.

    Overall, I’m relieved to see that the situation is resolving with only sporadic and isolated lapses in containment—there were only ever 85 cases internationally outside of Asia with a single fatality. That number is down to 52 now as folks recover and no recorded incidents of secondary infection without direct contact with a traveler from Wuhan. The mortality rate statistic is ever sinking as patients among the roughly 60,000 cases cumulatively diagnosed recover, and it’s proving to be primarily a threat to the elderly, though interestingly I’ve seen reports that few children seem to be affected.

    Later next week we should see the results from the clinical study of the cocktail of repurposed HIV antivirals that showed such great promise in simulations and early tests that had some severe patients recover in as little as two days. The study was rolled out in amazingly rapid fashion and the medical community seems to have focused on combatting this new disease with a vengeance—supposedly vaccine trials are to begin as early as next month.

    Vigilance and wariness are due, but at this time there seems to be no cause to panic, forward panic or feed conspiracy fears preying on phobias about diseases or likely even change any day-to-day activity or future plans for folks outside of China regarding the coronavirus. The estimate from current numbers is placing the potential of the quarantine lift at the beginning of April in the only forecast I have seen.

    — Dragos Ruiu

  • Acting Rationally Regarding Coronavirus: RSAC Conference Update

    Acting Rationally Regarding Coronavirus: RSAC Conference Update

    With all the hype surrounding the coronavirus, let’s take a step back, take a breath and not give in to emotional conference mob fear-mongering

    We have all read the headlines: Mobile World Congress in Barcelona has been canceled. Facebook pulled the plug on a smaller conference next month in San Fransisco. IBM Security has pulled out of RSA Conference next week. Health and safety are everyone’s concerns, but are we acting rationally regarding coronavirus?

    RSA Conference (RSAC) put out an update on Friday (use that link to stay up to date on RSAC) with some great metrics on some of the risk factors and attendance numbers. It is also important to note that RSAC is expected to draw a crowd of about 50,000 visitors (some of them attending the DevOps Connect: DevSecOps Days event that we produce).

    Yes, eight vendors have withdrawn from exhibiting at RSAC. Six of these were from China and frankly, given current travel restrictions, probably couldn’t get here anyway. One is from Canada and one from the U.S. (presumably that is IBM).

    But should we give in to emotional conference mob fear-mongering? There is some serious clickbait nonsense being bandied about, including “RSA in Doubt After IBM Pulls out of Conference.”  To be fair, the clickbait headline was updated, but still, that is just fear-mongering at its worst.

    Why would IBM and the Canadian company pull out? Well, two obvious reasons. One is for the safety of their employees and their potential customers. The other is economic if they feel attendance will suffer. But while I don’t have any facts to back it up, I would have to assume that unless the event is outright canceled, vendors pulling out at this late date won’t be refunded their deposits and payments. This is true not only of their fees to RSAC but also of the money they’ve ponied up for hotels, airfare, party deposits, etc. While potential liability for unnecessarily exposing people to the virus could be a legal option, reasonable precautions are being taken. So I don’t think economics play into the decision to pull out.

    As of Friday, RSAC reports that including the members of the canceled vendors, only 0.79% of attendees had canceled their attendance. I would assume that the overwhelming majority of these were attendees from Asia or other impacted regions who could not get flights here anyway. Something like 82% of attendees are from the U.S. On top of this, RSAC is taking additional precautions to keep the conference as germ-free as possible.

    I was in touch with RSAC management earlier last week regarding the DevSecOps event. At that point, I was informed that they were working closely with the City of San Francisco to do everything possible. They are following CDC and WHO guidelines. BTW, CDC still says the impact here in the U.S. to coronavirus is low.

    So, then, are we seeing an overreaction to coronavirus? The security industry, more than the mobile application or other tech industries, is more attuned to risk management. Are we managing this risk adequately? Are we giving in to the fear-mongers among us? The flu has killed so many thousands more people (albeit with higher infection rates), but that has never caused us to shut down conferences or question gathering in groups.

    Personal health and safety is everyone’s own right and responsibility, as well as the responsibility of the authorities. Of course, you should do what you think is best for you and your family. But I think times like this call for a moment of lucidity and the use of the risk management fundamentals so many of us practice in our professional lives.

    Those of you who know me personally know I am a huge Pittsburgh Steelers fan. Their coach, Mike Tomlin, has a saying that I think applies to this situation: “We don’t live in our fears, we live in our hopes.” I hope the current trend of withdrawing from our community is not one that will continue. I refuse to give in to exaggerated fears.

    I do want to announce two things, though, in regard to this coronavirus situation. First, for any conference organizers who have made the decision to cancel their event for this reason (it is your event, your decision), MediaOps is offering a conference disaster program (CDP) that will allow you to use our virtual conference platform and team to take your event virtual with almost all of the features of an in-person conference.

    We have produced more than 10 virtual conferences in the last year or so that have drawn tens of thousands of visitors with hundreds of sessions, exhibit halls, interactive booths, signage, live chat and more. You can go to the home page of Predict 2020, our most recent virtual event, and click “Recent Events” to get an idea here, but just a caution, registration is required. Please see our press release on this for details. It is important that the tech community continues to engage in the very important exchange of ideas, learning and community that is so vital to our success and progress.

    Secondly, Accelerated Strategies Group, DevOps Institute,  JumpCloud and MediaOps are hosting a survey to learn about what you and your organizations are doing in light of the coronavirus outbreak and whether this is forcing you to rethink actions and behaviors going forward—not just for attending conferences, but as part of disaster recovery and business continuity. For instance, is this situation changing your views around working remotely versus working in a large office, going to customer premises or international engagements? Help us gather the information—please take moment and head over to http://acceleratedsurvey.com to answer a few questions.

    As is the mission of Accelerated Strategies, all of the research and analysis will be made available to everyone to use without registration or any payment. Because “knowledge wants to be free.” I couldn’t think of a better example of why that mission is so important.

    “We appreciate being invited to support the efforts of Accelerated Strategies to learn how this global situation will impact people professionally. We know that the JumpCloud community has been impacted, so we are thankful to be able to help in a small way,” said Rajat Bhargava, co-founder and CEO of JumpCloud. “Supporting primary research into the impact of coronavirus across this community is important work, and will hopefully help shape the actions that organizations can take with their teams and business to successfully navigate the future.”

    “DevOps Institute’s mission is to advance the Humans of DevOps and we are obviously concerned about the impact on the thoughts and behaviors of our global community,” said Jayne Groll, CEO of DevOps Institute. “The best way to overcome the hype and adapt to changing times is to collect and share community data.”

    Finally, Mitchell Ashley, CEO of managing analyst of Accelerated Strategies Group, Groll and I sat down for a video discussion of the coronavirus discussion and the reasons behind the survey. The video appears just below. For information, we recorded this just before the news of IBM Security’s withdrawal from RSAC came out.

    [videopress 5RyZpLsG]

    — Alan Shimel

  • EP 1: A Brief History of Testing

    EP 1: A Brief History of Testing

    DevOps’ sister site Digital Anarchist has launched a bi-weekly video series and companion monthly roundtable on DevOps, Automation, CI/CD and testing. Featuring leaders in all of these areas, we explore the challenges and issues software delivery and IT teams face every day. How do we go faster, smarter with better quality? DevOps Unbound!

    The video is immediately below, followed by the transcript of our conversation. Enjoy!

    Transcript

    Alan Shimel: Hey everyone. Welcome to the very first episode of DevOps Unbound. I’m your host, Alan Shimel and joining us for this initial episode of DevOps Unbound, I’m proud and happy to introduce you to James Bach and Grigori Melnik. Grigori, James, welcome to DevOps Unbound.

    Grigori Melnik: Hey everyone.

    Shimel: Before we jump into things, let me give each of you an opportunity to kind of introduce yourselves, your backgrounds, your positions, etcetera, so that our audience kind of knows a little bit, if they don’t already, who you both are. So, Grigori, you’ve already been a guest in our show, so if you don’t mind, I’m going to ask James to go first. James? Introduce yourself. Go ahead.

    James Bach: My name is James Bach. I’m a consulting software tester. I started as a developer in my teen years after I dropped out of high school. I’m the proudest high school dropout you will ever meet. I later wrote a book about dropping out of high school and my particular self-education method, but my big opportunity came when Apple computer hired me to be a test manager, and at the time, I was the youngest manager in the R&D division of Apple computers.

    So that’s kind of something I’m proud of. And I fell in love with testing and I decided to devote my career to testing. I studied the epistemology of testing, the mathematics of testing, the sociology of testing. I am a bit obsessed with testing.

    Shimel: To say the least.

    Bach: And I have a book about that called “Lessons Learned in Software Testing” with a couple of coauthors. And now I teach and consult.

    Shimel: Excellent. And you know what, high school dropout or not, you’ve done pretty darn good, so congratulations and not saying it’s an example for our younger people in the audience to necessarily emulate. Of course, James grew up –

    Bach: My son did better than me. He never went to high school, so I’m –

    Shimel: Really?

    Bach: He’s already outdone me.

    Shimel: Absolutely. Very good. Grigori? Why don’t you tell them a little bit about yourself?

    testingMelnik: Sure. So I’m Grigori Melnik and I am the chief product officer of Tricentis, focusing on building the testing tooling of the future, testing tools of the future. Previously, I guess I spent almost two and a half decades focusing on the developer audience and building all kinds of platforms, Microsoft and Splunk and MongoDB and you know, always been kind of customer obsessed in the sense of developer obsessed quite a bit, making sure that whatever we were focusing on would help drive the productivity and alleviate some of the pains that developers in our target audience had.

    And while a few of those things that I’m particularly proud of, my team at Microsoft was actually the first one that built the very first auto-scaling for what was back known as Windows Azure, now Microsoft Azure, but also focused on common patterns and practices in implementing the crosscutting components that represent crosscutting concerns that later would make into the .NET framework.

    So again, a lot of work identifying those patterns, capturing them, externalizing them, testing them out and then helping drive their use. When it comes to testing, I first kind of discovered it in my days in academia when I was doing research and teaching at university, and it was quite interesting because testing was predominantly viewed through the lens of formal method groups. It wasn’t really viewed as an intellectual activity of discovery, as an intellectual activity of exploring or experiencing something.

    And those were actually the days when I’ve encountered the group of testers from the context driven school of testing, including James and then we kind of kept in touch ever since, even with me gravitating away from the testing more into the developer world and now doing like the full loop of coming back to testing and I have to tell you, I felt, when the opportunity came, I felt that the world of testing, at least from the perspective of how the discipline itself has advanced would be way further developed in the last decade than I found after kind of leaving it for a while.

    So I’m now on a mission of kind of reigniting that whole discipline and putting it more on a pedestal and giving it more view and empowerment and leveling up all around. So, yeah.

    Shimel: Excellent. So, thank you both, gentlemen. And I’m Alan Shimel, I’m the editor in chief, CEO for MediaOps, the folks behind DevOps.com, Container Journal, Security Boulevard, TechStrong TV, et cetera. And just quickly before we jump into today’s agenda, DevOps Unbound though, today’s focus is on testing. It’s not just about testing. It’s really about DevOps kind of unbound, setting us free, being able to leap tall buildings and bound into space, sort of freeing ourselves of gravity, whatever you want. It’s about speed. It’s about acceleration. Right? It’s about automation in a lot of ways.

    And each – we’re going got be doing these every other week and each episode will focus on particular aspects of this unbound nature, if you will. Today’s is testing. And then once a month, we’re also going to have a roundtable with about six or eight people of Grigori and James’ stature and we’ll open it up to the public for live audience questions and discussion. So I’m really looking forward to that. DevOps Unbound is sponsored by our friends at Tricentis and we thank them for it and with that out of the way, let’s jump into things.

    So, Grigori, I wanted to start off – obviously, you and James take very different paths to our – and both of you have been very successful in your lives and careers. So it just goes to show, there’s more than one way to skin the cat. Right?

    But, let’s take a look – look, I’m probably older than both of you, though not that much I’m sure, but let’s look at the history, the historical context of where you guys come from to be sitting here today and how that, you know, vis-à-vis kind of the whole testing industry, the whole testing, you want to call it a profession, the guild, the whatever you want to call it, right, how has this evolved over the years and let’s put some context in with timeframes. James, when you first went to Apple without saying you’re old, what kind of – what were the timeframes for that?

    Bach: Well, I am old.

    Shimel: So am I.

    Bach: But you’re older, which is nice. It’s nice to be a young guy in the room again.

    Shimel: Uh-huh. I can’t tell you how well that makes me feel, but go ahead.

    Bach: First, 1987, May 21, 1987 was the first day that I ever professionally tested something as a tester. Before that, I was doing videogame development and I had done informal testing, and I hated testing because testing just got in the way of me shipping my product. So, I didn’t like testing until it became my job and then I realized I’m perfect for testing ’cause I love complaining. And I’m much more interested in finding how things don’t work than to figure out how to make them work.

    Shimel: That’s interesting. You know, my background’s in cyber, back then we called it InfoSec, and in InfoSec, most of the people got into it ’cause they liked to break things. Right? Yeah. Same thing. Grigori, how does that timeframe-wise and everything else, how does that match up with your own experience?

    Melnik: So I like to actually build things. _____ you guys who are breaking things. And occasionally I break things and actually this also speaks about this overall I guess optimism of most developers who think that what they write is perfect and always underestimate the amount of buggy code that we put in there.

    But to me, if I think about my first day when I actually had my job as an engineer, actually, it was September, I think 5, 1990, so a few years after James and at that time, I was actually writing a C-library for a PC converting the data from mainframe into the visual format and I had to deal with all kinds of quirks of Fortran and the 80 characters limit and the asterisks for, you know, for bringing – the continuation of the line, all kinds of exciting stuff. But back to the beginning, to make sure that I don’t go too far on the tangent, we actually didn’t have, for a very, very long time – again, I’m giving you my angle into the testing, if you will.

    We actually didn’t have a dedicated thinking about testing as an activity, as a pursuit of excellence. It was just something that you kind of were doing and then at some point later, you’ve heard and learned that oh wait, look, there’s a QA department, apparently, right? And they’re the ones that were mostly viewed as gatekeepers or police of some sort. Right?

    And then again, if I think about again, once I got more into the research and academia and studying testing specifically because, you know, I’m probably one of the very few people who has testing in the title of my PhD dissertation. But, I remember looking back and thinking, “But where does this come from?” Right? Where did actually software engineering come from?” Right? And of course, this is where the history of the conference deck, you know, after the _____ _____ where all the stalwarts of at that time computer science and well, not even computer science, mathematics departments because that’s who were doing all the programming back then at the point the software engineer discipline and later on the association of debugging, right?

    It was the infamous story of how the moth was found in Harvard University’s scientific lab and the term bugging, you know, was coined. I almost think like the – in the early days, it was very much associated with this era of debugging. Right? Then later on, the era of the ability to demo, the fact that the software was matching the stack or the requirements, I think it almost feels like there were at least a decade when people were fixated and some would argue that it still continues.

    Shimel: What decade was that?

    Melnik: Hmm?

    Shimel: What decade are you referring to?

    Melnik: The debugging or the – the debugging I’d say –

    Shimel: Are you talking about the 70s? Are you talking about the 60s? Are you talking about the 50s?

    Melnik: I’m talking about 50s and 60s. I’m talking about the 50s and 60s as almost the era of debugging the way I viewed it. Then, after that, the era of more like 70s and 80s where you were focusing more on matching the spec and demo and that the software would actually approve it. And this is where this big, big, big focus was on formal methods and trying to even mathematically prove that a software worked according to the spec.

    And then after that, I feel like the next era was the era of breaking or, you know, something that probably is still continuing. And again, all these elements I feel are present in today’s profession of testing, but the later years, the last 20 years was everything that I was kind of studying, watching from the sidelines, getting myself into. I like to call it the era of enlightenment, if I may. I know that’s super pompous of me, but this is where I view more testing in the way how James and other members of the context drew in school of testing had formulated it which is, you know, lighting the way for the decision-maker, not for the developer necessarily, not for – again, it could be for the developer, but somebody who at the end of the day makes the decision whether what is being produced is acceptable or not, or if it’s good enough to ship. Is it, you know, what risks associated there and informing me as a decision maker about all these different factors and then leaving that decision up to me.

    So the testers are not the police. They’re not the quality gate. They’re not _____ anything. It’s really up to the stakeholder who is commissioning all this effort and who makes the ultimate decision about releasing something, putting something into production.

    Bach: I’d like to offer some historical notes on this.

    Melnik: Please.

    Bach: Okay, first, are you aware what the first book was on the subject of software testing, the first known book? A little quiz for your Grigori?

    Melnik: Is it the Myers book?

    Bach: It’s before that. It’s Program Test Methods from 1972 by Bill Hetzel. Now that book was a report on a conference a testing conference which was the Chapel Hill conference, which happened in ’72. That seems to have been a historical watershed event in testing. Before that, the first chapter on software testing that I’ve been able to find was written in 1961 by my teacher, Jerry Weinberg, who wrote it when he was 25 years old. It’s a brilliant chapter on testing.

    What’s fascinating to me is how differently Weinberg talks about testing in 1961 compared to how they talked about testing in 1972, although there is a reference in the 1972 book back to Weinberg, praising Weinberg’s attitude about testing. It’s fascinating to read that because the book in 1961, it’s Computer Programming Fundamentals and the chapter about testing was written by Jerry, he told, although it said it’s co-written, the book’s co-written with Herbert Leeds and Jerry Weinberg, but Jerry wrote the chapter on testing.

    And Jerry talked about testing as a matter of imagination, not automation, as a matter of being suspicious and critical, as a fundamentally unalgorithmic process. And he develops this beautiful story in his chapter about a programmer who’s sure that he’s found the last bug and then finds out that he’s wrong. And then he adds another check for that.

    And then he’s sure now he’s found the last bug and then he sees something else go wrong. And Jerry’s conclusion is look, this is just, we’re working on complex systems and this is always going to be like this. Now, Jerry was on the first project in 1958 that ever had a dedicated test team.

    Now, the reason why he knows that is that in 1961, IBM held a conference of all the computer programmers in the entire world of which there were 400, apparently, and Jerry said his team went to that conference. He was at IBM at the time, and he said everyone thought they were crazy ’cause they had a dedicated group of testers and no one else did.

    They all were just testing their own stuff. So it seemed like the idea of having a dedicated test team caught on and then in 1972, the way they talked about testing was all about test cases, automation, formality and that kicked off the era, I think, of the factory, the test factory. We can have technology and we can have procedures that make it so you don’t rely on human thinking.

    So this goes against what Jerry Weinberg was preaching, not only back in ’61, but all through his career, I became a student of Jerry’s in around 1989 and took all his classes in the mid-nineties and he became a mentor to me. That’s why I’m a real acolyte of Jerry Weinberg, because he always put the human in the center of everything. But, testing – when I joined testing, all the testing textbooks were about how you have to define test cases and if possible, automate them.

    And I felt like that was a fool’s idea. I think, well, the problem is is that there’s too many things to define and far from being unbound, we’ve become super bound by all of these documents and all of this code. And so if you want to be unbound, we have to find a way to temper that. We have to find a way to interact with our tools so that we’re not constrained too much by them. And that, in the nineties, the urge to unbind ourselves from that waterfall world and that heavy documentation world created agile, but it also created the context driven school of software testing, which is a humanist approach to software testing.

    And that was in the mid-nineties that we started creating that. And then DevOps and agile continued to sort of take over the world except that it seems to me that agile in a lot of places has lost it’s humanist foundation and it’s turned into tools, tools, tools. And so if we’re going to really talk about Unbound, DevOps Unbound, it seems to me that we have to be specific about what is it we’re unbinding. I hope what this means is it’s people being unbound, using DevOps as a tool rather than –

    Shimel: But not just a tool. I’m sorry. I didn’t mean to jump in. But not just – you know what, James, we don’t want to make the same mistake that Agile made. And you just said, one of the problems with Agile is we went from humanist to tools, right, too much of a reliance on tools. Let’s not make the same mistake in DevOps. I think that’s something I’ve advocate for for a while too is we can’t lose the human in DevOps.

    Bach: Actually, I want to hear you say more about that, Alan, if you’re willing to say a little more about that.

    Shimel: I’m not shy. I’ll give you my two cents. Look, I started DevOps.com. I cover this place. I cover this area pretty heavily and I have for seven or eight years now. And I think there’s been this – and I don’t want to say agile failed ’cause agile is far from a failure. But there has been a reliance on tools and maybe overly processed. When we think about things like ITIL and ITSM versus DevOps, let’s say, right, we get in – we tend to point fingers at ITIL. Excuse me and ITSM _____ too much process, too heavy, too much of that, that whole change management thing.

    But there are good things there. Nothing’s all bad and all good. The world’s not black and white. It’s grey. Right? And so there are things we take out of ITIL and things and ITSM that we put into DevOps. Btu DevOps, to me, anyway, and it’s just my humble opinion, is fundamentally about people and teams and culture, not the tools- there’s a lot of tools we could use and there’s overlap in tools and what’s the best tool for any given job.

    We could fight about it till the cows come home, but at it’s nitty-gritty, DevOps is making sure that devs and ops and tests and security and these people work with a higher degree of communication, right, with a higher degree of cooperation getting jobs done faster. And we do that by adding things like automation to the mix. But automation for automation’s sake alone is not enough. Right? And to do automation, yes, you’ve got to use tools sometimes to make that automation work. I get it. But if we lose the fundamental aspect that DevOps is, at its core, about humans, I think we all – we lose what DevOps is and I don’t hold myself out to be as accomplished as either one of you, but I –

    Bach: I still love you, Alan. I love what you just said. I think this is – if you can hold on to what the principle and the feeling behind what you just said, we can do anything with tools and we’ll be okay. We’ll be okay. If we’re talking to each other, if we’re caring about each other, I keep seeing people losing that and of course, any technology and any methodology, when it’s applied sociopathically, will become abuse. And so we just – those of us who can, shall do – should do whatever we can do keep it non-abusive and keep us talking. And then I think DevOps can be a wonderful thing.

    Shimel: Absolutely. I’m sorry to take us down that. Go ahead, Grigori.

    Melnik: No, it’s super encouraging to hear what you said, Alan and again, I’m a very big believer into the greatness of human mind, but it feels to me that in this kind of history of our industry, the pendulum keeps swinging back and forth, right? remember the whole infatuation with the case tools, you know, back in the eighties and nineties and then later on, there was this whole big movement of the software factories, like the term was actually software factors where the idea was that you can go and abstract away at some high level and then the loop, y, the tools will generate all the code and everything for you and make it all highly maintainable, all that, and of course that failed too.

    But I think out of this desire for some reason to do – to come up with the sort of boosters. So I don’t know, some kind of the way of equipping the humans to deal with the inherently complex problems where today there’s no better mechanism of dealing with them other than human brains. So this whole vision of, you know, computers writing computer code, I mean, that’s been promised in the first era of AI, not today, but I’m talking about the sixties, right, and seventies were all –

    Shimel: Yeah, yeah, I mean Spielberg does pictures.

    Melnik: Then it kind of died out. Right? Same thing again, you know, having the computers entirely come up with the test strategy, the thinking about testing automatically, entirely automatically, I think is – I think it’s utopical, at least if you think about what the tools are capable of doing today and for a very, very long time in the future. I think the human will remain to be at the center of this activity, while again, all the tooling is great because tooling gives you additional powers and additional ways of perhaps automating the most rudimentary, the most, you know, boring elements of the job and lets you actually free up time to think about new theories, new hypotheses, new models, new approaches –

    Bach: But you’ve got to consider different kinds of tools. Like, have you noticed the difference between let’s say a tool like a programmer’s IDE. When I use a programmer’s IDE, I don’t feel oppressed. I feel empowered. I feel like I’m riding a magic carpet and I have laser cannons mounted on it. I feel wonderful. But when I use most testing tools, I feel oppressed, like I have just a few possible things I can do and if I have any –

    Shimel: Like you’re castrated.

    Bach: that’s outside of what the test tool designer has thought that I might want to do for testing, then I’m not allowed to do that. This is what I feel like when I encounter something like Cucumber, which is very restricted and the Gherkin language, it’s very restricted. It’s stopping me from going on flights of imagination. And yet, when I use the tools that programmers have created for programmers, unsurprisingly, programmers have created for programmers tools that make them feel powerful and free and able to do all kinds of wonderful things. I would like to bring the same sense of freedom to testing that programmers already enjoy. That’s part of what we’re doing with the transformation work we’re doing at Tricentis.

    Shimel: Yeah. I love that.

    Melnik: In all fairness, not all of the programmer’s tools are that liberating. Some of them feel like you are operating in a straightjacket too, but in general, at least there are some examples, there are instances of tooling that are widely accepted, widely adopted today that are supporting and kind of accelerating your abilities to do your job without constraining you. That’s for sure.

    And you know, the piece that James was alluding to, this is actually the new initiative, that we are driving inside Tricentis, you know, about mentioning this whole new platform of the test tools for the future where we are building something akin to the IDE, we’re actually not calling it IDE, we’re talking ITE, integrated testing environment where actually it’s the human being, the human tester who is in the very, very center of the ITE, and all these other snippets and utilities and services and everything around the human tester, around the human that manages to support the individual in the way, wherever his line of thought, line of exploration, line of test execution may lead to. Okay?

    So yeah, we’re kind of envisioning this to be as a super configurable kind of morphing tool, almost like the chameleon style. We’re depending on the context and the environment, the different capabilities of the ITE, the integrated testing environment will represent themselves and then the human will actually pick whether this is actually something that they want to take advantage or not as opposed to again being forced into a specific kind of mold or one way of doing testing. And I don’t think – we don’t think actually anybody has attempted something of this caliber, specifically in the space of test tooling before. That’s why we’re so enthusiastic and so passionate about this project. Aren’t we, James?

    Bach: Yeah. I also don’t think that anyone is going to be able to copy is easily because the only way that they could actually compete with us is by hiring someone who loves testing, which test tool companies hate doing because testers are troublemakers. I still can’t really – it’s hard for me to fathom that Grigori really knows what he’s done by hiring me because I’m a constant gadfly.

    Melnik: [Laughs]

    Bach: I’m constantly complaining about the state of test tools in the world and at Tricentis, frankly, and I want things to be fundamentally better, but that means we have to fundamentally change how we think about what is a tester. Which might get us into the role of testing a bit, but the – to me a tester is a puzzle solver, a problem finder. I’m not a button pusher and I’m not a verifier. I don’t verify things. Tools can verify things. I’m not looking to prove that something works because I can’t prove that anything works. What I can do is collect evidence and then draws inferences from that evidence with a critical mindset.

    And of course, lots of tools are collecting facts about the products that I’m testing and those – that can be automated and so we’re pulling in these facts. And we can say, “We got this output and we expected to get this output, so apparently there’s no problem here as far as we can tell so far.” But then the tester layers onto that a critical mindset saying, “But how do we know and how can we be fooling ourselves?”

    And so I’m bringing that mentality into Tricentis and I’m really surprised so far they’ve been actually quite welcoming of me, but for years and years, I’ve tried to help other tool companies with this and basically, you know what reaction I get? They basically say, “Well, our customers just want to have automation that just pushes a bunch of buttons and we don’t really care about test design. We don’t really care about empowering testers. So that’s not going to help us make any money, James, so we’re really not interested in supporting the skilled testers that you keep talking about.” So Tricentis has a different kind of vision that I think is hard to match.

    Shimel: There’s also a little bit of you can’t make wine before it’s time. Right? And I think right, I think you need the right macro conditions, that things like DevOps have brought about and the whole progress -0 we’ve gone back here now to the fifties and sixties and all the way to the present time.

    Certainly the world we live in today may be a – I want to think so anyway, we’re a little bit more open to the idea of saying, “Look yeah, we can automate some stuff. We can have – we don’t need a human to just push buttons. Right? We have tools that can go push the buttons for us, but we need humans to do blank. We need humans to do some of this stuff and so we need to enable and empower them to do that within the context of let’s automate what should be automated, let’s say. But we still need those humans in there.

    You know, when I was growing up, much like you guys, right, the only animal in the world that used tools was humans. Isn’t that – that’s what I learned in school, right, that’s what separated us from animals, one of the things, right, was our ability to use tools. Well, then we found out chimpanzees use tools and other monkeys use tools and we still were okay with that ’cause they were primates. Now we found birds use tools, right, to crack nuts and stuff like this.

    So tool use in itself does not connotate one’s intelligence or higher being. We need to – so to me, that’s the ultimate case. Right? It’s not about what tools we use. It’s about how we use our brains. And I think that’s apropos to what we see in testing today. Yes, we could come up with tools, but it’s creating an environment for people to think in and use their brains in and apply it that I think will ultimately provide us the highest payback, if you will. Right?

    Bach: It’s interesting what you just said about you’re implying that the history of how we got to where we are now is important, that we have to have a certain set of – a certain historical context, technological context in order to take the next leap. And I think one thing in which that’s really true is we now have decades as an industry, decades and decades of experience trying to eliminate people from engineering and we can’t do it. I remember, maybe you do, there were these advertisements in Byte Magazine in the eighties about case tools and all your marketing people can just define your product and you don’t need developers anymore because it automatically generates all the code.

    And I remember sitting there at Apple Computer reviewing case tools, advertisements that had been sent to me, thinking, well, could I buy some of these tools and actually use them to help with the testing? And it turned out, no. You couldn’t. It was just all – it was all hype and nothing. And so I shrugged. And so a lot of – and even today, now we have AI, AI is the new case tool and the AI will do all this stuff for you. Then it turns out the AI is biased and racist and confused and if you put kitten ears on a whale, it says, “That’s a kitten.”

    Shimel: Yep. And it’s no more than ML, the machine learning anyway, but you know, yes, we’ve been – we have been, you know, chasing this white whale for most of my adult life and at the same time, if it was a nation, the fastest growing nation on earth are developers. There’s 40-something million is the estimate growing what, 20 percent a year or something like that. So I think it’s time we stop probably chasing that white whale and move on to empowering people.

    Bach: And one way to do that, I suggest a definition of programmer or perhaps developer. And the definition I use is a developer is someone who stands at the gateway between the world of the machines and the world of humans. And the developer’s purpose is to operate competently in the world of people and then operate competently in the world of machines.

    And if you don’t have that person standing at the gateway, then you don’t have a connection between the world of humans and the world of machines. You just have people kind of praying to the god of technology and hoping that good things happen. And so no matter how complicated technology gets, no matter how much AI we have, we still have the need to operate competently in the world of people and the developers will always live right at that threshold. And testers need to live there too and not get mowed under by automation.

    Melnik: Yep.

    Shimel: And you know what guys, we’re almost out of time, but this also brings up something that I thought we might be able to get to on this show, but we’re running out of time, and that is that this caste system, if you will, caste system of developers being a higher caste than the tester who’s higher than the, what we call today the SRE, the ops person or what have you. And this whole IT stack of humanity, I think we need to examine that too with the develop – when we’re asking the developer to do the security and the testing, is he any better than the tester? Is there a difference? But we’re going to save that one I think for another show, if you guys would like to come back on, and we can explore that a bit.

    Melnik: _____ back, but I categorically reject that whole hierarchy and I also do not like the whole, you know, notion when people say, “Hey, but the tools and everything that would really help with the low skilled tester.” That’s another notion that kind of gets _____ _____ –

    Bach: No, we reject that.

    Melnik: So annoying and, you know, whether it’s development or testing or any other, you know, data science modeling, the UX design, it’s the discipline, it’s something that requires dedicated effort of studying, perfecting, thinking about the way how people do that work and it requires intellect. That’s the most important thing. You know, using some very powerful tools doesn’t give you the license to turn off your brain and I’m happy to come back on the show and talk about the different career letters and progressions because again, it’s going to take us a longer –

    Shimel: That’s a whole other show.

    Bach: There’s a lot to –

    Shimel: _____ and vocal about that.

    Bach: say about that. But I just want to note that this whole issue has been studied in great depth in another field, in the field of the sociology of science. For instance, in physics, theorists are in the higher caste and experimentalists are in the lower caste. So if you’re an engineer, you’re in the lower caste and they’ve studied this. How do these people cooperate? How do they assign prestige to each other? It’s a well-known phenomenon in many fields of human endeavor.

    Melnik: And the same in math, right, the theoretical math versus applied math, the theoretical math seems to always think that they’re the gods and they’re the ones that are, you know, creating something that, you know, will take centuries for the world to truly appreciate and then you guys are in the applied math solving the problems of today.

    Shimel: Exactly. Guys, we’re out of time, but I’m going to hold this – I’m going to hold you both to it. We’re going to come back on – not in the next show because I think we have something scheduled, but in one of the ones coming up, we’ll have you both back on, or maybe this’ll serve as part of our first roundtable in about a month from now when we’ll open it up to the audience as well. But for now, Grigori, James, thank you. Yes

    Melnik: Thanks, Alan.

    Shimel: James, thank you.

    Gentlemen, it was a pleasure. This is Alan Shimel. You just watched the very first DevOps Unbound. We’ll be back in two weeks with a fresh panel, fresh topics, stay tuned. Thanks again to Tricentis for sponsoring and thank you for watching. Bye-bye.