devopsy.kinsta.cloud

Category: Low-Code/No-Code

  • 4 Ways to Uplevel Your Software Engineering Team

    4 Ways to Uplevel Your Software Engineering Team

    In my 20 years leading software development teams, I’ve witnessed the industry’s continuous growth alongside technology’s evolution. The only thing we know for certain is that the industry will continue to change and winning businesses will be those that build with change in mind, backed by effective, fast-moving software teams.

    This is the year we must focus on fine-tuning our DevOps processes and uplevel our teams, but where do we start?

    Below are four ways you can begin to transform your teams into engineering powerhouses, no matter how big or small or where they are in the world.

    1. Embrace New Delivery Models

    Remember when deployments were a big deal; a highly-anticipated event that often meant late nights? These days, many teams have managed to make deployments a non-event and are deploying any time of day. Those that haven’t adapted risk being left behind. The rate of deployments will only increase, so how teams handle this progression will be a deciding factor for success in an already competitive field.

    In 2022, teams should continuously evaluate their procedures as they push the boundaries of their tech stack. Navigating the complexity of the digital era—from massive datasets and machine learning to networks of third-party services—will force both developers and company leaders to embrace flexible tooling and processes to ultimately refine the risk/innovation tradeoff.

    2. Prioritize People and Culture

    While 2021’s Great Resignation saw many software professionals jumping ship in search of a fresh work environment, in 2022 we expect to see a Great Reshuffle. Realizing their new or current gig still may not be quite the right fit, engineers and developers will start looking for roles that are more in line with their long-term career and personal goals.

    Don’t fear this reshuffle. Instead, recognize it as an opportunity to build a strong and stable team. Be honest about what, exactly, the job entails and the hard and soft skills you’re looking for. Honesty throughout the recruitment process leads to a better match between employer and employee and also contributes to resilient company culture.

    3. Deploy Low-Code Solutions Strategically

    Pressure to get the highest productivity out of software development teams has led to the adoption of no-code and low-code solutions. But that means these tools are being used predominantly by people who already know how to code. The folks with big ideas who don’t actually want to be programmers remain unserved and untapped.

    Expect this disparity to soon lead to a split in the category of no-code and low-code solutions—those built specifically for optimizing developer teams, and those that can serve everyday creators. To really get the most out of your team, keep an eye on the low-code space and ensure the solution you use is the one that’s actually best suited for your goals.

    4. Build With Change Validation in Mind

    The growing adoption of cloud storage, service-oriented architectures, third-party API-based services and open source code (to name a few) makes modern software development monumentally complex.

    A way to manage this complexity is by pulling our focus away from the application itself and onto myriad sources of change that affect the application—a concept we can think of as change validation.

    Ultimately, change validation builds upon tried-and-true software best practices such as continuous integration, continuous delivery and release orchestration. Cloud-native architectures can be effective and scalable, but you need to have the right tools and systems in place to validate changes to your code at every step.

    In the past, the general consensus was that you shouldn’t test in production; you should just release and wait for the bug reports to tell you what’s wrong. But in the world of extensive software supply chains and cloud-native architectures, testing in production is the only way to truly know whether changes to your code are working as intended before releasing software to customers.

    In the new year, software developers will be of critical importance as organizations continue to expand on digital services and projects. Embracing new methods of software delivery, prioritizing people and culture and keeping an eye on how to best leverage automation tools like no-code/low-code and change validation will all help to transform your team for the better in 2022. This forward-looking approach and a willingness to reassess and pivot guarantees that your software engineering team will remain agile amidst a rapidly changing tech landscape.

  • Front-End Frameworks Enable Better Dev Collaboration

    Front-End Frameworks Enable Better Dev Collaboration

    The general public often thinks about software development in terms of a lone software developer hacking away tirelessly at their keyboard. Of course, that is an anachronism, at best. What is true is that collaboration among software engineers, especially with their colleagues in IT operations which evolved into DevOps, has become the norm for rolling out better code faster.

    We are on the cusp of the next big evolution as software development becomes more of a ‘team sport’ than ever before. Now, collaboration is extending beyond IT (developers and operations) to cross-functional areas across various business teams. Product development, marketing and others also are providing input and feedback into the software development process and, most significantly, becoming part of the process.

    Front-End Frameworks are Driving Collaboration

    Historically, software programming, including front-end programming, happened in local IDEs. However, the rise of modern front-end web frameworks has led to an entire class of developer tools that speed up the build process and allow applications to be deployed more quickly.

    There are a number of front-end frameworks that do this: Netlify, Vercel and Appsmith, an open source internal app builder, are three examples. These tools are getting widespread adoption, because, in a world where front ends are becoming more complex, they make things like hosting, deployment, authentication and serverless functions much simpler. The other reason for adoption is also because many of these tools are built on top of popular open source frameworks such as React, which already has a vast user base.

    This is enabling a new kind of collaboration that is unlocking a lot of value for all the stakeholders involved. Inspired by how Figma reshaped the design process by allowing real-time commenting back in 2016 or how Google’s suite allowed real-time editing, there is a similar phenomenon taking place over the last year in software engineering.

    Visual, Real-Time and On the App

    The most obviously striking feature is that collaboration is happening on the app (or the app prototype) and is becoming increasingly visual. Writing or editing code in the command line is great, but it doesn’t necessarily help the developer to visualize what is happening. Vercel’s Next.js Live, for example, allows teams to chat, draw and edit.

    collaboration

    This also means that collaboration is happening on the app instead of through tools like email, Slack and Jira, leading to targeted feedback without having to toggle between multiple tools.

    Collaboration and Feedback Loops Become More Inclusive

    While developers often collaborate at the code level, non-developers’ feedback is often given at the design level. This is more often the case for internal tools (or apps), which typically account for anywhere from 20% to 40% of engineering bandwidth in organizations.

    For example, Appsmith today has thousands of developers self-hosting and deploying internal applications for users who are often business or operational teams like support, sales and/or finance, for example. Often, these business users don’t even know who has built the application. Real-time commenting via front-end frameworks facilitates collaboration between software engineering teams and their business counterparts who can now communicate directly, provide feedback and collaborate with their engineering peers. This close collaboration empowers all parties, increases efficiency and saves significant time while improving the overall quality of the software and ensuring that it meets expectations.

    AppSmith

    In addition, non-engineers don’t need to familiarize themselves with a new tool like GitHub or go through a painful replication issue on Jira involving a variety of screenshots or screen recordings. Sharing feedback can be done much more easily.

    Better Version Control and Feedback

    For developers, having the ability to visualize a particular branch of an application and give detailed feedback on it and then track it on GitHub or GitLab speeds up the development cycle. Netlify, for example, pioneered this when it launched Deploy Previews earlier this year. Netlify takes this feedback and integrates it into project management tools like Jira, Trello and many others in addition to GitHub and GitLab.

    collaboration version control

    We are seeing other companies, like Sturdy, building on this much-needed trend of real-time collaboration in app development.

    Collaboration is the Trend

    Great software is the story of teams expanding collaboration beyond developers and there is a lot of good tooling available to help achieve that. This trend should continue to gain traction in the years to come because it taps into a number of other underlying trends in the software development space.

    First, the explosion of alternatives in the backend-as-a-service space, in which Heroku and Firebase were early pioneers, means BaaS is embraced by many more organizations for a variety of use cases. This trend speeds up development because they present a much more tightly integrated ecosystem of services and organizations don’t have to worry about deployment, hosting, content delivery network (CDN) and/or authentication themselves, for instance.

    Second, the proliferation of APIs is driving the emergence of more complex applications built on a variety of data sources. Everything is connected to everything. Of course, this also means that a lot more data is available to support decision-making, and this leads to many different kinds of applications being created both for external as well as internal purposes.

    And finally, the larger low-code/no-code movement is creating millions of new citizen developers and blurring the boundaries between who is and isn’t a developer.

    Summary

    DevOps marked the start of the evolution of software development into a team sport, and collaboration is now accelerating beyond the boundaries of IT. Like DevOps, the result of this collaboration in the software development process will be better software that propels businesses forward created faster than ever before.

  • The Low-Code Tide is Rising

    The Low-Code Tide is Rising

    [pdf-embedder url=”https://devopsy.kinsta.cloud/wp-content/uploads/2022/02/hcl-low-code-tide.pdf”]

  • Low-Code SaaS Solutions Need Security at Their Core

    Low-Code SaaS Solutions Need Security at Their Core

    Faster integrations. Accelerated software delivery. Elevated user experiences. These are only three of the benefits organizations gain by incorporating low-code platforms, apps and solutions into software development and business process management.

    Low-code platforms aren’t new, but demand for the technology soared in the last two years as companies were challenged to meet stakeholder demand for more digital transformation. With low-code tools, companies find they can expand digital transformation efforts through faster business application delivery. In addition, the time it takes to innovate is dramatically reduced with low-code tools.

    Low-code solutions are no passing trend. In their recent report on global cloud revenue, Gartner predicted that by 2025, the use of low-code and no-code will “nearly triple,” adding that “70% of new applications developed by organizations will use low-code or no-code technologies, up from less than 25% in 2020.”

    Low-code solutions give organizations the ability to produce working solutions and integrations with more speed and agility than more traditional on-premises development. Integration used to be a labor-intensive IT process requiring custom development on both sides of the integration. As more organizations adopt a “buy versus build” approach to software development, they are turning to self-service and other solutions with “out of the box” functionality to increase speed and efficiency. In addition, the vendor-developed components of low-code tools also offer a better user experience.

    Rising Demand for Low-Code, Platform-based Solutions

    As organizations expand their product and service offerings, the demand for low-code, platform-based solutions will increase. SaaS and PaaS solutions with a low-code focus can be effective for organizations looking for accelerated functionality. Often these tools include pre-built models and templates that businesses can quickly implement and easily duplicate for flexibility and versatility.

    The ability to create seamless integrations with other applications is a must. Best-of-breed low-code platforms enable intelligent integration between multiple applications using graphical user interfaces (GUI) as well as industry-standard interfaces such as JSON and APIs within vendor-supplied environments. Intuitive visual user interfaces and drag-and-drop features allow businesses to customize the solution to meet their needs and preferences.

    But along with ease of use and rapid functionality, organizations must look for low-code tools with security built-in.

    Security: A Priority for Low-Code Tools

    Security must be a top priority for organizations using low-code tools in any capacity, from using a low-code platform for application development or using a no-code SaaS solution for business process automation.

    Anytime an organization introduces outside applications or any third-party API integration to an environment, the organization is entirely dependent on the vendor’s security implementation. This is especially true when combining various solutions to create a unified product or service. If the vendor doesn’t take security seriously, other parts of a solution could be exposed to risk because of a weakness in another area.

    Problems can get in either intentionally or unintentionally, as demonstrated with the recent Apache Log4j vulnerability. The bug in this commonly used routine was found to have massive potential for cybersecurity attacks. As CNET cautioned, “The vulnerability in the widely used software could be used by cyberattackers to take over computer servers, potentially putting everything from consumer electronics to government and corporate systems at risk of a cyberattack.”

    Ways to Remedy Security Risks of Low-code Tools

    Organizations can’t make assumptions about the security of every tool, solution or platform they bring into their environment. They must complete their own due diligence for security in the software development pipeline or any time a 3rd party app or tool is introduced.

    One critical step to addressing security is incorporating DevSecOps and shifting security left in the software development pipeline. The Log4j vulnerability put the need for DevSecOps in the spotlight. Taking a shift left approach and implementing security earlier and more often in the DevOps process can help to catch more potential vulnerabilities. It’s critical to introduce DevSecOps early in the development cycle, or organizations risk missing a bug or vulnerability. In the development cycle, security isn’t an antivirus scenario; all code must be scanned for vulnerabilities.

    Organizations also need to employ due diligence when exploring options and solutions to bring into their environments. Look for solutions with security at their core. Before integrating any low-code solution, examine the vendor’s approach to security.

    Some security measures to look for when considering vendors or solutions include:

    • All communications should utilize at least TLS 1.2 (transport layer security) and comply with industry standards for certificates and encryption keys.
    • All hashing should be using current accepted standards with HMAC, they should be enforcing security rules on passwords such as only storing password hashes and requiring 2FA if they interact directly with customer accounts.

    Low-code platforms and tools have the ability to accelerate digital transformation efforts without having to rely on hand-coded, on-premises solutions. The potential for time savings and cost savings is significant, but it’s important for organizations to ensure they’re not compromising security when choosing solutions.

  • How Low-Code Enables the Composable Enterprise

    How Low-Code Enables the Composable Enterprise

    Enterprises know that their customers and partners expect a superior personalized experience. After all, customer experience has been a top priority for organizations over the last decade. However, despite all the technological advancements and transformation initiatives, the ability to deliver innovation with speed continues to elude. 

    Without this ability, enterprises constantly play catch-up with rapidly shifting business dynamics and customer expectations.

    Why is Strategic Agility so Elusive?

    Enterprises are unfortunately locked in a situation that Gartner Research identifies as “static application experience”. It is a paradigm of rigid and bloated application architecture, creating inertia that organizations find difficult to navigate around. This technological impedance is one of the primary reasons (besides organizational culture and structural challenges) at the root of organizational sluggishness.

    To adapt to the challenges of the modern world, enterprises need to move from a static application experience to a more dynamic one. This can be achieved through the approach — wrapped around a goal — of a composable enterprise.

    Composable Enterprise is the Future of Applications

    A composable enterprise aims to create an application architecture wherein enterprises can deliver various functions through composition (as against development), by leveraging packaged business capabilities (PBCs). Gartner estimates that by 2023, 30% of new applications will be delivered, priced, and consumed as libraries of packaged business capabilities, up from fewer than 5% in 2020.

    To be fair, this run-up to a composable enterprise is not a fresh-of-the-press revelation. Enterprises have been attempting to move from hardcore coding-based development to a more service-and-composition-oriented architecture over the last couple of decades, albeit only in pockets and not as fast as they would have wished.

    Composable enterprise has become the need of the hour. And this is being driven by the sense of urgency created by multi-faceted disruption across industries, coupled with technological advancements that make it possible for organizations to accomplish it at an enterprise scale. 

    One such advancement comes in the form of low code digital transformation platforms.

    How do Low-code Platforms drive Composable Enterprise?

    According to Forrester Research, low-code development platforms are emerging as a key strategy to accelerate app delivery to support digital business transformation. They have the potential to make software development as much as ten times faster than traditional methods. Low-code platforms use visual composition and a modeling-based approach to speed up application development. 

    A good low-code platform drives the creation of a composable enterprise in two ways, both of which are critical for long term sustainability:

    • By enabling rapid development of modern PBCs that deliver cutting-edge functionality without having to rebuild the organizational core, thereby protecting decades of investments in legacy and core applications 
    • By providing the core capability to create applications through composition and abstraction with a modeling-driven application environment, wherein the organization can create customer-centric business applications that deliver a dynamic omnichannel experience and drive the end-to-end customer journey

    Is There a Catch?

    Low code platforms come in various shapes and sizes, from those supporting the creation of relatively simpler stand-alone applications to those that enable the rapid development of mission-critical enterprise-scale applications with various functional components. Mostly, the latter category forms the core of a composable enterprise.

    To drive a composable enterprise, a low code platform needs to be equipped with a variety of capabilities. It should: 

    • Speed up pro-grade development through modular, modeling-driven, and abstraction-oriented development
    • Support a variety of business and technological needs, such as workflows, content management, straight-through transactions, mobile apps, collaboration, customer self-service, omnichannel customer engagement and automated business rules
    • Offer service-oriented integration that can extend beyond the organizational boundaries
    • Enable rationalization of application portfolio by helping avoid the introduction of multiple point-solutions in the mix with its own ability to develop a variety of applications quickly
    • Prevent shadow IT through central governance, visibility, and guardrails, without hindering innovation
    • Enable agile, continuous integration/continuous delivery (CI/CD) and adherence to quality standards and architectural requirements
    • Enable, even catalyze, change with traceability, thereby ensuring long term sustainability of business applications

    What Next?

    The ability of organizations to accomplish a composable enterprise of the future will depend on a multitude of factors. It is essentially a transformational journey.

    It is important to take the right steps and build in phases, starting from establishing a core low code platform and building peripheral capabilities with time. Picking the right set of applications and establishing early wins go a long way in building momentum towards the long-term goals.

    Identification of the right low code platform that can drive your transformation journey to a composable enterprise is critical for achieving a composable enterprise.

  • Best of 2021 – The Next Evolutions of DevOps

    Best of 2021 – The Next Evolutions of DevOps

    As we close out 2021, we at devopsy.kinsta.cloud wanted to highlight the most popular articles of the year. Following is the seventh in our series of the Best of 2021.

    As society continues to recover from the global COVID-19 pandemic and some semblance of normal starts to return, technology continues to move forward. The pandemic certainly changed what normal means and people, processes and technologies all have adapted and evolved to meet those challenges. The narrative that the pandemic caused of your organization’s digital transformation is true for many practitioners. With 2022 just around the corner, DevOps is on the cusp of maturation of previously bleeding-edge paradigms and a focus on engineering efficiency. Here are five DevOps evolutions you should keep an eye on going forward.

    Engineering Efficiency is Front and Center 

    Engineering efficiency is a particularly broad umbrella term. At the foundational level, engineering efficiency focuses on making someone (for example, an engineer) more productive. There are a multitude of disciplines that intersect, from organizational design to engineering/developer experience. Engineering efficiency is increasingly critical for organizations today. The pandemic had two major impacts on the technology sector in terms of resources and staffing. The first, at the start of the pandemic, was the unprecedented and unpredictable availability of resources; physical locations were being shut down because of the medical severity of the pandemic and the “getting hit by a bus” factor was playing out in real life. Second, during the recovery period, the Great Resignation began, and with it, a fight for resources that has become increasingly intense. Both have meant that the availability of resources, especially ramped resources, is scarce. 

    The Spotify model of tribes/guilds of engineering resources is a promising evolution; folks can frequently move around, reducing the toil that engineering resources face and allowing for engineering resources to not only ramp up more quickly but also increasing engagement and retention. The industry continues to march toward standardization in areas that were typically bespoke, such as the release process, and I think we’ll see that continue to evolve, as well.

    Git is Ubiquitous

    Leveraging a source code management (SCM) solution used to be reserved for software engineers. But as the proliferation of “something-as-code” has touched multiple levels of the technology stack from networking, storage and, ultimately, a development pipeline, the march of operations-focused engineers adopting many of the traits of software engineers continues. Having iteration in your infrastructure stack with more ephemeral/disposable infrastructure is becoming the norm. Saving and packaging the multitude of configurations for the “something-as-code” source control is a natural area of evolution. 

    Building off of source control are the package managers—your Docker registries, Helm chart repositories, etc.—for more deployable artifacts; that said, getting those artifacts to production is a process. Because Git is becoming ubiquitous across the technology landscape, this leads to the continued adoption of GitOps. Since the seminal piece was written by Weaveworks in 2017 defining the GitOps paradigm, leveraging GitOps is seen as a viable paradigm for many organizations five years later, especially when starting with greenfield initiatives. 

    Kubernetes is No Longer Bleeding Edge

    In 2022, Kubernetes will celebrate the eighth birthday of its first commits on GitHub. Taking a jog down technology memory lane, eight years before Kubernetes (in 2006), VMware was still a private company and it would be a few years before vSphere was even released (remember how it felt to run a workload on a virtual machine in 2014?). The Kubernetes ecosystem still moves quickly, but placing workloads on Kubernetes is not a novel concept anymore. As application infrastructure and architecture have adopted the Kubernetes way (in other words, being idempotent and ephemeral), there is maturity around running a suitable workload on Kubernetes.  

    Kubernetes by design is highly pluggable. If you do not like the opinion or implementation of something inside Kubernetes, you can replace that opinion. Don’t like how Kubernetes handles ingress traffic? Then choose from one of the many ingress controllers available today. That is just one example of dozens of pluggable areas. Because of this, Kubernetes is viewed as a dynamic, non-static resource. Using Kubernetes takes trial and error and getting your cluster to be robust, performant and reliable is an ongoing journey that requires ongoing iteration. 

    Authors Can Be the Enforcers

    There is no question that in a modern software stack, we are inundated with data. The metrics soup and the continued science of and exploration of observability (metrics, traces, logs) provide us with a lot to work with. Making decisions, even automated ones, based on that data continues to be critical. With the rise of site reliability engineering (SRE) practices, reacting or anticipating spikes in usage, failures and even security-related items are par for the course for modern teams. 

    These decisions can be authored into policies that specific platforms understand, such as autoscaling rules for a cloud vendor or something like Open Policy Agent in the Kubernetes ecosystem. With so many items shifting left toward the development team, finding the right resource, skillset or institutional knowledge to author these rules can involve the input of several teams. Because of the rise of “something-as-code,” regardless of whether the author of these rules is a software engineer, DevOps engineer, platform engineer or anyone in between, that author has the ability to enforce. 

    Shifting Left … But Complexity Shifts Left, Too

    The old adage is that complexity is like an abacus: You can shift complexity around, but it never really goes away. With the movement to shift responsibility left to development teams, this also means that associated complexity is shifting to the development teams. Modern platform engineering teams provide the infrastructure (compliant Kubernetes clusters) to teams and any workload that is run on those clusters is up to the development team that owns it.  Typically, development teams then focus on features and functionality. Managing lots of non-functional requirements—and even core infrastructure requirements such as networking—can be a burden; think about how your organization would handle a service mesh.

    If you are a DevOps or platform engineer, making your internal customers—your development teams—successful is a great goal to work toward. Crucial to this is disseminating expertise. This can be in the form of automation and education. A common practice with the DevSecOps movement is to have some sort of scanning step as part of the build or deployment process, disseminating the internals as far as how the scan is performed, what happens if something is found, etc. Gaining internal adoption is a journey and having a good developer experience built around clarity and stability are important. 

    Evolution in 2022

    Even with all of the challenges, bumps and learnings that the last year has given us, technology continues to evolve and advance and even lower the barriers of entry to continually become more inclusive. Focusing on improving engineering efficiency and reducing toil will allow for more participation and lower the barriers to entry.

     

  • Rails 7 FTW | WFH is SOP | 586M Passwords Dumped

    Rails 7 FTW | WFH is SOP | 586M Passwords Dumped

    Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.

    This week: Ruby on Rails 7.0 is go, working from home is still de rigueur, and HIBP gets far, far bigger.

    DHH is Excited

    First up this week: Ruby on Rails version 7.0 is now in production. It promises less bloat, better security and even more developer efficiency.

    Analysis: Last chance for greatness

    Talk to devs about Ruby on Rails and you’ll hear a wide range of opinion—all the way from “obsolete memory hog” to “productivity secret weapon.” But its important promise seems to be to encourage devs to use better design patterns.

    Paul Krill: Ruby on Rails 7 rejiggers JavaScript support

    Ruby on Rails 7, the latest version of the web application framework, is now available as a production release. … It gives developers a “no-Node” approach to front-end development while still providing access to NPM packages and modern JavaScript.
    …
    Most Rails applications will not require Node.js, given the new defaults. … Other improvements:
    …
    Encrypted attributes have been added to Active Record, enabling applications to offer at-work encryption in addition to traditional at-rest and in-transit. … With asynchronous query loading, two unrelated queries can be run concurrently. … The Spring application preloader is no longer on by default, as faster computers have made it unnecessary.


    Let’s hear from Rails creator David Heinemeier Hansson—AKA DHH:

    Seven is … the culmination of years of progress on five different fronts at once. … The part that really excites me … is how much closer it brings us to the ideal of The One Person Framework. A toolkit so powerful that it allows a single individual to create modern applications upon which [to] build a competitive business.
    …
    It’s been well over twenty years for me now, and a big release like this still makes me giddy. … What a glorious time to be working in web development.


    What a whatnow? Here’s bb_matt:

    I don’t pretend … it’s a “glorious time to be working in web development,” except for one important aspect: … Experienced programmers coming over from software development and starting to make amends [with] strong typing, robust CI/CD, a focus on TDD, a focus on domain modeling.
    …
    99% is still total **** though—but then again, so is most software.

    Home Working Ain’t Gone Away

    A month ago, my long-suffering editor permitted me to write, “WTH? We Wanna WFH.” And survey after survey says tech workers work better at home. After the last 21 months, there’s simply no denying it.

    Analysis: Genie out of bottle—no going back

    If you’re under the misapprehension that DevOps is somehow “special” and your workers will be glad to return—think again. Find a way to make it work, or work will stop—and your business will die.

    Steven J. Vaughan-Nichols: How to lure employees back to the office? You can’t. Not now. Not ever.

    Months have gone by, and the great resignation keeps rolling along. … People don’t want to catch COVID-19 [but] bosses still think they can force skilled workers to return to offices. … That’s not going to happen.
    …
    The problem? Many executives and owners haven’t gotten the clue yet. [But] any doubts you may have about people not doing a good job unless you’re looking over their shoulders should have vanished by now. … The monthly academic WFH research.com survey has found almost six out of 10 workers reported being more productive working from home. … In the Dice State of Remote Work report … 53% of technologists listed greater productivity as one of the main benefits.
    …
    It’s simple: It works better for them and for your company. … Anyone who’s been paying attention … must agree. You can either go along with the flow, or you can fight it and first lose your staffers and then your company


    So what do DevOps managers think? One of them is kozikow:

    100% remote is not great either. … When there was a long period of 100% remote during Covid, there were some issues. … We developed a policy that Mondays are required, Wednesday are encouraged, rest is work from home. … It was shared decision of the team.
    …
    I think that most people who are strongly against hybrid work just have to live in a miserable place like SF. … It’s unfortunate that so many software companies are in the Bay Area.


    But you couldn’t pay some people enough to go back—people such as this Anonymous Coward:

    No way in hell they’d ever be willing to pay me … to come back into an office. … No having to go out in ****ed up weather, no fighting traffic and … dangerous drivers, plus I get all that commuting time back.
    …
    And I don’t have to put up with Linda cooking fish in the microwave.

    Have I Been Pwned? There’s a 38% Higher Chance

    This week saw a huge bump in the size of Troy Hunt’s already-massive database of stolen credentials. In case you’ve not seen it, HaveIBeenPwned.com is an amazing free service that lets apps securely check a user’s password isn’t already used elsewhere on a compromised site.

    Analysis: Build the API into your auth flow ASAP

    The UK’s equivalent to the FBI has donated a huge trove of credentials—after deduping, it’s added more than 225 million new passwords to the database. Frankly, if you still allow your users to rely on any of the 847 million passwords in HIBP, it would be negligent.

    Simon Sharwood: National Crime Agency finds 225 million previously unexposed passwords

    Troy Hunt, of Have I Been Pwned (HIBP) fame, yesterday announced … the NCA shared 585,570,857 [creds] with HIBP, and Hunt said 225,665,425 … he hasn’t seen before in the 613 million credentials HIBP already stored. [HIBP] lets anyone conduct a secure search of stolen passwords to check if their credentials have been exposed.
    …
    The NCA’s statement to Hunt did not reveal the source of the password trove [but said they] “were able to identify a huge amount of … passwords in a compromised cloud storage facility. … It became clear that these credentials were an accumulation of breached datasets known and unknown.”
    …
    [The] release brings the total Pwned Passwords count to 847,223,402, a 38 percent increase.


    How’s this relevant to DevOps? Troy Hunt explains:

    In the last month, there were 1,260,000,000 occasions where a service somewhere checked a password against … HIBP’s Pwned Password API. … There are all sorts of amazing Pwned Passwords use cases out there. For example … checking their customers’ passwords on every registration, login or password change to see if it’s previously been breached.
    …
    The UK’s National Crime Agency has done some wonderful work over the years to combat cybercrime. … Today’s release is about turning on the firehose of new passwords and making them immediately available to everyone for free. Having this open to the community, owned by the community and supported by the FBI and NCA is an enormously pleasing result.


    Time for a metaphorical thought experiment. LenKagetsu obliges:

    You were told by a reliable source that an unknown person … posted a high-res image of … your house key … on the internet. Would you change the locks?

    The Moral of the Story: Never switch horses in midstream


    You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.

    Image: David Emrich (via Unsplash)

  • How Log4j Becomes a Serious DevOps Problem

    How Log4j Becomes a Serious DevOps Problem

    The recent discovery of the Apache Log4j vulnerability has wide-ranging implications for anyone who develops software, especially for those in the DevOps realm. What’s most troubling about the vulnerability (CVE-2021-44228) is how prevalent the use of Log4j is. The vulnerability is reported in a vast array of applications and directly impacts numerous Apache projects, including Druid, Dubbo, Flink, Flume, Hadoop, Kafka, Solr, Spark and Struts. There are also numerous Cisco programs impacted by the vulnerability. The list of impacted applications and libraries seems to be almost infinite, extending to Elastic LogStash, GrayLog2, Neo4J, Steam, Twitter and even the VMware Tanzu family of programs. 

    Simply put, any application that uses Log4J for logging and tracing is subject to the identified family of attacks known as Log4Shell. Those attacks prove easy to exploit and can be used to take control of vulnerable servers.

    Why DevOps Practitioners Should be Concerned

    The world of DevOps is all about reiteration, where features and improvements to applications are slipstreamed into production environments. To accelerate development, the QA process is usually limited to the most recent changes.

    In other words, developers, via their pipelines, can often establish a baseline of quality and then speed up their CI/CD pipelines by testing only what has changed since the last iteration of the application. This process ensures an acceptable level of quality without introducing what are perceived to be unnecessary steps.

    However, those processes do not take into account newly discovered flaws in older APIs and libraries, meaning that those flaws could telegraph into deployed applications and leave DevOps teams completely unaware of the impact and possible disruption. Detecting flaws after an application is deployed is like putting the cart in front of the horse.

    Further complicating the situation is that many developers lack a well-defined and well-maintained software bill of materials (SBOM), which means developers may be unaware of the components and/or libraries being used in a deployed application.

    Without an SBOM, it becomes increasingly difficult to remediate an issue with an application—especially if developers are unaware of the issue to begin with.

    Where Should Responsibility Lie?

    More often than not, vulnerabilities introduced into applications become a game of finger-pointing, where developers blame library suppliers or infosec staffers, and infosec blames developers for not performing due diligence on the components they are selecting to incorporate into their applications.

    Of course, finger-pointing only adds to the angst and delays the process of remediation and does nothing to determine where the responsibility for detecting and remediating vulnerabilities lies. DevOps teams need to put these squabbles aside and establish a process that deals with unintentionally introduced vulnerabilities. What’s more, DevOps teams need to invest in DevSecOps to make sure that vulnerabilities are detected and remediated as quickly as possible.

    To avoid the potentially massive disruption that a vulnerability like Log4Shell can cause, those running DevOps should consider:

    • Creating and maintaining an SBOM 
    • Deploying automated tools that scan for discovered vulnerabilities
    • Automatically comparing the SBOM against vulnerabilities
    • Including DevSecOps processes within their CI/CD pipelines
    • Frequently testing applications for flaws
    • Coordinating with cybersecurity personnel when a flaw is discovered
    • Patching frequently

    With more and more vulnerabilities discovered on an almost daily basis, DevOps teams must be ever vigilant about what components are incorporated into their applications. What’s more, with the increased use of low-code/no-code tools and integrated development environments (IDEs), DevOps will also need to consider if those tools use other libraries that can become compromised.

     

     

  • Low-Code: Bridging the Gap Between DevOps and Business

    Low-Code: Bridging the Gap Between DevOps and Business

    The need to innovate faster, manage multiple environments, optimize an application’s life cycle and achieve continuous delivery are aspirational goals that a successful DevOps team strives for. But there are loads of challenges, as meeting these goals increases the pressure on DevOps teams to adopt improved application architecture, new tools and developer workflows.

    The overarching principle of DevOps is continuous effort, including continuous business planning, collaborative development, continuous testing, continuous release and deployment, continuous monitoring and collaborative customer feedback. This is where low-code development platforms are emerging as an integral way to empower DevOps teams.
    If you look closely, ​​low-code and DevOps share common benefits: The ability to offer faster, scalable and complex applications consistently to meet business needs.

    However, many DevOps teams still rely on conventional manual coding and automation. Low-code can also supplement the talent shortage by enabling folks without extensive programming experience to develop and deploy applications faster.

    How Low-Code Platforms Impact DevOps

    Automated Application Deployment: Low-code platforms increase the speed of DevOps while also reducing the overall complexity by providing a unified platform to enable the cultural shift. From managing version control to validating builds, low-code platforms do all the heavy lifting for your developers. With low-code, you can deploy almost anything in a single click—user interface, workflows, database and/or integration components.

    Clutter-Free DevOps: Low-code platforms allow you to integrate with different programming tools using APIs, SOAP and REST web services.

    Hassle-Free Migration: Organizations can keep their legacy systems alive longer by making their functionality available to many other systems. Consider developing an Android and iOS mobile application on top of your existing CRM system. While your core system maintains, a low-code platform allows you to develop add-ons or new apps on top of it. Furthermore, because low-code platforms provide easy-to-use tools, citizen developers may participate in the migration process.

    Maintenance at Scale: With low-code, you don’t have to worry about updating apps over time because the platform designer always updates and refines the stored interfaces—and, as a result, your application—without even bothering you.

    Enterprise-Grade Security: Security is a top consideration when building scalable apps. Low-code platforms enable your IT and DevOps teams to manage data and user access. Each user can be provided with access to only the information and functionality that they require based on their roles and responsibilities.

    Compliance and Security: Legitimate low-code platforms adhere to the Global Compliance Assurance Standards, as well as ISAE and ISO certifications. Security should be a top priority for your platform, which will serve clients from a variety of businesses, including government entities. Besides integrating robust security and governance features, make sure that your platform has also implemented an ISO/IEC 27001-compliant information security management system (ISMS).

    Democratizing IT: Bringing Business and DevOps Together

    A major challenge for DevOps is to constantly meet the changing needs of the business. The invariably dynamic nature of processes demands continuous optimization, which turns out to be a bottleneck for business, especially if IT can’t deliver applications on time. To make this whole approach scalable, low-code platforms provide multiple environments for your business and DevOps team to test, build, deploy and modify applications collaboratively.

    A comprehensive low-code platform offers the means of both visual programming and coding capability. For usability reasons, these tools are clearly separated and presented to the development team in a way that allows citizen developers and business users—who are most commonly the domain experts—to use the visual components while developers can work on adding custom code to extend the capabilities of the application.

    While a complex app can only be developed by an experienced professional developer, modifying the look and feel of an app or building/modifying basic functionality can be carried out by business users/citizen developers.

    Moving IT Up the Value Chain From Executor to Enabler

    IT teams are now viewed as critical to enabling their businesses to achieve greater productivity and profitability. By providing a self-serve model using a low-code platform, you can enable citizen developers to build custom apps, employees to use portals at their convenience and create dashboards to improve everyone’s visibility, among other value-adds.

    The key is to provide your teams with the right set of tools with the right level of access while still enabling IT to manage and monitor these low-code applications’ reach. For DevOps and IT ­leaders, it provides an opportunity to empower businesses with strategic insights and recommend solutions that best suit business goals, mitigating risks and offering budgeting strategies, rather than just being a facilitator of technology.

  • 5 Ways Low-Code Accelerates Digital Transformation

    5 Ways Low-Code Accelerates Digital Transformation

    Organizations traditionally have struggled with build-versus-buy decisions when digitizing their internal operations and processes. While the build option offered the benefit of using internal teams or outsourcing to external vendors who could satisfy requirements, the downsides are a long wait, higher costs and the constant change and maintenance applications require. On the other hand, buying solutions off-the-shelf meant that the costs were lower but the businesses would have to change or adapt to already-crafted solutions; not all businesses could adhere to a one-size-fits-all solution. 

    This challenge often resulted in only the highest-priority and big-budget applications or tools seeing the light of day while others were put on the back burner—even if those back-burnered tools could have improved productivity and user experience.

    Enter low-code platforms. The adjacent skill phenomenon enables users with similar fundamental experience but in different niches—think web developers and designers—that, when provided with a drag-and-drop tool can supplement their experience to move up the value chain and become full-stack developers.

    In a similar way, low-code platforms enable backend engineers to use drag-and-drop tools to build UI and business logic quickly. This translates into full-stack skills and makes frontend engineers redundant for internal tooling. With low-code and no-code tools, backend engineers can create dashboards, CRUD apps, transactional systems, processes and workflows built on top of existing data sources like databases, connected via APIs, housed in third-party tools etc. These solutions can easily be created and deployed in a matter of hours instead of weeks or months or, worse, back-burnered and doomed to never see the light of day. 

    How Does Low-Code Accelerate Digital Transformation?

    Given that most businesses are struggling to find the right tech talent, they need to explore new approaches to meet the demands associated with digital transformation. Low-code helps by making coding less burdensome and reducing the time and resources spent in building digital solutions. Anyone can develop apps regardless of their technical expertise and, therefore, contribute to the acceleration of digital transformation. 

    Here’s a look at how low-code solutions are accelerating digital transformation.

    Accelerating Visual Development  

    Low-code platforms can reduce turnaround time for building new apps by 90%—from well over six months to under four weeks.

    Developers and non-developers alike can use drag-and-drop functionality to build frontend applications on the fly. A major capability low-code platforms provide is the ability to build functional prototypes of possible solutions and test them quickly. Low-code platforms help unlock innovation by giving low-code platforms to business users who know and understand operational challenges best. Business users can create functional prototypes and iterate toward fully functional applications.

    How? Visual drag-and-drop interfaces, ready connections to data sources and APIs, point-and-click workflow designers and baked-in security. By taking away much of the boilerplate, most low-code app development projects are delivered with little to no coding required in a short time. 

    Along with a catalog of pre-built components and pre-configured modules, component reusability is another advantage of using low-code tools. Using standard UI components such as menu bars, buttons, form sections, etc. allows a user to take advantage of pre-built UI components and merge them into a full-fledged application.

    Democratizing App Development

    Gartner found that the demand for business-related apps is five times higher than the available IT capacity.

    That means the talent gap is one of the biggest hurdles to digital transformation. By turning a large number of semi-technical employees into citizen developers, companies can empower teams to create high-quality digital solutions for everyday operations while still meeting IT security regulations and addressing cybersecurity concerns. Low-code offers an intuitive user interface to design applications, websites, workflows and automation recipes. Some of the more refined low-code platforms also support backend integrations; meaning users can connect their digital solution to multiple data sources and produce unified web portals. 

    So, in addition to increasing the development resources, citizen developers can also help to accelerate business value. While they create business apps, the more complicated digital issues can be managed by the IT department. 

    Easy Data Integration

    Customization is the best way to extract the maximum value from existing systems. 

    Tools built using low-code technology are highly customizable and scalable. Low-code platforms enable the rapid creation of purpose-specific applications, which, via API connectors or building middle layers, can be “stitched” together with legacy applications to create end-to-end products. With easy-to-use API and database integrations, this allows teams to integrate with any pre-existing enterprise software such as ERP, CRM, custom applications and databases and extract the richness from their core legacy investments. 

    Reduced Costs and Scalability

    Many enterprises have project backlogs that cost them billions of dollars in opportunities. Because they can’t find the right talent or software to address business opportunities fast enough or give them priority over other tasks. Low-code can help reduce backlogs by helping your development team get more done in less time.

    Low-code development turns application elements like pre-built UI components, integrations and custom logic into visual building blocks that are easy to copy and repeat. Ready connections to multiple data sources allow users to easily connect to data from different business functions and scale the application. 

    A low-code approach simplifies the work required to scale and maintain apps across the entire enterprise or for millions of customers. The developer can build something once and implement it everywhere in minutes. Easy cloud deployment makes it easy to extend the application from one geographic location to another.

    Eases Application Life Cycle Management 

    The main aim is to produce flexible, cost-effective and rapid applications that are adaptive to enhancements and less complex in terms of maintenance. Low-code development accelerates application delivery by enabling users to deploy applications in just a few clicks, without relying on DevOps or engineering teams. 

    Depending on the platform, all the stages of the application life cycle—development, deployment, monitoring, maintenance, updates—can be performed from a single point in real-time, ensuring security, compliance and version control.

    The maintenance phase of software is vital to be able to quickly change what already has been developed to guarantee that the app continues to serve the purpose the business requires. The essence of low-code is that, as the name suggests, there is less code; therefore, there is little code to maintain.  

    The Future of Low-Code and Digital Transformation 

    All kinds of organizations across all industries are seeking new ways to meet challenges and increase business performance as a result of digital transformation. Introducing low-code/no-code enables businesses to be bolder and more experimental when executing on their ideas. This is digital innovation in action.

    Businesses are already leveraging low-code to get ahead of their competitors by increasing business agility and improving efficiency. This technology is giving IT teams the potential to also get rid of old silos between business departments. 

    Low-code has been helping enterprises overcome the lack of access to relevant resources to meet their business needs. By speeding time-to-market for digital products, low-code helps businesses respond to market dynamics faster while being more efficient. 

    Every organization should take advantage of these opportunities and adopt a low-code platform for accelerating productivity and achieving faster results, apps and tools. In the words of Chris Wanstrath, CEO of GitHub, “The future of coding is no coding at all.”