devopsy.kinsta.cloud

Category: Features

Digital Transformation Efforts Hindered by Lack of Upskilling

There’s no digital transformation without a staff transformation. The people skills that helped bring successful enterprises to where they are today won’t be the skills that will make them successful tomorrow. Fortunately, Leadership Suite readers are well aware at how important it is for the success of their organizations to close the gaps between the skills their employees have today and the skills they need to carry the enterprise forward.

According to the Upskilling 2020: Enterprise DevOps Skills Report from the DevOps Institute, based on 1,300 respondents, more than 50% of enterprises find challenges with all aspects associated with managing the people, processes and technologies that make DevOps possible.

The report found 58% of enterprises have a tough time actually finding those with the right DevOps skills and 48% said it’s difficult to retain skilled DevOps professionals.

With that in mind, it’s no surprise the report found DevOps salaries on the rise. According to the Robert Half Technology 2020 Salary Guide, salaries for experienced DevOps engineers can reach beyond $179,250. Survey respondents said that the skillsets necessary for DevOps practitioners skillsets should be multifaceted, including process skills and knowledge (69% of respondents), automation skills (67%) and interpersonal skills (61%). The 2019 survey found automation skills to be the top skill, followed by process skills and knowledge.

The survey contends that successful DevOps professionals will have expertise that consists of both breadth and depth of knowledge, along with tangible and intangible skills that help them both dive into the details of a situation while also understanding the big picture. The 2020 Upskilling survey cited three highly sought horizontal skill categories: automation, functional knowledge and technical skills.

A second grouping of skills—process and framework skills—is a vertical skillset which focuses on flow and understanding of different practices and methods such as scrum, agile development and value stream mapping. Another vertical skill category focuses on human skills such as collaboration and interpersonal skills.

“People, process and technology have always been the trifecta needed to execute DevOps successfully,” stated Shawn Ahmed, senior vice president and general manager of the Software Delivery Automation business at CloudBees. “As we strive to enhance the culture needed to predictably deliver better software faster at CloudBees, it’s been important for us to identify which skills are considered ‘must-haves,’ which are ‘nice-to-haves’ and which are ‘not important’ across teams, roles and regions.”

“As the report underscores, upskilling is now more important than ever to enable meaningful collaboration between all teams to truly deliver software at an elite level,” said Ahmed.

The survey also found that adoption for Agile is at 81%, DevOps 75% and ITIL is at 25%. Organizations that employ SRE rose to 15% this year from 10% in 2018.

— George V. Hulme

March 19, 2020
COVID-19: Don’t Sacrifice DevOps

Like everyone else, I’ve been following COVID-19/Coronavirus issues. My focus is more on the IT impact of the disease and its status as a pandemic.

Let’s start by saying it isn’t the end of the world. Yes, it’s serious. Yes, it will be disruptive. Yes, those impacted by the worst aspects of the disease will leave a hole. But when it is over, and the tide has swept by, the vast majority of people will still be here, still trying to do what they need to do.

That includes ITOps/DevOps maintaining whatever you put in during the rush to work remotely. Some organizations will be happy to throw something up and then rip it back down, but most will not. Once they’ve worked out how to work remotely, they’ll want to keep that as an option. Some to offer more work/life balance to employees, others to have a backup plan in case of emergency. Ask any company in Katrina’s path, remote work plans born in emergencies tend to hang around.

It is the nature of DevOps to be nimble and reactive, planning on improving things as time goes on. That’s a good feature of both DevOps and modern IT teams. But some things are less nimble than others, and the rush to remote work is going to show that in a hard way.

The VPN chosen or expanded to enable remote workers is not likely to be swapped out easily or quickly. While there is a sense of urgency—if you follow /r/sysadmin or to a lesser extent, /r/DevOps on Reddit, you know that urgency may even be too gentle a word. Some management teams seem to be in panic mode—you are going to have to live with some of these choices for a while, don’t make them knee-jerk.

Normally, an MSP is your friend when moving like this, offering expertise and knowledge your organization doesn’t have internally, and shortening both deployment and the learning curve. But consensus is that MSPs, laptop manufacturers and VPN vendors are going to be booked solid for the near term.

So, choose software when you can. Not because software is better (truly for some functions it is worse), but because it is generally easier to replace. A software VPN can be expensive, but you’re not buying hardware that is a sunk cost. Consider short-term solutions such as Amazon Workspaces or possibly Chrome Remote Desktop, old standbys like VNC or RDP (likely with VPN in both cases), file sharing with things such as Sharepoint or OneDrive. Later on, you can look at a Cloud NAS such as Nasuni, or a more solid remote access plan.

Yes, all the suggestions above have things you need to worry about. No, not everything will be within your control. However, these things are easier to rectify on iteration than “We bought big solution X, and it doesn’t do Y, so we need to replace it.” Start with short-term solutions and improve them as you go–this is truly the DevOps way, but it is easy to lose as you’re looking for high-volume, perfect and urgent.

IT workloads (particularly operations workloads) are going to increase for any organization that wasn’t already set up for broad remote work. There is no way around this fact. As someone suggested online, “Kiss your family, tell them you’ll see them in a couple months and get to it.”

You’ve got this. The internet is loaded with information to help, places such as Spiceworks and Reddit have people willing to offer advice all day. Smaller MSPs are likely happy to talk with you as they attempt to grow their business. Determine what you need, how fast you need it and implement the best solution you can in the time available, aiming to improve it on the next iteration. And keep the wheels of business running.

It’s a flu variant, not the black plague. Businesses that deal with this well will come out well. Right now, “Deal with it well” includes a lot of IT work: from continuity planning, to fast DevOps iterations, to getting people at home productive and supporting them through this.

— Don Macvittie

March 19, 2020
Social Distancing in the Age of Automation

An unintended consequence of COVID-19 is that the practice of social distancing might remain long after the threat posed by the virus subsides.

It seems as if COVID-19 (aka the Coronavirus) has appeared out of nowhere. At the end of 2019, we were all unwrapping out holiday gifts and looking hopefully into a new decade. Now, in March of 2020, schools are closed for weeks, if not months, major tech conferences are canceled, the NBA has suspended the season and the shelves at Walmart and Costco are bare of daily essentials.

We’ve gone from zero reported cases at the end of January 2020 to over 120,000 worldwide six weeks later. (See Figure 1, below).

Figure 1: Total confirmed cases of COVID-19 as of March 12, 2020. Source: By Our World in Data – OWID, CC BY 4.0.

The World Health Organization (WHO) has declared that we are in a pandemic. COVID-19 is spreading around the globe and its spreading fast. People are dying from it. As of March 13, 2020, sources report that Italy had 1,016 deaths among the 15,113 cases of infection. Another source reports that in mainland China, at least 3,158 people died from the 80,778 infected. The number keeps growing. What’s amazing is that in November of 2019 there were no reports of deaths from COVID-19. To say that this is the stuff of science fiction made real is no understatement.

Social Distancing as a Tactical Response to COVID-19

COVID-19 is a contagious disease. The rate of infection is pretty high when people gather together in large groups. To address the risks, gatherings of over 250 people have been discouraged, if not banned outright by business and government. This tactic has been given a name, “social distancing.”

Social distancing means that we keep our distance from large groups of people. As with any change in social behavior, there are economic impacts. Most people go to a workplace to do work. Take away access to the workplace and work stops, the economy comes to a halt. At least that’s how it was in the old days.

Today we live in a wired world that makes online interactions as easy as a stroll down Main Street. As a result, many of us work online thus allowing commerce to continue even when access to the physical workplace is restricted. Yet, most of us—working online or not—are still tethered to a common, physical workplace, at least we were until COVID-19 kicked in. Now we’re going home and telecommuting. Once the threats posed by the virus have passed we’ll all go back to business as usual. This current episode of social distancing will be but a memory.

Or will it?

What if social distancing becomes a way of life that stays with us for the foreseeable future? What if we all just get so accustomed to social distancing—employer and employee alike—that we just stay home after this all blows over? What then? Think about it. It could very well happen and the implications are significant.

Social Distancing Is Not New

Social distancing has been a trend even before COVID-19 came along. Before the introduction of mass-produced private homes, people either lived in cities or in the rural countryside. Urban dwellers congregated in public spaces, Venice Beach, Boston Common or Central Park for example. They ran into each other walking down the street. They rideshared on mass transit.

Then the automobile came along and social distancing set in. More people started to prefer riding in the isolation of the privately-owned automobile than on a crowded city bus or subway. The interstate highway system emerged to support the millions of new cars on the road. These highways and the 30-year fixed mortgage gave birth to suburban living. Also, television reduced movie-going to a predominantly entertainment experience. Who needs to see a newsreel in a movie theater when the news is getting piped into your television set every day?

The suburban house became the castle of any man or woman who could cough up a relatively small down payment to buy one. The next thing you know the house becomes the social center: barbecues, cocktail parties, Super Bowl Sunday and legions of teenagers wreaking havoc at alcohol-fueled backyard pool-parties while their parents are out of town.

Eventually, the introduction of video streaming (neé cable-based HBO) big-screen TVs, and movies on the demand made the family entertainment center a permanent fixture in residential house design. Finally, along comes high-speed internet and dad’s den gets replaced by dad’s home office and mom’s home office.

But, we still had to go to the store to get stuff. Hence the rise of the shopping mall as a common ground in which to socialize. And, we still had to go to work to pay for it all … for a while, anyway, until Amazon comes along and brings social distancing to the shopping experience and telecommuting gizmos such as Slack, Zoom and a plethora of mobile apps make working from home a feasible way to conduct business. The only catch is that employers needed to get on board with telecommuting. Some did and some didn’t until COVID-19 started killing people. Now, they’re on board.

Living in a Social Distancing World

COVID-19 is forcing everyone to stay put. Every day an increasing number of companies are mandating that if you can work at home, you are to work at home. Late-night television shows are broadcasting empty theaters. There’s even talk of canceling the Democratic National Convention. It seems as if we’re all going home.

The risk is that we just might stay there.

Let’s face it, we’ve created a digital infrastructure that can support a situation in which most of the population of the developed world stays in a state of social distancing permanently. All the things required to make it happen are in place. Today, we can buy just about all we need online and have it delivered to our doorstep. An increasing number of the ordinary activities of daily life happens on the internet, everything from a casual chat on Skype to a game of cards with our friends on Trickster Cards, are typical. And yes, people have been having romantic interludes online since personal computers could support video conferencing.

In the not-too-distant-future, home healthcare devices will do away with most visits to the doctor’s office. Soon, if we need to get somewhere, we’ll call a driverless vehicle to get us there. Manufacturing automation will continue to improve to the point where we won’t work in factories directly anymore. We’ll just control the robots that do work in the factories from computers in our home office.

As finance and services continue to become a growing part of the economy, the work that industry requires can be done from home, too—quite easily in fact. Yes, we’ll still need human plumbers, electricians and nurses. But these workers will occupy a special place in a socially distanced world. They’ll be well vetted and well protected.

So, the long and short of it is that current events might very well be a harbinger of things to come. And, if anything, the hazards of COVID-19 are pushing forward the propensity to make social distancing the norm. When that happens the really big question to ask is this: If all of us are socially distanced by default and more of our interaction with, and understanding of, the world comes from that which we see and hear on cell phones, computers and television sets, how will we know what is real and what is well-contrived fiction? It’s an important question that deserves serious consideration. I hope we can answer it. Then, once answered, the even bigger question to ask is: Will we care?

— Bob Reselman

March 17, 2020
Better Apps and Better Security When You Shift Left

Tens of thousands of people and hundreds of cybersecurity vendors descended on San Francisco at the end of April. While the RSA Conference was the primary draw, there are a number of peripheral events that go on throughout the week as well, such as the Cloud Security Alliance Summit, the CIO/CISO Interchange, BSides San Francisco and the Qualys Security Conference.

I was able to attend some of the Qualys Security Conference and I had the opportunity to see Alex Mandernack, security solution architect for product management at Qualys, presenting on the need to shift left when it comes to cybersecurity.

Mandernack outlined some of the issues organizations face today when it comes to security. Migrating to the cloud and embracing DevOps culture means more ephemeral, elastic environments and compressed development time frames. He pointed out that these trends make security more challenging, but also described the opportunity they present to change our approach to streamline and improve security.

The Traditional Pipeline is Broken

The traditional model of application development is much more linear. Each app team builds their own image—often in a silo or vacuum disconnected from other teams. Penetration testing is conducted on a sporadic or infrequent basis, and eventually the app is deployed. Vulnerability scans are run on the app in production, and issues or deficiencies are reported back to the developers to address or incorporate into the next build.

The process is slow and cumbersome. It also has the potential to introduce redundancies that waste resources and make the organization less efficient. As companies embrace DevOps and move to the cloud, the traditional development pipeline simply doesn’t work—especially not for security.

DevOps, and Cloud, and Containers — Oh My!

The cloud and DevOps fundamentally change the development lifecycle. Development time frames are compressed, and the process is a self-feeding, iterative circle rather than a repeating linear approach. The traditional approach of identifying and resolving security issues after an application is deployed won’t work in a DevOps environment because by the time issues are identified and fixed, the app itself may have already moved on to the next version.

Cybersecurity and the development pipeline have enough challenges with the cloud and DevOps, but there is also a newer technology trend that exacerbates the problem—containers. Containers are designed to get code quickly and to operate fast. They are also built for scalability—spawning and spinning down hundreds or thousands of containers constantly to keep pace with demand.

There is a diverse array of tools and platforms associated with cloud, DevOps and containers. Organizations often employ a complex collection comprised of some combination of AWS, Azure, Docker, Kubernetes, OpenShift and others. The result can quickly become a black hole when it comes to security—which is why it’s important to push security left into the CI/CD pipeline.

Shift Left to Help Security Teams Do Better

In a DevOps culture, developers and security teams need to think about security sooner. It’s important to get the security tools into the process earlier. Thankfully, with the DevOps lifecycle and the tools commonly used within a DevOps environment, it can be done.

For starters, companies should build a golden image. Developers shouldn’t have to patch and update the base operating system before they even start developing. The golden image takes a baseline operating system such as Ubuntu or CentOS, and completely patches and configures it so everyone has a standard, consistent image to develop on.

With the golden image in place, the next step in shifting security left is to implement testing and scanning in the CI/CD pipeline. Put vulnerability information at the fingertips of developers as they’re developing and implement vulnerability gates in the pipeline to ensure that applications that don’t comply with policies and meet minimum requirements are not allowed to be deployed.

New Role of the Security Team

Part of shifting security left includes providing tools that make security self-service for the DevOps team. Automating actions with scripting, APIs and CI plugins ensures that security is simplified and streamlined to provide value for developers.

In this shift left scenario, the security team has to redefine its role in the process. The security team is still vital, but rather than being the police or a roadblock in the development process, the role of security focuses on verifying and auditing the process. The security framework should have dashboards and live data that enable the security team to monitor activity and identify trends that may need further attention.

Better Security, Faster

There is often conflict between developers and security teams, but there doesn’t need to be. Mandernack stressed that developers don’t want to create insecure apps either.

Shifting security to the left into the CI/CD pipeline streamlines the whole process. Ultimately, the result is higher quality, more secure applications that are developed faster.

— Tony Bradley

March 10, 2020
DevSecOps Days Virtual Summit: The Best of Dev, Sec and Ops
We’re fresh off RSA Conference 2020 and the live version of DevOps Connect: DevSecOps Days, a daylong event packed with industry experts speaking on all things Dev, Sec, Ops and variations of the three. It was highly successful in both attendance and knowledge-sharing, so once again we’ve taken the entire event virtual and bringing it to you.

The return of DevOps Connect: DevSecOps Days Virtual Summit will take place Thursday, March 26, at 10 a.m. EST. The all-day event will feature speaking sessions and panels focusing on digital transformation and disruption, with experts and practitioners discussing their company’s transformation to DevSecOps, the issues that have impeded their progress and how they get buy-in from all levels of the company.

Our virtual summits are just like a real conference but without the hassle of traveling, tickets and crowds (and, this year, nasty coronaviruses). The online environment at DevOps Connect: DevSecOps Days Virtual Summit features a lobby, expo lined with booths full of downloadable resources, and an auditorium where attendees can watch sessions by Bryson Koehler and Jamil Farshchi, CTO and CISO of Equifax; Larry Macherrone, director of DevSecOps Transformation at Comcast; and other industry forward-thinkers to get an exclusive look into DevSecOps initiatives at large enterprises and organizations across industries.

Here’s an at-a-glance lineup of our speakers:
- Bryson Koehler, Equifax
- Jamil Farshchi, Equifax
- Dr. Amit Elazari, Intel
- Jennifer Czaplewski, Target
- Bill McArthur, TD Bank
- Jasmine James, Delta Airlines
- Charlene Li, author
- Larry Maccherone, Comcast
- Sladjana Jovanovic, TD Bank
- Ross Clanton, executive consultant
- Sean Davis, Equifax
- Chris Roberts, Attivo
- Chris Riley, Splunk
- Alan Shimel, MediaOps
- Mark Miller, Sonatype
DevOps Connect: DevSecOps Days Virtual Summit is truly an all-day affair, with sessions running from 10 a.m. to 5 p.m. Eastern. The expo hall will be open throughout the event, giving attendees the opportunity to chat with vendor sponsors, download information and even take part in a scavenger hunt to win prizes including Amazon gift cards.

Plus, those who register but can’t make the event will be able to access it later—all registered attendees will receive a link to access the virtual summit on-demand.

Space is limited, so don’t wait. Register today for DevOps Connect: DevSecOps Days Virtual Summit to hear the best of what’s happening in the DevSecOps space from those who are actually doing it.

— Charlene O’Hanlon
March 9, 2020
DevOps Deeper Dive: Mainframe Fallout from BMC’s Compuware Buy

The acquisition of Compuware this week by rival BMC Software signals that the rate at which mainframe environments are being modernized might not be occurring fast enough to support a vibrant third-party tools provider ecosystem.

Both BMC and Compuware were sold to private equity firms in 2018 and 2014, respectively. Thoma Bravo, which acquired Compuware, is now selling the company to KKR. BMC was acquired by KKR in 2018 from Bain Capital and Golden Gate Capital for $8.5 billion. BMC was originally taken private by investors in 2013.

Other rivals in the mainframe category include CA Technologies, which was acquired for $18.9 billion by Broadcom last year, and Micro Focus, which includes software assets originally developed by Hewlett Packard Enterprise.

BMC executives declined to comment on the merger and terms of the deal for Compuware were not disclosed.

All these machinations by private equity investors doesn’t do much to inspire confidence among end customers, said Judith Hurwitz, president and CEO of Judith Hurwitz & Associates, a market research and IT consulting firm.

“Private equity firms always have to eventually look for an exit,” she said. “In this case, one investor wanted out.”

That leaves IT leaders in the unenviable position of not knowing whether the application development platform on which they have standardized might be around for the long haul, said Hurwitz.

The challenge faced by third-party providers of application development tools in the mainframe space is largely two-fold. While the number of workloads running on mainframes continues to increase thanks mainly to availability of Linux on the platform, the number of organizations that have a mainframe has declined. The low end of the mainframe market has been eroded by high-end distributed systems. In addition, many applications that previously ran on a mainframe have been shifted into a public cloud.

The second challenge these providers face is IBM, which is now a much more formidable competitor in the mainframe tooling sector. IBM has launched a series of initiatives to provide tools to modernize mainframe platforms using best DevOps practices as part of a larger digital business transformation initiative. However, regardless of the relative strengths of IBM’s DevOps portfolio, there will always be a significant base of mainframe shops that will prefer tools from IBM over those provided by a third-party rival.

In a prepared statement shared via email, Barry Baker, vice president of IBM Z Software, said:

Over the last 18 months, we’ve come a long way to expand the ecosystem for mainframe skills by bringing new tools to IBM Z and LinuxONE. Our goal remains unchanged – to make development on Z a common experience for all developers across the tech stack – not just mainframe developers. We’ve made significant progress toward this goal with the adoption of DevOps and industry-standard tools like Git and Jenkins on the platform, along with our own offerings including IBM Z Open Development and IBM Z Unit Testing. We took another step with Red Hat OpenShift on IBM Z, further enabling cloud developers to deploy z/OS applications using OpenShift without any special Z skills required.

We continue to invest and over the next few months we’ll be unveiling even more tools across three focus areas: developer experience, automation and operations to truly deliver on our promise for a cloud native experience – and encourage our clients to watch this space.”

Of course, all of IBM’s tooling rivals in the mainframe space have launched similar DevOps initiatives. The challenge they all face is the rate at which mainframe organizations are embracing DevOps may not be fast enough to sustain a vibrant third-party ecosystem. Not surprisingly, BMC has also been extending its reach to encompass distributed computing platforms. Competition among tooling vendors on those platforms is already fierce.

There can be no doubt mainframes will continue to play a crucial role in IT. Most large enterprises are still dependent on mainframes to run some of their most mission-critical transaction processing applications. Less clear is to what degree those organizations intend to modernize those applications beyond simply making application programming interfaces (APIs) available for legacy applications. IBM, along with every provider of development tools for the mainframe, has been making a case of deploying new applications running on Linux on a mainframe because the total cost is lower than trying to connect those applications running on a distributed system to a legacy mainframe application.

A recent global survey conducted by Vanson Bourne on behalf of Micro Focus suggests that argument is starting to resonate. Nearly two-thirds (63%) said some form of modernization was favored over the replacing and retiring of older COBOL-based systems in 2020.

Regardless of how much economic sense that argument makes, however, the rate at which mainframe applications are being modernized will, at best, continue to be an extended process.

— Mike Vizard

March 6, 2020
Commercial Objectives in the Age of Automation

When I was 17 years old, back in 1971, I sold orange juice near a busy street corner in New York City. My job was to stand out in front of a fruit stand and dispense quarts of OJ from a machine. It was pretty simple: keep the hopper on the top of the machine filled with oranges and keep the supply of quart jars steady. Then, when a customer came by to make a purchase, I filled a quart jar with juice, took the customer’s money and rang up the sale in the cash register.

That was my job, rain or shine, in warm weather or cold: keep the machine operational, give the customer the goods and collect the money. Other people had this job, too. Selling fresh-squeezed orange juice to the masses by way of a rather simple piece of automation technology kept us busy.

But, here’s the thing. If my employer had to choose between me or the machine, he’d have chosen the machine every time. The machine was a gold mine. It made more orange juice in a minute than 10 human squeezers could have done in 10 times the amount of time. In fact, if my employer used humans, he would have lost money. The machine was key to his commercial success selling orange juice.

Now, hold this thought while I move forward to recent times.

In May of 2019, the rideshare service Uber went public. In order to issue shares on a public exchange, the company, as prescribed by law, needed to publish a prospectus describing its business model as well as how it intends to use the money it raised through the IPO.

Every company that’s listed on a public stock exchange publishes a prospectus. Facebook has one, and so does Microsoft. Even World Wrestling Entertainment, the folks that produce action-packed events such as the WWE Super ShowDown and WrestleMania, has one. The prospectus is the way the SEC creates transparency into the finances and commercial strategies of a company. If you take the time to read one, a prospectus will tell you a lot.

So I did. I read the Uber prospectus and I found something very interesting on Page 10: “We are investing in technology to power the next generation of transportation. Our Advanced Technologies Group (‘ATG’) focuses on developing autonomous vehicle technologies, which we believe have the long-term potential to provide safer and more efficient rides and deliveries to consumers, as well as lower prices,” stated Uber.

In other words, Uber is actively pursuing driverless technology as a key commercial objective. Why? Well, to answer this question let’s go back to my days in New York City playing trusty sidekick to the orange juice machine.

Back then, in order for my employer to make money selling fresh-squeezed orange juice, he needed both me and the machine working in tandem to fulfill the commercial objective to turn some oranges and a glass jar into money. In terms of his commercial objective, I was the weak link in the chain. I got sick. I had bouts of adolescent unreliability. I moved on to greener pastures when better opportunities appeared. If he could have replaced me with a vending machine that sold fresh orange juice he would have. If I were in his shoes, I’d do the same thing. But at that time, orange juice vending technology was not as advanced as it is today. I was lucky, I guess.

But, that was then and this is now. So let’s go back to Uber.

Remember, the commercial objective of rideshare is to turn a moving vehicle into money. Right now this involves a cellphone, a human and a car. The cellphone provides the driver with passenger pickup information and routing instructions to get to a destination. The car provides the transportation. The human operates the car in response to and with the assistance of information coming from the cellphone.

Right now humans are really good at operating motor vehicles and interacting with the cellphone and passengers very much in the same way I was really good at keeping the orange juice machine full of oranges and dispensing the product to customers. But, just as I was the weak link with the orange juice transaction, so is the human in a rideshare. The cost of a human can vary and things can get sticky in terms of legal matters that go with human employment. Yet, the risk is offset by profit the human produces, for now anyway. But, that can and will change. Take the human out of the equation and the profits go up and the risk goes down, provided the underlying automation technology is advanced enough to meet the demands of the situation.

If you have any doubt that driverless technology will advance to the point where humans can be replaced, think back to how crappy voice recognition was in 1989. It was really, really bad. Now, voice recognition is really, really good, even in a variety of languages. Getting to that level of technical maturity only took 20 years. Now, imagine how good a driverless vehicle will be 10 years from today. I’ll wager it will be really, really good.

Yes, some people will point to the current fatalities created by driverless automation to assert that human displacement won’t happen. But, if you have any doubt that it will, keep in mind that the were a lot of crashes early on when the Wright brothers took to the skies in 1903. Yet, by 1919 KLM was flying commercially. That’s a pretty dramatic accomplishment in terms of safety improvement for a technology.

So the long and the short of it is, just as the owner of the fruit stand would have gladly chosen an orange juice vending machine over me, so too does Uber want to take the human driver out of the car. For all intents and purposes, a rideshare vending machine will be the preferred way to meet the commercial objective at hand.

So, where does that leave humans?

The conventional wisdom is that as human labor continues to get replaced by machine automation, there will be new, unimagined jobs for those displaced workers. I think otherwise.

Consider this: around the 1880’s there were almost 200,000 horses in the City of New York. Now, if you can find 400, you’re lucky. Why? Because that much horse labor isn’t needed anymore. Some have gone onto other jobs, such as being a thoroughbred competitor at Aqueduct Racetrack or a tourist amusement pulling a carriage through Central Park, but as far as being the engine the moves street-cars, carriages and mounted pedestrians, that time has long passed. Horse labor no longer meets the commercial objectives of transportation.

So too will it be with humans who earn a living driving a motor vehicle. They will be displaced. Only this time there is a very good chance that there will not be the number of new, unimagined jobs created that will meet the needs of the broad segment of the population being displaced. Yes, there will be new specialized work, but not at the scale necessary to absorb the number of those out of work. After all, once the automobile came along, the 200,000 horses left behind in New York City did not go on to become thoroughbred racers.

The point of the analogy is this: the more specialized the work becomes, the more difficult it is to quickly acquire the skills necessary to do the work. For example, some displaced drivers might be able to become data scientists quickly, but a significant majority will not. To assume otherwise is folly.

Addressing the issue of worker displacement due to advanced automation is a serious problem, one that deserves significant attention. Hopefully, we’ll figure out some solutions that have long term viability. Otherwise, we’re in for some big trouble because no matter what, businesses will continue to advance and embrace automation to meet their commercial objectives. As the saying goes, “an ounce of prevention is worth a pound of cure.”

— Bob Reselman

March 6, 2020
You Still Have to Make Time for Maintenance

I’m going to take a side trek today into home computing with applicability to IT. Bear with me.

We maintain a pretty complex home network, as home networks go. With three NAS servers, a small one-box SAN, some web servers and connections to several hosted environments. We both work from home, and my business is contained in one of the NAS servers and some of those hosted environments, so it’s all necessary. Scheduling downtime with several people using the network darned near 24/7 is difficult. Not medium enterprise level of difficult, but still an issue.

Two of our NAS servers each have a disk out. It happens, that’s why they’re NAS servers. In general, the only day that replacing the disks makes sense is Sunday, when things are a little slower (both in schedules and network usage) than normal. One of our web servers is just plain dead–but there’s info on there we have to get off. The code is mostly being replaced, but the data is collected over years and we need to see how much we can salvage.

None of these things are shiny DevOps things. Yet, they still have to get done. Importantly, they have to get done when automated tools aren’t running across the network or counting on the NAS to be responsive. The rush isn’t huge, because there are off-site backups, but restoring a remote backup is a long-term proposition–weeks, not days in our current environment–so it must happen as soon as practicable.

Don’t forget that with the drive to automate everything. If you own the hardware, it’ll need maintenance. If you own the software, same thing. If you need data to move platforms, it will take time. All things we kind of hand-wave in the DevOps world. They’re seen as bottlenecks, if seen at all. Generally, we don’t even consider maintenance issues until they impact DevOps, but we know they are going to happen so we should have a plan for how to deal with them.

Those few of you whose entire environment is hosted in a cloud provider have an easier job of it, but eventually you will be asked to move cloud providers. As sure as the sun will rise tomorrow, something will drive a move away from your chosen platform. Normally TCO, but other factors play in, too. When that happens, the work will be more than “Find time for the NAS to rebuild without overly impacting everything else.”

So, spend some time thinking about it. Do you have plans to make room for maintenance? Are you scheduling maintenance into release cycles? Are you coordinating releases with updates that are not required by this specific release?

This is where dev (typically Agile/Scrum) meets ops (typically system/network maintenance), and it is every bit as important as what is normally seen as DevOps. Get it right and have fun, keep cranking stuff out. Get it wrong and struggle with the problems infrastructure issues can inflict upon your cool new update. One of our new websites outright stopped development when the web server went down–for a variety of reasons, but the catalyst was the loss of the original. We’re working out what to do about that.

Meanwhile, we didn’t make time yesterday, so I’ll be replacing disks and tearing apart a web server in a much smaller window that is available today. See you when I poke my head back up. Hopefully, you’ll have better planning than we did.

— Don Macvittie

March 2, 2020
Coronavirus Update: A Slowdown Already Occurring

I have been watching the real-time regional situation reports about the coronavirus from the Chinese medical association site ncov.dxy.cn (the same site the John’s Hopkins outbreak dashboard sources its data from) closely now since very close to the beginning of the outbreak, and my daily routine has been to snapshot the regional outbreak tallies and compare the numbers with previous data to discern the trends.

The top-level executive summary is that while three nearby provinces have peaked now at around 3,000 cases of the coronavirus, the majority of the other provinces got up to a few hundred to a thousand cases. Cases are declining universally now as folks recover, and new case increases have slowed from the initial fast-spreading burst now down to a trickle outside of Hubei.

The percentage of overall cases has gradually increased in locality from its initial widespread that saw half of all cases in Hubei Province centered in Wuhan now steadily inching up to closer to 90% (above 83%) of cases being centralized in Hubei and Wuhan. Essentially, the outbreaks were sporadic in small clusters and contained in the other provinces, and the counts are all going down—a positive sign. The only place it ever really saw huge unrestrained growth was in the city of Wuhan, where new cases continue to be diagnosed, but as I mentioned above, even that has seemed to be under control now, with the rate of overall new cases in an almost-steady linearly decline for two weeks now, as presumably, the containment seems to be working. The quarantine that many experts said was unlikely to succeed is showing every indication of actually succeeding.

The graph above IMHO best describes the progression of the coronavirus. Ignore the big spike—that was a numeric anomaly from the redefinition of “clinically prescribed” cases situations where patients had pneumonia symptoms but test swabs indicated negative for the virus, presumably where health officials cleared the virus and only the symptoms from the induced pneumonia remains. They redefined the counting criteria and classification so that those patients could access care facilities, which is why the graph seems to spike—though this bureaucratic anomaly caused undue panic in many folks observing the numbers before the Chinese-language information about this redefinition reason percolated out and was translated as an explanation to international media. Overall, this graph illustrates what I saw from the regional counts: There was an initial rapid ramp up and then containment and a slow, steady decline in new case increases. The yellow line is suspected cases and the red line is confirmed tested cases. As you would expect, the suspected numbers led the confirmations by around a day.

The situation right now is that really the only place case counts of the coronavirus are increasing is in Wuhan itself, with the greatest density of cases. Starting one to two weeks ago the cases rates finished their rapid expansion in the other provinces and began their long, slow, steady decline as patients recover, with a small number of fatalities. New cases seem to be fairly limited small clusters of one to 10 cases and isolated, as well as declining for weeks now.

Internationally, the only trouble spot is the quarantined cruise ship in Japan, which seems to be acting as an incubator. I can tell you a lot about that ship because one of my co-workers’ parents are on board and I’ve been getting first-hand reports of what is going on. After a burst of cases last week on the ship, those in charge have fortunately decided to disembark the ship to national quarantine facilities set up by the passenger’s origin governments. This is good because conditions aboard were becoming pretty miserable, entertainment was limited and unlocking the porn and movie channels did little to appease the occupants, who were becoming frustrated with the limited food choices in particular. It was a terrible time for the staff—essentially on a jail ship forced to feed and the occupants. I’m told disembarking is due to begin over the next few days.

Outside China, excepting the cruise, there were relatively few cases of non-direct secondary infection of the coronavirus that weren’t directly linked to someone who had been in Wuhan or in contact with someone from Wuhan. There were a few clusters of infection, particularly in one Hong Kong apartment building and another one in Singapore, but pretty much all the cases were primary contact up until now, so it seems international diligence and containment is holding.

There is plenty for folks to be diligent about, but for now, there seems very little to panic about and every indication that this impossible quarantine is going to be studied as a model of how to respond in the future.

Let me also pre-empt the inevitable distrust of the Chinese government some folks have to mention that the inevitable conspiracy fear-mongering and panic you see being spread in paranoid YouTube rants and misrepresentation clickbait is completely unfounded from the data and news sources I monitor. To quote a WHO press conference, “The Chinese authorities have shown exceptional transparency and openness in this outbreak.” Another expert I heard on the radio who worked on the earlier SARS outbreak noted that one of the key lessons learned in that incident was the importance of rapid and accurate information dissemination to control and respond to infection outbreaks, and the Chinese medical association seems to have taken this lesson to heart to not repeat those missteps with the coronavirus. The fact that I was able to monitor regional situation reports over the last two months is a clear indication of that.

The folks who feel that somehow the Chinese government is sandbagging the numbers and the problem may be worse than indicated aren’t really acknowledging the stupidity of such a fiction. Misrepresenting the situation to their own medical professionals combatting the outbreak would not only be irresponsible and dangerous but also extremely unlikely and infeasible. There is little incentive to misreport, and such a fiction would need to involve concerted action from hundreds of thousands of medical professionals—and likely beyond the capabilities of even the Chinese bureaucracy; in the end, their government is as clumsy and bumbling as ours and it would require far too widespread a meddling to maintain consistency. The Chinese censors can stomp down and suppress anything that makes the bureaucrats jumpy, but it is likely incapable of producing such a coherent fiction across so many sources, sites and reports as would be required to fulfill the paranoid fantasies of wary folks. Not only is there no motive or gain, but there is also likely a huge disincentive and probably penalty for misreporting and misrepresentation, if the rapid fall from grace and dismissal of the bureaucrats who made the initial mistake and sandbagging of the numbers that led to the initial outbreak is any indication. As a matter of fact, the only indication I’ve seen with any substantive evidence of government information suppression was the blocking of the online lynch mobs for those bureaucrats who were at fault for the doctor who sounded the alarm’s arrest after that doctor tragically died. Anyone who would dare tamper with the numbers likely would face the same fate.

There is by definition underreporting as the visibility to cases of the coronavirus with very mild symptoms or test errors or any number of other anomalies in mass counts, but the numbers from a macro level look promising.

Overall, I’m relieved to see that the situation is resolving with only sporadic and isolated lapses in containment—there were only ever 85 cases internationally outside of Asia with a single fatality. That number is down to 52 now as folks recover and no recorded incidents of secondary infection without direct contact with a traveler from Wuhan. The mortality rate statistic is ever sinking as patients among the roughly 60,000 cases cumulatively diagnosed recover, and it’s proving to be primarily a threat to the elderly, though interestingly I’ve seen reports that few children seem to be affected.

Later next week we should see the results from the clinical study of the cocktail of repurposed HIV antivirals that showed such great promise in simulations and early tests that had some severe patients recover in as little as two days. The study was rolled out in amazingly rapid fashion and the medical community seems to have focused on combatting this new disease with a vengeance—supposedly vaccine trials are to begin as early as next month.

Vigilance and wariness are due, but at this time there seems to be no cause to panic, forward panic or feed conspiracy fears preying on phobias about diseases or likely even change any day-to-day activity or future plans for folks outside of China regarding the coronavirus. The estimate from current numbers is placing the potential of the quarantine lift at the beginning of April in the only forecast I have seen.

— Dragos Ruiu

February 18, 2020
Acting Rationally Regarding Coronavirus: RSAC Conference Update

With all the hype surrounding the coronavirus, let’s take a step back, take a breath and not give in to emotional conference mob fear-mongering

We have all read the headlines: Mobile World Congress in Barcelona has been canceled. Facebook pulled the plug on a smaller conference next month in San Fransisco. IBM Security has pulled out of RSA Conference next week. Health and safety are everyone’s concerns, but are we acting rationally regarding coronavirus?

RSA Conference (RSAC) put out an update on Friday (use that link to stay up to date on RSAC) with some great metrics on some of the risk factors and attendance numbers. It is also important to note that RSAC is expected to draw a crowd of about 50,000 visitors (some of them attending the DevOps Connect: DevSecOps Days event that we produce).

Yes, eight vendors have withdrawn from exhibiting at RSAC. Six of these were from China and frankly, given current travel restrictions, probably couldn’t get here anyway. One is from Canada and one from the U.S. (presumably that is IBM).

But should we give in to emotional conference mob fear-mongering? There is some serious clickbait nonsense being bandied about, including “RSA in Doubt After IBM Pulls out of Conference.” To be fair, the clickbait headline was updated, but still, that is just fear-mongering at its worst.

Why would IBM and the Canadian company pull out? Well, two obvious reasons. One is for the safety of their employees and their potential customers. The other is economic if they feel attendance will suffer. But while I don’t have any facts to back it up, I would have to assume that unless the event is outright canceled, vendors pulling out at this late date won’t be refunded their deposits and payments. This is true not only of their fees to RSAC but also of the money they’ve ponied up for hotels, airfare, party deposits, etc. While potential liability for unnecessarily exposing people to the virus could be a legal option, reasonable precautions are being taken. So I don’t think economics play into the decision to pull out.

As of Friday, RSAC reports that including the members of the canceled vendors, only 0.79% of attendees had canceled their attendance. I would assume that the overwhelming majority of these were attendees from Asia or other impacted regions who could not get flights here anyway. Something like 82% of attendees are from the U.S. On top of this, RSAC is taking additional precautions to keep the conference as germ-free as possible.

I was in touch with RSAC management earlier last week regarding the DevSecOps event. At that point, I was informed that they were working closely with the City of San Francisco to do everything possible. They are following CDC and WHO guidelines. BTW, CDC still says the impact here in the U.S. to coronavirus is low.

So, then, are we seeing an overreaction to coronavirus? The security industry, more than the mobile application or other tech industries, is more attuned to risk management. Are we managing this risk adequately? Are we giving in to the fear-mongers among us? The flu has killed so many thousands more people (albeit with higher infection rates), but that has never caused us to shut down conferences or question gathering in groups.

Personal health and safety is everyone’s own right and responsibility, as well as the responsibility of the authorities. Of course, you should do what you think is best for you and your family. But I think times like this call for a moment of lucidity and the use of the risk management fundamentals so many of us practice in our professional lives.

Those of you who know me personally know I am a huge Pittsburgh Steelers fan. Their coach, Mike Tomlin, has a saying that I think applies to this situation: “We don’t live in our fears, we live in our hopes.” I hope the current trend of withdrawing from our community is not one that will continue. I refuse to give in to exaggerated fears.

I do want to announce two things, though, in regard to this coronavirus situation. First, for any conference organizers who have made the decision to cancel their event for this reason (it is your event, your decision), MediaOps is offering a conference disaster program (CDP) that will allow you to use our virtual conference platform and team to take your event virtual with almost all of the features of an in-person conference.

We have produced more than 10 virtual conferences in the last year or so that have drawn tens of thousands of visitors with hundreds of sessions, exhibit halls, interactive booths, signage, live chat and more. You can go to the home page of Predict 2020, our most recent virtual event, and click “Recent Events” to get an idea here, but just a caution, registration is required. Please see our press release on this for details. It is important that the tech community continues to engage in the very important exchange of ideas, learning and community that is so vital to our success and progress.

Secondly, Accelerated Strategies Group, DevOps Institute, JumpCloud and MediaOps are hosting a survey to learn about what you and your organizations are doing in light of the coronavirus outbreak and whether this is forcing you to rethink actions and behaviors going forward—not just for attending conferences, but as part of disaster recovery and business continuity. For instance, is this situation changing your views around working remotely versus working in a large office, going to customer premises or international engagements? Help us gather the information—please take moment and head over to http://acceleratedsurvey.com to answer a few questions.

As is the mission of Accelerated Strategies, all of the research and analysis will be made available to everyone to use without registration or any payment. Because “knowledge wants to be free.” I couldn’t think of a better example of why that mission is so important.

“We appreciate being invited to support the efforts of Accelerated Strategies to learn how this global situation will impact people professionally. We know that the JumpCloud community has been impacted, so we are thankful to be able to help in a small way,” said Rajat Bhargava, co-founder and CEO of JumpCloud. “Supporting primary research into the impact of coronavirus across this community is important work, and will hopefully help shape the actions that organizations can take with their teams and business to successfully navigate the future.”

“DevOps Institute’s mission is to advance the Humans of DevOps and we are obviously concerned about the impact on the thoughts and behaviors of our global community,” said Jayne Groll, CEO of DevOps Institute. “The best way to overcome the hype and adapt to changing times is to collect and share community data.”

Finally, Mitchell Ashley, CEO of managing analyst of Accelerated Strategies Group, Groll and I sat down for a video discussion of the coronavirus discussion and the reasons behind the survey. The video appears just below. For information, we recorded this just before the news of IBM Security’s withdrawal from RSAC came out.

[videopress 5RyZpLsG]

— Alan Shimel

February 17, 2020