devopsy.kinsta.cloud

Tag: coding

  • Google Previews Generative AI Service to Improve Code

    Google Previews Generative AI Service to Improve Code

    Google is previewing an instance of a generative artificial intelligence (AI) service that surfaces code recommendations to make it possible to build high-quality applications faster.

    Specifically, Duet AI for Google Cloud surfaces code recommendations in real-time, generates full functions and code blocks and suggests fixes for vulnerabilities and errors in the code that it discovers. It also promises to enable DevOps teams to create custom large language models (LLM) based on their own code. In fact, GitLab and Tabnine are, respectively, already integrating LLMs running on Google Cloud with their continuous integration/continuous delivery (CI/CD) platform and testing tools.

    Chen Goldberg, vice president of engineering for Google, told attendees at the Google I/O 2023 conference that Duet AI for Google Cloud will fundamentally change how developers will be able to build applications, regardless of their skill level.

    Duet AI for Google Cloud was trained using data collected from Google Cloud using sample code and documentation to fine-tune behaviors and patterns.

    Duet AI for Google Cloud is available under an AI Trusted Tester Program and provides developers with many of the same capabilities that can be found in the GitHub Copilot tool that is based on the LLMs created by OpenAI.

    In addition to making Duet AI for Google Cloud accessible via both its tools and managed services, Google said it also plans to integrate the service with multiple integrated development environments (IDEs).

    It’s still early days as far as the use of generative AI within DevOps workflows is concerned, but it’s clear that the amount of code being created by developers is about to increase exponentially. Hopefully, AI technologies will also one day help software engineers find ways to manage the massive volume of code moving across their DevOps pipelines.

    Generative AI platforms will fundamentally change the way humans interact with machines. Instead of requiring a developer to create a level of abstraction to communicate with a machine, it’s now possible for machines to understand the language humans use to communicate with each other. Using a natural language interface, developers will soon be asking generative AI platforms to not only make suggestions but also debug applications and, eventually, write the code used to create an application.

    At this point, like it or not, the generative AI genie is out of the proverbial bottle. Just about every job function imaginable will be impacted to varying degrees. In the case of DevOps teams, the ultimate impact should involve less drudgery and toil as many of the manual tasks that conspire to make managing DevOps workflows tedious are eliminated.

    In the meantime, DevOps teams should spend some time identifying which tasks will become automated by generative AI and other technologies that employ machine and deep learning algorithms. It doesn’t make much sense to onboard new members to a DevOps team only to discover that the tasks assigned to that individual are about to be automated. Hopefully, when all these AI technologies are finally implemented, the entire DevOps experience will be better than ever.

  • 5 Unusual Ways to Improve Code Quality

    5 Unusual Ways to Improve Code Quality

    Code quality refers to how well-written and maintainable software code is. It encompasses factors such as readability, efficiency, scalability, reliability, maintainability and security. High code quality ensures that software is easy to understand, modify and extend, has fewer bugs and is less likely to break down. It also reduces development time and costs and improves the overall user experience. One common approach to determine code quality is to use automated tools that analyze the code based on predefined quality standards and generate a report with a numerical score.

    Why is Code Quality Important?

    Generating high-quality code ultimately enhances the end user’s experience. Focusing on creating quality code can also help consumers understand the safety and reliability of the software or program they’re using.

    Low-quality code can affect user experience and satisfaction, making it critical to write high-quality code that functions properly. When developers write low-quality code, it can create vulnerabilities that expose the software to cybersecurity threats, resulting in bugs and functionality issues and impacting the software’s reliability. 

    Here are some additional reasons high-quality code is important: 

    • Enhances code readability: Readability is important because it leads to higher rates of understanding among other developers. A code that’s easy to read is also easy to improve.
    • Improves the level of program sustainability: Program sustainability measures how long a code can survive with minimal changes. High-quality code can last for years, making it more sustainable.
    • Increases transferability: Transferring code from one platform to another is a complicated process. It’s much easier for developers to transfer high-quality code, as they only need to make minimal changes.
    • Lowers costs related to program or software: When software lasts for a long time with few errors, it can save a company money. Instead of paying for additional time to rewrite low-quality code, the company can rely on the original, high-quality source code.

    5 Unusual Ways to Improve Code Quality

    Here are a few ways you may not have thought of which can help your development team improve code quality and end-user satisfaction.

    Bug Bounty

    A bug bounty program is a type of crowdsourced security testing in which an organization offers rewards to independent security researchers or ethical hackers for identifying and reporting vulnerabilities in their software or systems. By offering rewards for vulnerabilities, organizations can incentivize security researchers to find and report security issues before they can be exploited by attackers.

    Bug bounty programs can improve code quality in several ways:

    • Incentivize security testing: Bug bounty programs incentivize security researchers to test an organization’s software or systems for vulnerabilities. This can increase the amount and quality of security testing that is done, leading to a more secure product.
    • Encourage responsible disclosure: Bug bounty programs encourage security researchers to report vulnerabilities directly to the organization rather than publishing them publicly or selling them on the black market. This allows organizations to fix vulnerabilities before they are exploited by attackers.
    • Provide feedback on code quality: Security researchers who participate in bug bounty programs can provide feedback on code quality which can help organizations to improve their development practices and write more secure code in the future.

    Auto-Generated Documentation

    Auto-generated documentation is a type of documentation that is generated from code comments and metadata as part of an automated development pipeline. It is typically generated using tools such as Javadoc, Doxygen, or Sphinx, which parse code comments and metadata to generate HTML, PDF, or other formats of documentation.

    Auto-generated documentation can improve code quality in several ways:

    • Improved code readability: Auto-generated documentation can provide clear and concise descriptions of code functionality, making it easier for developers to understand the code and its purpose.
    • Better code organization: Auto-generated documentation can help developers organize their code by providing a clear hierarchy of classes, methods, and functions, making it easier to navigate and maintain the codebase.
    • Consistency: Auto-generated documentation can ensure that documentation is consistent across the codebase, reducing the risk of errors and misunderstandings.
    • Quality assurance: Auto-generated documentation can be used as a quality assurance tool, helping developers to identify errors and omissions in their code comments and metadata.

    Coding Conventions

    Coding conventions are a set of guidelines and standards that outline how code should be written and formatted to promote consistency and readability. They typically cover aspects such as naming conventions, code structure, formatting, and documentation. 

    By following coding conventions, developers can improve code quality and make their code easier to read and understand, which makes it easier to maintain and modify. They also help ensure that code is consistent across a project or organization, which can make collaboration and integration of different code segments easier.

    Typical elements that coding conventions dictate include:

    • Naming conventions for variables, functions, and classes.
    • Indentation and formatting of code blocks.
    • Use of whitespace and comments to improve readability.
    • Guidelines for handling exceptions, errors, and input/output.

    Quality Gates

    Quality gates are a set of checkpoints or criteria that software must meet before it can progress to the next stage of development. They are typically used in software development processes to ensure that the software is of a certain quality and is ready for release.

    Quality gates can be automated or manual, and they are typically implemented at key points in the development process, such as after unit testing, integration testing, or acceptance testing. They can include metrics such as code coverage, code quality, functionality, performance and security.

    By enforcing quality gates, development teams can catch and address issues earlier in the development process, which can reduce rework, save time and ensure that the final software product meets the required quality standards.

    Smart Code Snippets

    Smart code snippets, also known as intelligent code snippets or live templates, are pre-written code fragments that can be inserted into a code file with placeholders for variables or user-defined inputs. They are designed to help developers write code more efficiently and accurately by reducing the amount of repetitive or boilerplate code they need to write and by providing contextual awareness and intelligence.

    Regular code snippets are static pieces of code that can be inserted into a file as needed. They typically contain pre-written code blocks or templates that can be customized to fit the specific use case.

    In contrast, smart code snippets are dynamic and can adapt to the context of the code being written. For example, a smart code snippet might include placeholders for variables that need to be defined or automatically fill in common code constructs based on the context of the code. 

    Conclusion

    The five lesser-known ways to improve code quality discussed in this article offer a starting point for teams looking to take a fresh perspective on their development process. Improving code quality is critical for the success of any software development project. While there are many established methods and best practices for improving code quality, there are also some less conventional approaches that can be surprisingly effective. By adopting a creative and open-minded approach to software development, teams can identify new ways to improve code quality and build more reliable, efficient and secure software.

    Image Source 

  • Implementing Shift Left Security in the Cloud

    Implementing Shift Left Security in the Cloud

    While ransomware has been the leading concern for enterprise security teams over the few past years, software vulnerabilities are nipping at its heels. The boom in cloud-based apps and services and increased digitization of work have been a boon for hackers, who are taking advantage of developers’ and DevOps teams’ attempts to work faster and smarter to keep up with demand. One estimate says that four out of 10 zero-day attacks carried out in the last decade happened in 2021 alone.

    Many things account for this increase. Developers are stretched and are reusing code, which allows for misconfigurations and vulnerabilities to reappear unexpectedly in different programs, and the use of multiple cloud services fragments security measures and reduces visibility into the code running many enterprise functions. This is why developers and security professionals alike are paying more attention to security throughout the software development life cycle (SDLC), particularly in the early stages.

    Shift Left Security Principles and Challenges

    The zero-day surge has led to an increased interest in shift left practices as a way to make security a priority in the development process. Shift left culture brings security into the equation much earlier in the software life cycle, before the software is deployed, rather than patch bugs after users report them. This preemptive approach helps head off vulnerabilities that can affect an application’s security posture unbeknown to its defenders.

    Shift left principles can also enhance security when developers build applications for cloud platforms—such as Amazon Web Services, Microsoft’s Azure or Google Cloud—where visibility into the proprietary code and security tools of the platform can be limited. In a shift left culture, DevOps embeds least privilege policies as part of the daily work on cloud workloads, to protect network infrastructure and avoid granting excess permissions on those workflows.

    For example, setting up role-based access control (RBAC) on Kubernetes containers enforces a least privilege model on those clusters and avoids excessive permissions that can lead to a breach, while removing admin credentials from continuous integration/continuous delivery (CI/CD) workstations shuts off hackers from using those pipelines as an attack vector.

    Shift left security is a great concept, but runs into hurdles in execution, mainly the internal conflict between development teams who want to move at the speed of business while security staff takes a more cautious approach. This leads to friction, with developers warning about access denials affecting their work and causing deployment delays, while the security analysts worry about data breaches caused by too many users with unchecked admin privileges.

    Working out this friction requires a mindset shift, where DevOps understands that security is part of the development process, and management can trust that developers have security in hand. This also requires tools and training to integrate shift left practices, such as platforms that can bridge the security needs of the CISO (by granting greater visibility into the network infrastructure code, for example) and the agility needs of the DevOps teams (by automating security guardrails and entitlements, for example). The ultimate goal is creating what is known as a DevSecOps model, bringing together development, security and operations into one agile, safe and efficient workflow.

    How to Adopt Shift Left Security on the Cloud

    Four best practices can help:

    ● Gain deep visibility: With enterprises often working in multiple cloud environments—and mixing public and private clouds into hybrid infrastructures—visibility into assets typically suffers, which makes getting a clear view of risk difficult. Being able to discover all identities, permissions, configurations and resources in the environment and all the access paths to specific resources can help build a contextual inventory of cloud assets to better manage them and carry out policy analysis.

    ● Prioritize risk: Risk management is a key practice of any security program, but the flood of alerts from multiple cloud providers and systems can overwhelm security operations centers, which are often short on talent and time. Automation tools can now search and prioritize risks across an entire cloud environment, from development to production, spotting problem combinations and alleviating the workload of sorting manually through alerts across multiple silos, freeing the staff to work on higher-priority mitigation and remediation tasks.

    ● Just-in-time access: Zero-trust architecture has become the standard to aspire for most security defenses, but it is often challenged by the difficulties of managing access privileges. Just-in-Time (JIT) access, granting limited-time revocable rights, is a useful tool for building a zero-trust security architecture and enforcing least privilege policies to maintain it. Technology tools that actively manage and monitor developer access to cloud environments, including a strong audit trail of privileged activity, give security a means to enforce JIT access and zero-trust in turn.

    ● Find and prevent vulnerabilities and misconfigurations: Infrastructure-as-code (IaC) has made software deployment in the cloud (much more agile and efficient with the use of virtual machines, containers, microservices, etc. However, security is often an afterthought both pre- and post-production when standing up cloud infrastructure. Organizations should scan code for security policy violations and other risks in order to mitigate flaws before they reach production and to detect and fix problems in production environments. With feedback and automated guardrails built into development workflows, DevOps and security teams can reduce security risks in their code.

    Like zero-trust, shift left is on its way to becoming a standard practice for cybersecurity assurance. But building a DevSecOps model takes more than good intentions. It requires practices, tools and training to execute that model, and a mindset of partnership across the enterprise and with outside cloud and security partners. Only a group effort will provide the cloud security assurance an agile business needs.

     

  • Top 10 US States for a Coding Career

    Top 10 US States for a Coding Career

    Coding jobs are in high demand and the Bureau of Labor Statistics projects that computer and information technology employment will grow 13% by 2030. Alongside the increasing demand, coding has emerged as a highly flexible career option with room for growth. 

    If you’re looking to build a lucrative career in coding, researchers at Scrapfly.com pulled together a list of the top 10 states for coders and what the average salary is in those states.

    Scrapfly.com, a web scraping API, calculated each state’s job openings per 100,000 people, as well as the median annual wage. Delaware came out on top with 759 coding jobs per 100,000 people, with a median wage of $108,440. Behind it is Vermont with 519 jobs per 100,000 people and a median wage of $99,210. 

    Surprisingly, the least populous state in the U.S., Wyoming, rounded out the top three with 488 jobs per 100,000 people. 

    “As you can see by the data, it’s a common misconception that you have to get a job in one of the more populous states in order to get the dream job as a software developer. Wyoming is a great example of a state that is small in population but is really pushing the boundaries in terms of creating jobs within the tech industry,” Scrapfly.com researchers said. 

    Despite having the fourth-highest annual salary, Alaska placed seventh on the list with 443 jobs per 100,000 people. Behind it, Massachusetts had the highest median wage at $128,160 per year. 

    Numbers seven through 10 on the list all bring in at least $100,000 per year, on average, with New Hampshire and Rhode Island providing 411 and 395 jobs per 100,000 people. 

    Furthermore, Montana, South Dakota and North Dakota come in at numbers four, five and six with their median wages varying between $80,000 and $78,000. In those states, between 458 and 475 jobs per 100,000 people were recorded. 

    “Whether you’re already established in the coding world or looking to kickstart your career journey, there are plenty of states that provide ample opportunity to flourish,” said Sparkfly.com’s research team. 

    Although many people don’t have a coding background, it is easier than ever to learn the skills necessary to get a job in coding. Indeed.com advised learning a programming language like JavaScript, Python or Swift and taking a coding class. It also touched on the importance of contributing to open source, building projects and expanding your portfolio. 

    “This research demonstrates that a career in tech and coding is more accessible than many believe. We can see this not only by the sheer number of job openings across the states but by the attractive average salaries too,” the researchers said.

  • Four Secure Coding Best Practices for Mobile Apps

    Four Secure Coding Best Practices for Mobile Apps

    Mobile apps have become the primary point of innovation for many companies, and skilled mobile developers are in high demand. The business asks developers to innovate fast using the latest smartphone features and capabilities to drive high download rates, wow their users, capture customers and grow their business. Dev teams facing constant pressure to move faster may push security to the back burner, focusing on required features and delivery dates the business demands. However, many dev teams have figured out how to innovate faster with security built in by ensuring that devs understand key security requirements and coding best practices. Working with hundreds of development teams on securing thousands of mobile apps, we found four common areas of security failure that can be addressed easily.

    Use SSL via HTTPS

    Mobile app devs may instinctually use Hypertext Transfer Protocol (HTTP) for network communications. However, HTTP puts private user information out in the open for threat actors to intercept. Developers can fix this common mistake by using HTTPS instead, which encrypts data sent to and from servers via industry-standard SSL. Android developers can use the available NetworkSecurityConfig file to set up a predetermined configuration for all network connections made within the app or manually incorporate HTTPS. iOS developers can use App Transport Security (ATS) as the default feature that enforces secure communications in iOS apps and prevents any insecure connections between the mobile app and the server from being completed.

    Validate the Contents of the Certificate

    Certificates add an additional layer of security to HTTPS connections by enforcing additional validations when performing a connection. Certificates include the certificate authority (CA) that signed it and the list of hostnames known or accepted by the application. Apps that validate these components when performing connections with the server significantly reduce the risk of a man-in-the-middle (MITM) attack that can steal credentials and sensitive data.

    To verify a certificate has been issued by a valid CA, Android developers can reference the preconfigured list of CAs included on devices running the mobile operating system. Android developers can implement native classes such as HostnameVerifier to achieve proper hostname verification within their app.

    iOS developers can leverage ATS that provides built-in validation, or use methods in the NSURLSession class to manually code these instead.

    Avoid Hardcoding Resources of a Mobile App

    Attackers often use hardcoded info within the source code of a mobile app to take advantage of users. For instance, attackers can use credentials stored within app files to gain access to a user account. Attackers can also find hardcoded API keys or URLs to gather private data or take over an app entirely. Mobile app developers can prevent these areas from being compromised by not hardcoding keys, passwords and URLs into the source code. Encrypting transport and decrypting data on the backend also adds an extra layer of security.

    Use the Latest Cryptography to Protect Mobile Users

    Outdated cryptography algorithms like SHA-2, RC4 and DES allow attackers to easily break a seemingly secure mobile app. Using older algorithms may also make a mobile app non-compliant with industry regulations leaving an organization at risk of fines or legal jeopardy. Devs can avoid this problem for Android and iOS mobile apps by using the latest cryptography algorithms available, selecting those that are suitable for a specific app scenario. When signing your binary before publishing it to the store, use keys with a length of at least 2048 bits (preferably 4096 bits), and on Android use SecureRandom or SecRandomCopyBytes on iOS when generating random values for cryptographic implementations. Android devs can leverage the Keystore class and iOS devs can leverage Keychain services to store highly sensitive data. Devs should avoid insecure modes of operation, improperly generated cryptographic keys and initialization vectors (IVs) to guarantee that the information that is encrypted cannot be decrypted by a malicious actor.

    Today’s mobile app users need confidence that mobile apps are built with security in mind. While building innovative mobile apps, developers have a responsibility to learn a practical set of secure coding best practices to protect their users (and their businesses).

  • Techstrong TV: Closing the Diversity Gap in Tech Careers

    Techstrong TV: Closing the Diversity Gap in Tech Careers

    Charlene and Liliana discuss closing the gap in diversity in careers in tech. Learning to code can be a beneficial skill for traditionally underrepresented demographics, leading to more employment opportunities. The video and a transcript of the conversation are below.



    Recorded Voice:         This is Digital Anarchist.

     

    Charlene O’Hanlon:   Hey everybody, welcome back to Techstrong TV. I’m Charlene O’Hanlon and I’m here now with Liliana Monge, who is the cofounder and CEO of Sabio Coding Bootcamp. Liliana, thank you so much for joining me today, I really do appreciate it.

     

    Liliana Monge:           Thank you so much for having me. I’m super excited to have this conversation.

     

    O’Hanlon:   Excellent, excellent. Well we are happy to have you here, especially because I, I really do appreciate the efforts that you guys are doing through your coding bootcamp and really want to give you guys a little boost up if you will by a little bit of free promotion.

     

                                     But let’s talk about what you guys are doing. What, tell me a little bit about Sabio Boot, ah, Coding Bootcamp.

     

    Monge:       Yeah, so we started in the fall of 2013 in Los Angeles. Back then we had a very singular focus to make sure that the LA ecosystem was really going to be diverse. There was you know Los Angeles kind of at one point in time really lived in the shadows of San Francisco, of Silicon Valley and you know I would say in 2010, 2011 things really started to get heated up, more venture capitalists started to come into the state, a lot more companies started going public, such as Cornerstone OnDemand. So we knew what was going to happen in terms of all of this amazing wealth creation and jobs.

     

                                     So my partner and I, my cofounder, Gregorio and I, decided that we wanted to make sure that the ecosystem in California and Los Angeles was going to be diverse. So we set up a really innovative program that allows any adult who is smart and motivated to become a software developer within a very short period of time. So it’s very practical training. We were a hundred percent dedicated to helping women, more Latinos, more Black people, people who are underrepresented in tech like military veterans join this innovation economy.

     

    O’Hanlon:   That’s great, that’s great. And I’ve spoken with folks in other cities who basically have the same idea to, to really bring up the, you know rise up the traditionally underrepresented communities when it comes to technology. And it really surprises me how many start with these coding bootcamps or these coding classes. It seems like that is kind of the cornerstone of so many IT jobs these days. So I mean do you see a lot of folks entering the tech space using that particular avenue, the coding or, or is it do you think that it is kind of fundamental these days?

     

    Monge:       So I do think it’s definitely fundamental and it is a solution that can be applied pretty much throughout the United States or the world at this time, especially because we see the cost of hardware has come down significantly. That is a barrier to entry, right? You have to kind of have your own machine which is you know that, that needs to run VC software. As we all know software engineers run quite VC software. So you have to start with a price point of somewhere around you know $1500.00 to $2000.00 so that every person has the equipment they need, so that can be a barrier.

     

                                     However, once if you find a way to overcome the hardware barrier, you also have to make sure that there’s reliable internet, right, because all the information is on the internet, you’re posting to AWS Cloud probably your code and things like that. So there are two barriers.

     

                                     But then the last component, which is curriculum and practical training to become a software engineer I would say that is probably the most prolific. There is so much curriculum out there. So we decided to build our own custom curriculum. However, there are other organizations that release curriculum that’s available. There’s also a bunch of free stuff. Vendors many times have free resources. So it is a very wonderful solution to help any population.

     

                                     You know there’s so much going on right now. Like let’s say in Appalachia where the economy is changing and so people are like, “Is this a possible solution?” Miami is going through a massive transformation, right? They were known for hospitality, for travel, for leisure and now it’s just got this massive tech injection. So you can see how you can really take a coding bootcamp and kind of pluck it anywhere and if there is an ecosystem that’s going to support it, it can definitely create an amazing tech workforce anywhere in the country.

     

    O’Hanlon:   Yeah, I, I find it especially in, in urban areas that these coding bootcamps are, are cropping up. And I wonder if that’s also kind of I don’t want to call it a “substitute,” but maybe another avenue for especially kids coming out of high school that don’t really have maybe the means to go to a four-year college and then there are some people who don’t see the value in a four-year college, they just want to do the tech school route and get, get a basic understanding of what they need to do and then, and then go out and enter the workforce.

     

                                     So do you see these, ah, the important or the, the popularity of these coding bootcamps do you see them as more of a kind of a just a step for or these transitional and especially traditional under-represented communities a way for them to, to get the resources, to get the education they need without having to spend four years in college? Or do you see it more as they’re looking at it as, “I don’t want to go to college, but I do want to learn a trade and I want to…you know I see that there is value in coding because tech is the future.” So where, where are you kind of seeing people joining the bootcamps from?

     

    Monge:       Yeah, so that’s a fantastic question. When we began we thought we were going to be able to take students who graduated from high school and enroll in the program. However, we have found that 18-19-year-olds are a little bit too young to think about, “In three months I’m going to be a professional.”

     

    O’Hanlon:   Okay.

     

    Monge:       So we will enroll people who are that young and there’s always like 1 out of you know 40 that are 18 or 19, however, across the county and coding bootcamps you’re right did start in all the major metros had their own coding bootcamps.

     

                                     We see people who are more about 21 to about 25. So it’s individuals that have some type of life experience, maybe they’ve worked a little bit, maybe they did some community college, or maybe they got a degree that didn’t allow them to really participate in the economy in a meaningful way. So we’ve met so many music majors, so many psychology majors, even people who have you know a general business degree you know might have a hard time finding their footing in the economy.

     

                                     So we find that people who have some type of life experience, whether you’ve worked in retail and now are a little more mature you know and you’re really thinking about,” Okay, I want a career that’s going to offer me a lot of opportunities,” those are really the people that we’ve seen across the country decide to participate in the coding bootcamp. I would venture to guess that it’s the space that’s a little more mature, it might move a little bit younger, but right now we haven’t seen a massive demand from the 18- or 19-year-olds.

     

    O’Hanlon:   Okay. So I know when you got started it was really a focus on getting the underrepresented communities, the Latina community and you know just addressing a need that was going to exist in the LA area, but what, have, have you seen that demographic changing with your bootcamps as you’ve progressed? Has, has it been less about making sure that you know these traditionally underrepresented communities and, and, but it’s become more of a kind of a general population that have been attending the bootcamps?

     

    Monge:       Yes, definitely. So we did see that big shift and especially you know in 2020 when COVID hit Sabio had to go into a hundred present live remote environment, right? So starting in April and May we really were able enroll a person who was in Texas, a person who was in Chicago, because all you needed was your laptop and strong access to the internet. So we have seen that the demographics of our coding bootcamp have become you know they’re very diverse. Where we will have you know Latinos, African Americans, we have a massive women in tech scholarship, we do a lot to try to encourage ladies to come to the program and support them post-graduation.

     

                                     But one of the things that we weren’t aware of when we started was that there’s actually a large military veteran population that is very well suited for coding. That we discovered maybe two or three years into the coding bootcamp. So now a good percentage of the people in the program are military veterans. So we’ll have people who actually live around the world, because veterans I don’t know have seen the world and they, they discover beautiful parts. And so it’s become a really diverse community in a unique way that we weren’t really anticipating.

     

                                     But what we want is basically our training room to look like America, right? An America super diverse, super fantastic and that’s who should be participating in the innovation economy. We think everyone should give it a consideration, give it thought, try it a little bit and decide for themselves if it’s something that they want to do professionally.

     

    O’Hanlon:   I, I think – I love that, I think that’s, that’s amazing that you guys are doing that. It’s interesting to think about. I, I have a 12-year-old son and you know he codes every day and he doesn’t even realize that he’s coding it, that he’s doing coding. We’re, you know I’m in awe of what he’s able to do on, on a regular basis. It’s not anything – I mean obviously I could learn how to code at some point, but I think we’re gonna, we’re, we’re kind of reaching this, this point in time where it’s not really going to be a question of, “Do you want to learn how to code,” it’s just you know you’re gonna learn how to code, it’s going to be kind of ingrained like you know like math or English or anything like that.

     

    Monge:       Right.

     

    O’Hanlon:   It’s just going to be part of, you know part of our everyday lives.

     

                                     So do you, do you foresee in the future that you might see kind of a shift in the, in people’s attitude regarding coding and, and you know and then you know maybe have as a result maybe your curriculum is going to be shifting into maybe other areas?

     

    Monge:       Yeah, so I think there’s opportunities on both sides. I mean we’ve seen that you know there’s been a national movement for Hour of Code, right?

     

    O’Hanlon:   Mm-hmm.

     

    Monge:       So in December during Computer Science Week most elementary kids will sit down and actively say like, “I am coding today.” So they’re developing the digital proficiency from an early age, which is fantastic.

     

                                     There are also a lot of after-school curricular activities that are related to coding and robotics. So I think that there has to be like you said a general understanding of what code is, how it operates, have some kind of fluency in it.

     

                                     There are also a lot of tools that help people do low-code automation, right? So there’s that development. But then there’s the development on the other side of the dumbbell which is you’re going to have a lot of AI and machine learning. We’re doing a lot of stuff with autonomous vehicles. I think I’ve seen that they, they showcased the tractor that’s a hundred percent autonomous, right? That the farmer’s controlling just with his phone.

     

    O’Hanlon:   Mm-hmm.

     

    Monge:       So I think there’s really exciting things that are happening across the spectrum, the technical spectrum and so it is going to become more incumbent for people to have some type of digital literacy and I think it just depends on how much…

     

                                     Right, like you and I probably I don’t know how much – like I never finished calculus, I could, I tried it, I could never get there.

     

    O’Hanlon:   [Laughs]

     

    Monge:       And now as an adult running a business I’m like, “What even is it,” right? Like do, who really needs it?

     

    O’Hanlon:   Right, right,

     

    Monge:       Versus, “I need algebra,” you need spreadsheets, you need concepts of finance. So I think it’s going to be something similar. There’s going to be a big spectrum. Does that make sense? Did I answer that?

     

    O’Hanlon:   Yeah, no, no, it, it makes, it makes total sense. You know you brought up AI and machine learning and other areas where we’re going to be heading.

     

                                     You know I was just talking to somebody earlier today about the metaverse and, and you know now that, now that we’ve got these entire you know universes that are being constructed virtually and people can actually interact and, and it’s nothing like Second Life. You know if anybody remembers Second Life 20 years ago people thought that that was going to be the next big thing and that was a big bust. But you know the metaverse and, and now companies are, are talking about using holograms to, to have you know interactions with other people.

     

    Monge:       Yeah.

     

    O’Hanlon:   There’s so many things that are going to be coming that, that just are kind of mind blowing. That we are going to need this next generation of you know the kids today who they are the next generation of coders and they’re the ones who are going to create these new universes for us and all these technologies and capabilities. So I think it’s really, really amazing that, that they’re getting this foundation now so that they can start kind of… They don’t have to think about the actual idea of coding, you know getting over that hurdle, they can just think about all of the possibilities that are, that are open to them and that they can provide to, to, to their customers in the future. So good stuff there.

     

                                     I love the idea that you know we’ve got, we’ve got these coding camps that do really give a nice foundational base to anybody and that’s, that’s an important thing. And anything that we can do to, to really blur the lines between equity and parity when it comes to underrepresented populations in technology I think is a really, really good thing.

     

                                     So Liliana I do want to thank you very much for what you guys are doing. I think it’s a great thing.

     

                                     If folks are interested in finding out more about the Sabio Bootcamps how can they get it? Do you have a website you want to point them to?

     

    Monge:       Yes, certainly. So it’s just our name: S-A-B-I-O-.L-A, because we started in Los Angeles. If you go to the website you’re going to find a bunch of different resources. We have a lot of introductory courses that are absolutely free, so that people can dip their toe in the water and say, “Okay, is this something that might interest me?”

     

                                     From what I’ve learned a lot of people really describe getting a little bug when they wrote something and something happens and they’re just like, “Oh wow.”

     

                                     But I think a lot of people are you know we’re, we’re makers, right? We, we evolve to work with our hands, to have tools and to build things, so this is one of those ways that we can really be creative and build something that other people can use or maybe you just build a solution for yourself that you really need, that no one else has built.

     

    O’Hanlon:   All right, well that’s, that’s such great stuff. I do appreciate it. Again, thanks for joining me today on TechStrong TV. Liliana thanks again for your time.

     

    Monge:       Thank you for having me.

     

    O’Hanlon:   All right everybody please stick around we’ve got lots more TechStrong TV coming up, so stay tuned.

     

    [End of Audio]

     

  • Mob Programming During a Pandemic: Lessons Learned

    Mob Programming During a Pandemic: Lessons Learned

    Despite limitations, mob programming can be effective, even during COVID-19

    The COVID-19 pandemic has many of us considering the long-term impact on our personal and working lives. Shaking hands with new colleagues or clients? Buffet lunches? I’ve recently wondered how social distancing will affect mob programming, which is a development practice we implemented at Bonitasoft late last year.

    What is mob programming? It’s a software development approach where an entire team gathers around one keyboard and one projector screen at once, according to Agile community organization Agile Alliance. It’s an extension of the idea of pair programming, which involves two team members collaborating to complete a development task in the same space.

    In an August 2013 CodeBetter.com post, Marcus Hammarberg, head of Quality & Curriculum at the School of Applied Technology in Sweden, equated mob programming to driving. The driver uses the keyboard, writing the code and following coding standards. Other team members are navigators, advisers and researchers who assist the driver and focus on higher-level tasks such as determining if the team is solving the right problem. They also tag in to take over as the driver.

    “I’m not saying that mob programming is for everyone, neither is pair programming,” Hammarberg write. “It might not be for all types of tasks either … But I am saying that getting your team into a room, with one computer and one screen, the whole team is working together on one feature—that there is no more effective way to get that feature out.”

    Of course, much has changed over the past several months, including people’s comfort level with being in close proximity. Before I get into my recommendations for how mob programming can work in the current situation, let me share why Bonitasoft embraced it to begin with and the benefits to my company.

    Embracing Mob Programming

    About a year ago, I saw Agile coach Woody Zuill deliver a presentation titled “Mob Programming: A Whole Team Approach,” at MixIT 2019. I was intrigued by what I saw as a promising development approach. However, I had my doubts about the effectiveness and logistics of gathering five people in front of one screen. I also suspected it wouldn’t be compatible with remote work—a premonition of today’s situation?

    Running development projects in sprints made it a low-risk investment, so I introduced mob programming to the other members of my five-person team, which is responsible for the development of the Bonita platform portal for delivery of applications and is comprised of a mix of introverts and extroverts. The team took a mob programming approach to design and test an application page. It was a medium complexity project built with Gradle, using the UI Designer web page development tool and tested with Cypress.

    After discussing the project’s objective and methodology, the team worked on a laptop and a standard-size screen in the open office space. Pros: Fast development completion, better implementation and good test coverage. Cons: Decreased focus because of lengthy discussion and the distraction of phone notifications, communication style differences and paused cross-cutting topics.

    My team members and I loved the result of mob programming but needed to iron out the format. We also skipped the first stage of agility in our excitement to try mob programming: starting with a strong framework and basic rules. These include spelling out the roles of the pilot, navigator and researchers on a team.

    Among other adjustments, we moved to a quieter spot in the office to work. We swapped out the small screen for a giant screen and replaced the laptop with a desktop, keyboard and mouse. We scheduled more breaks. We adhered to the basic rules. We rotated roles every 15 minutes, which meant all team members were more attentive and involved. Recognizing that timid team members might not speak up, we distributed speaking time more fairly. And we were more selective when choosing projects for the mob programming method (bug fixes, for instance, are best solved through pair programming).

    How We Benefited from Mob Programming

    The process required a little tweaking at the beginning but it was well worth it. We’ve realized a lot of benefits from the mob programming methodology. One of the biggest benefits is all the time we save on development projects. Mob programming eliminates merge conflicts, decreases the time spent in standup meetings and pull request reviews and reduces external interruptions (people are less willing to interrupt an entire group than just one dev working independently).

    Here are a few more mob programming benefits:

    • Global knowledge sharing: All members of a mob programming development team receive the same level of knowledge on new developments. New team members are able to quickly ramp up on the legacy code.
    • High-quality solutions: The solutions from mob programming efforts tend to be better tested with fewer bugs in the final product. Since the code is made modularly, it’s easy to modify if needed.
    • Team growth: Mob programming has taught us to communicate in a way that works best for each team member. We appreciate the diversity of thought and personality among team members rather than viewing it as a disadvantage.

    Can Mob Programming Work in a Pandemic?

    Now that you know why I recommend mob programming let’s look at whether it’s possible to continue using this methodology safely during the pandemic. Bonitasoft devs are all working remotely so I base this on experience. We apply the basic rules using videoconferencing tools and duplicate the development environment for everyone. Communicating via videoconferencing was an adjustment but it works. Each team can adapt mob programming to what works best for them over multiple iterations, whether they’re working in the same space or remotely.

    Here are a few mob programming tips:

    • Define when it involves remote work versus when it will involve everyone working in the same space (with social distancing procedures in place, of course).
    • Apply the basic rules strictly, so you have a solid foundation on which to build a mob programming practice.
    • Limit potential distractions by opting for a large screen, mouse and keyboard in a quiet location.
    • Factor free time into your non-sprint work schedule so that team members can check their email and work on other projects.
    • Define break times (the Pomodoro technique could be one option).

    Mob Programming is Worth Exploring … Even Now!

    During the past few months, I’ve learned a lot about mob programming and believe there’s a certain magic to it. At Bonitasoft, smart implementations have resulted from the development team embracing the value of collective intelligence and mob programming. We’re delivering projects faster and enjoying greater satisfaction in our work lives. With some adaptation, it’s possible to realize its value by adding it to your development methodology options.

  • Custom Coding: An Obstacle Along the Hybrid Cloud Journey

    Custom Coding: An Obstacle Along the Hybrid Cloud Journey

    If you’re like 80% of enterprises, you’re somewhere along a hybrid cloud journey. The imperatives of digital transformation, the emergence of DevOps as the de facto enterprise development methodology and the rapidly growing demand for continuous innovation have made hybrid cloud the go-to infrastructure for competitive enterprises.

    Hybrid Cloud Governance Requires Automation

    Despite hybrid cloud becoming the new normal, there are inherent challenges to managing these infrastructures. Not only do IT departments (and those they serve) need to adapt to different processes for provisioning public and private clouds, but they also need to ensure security and compliance across an increasingly heterogeneous cloud landscape. On top of these challenges, IT departments also need to monitor and control cloud costs and manage day-2 operations while seamlessly orchestrating private, public and on-prem systems.

    To tackle these new complex challenges, you need management and automation tools, which help alleviate the security, governance, and cost-control challenges that hybrid clouds inevitably bring. But integrating them with your existing IT infrastructure (e.g., networking, security, backup, etc.) burdens your IT team with significant custom coding requirements.

    The Dreaded ‘Custom Code Tax’

    So, you have your hybrid cloud, and you have your automation tools to optimize it. But now, each one of these tools—whether it’s for simple use cases such as resource naming or complex tasks such as multi-tier workload provisioning—requires integrations with dozens of underlying networking, security and backup endpoints, typically from dozens of vendors.

    These integrations often require custom coding, which is arduous and time-consuming. Your IT people will be stuck writing and maintaining thousands of lines of custom code to integrate your automation tools with all of these endpoints. It’s also expensive. Research by the Standish Group shows that over half of custom-coded projects cost almost double their original estimate, while about one-fifth of custom-coded projects will be canceled before they are completed.

    And the tax doesn’t end there. Governance and security become increasingly complicated and expensive because the proliferation of new tools and processes prevents IT from having a unified view of integration policies, automation playbooks and role-based access. Without the end-to-end visibility necessary to manage and monitor this proliferation of tools and processes or standardized provisioning across all IT platforms and tools, costs are only going to compound over time. Since 60% of all infrastructure outages are caused by human error, end-to-end automation and visibility are now mission-critical for enterprise organizations

    But what is to be done? Organizations need hybrid cloud to meet the demands of digital transformation, and they need automation tools to effectively manage and secure hybrid clouds. Your monetary costs and governance burdens will scale along with your IT, and as your organization invests in new automation platforms, the “custom code tax” will only keep increasing. But if you want your hybrid cloud to work right, there really is no choice but to pay it.

    Hybrid Cloud Management with Codeless Integrations

    Enterprise IT departments need to implement cloud management solutions that offer an alternative to custom coding. Cloud management that takes a policy-based, codeless approach to these integrations eliminates the need to custom-code, thus repealing the custom code tax.

    Take the example of cloud management platforms (CMPs). In the past, CMPs mainly focused on management. However, the complexity of hybrid clouds now requires an equal focus on both management and integration. Software-based, low-code/no-code methods for integrating automation solutions with relevant systems not only eliminate the high costs associated with custom coding but also ensure a governed, standardized approach to integrating automation tools with networking, security and backup endpoints.

    Not only will you save valuable time and budget dollars, but when your integrations are software-based and no longer rely on custom code, you will be able to apply advanced intelligence tools more easily as your organization grows and evolves. If your company wants to integrate certain tools that utilize artificial intelligence (AI) and machine learning, for example, you will run into obstacles trying to abstract data from custom-coded workflows. You can’t apply AI to a language that is unique in business logic because it has been custom-written. There could be a hundred thousand lines of custom code, so you would have to manually go through it all and try to figure out what’s there, who built it, why they built it and what the business logic behind it is.

    Codeless Will Rule the Day

    In a world where multi-tool reigns supreme, the more tools you want to use, the more custom coding you have to do. Enterprises today must be able to use their tools of choice in a best-of-breed approach while maintaining standardization through a robust integration layer. Going forward, this means that cloud management platforms will need to be built around extensibility and make integration a core capability, not an expensive afterthought.

    Forward-looking CIOs are choosing software-based solutions to enable multi-tool to work seamlessly in hybrid cloud environments. This results in lowers costs, better governance, and more robust security, especially as organizations advance their hybrid cloud journey.

  • Pair Programming

    Pair Programming