Tag: developers

  • Bootstrapping DevOps for the Internet Computer

    Bootstrapping DevOps for the Internet Computer

    All startups face unique sets of challenges and issues at each stage of their existence. The DFINITY Foundation, a Swiss-based not-for-profit with the remit to extend the functionality of the internet, is no exception. Like any new organization, we have had to evolve and adapt our DevOps and other practices in response to different obstacles.

    After learning to clearly communicate our vision for an open development platform where software runs directly on the internet, we created a road map to translate this vision into a decentralized architecture with distinct features that could be built and shipped on a periodic cadence. Consisting of five milestones, the road map culminates in a public launch in Q4 of 2020—and we haven’t missed a single deadline despite the disruptions of a global pandemic.

    Incorporating a focus on operational responsibility on top of our focus to ship features without losing speed was a major challenge this year ahead of the release of our developer network, called Tungsten. Sustainably bootstrapping operational responsibility for this release, as well as future releases, was imperative.

    We’ve all heard horror stories about operational teams that run through a checklist in a perfunctory fashion without identifying the root cause of a problem. Even worse, they are quick to give up and are resistant to launching changes, increasing the complexity of their workload.

    Pushing Forward With DevOps

    We were determined that this wasn’t going to happen to DevOps at DFINITY, so we embedded these core cultural touchstones into the organization.

    1: Create SLOs and SLIs for cross-functional clarity

    At the end of 2019, well before there was a service to operate, we started thinking about service level objectives (SLOs) and service level indicators (SLIs). These are critical for providing a common, quantifiable vernacular for R&D and Operations teams to measure how a service should be performing.

    An SLI is a clearly defined indicator for one aspect of a service’s performance, ideally focusing on user-visible service behaviors. The SLO sets the target for the indicator, as well as a window of time over which it is measured.

    To communicate the SLIs and SLOs, training materials were presented across the organization, including speaking with various engineering teams, discussing best practices at management meetings and giving an overview at an organizationwide meeting. In addition, the leadership of R&D teams signed off on the approach.

    To provide clear operational expectations as well as a forcing function, we established an early version of the SLOs as a high-priority OKR.

    As an additional consideration, it is crucial that your SLOs reflect aspects of your service that are visible to the user. As Charity Majors, CTO of Honeycomb.io, noted, “Nines don’t matter if your users aren’t happy.” SLOs are not a one-and-done deal; they need to be updated as the service evolves and as your ability to capture the UX improves.

    Having SLOs in place gave staffers with operational responsibility clear expectations to fulfill. If the service is performing within the SLOs (and if the SLOs are representative of user happiness), then things are running smoothly.

    #2: Engineers developing the software should also help run the software in production

    To bootstrap the team with operational and support capabilities, we needed to ensure that we didn’t create a siloed team lacking engineering skills. Operations in this context is a software engineering problem, which meant we needed to involve developers.

    The same engineers developing the software should have skin in the game in terms of how the software is running in production. If there are problems, these engineers are in the best position to diagnose them and propose and implement the necessary fixes. Getting organizational buy-in for this took some time.

    We emphasized the need for senior engineers to be able to operate the software being built. We didn’t want to fall into the trap of throwing a handful of junior engineers into the deep end without proper supervision or training, so we also established an expectation that all engineers should be able to operate the software irrespective of seniority.

    We built two teams of between five and 10 developers in each of our office locations in Palo Alto, California; San Francisco; and Zurich, which were initially staffed with volunteers across the organization. Each week, one team member at each site managed primary operational responsibility for the service instead of their regular project work, and they knew that the entire staff would help if there were any problems. We plan to rotate new people into these ad hoc teams every six to nine months.

    #3: Create optimally sized, communicative teams

    Operational team size is also important. If the team is too small, people are on-call too frequently. If the team is too large, they will be on-call so infrequently that they will either forget how to operate the production stack or their knowledge will become outdated.

    We share status updates through a daily log and informal shared communication channels such as Slack. There is also a weekly meeting to relay responsibility from one person to another.

    This has helped us identify capability gaps. With team members based across the world, we’ve come to acknowledge that if a problem requires a team’s expertise outside of its working hours, then rolling back first and investigating later is absolutely fine.

    The DevOps team decided early on that we weren’t going to start with 24/7 support, instead providing support during business hours in Europe and the U.S., where the majority of our early-access customers are located.

    We’ve been transparent to the wider organization throughout this process, calling out what is and what is not working well, and how we’re working to improve our processes.

    Conclusion

    We were fortunate that unprecedented global events like COVID-19 didn’t significantly affect our operations. That said, shaping our processes in-person and being physically present for people when they first go on-call would have been valuable, and we definitely felt the impact of losing that. But we’ve successfully bootstrapped our DevOps teams nevertheless, and we look forward to continuing to evolve as a team.

  • Open Source License Compliance Tips for DevOps Pipelines

    Open Source License Compliance Tips for DevOps Pipelines

    Open source components are used in most modern organizations, either included directly into software as code or as tools integrated into workflows. In DevOps environments, often a combination of the two occurs. These components can help speed development processes, provide functionality that isn’t otherwise available and decrease operating costs of teams.

    To successfully implement open source components, in software or pipelines, teams need to carefully evaluate what projects are included. Although most open source is free and supported by developer communities, there is no oversight guaranteeing that components are well-made and licensing can vary widely. This means that teams are responsible for ensuring that code is safe, stable and implemented legally.

    DevOps and Open Source Software Development

    When you are considering including open source components in your projects and pipelines, it is important to evaluate those components first. A well-developed evaluation process can help teams verify open source components and protect from:

    • Security vulnerabilities—Components are made by a community of developers, many of whom do not have extensive security knowledge. Additionally, because projects are worked on by many developers, code may not be uniform, creating bugs that can turn into security vulnerabilities.
    • Operational risks—Open source projects are maintained voluntarily. This means that project support may wane or unexpectedly drop. Additionally, updates and patches may not be released as reliably as with proprietary software. Since continued support is not guaranteed, you may be left with significantly more responsibility for maintaining and updating components that you originally planned for.
    • Legal risk/license IP compliance—Not all components are freely available for use by every organization or project. If you use these components unlawfully you can later be held accountable for breaking license agreements, even if you were unaware of doing so.

    Why Open Source Compliance Is Important

    Open source license compliance and legal risk are especially important and complex for commercial development teams. There are more than 200 open source license variations, each with different standards for when projects can be used, by whom and in what capacity. Compliance strategies ensure that you are aware of the licensing requirements of any component you use.

    In particular, the things you need to be aware of when it comes to open source compliance is whether projects can be included in commercial products or used by teams of your size and type. If projects cannot be used in commercial projects or require projects to be made open source upon inclusion, you are risking your own intellectual property.

    Including open source projects against license can open you to legal action from project maintainers, contributors or third-party organizations. For example, some projects are part of a dual-licensing strategy with companies looking to protect their own financial interests. Or, cases may be brought as a means to raise awareness about open source licensing by concerned community members.

    Another possibility is being actively targeted for financial gain. Some projects are contributed to by open source trolls, software developers who have made a business of suing for license non-compliance. These developers take advantage of licenses such as GNU General Public License v2.0 (GPL-2.0), which terminates usage and distribution rights when breached, enabling developers to sue to stop distribution or to demand a portion of profits.

    Open Source Compliance Tips for DevOps Pipelines

    There are several practices you can implement to ensure that your pipelines and products are in compliance when it comes to open source. These practices are especially important to integrate throughout your pipeline to help identify and correct any issues that may exist before products are pushed to production. Below are some practices to get started with.

    Create an Open Source Review Board (OSRB)

    An OSRB is a group responsible for creating and enforcing open source policies and procedures within your organization. These boards often include members from development, operations, legal and management teams.

    OSRBs can serve as advocates for open source use with executives and stakeholders. They can also serve as a source of information for teams looking to incorporate or contribute to open source projects. These boards can help you ensure that you remain in compliance while deriving the greatest benefit from open source.

    Incorporate Compliance Processes Throughout Development

    Compliance policies should be created and incorporated into all steps of the software development life cycle (SDLC). These policies should outline how components are vetted, by whom, how and when components can be included, and how tracking is done.

    Ideally, compliance processes and policies should be built into your pipeline processes. For example, by returning builds to developers if they include blacklisted licenses. By incorporating compliance, you reduce the chance that it is overlooked and minimize interruptions to productivity. Incorporation also helps you ensure that licensing issues are found sooner rather than later, minimizing the impact if components need to be replaced or removed.

    Create ‘Playbooks’ for Commonly Used Licenses

    While there are many licenses that open source projects can fall under, there are several that are significantly more common than others. For example, MIT or Apache—for these licenses, you can simplify compliance procedures by creating playbooks.

    Playbooks outline the details of licenses, including license grants, obligations, restrictions and patent impacts. When a developer wants to include a component, they can use these playbooks to quickly determine whether that component is eligible for use. While this won’t eliminate all legal questions when it comes to licensing, it can significantly reduce how often you need to confer with legal counsel about inclusions.

    Use Software Composition Analysis (SCA) Tools

    SCA tools can help you identify open source components in your own products and in any tools you adopt. These tools enable you to scan source code to determine what components are inside and create an inventory that you can then use to verify compliance. As a bonus, these tools can also help you identify components with known vulnerabilities, which you can then mitigate.

    SCA is especially helpful when you are newly implementing open source compliance policies. It can provide information on the types of components you are already using and help you ensure that those existing components meet your newly applied standards. Some tools even enable you to set up alerts for license conflicts or irregular version use, making verification easier.

    Conclusion

    Open source compliance is a critical component of most DevOps implementations. To ensure compliance, teams need to carefully choose and then properly keep track of open source components. You can do that by creating an open source review board (OSRB), which can help enforce open source compliance policies. You should also incorporate compliance throughout your pipeline, create playbooks for commonly used licenses and leverage SCA tools.

  • Low-Code the ‘Connective Tissue’ of Transformation

    Low-Code the ‘Connective Tissue’ of Transformation

    Low-code is helping enterprises bridge siloed data, systems and workers for faster digital transformation

    Enterprises today are racing to digitally transform their business-technology systems. Those enterprises that create the most satisfying digital customer experiences and successfully streamline internal processes in their back offices will be rewarded with not only increased sales but a more agile technology architecture that will adapt more readily to changing business demands.

    An increasingly important aspect of successful digital transformation is making it possible for non-programmers to develop some of the digital functionality they need on their own with low-code and so-called “no-code” development capabilities.

    Low-code vendors are increasingly improving their wares, such as OutSystems’ recent announcement to use artificial intelligence to help accelerate low-code development. As Mike Vizard reported, OutSystems released its “AI Assist,” enabling IT teams to better visualize complex application architectures. Earlier this month, Airtable announced it raised an additional $185 million to invest in its low-code platform. In contrast, Microsoft announced new Microsoft Power Platform capabilities, such as the ability to build custom apps, automate Microsoft Teams workflows and AI bots.

    The low-code push is driven by the demands for professional developers to be able to do more, as well as creating an ability for non-programmers to build apps and software functionality they need. The typical enterprise has weeks, if not months, of application development backlog.

    Earlier this year, a survey commissioned by intelligent automation vendor Kofax, “The Kofax 2020 Intelligent Automation Benchmark Study,” found that low-code platforms should improve efficiency across an organization. The survey of 450 automation and AI decision-makers worldwide found respondents believe that a low-ode platform must result in reduced workloads (67%) and improve efficiency (70%). Respondents said such benefits are made possible when low-code platforms provide strong integrations with current technology (74%) and are easy to learn (73%) and use (71%).

    The Kofax survey respondents believe an intuitive automation platform that is capable of accommodating IT and business line managers and citizen developers provides for increased employee productivity (52%), improved customer experience (49%) and improved operational efficiency (45%).

    In the effort to digitally transform themselves, such low-code outcomes would be welcome. According to the Kofax report, while firms often automate the digitization of information (58%) and front desk interaction (52%), these efforts don’t provide the amount of value that they should because they are siloed. The survey found that this results in technical debt (46%) and delays (35%), and limits scale (34%).

    Ideally, the right low-code platform can help professional and non-professional developers knock down such siloes and more readily succeed at their digital transformation efforts. That is critical, since the dramatic rush to digitize since the novel coronavirus pandemic.

    Chris Huff, chief strategy officer at Kofax, said while the novel coronavirus pandemic has accelerated enterprises’ move to digitize their business, the pandemic’s business impact has also increased the complexity of workforce collaboration. Organizations, he said, must effectively federate their operations to effectively manage that complexity and automate at scale.

    That means CIOs and line-of-business executives must work together to connect currently siloed data, systems and workers throughout the enterprise. And the enterprise can maximize value, Huff said, when citizen developers focus on increasing automation and building solutions to business problems and effectively managing and maintaining digital workflows. In this way, he noted, low-code intelligent automation is the “connective tissue” that enables geographically dispersed teams to work successfully.

  • Survey Surfaces Impact of COVID-19 on DevOps Teams

    Survey Surfaces Impact of COVID-19 on DevOps Teams

    A survey of 500 IT and engineering professionals across software and finance industries published today by Harness, a provider of continuous integration/continuous delivery (CI/CD) platform, suggests there is significant room to improve application development processes now that most DevOps teams are working from home due to the COVID-19 pandemic.

    The survey finds only 43% of developers said development velocity has increased since COVID-19, while just over half (52%) said they are happier in their roles since the pandemic began. Ravi Lachhman, a developer evangelist for Harness, said as velocity increases so does the need to automate DevOps processes across a distributed application development team. The level of automation achieved, in turn, has a direct impact on developer satisfaction.

    Despite any productivity concerns, however, nearly three-fourths of developers (74%) said their organization plans to keep a remote or distributed workforce following the pandemic. That compares to only 2% who said their teams were fully remote prior to the pandemic.

    On the plus side, developers are overwhelmingly satisfied (94%) with their employer’s investment in employee growth and development, and two-thirds (66%) said they value their companies even more than they did before the crisis. However, only a little more than half, (52%) said it was unlikely they would change jobs within the next year. Among developers who make less than $75,000, 54% said they are at least somewhat likely to change jobs, compared to 46% of those making more than that.

    Compensation was the most-cited priority for switching jobs. Over a third (35%) said that if they were to look for a new employer, their top priority would be better pay. That compares to 27% who would prioritize more opportunities for career and professional growth and 20% who would switch for the ability to work remotely. Another 13% would leave for better benefits, while 5% cited shorter hours.

    Almost two-thirds (60%) anticipated that further salary cuts or layoffs for their development teams are at least somewhat likely. So far, 28% of developers reported there have been layoffs at their organizations, with 22% saying those layoffs included members of their teams. Only 29% of developers said they have seen an increase in developer onboarding since the pandemic began, compared to 42% who saw a decrease. Another 29% saw no change.

    Nearly two-thirds of respondents who earn $150,000 or more are happier in their roles since COVID-19 began (64%), while 44% of those who make $75,000 or less are happier.

    Among developers over the age of 55, almost three-quarters (70%) said they are either less happy or their happiness has not changed. Interestingly, that compared with 43% of millennials. The report also noted both men and women feel they are compensated fairly, at 81% and 82%, respectively.

    The so-called “new normal” that DevOps teams are adjusting to is clearly taking a toll. For the most part, the transition to working from home full-time has not been as disruptive as many initially feared. However, it’s also clear many organizations will need to revisit how their DevOps workflows are constructed to accommodate the fact that most DevOps teams won’t be returning to an office anytime soon.

  • Balancing UX and Privacy With IoT

    Balancing UX and Privacy With IoT

    As more IoT devices track data to improve customer UX, privacy concerns are becoming more prevalent. How can developers strike a balance?

    The internet of things, or IoT, is a system that has changed the way we perceive technology. While it has made the usage of technology easier than ever, it does come with its own set of problems. Being such an interconnected network, IoT’s main threat is its ability to pose myriad security and privacy problems.

    In this article, we seek to discuss how and why privacy is becoming a rising challenge in the world of IoT. By understanding how our privacy and security will be affected, we can take the right measures to reduce our vulnerability to these threats and secure our lives.

    How Interconnected Are Devices?

    IoT devices come with several technical capabilities, most of which have been researched and optimized only to the extent of their functionality. Today, IoT connectivity is available in a growing number of devices and equipment. Smartphones can connect to the internet and several household appliances, which also allows people to control these items remotely. Transportation departments have begun to hash out more advanced vehicle-to-vehicle communication, focusing on improving driver and passenger safety on the road. SmartGrid interconnected technologies allow electricity providers, managers and users to monitor and control electricity use in homes, offices and places of business. Today, several people are also making rampant use of SmartHome technologies to control appliances and home security systems and use fitness trackers to control their movement as monitor their eating and sleeping habits. These trackers are connected to their smartphones for better data aggregation.

    All of these connected devices pose a question: With so much data collection and data tracking being carried out by these devices, aren’t we compromising on our privacy and security?

    How IoT Affects Privacy

    When we consider the compromised privacy of individuals, we are talking about each individual’s loss of control over personal information. When people invest in these interconnected devices, they are not entirely aware of how much of their personal information is tracked and saved by the manufacturer in a bid to improve user experience.

    An individual can lose control if someone hacks into their smartphone or computer and remotely operates other devices. There’s no doubt that our smartphones carry a majority of our information. They are linked to our bank accounts, email accounts and even systems that need authorization. In fact, experts predict that there would be about 31 billion connected IoT devices by the year 2021. Usually, hackers employ methods that are undetected, so more connections would mean an increase in hacking activities as well.

    The data collected from an individual’s smartphone or laptop can give hackers a detailed look into their activities, including internet searches and purchasing power. The information is typically used to work on user experience, but also can be used to target particular products to the individual. Sometimes, this data is even sold to other organizations that are looking for a target audience to sell their products.

    Rising Challenge of Protecting Data

    Data is constantly being stored, transmitted and processed by different companies with the help of IoT devices. With more entry points to access data in the form of smart TVs, speakers, lighting systems, printers and more, your data is more vulnerable than ever.

    IoT vendors, therefore, should have dedicated compliance and privacy rules that alter and anonymize personal data before it is stored. The aim is to prevent the data from being able to identify an individual. Cached data and data that is no longer needed should be disposed of in a secure and organized manner.

    Stored data also must meet compliance with legal and regulatory mandates. This must extend to mobile devices, web presence, cloud applications and any other means by which the data from IoT devices are accessed and managed.

    Affordability of Protecting Data

    Yet another concern among IoT developers is the ability to provide enough security for their services. Limited budgets and manpower constraints can prove difficult for establishments to heed to privacy and security concerns. The reason so many loopholes exist is due to the fact that so many manufacturers focus solely on getting the app out into the market to attract funding without considering the damage that could follow.

    With more and more people concerned with their data privacy, organizations must implement more security checks to avoid ruining their brand authority and trustworthiness due to a data breach.

    Conclusion

    Users today are more connected than ever, which means privacy and security concerns must be top of mind for developers. Manufacturers may argue that data collection is essential to the development of their products and the IoT market in the long run, but there must be more focus on the security of the data and personal privacy concerns. Data collection should be done in a monitored manner, with compliance to regulations from the onset. A recent survey noted that 92% of global consumers want more control over how their information is collected. The same number of people also want to enforce punishments for corporates that violate their privacy. IoT developers, therefore, must strive to find a happy medium that balances security and privacy with user experience.

  • DevOps Was Supposed to Kill Developer Jobs. Here’s Why it Didn’t

    DevOps Was Supposed to Kill Developer Jobs. Here’s Why it Didn’t

    The rise of DevOps is more an evolution than a revolution, and developer jobs aren’t going anywhere

    Development died a long time ago and was replaced by DevOps. Or, at least that was the way it was supposed to happen.

    In reality, developers are doing just fine. There are currently almost 150,000 development jobs right now on one major job site, compared with only about 16,000 positions for DevOps. It seems that the revolution in which developers would be replaced with DevOps engineers never actually happened.

    In fact, and as we’ve previously argued, many people find that having DevOps on their job title actually harms them when it comes to finding the right job. In this article, we’ll look at why.

    The Death of the Developer

    The “death” of the developer has been prophesied for quite some time now. Ever since the creation of the concept of DevOps, in fact. The most vocal and prominent instance of this argument was offered by programmer Jeff Knupp back in 2014, who used a blog post to argue that the popularity of DevOps meant that programmers were increasingly unable to focus on what they do best: writing code.

    Instead, argued Knupp, the tyranny of DevOps was forcing coders to become generalists rather than specialists. They were being forced, he said, to include on their CVs an ever-growing number of “skill sets,” some of which were pretty tangential to their core role within an organization. Instead of traditional developers, it was feared, an army of “DevOps engineers” would rise who could just about do a wide range of tasks, but do none of them very well.

    In the interests of balance, it’s worth pointing out that Knupp—and many who have repeated his argument—have a vested interest in “defending” traditional coders against the rise of DevOps. It might be true that a thorough knowledge of GDPR compliance processes is not technically necessary for a developer, but some of the skills the DevOps highlighted—not least backend security—are best addressed at the development stage. Developers, in other words, shouldn’t be given a free pass when it comes to thinking about the way in which their creations are actually used.

    Adapt and Survive

    Nonetheless, the popularity of the concept of DevOps has forced many developers to adapt their skill sets, or at least the way they present them. Concepts such as CI/CD, segmentation of internal communication, automation and “continuous everything” have become central to the way many developers work and are highly sought after. We have DevOps to thank for that.

    In addition, the rise of DevOps has made room for an ever-expanding set of novel approaches. Five years ago, it seemed that a new approach to IT management was being developed once a month. First came DevOps, then DevSecOps, then QAOps. This explosion of new approaches does seem to be calming down, but they remain influential on at least two levels.

    The first is that, although none of these approaches (and arguably even DevOps, as we’ll see below) have developed into distinct disciplines, they have subtly redefined the way in which developers are understood by the average organization. The second is that, in this context, many developers have begun to stress that they have cross-cutting expertise. In other words, they have had to adapt the way in which they present themselves to survive.

    The Death of DevOps

    Because of this, we should see the rise of DevOps more as an evolution than a revolution.

    At the broadest level, DevOps has had a hugely beneficial effect on the process of software development. There is an expectation that developers will have at least a passing acquaintance with the systems and processes that IT teams use. This was not always the case in the past. Developers today have to know how things such as cloud IAM frameworks or APM platforms work, and why they are important for deploying and managing the applications that developers write.

    In this context, it seems strange that some coders ever worried that their job would be replaced. While it’s true that developers are now expected to have much broader skills than they did 10 years ago, organizations still need people who can actually code, and will do for decades yet (until we are all replaced with AI, that is).

    It seems that some of us were too eager to see a dramatic revolution, whereas the reality has been more subtle and much slower. And indeed, in many cases the “transition” to DevOps has been almost invisible: new graduates are now trained in the basic principles of DevOps, without this ever having become a discrete college course.

    Many of these new graduates, in fact, would be hard-pressed to define what DevOps actually is. But that’s not because it’s gone away; quite the opposite. It is now such a fundamental part of the way that most of us do our jobs that it is losing its identity as a separate idea. This means, eventually, that it will not be “development” that dies, but “DevOps” as a distinct addition to it.

    The Future

    In short, DevOps has not killed the developer, and there is no evidence that it ever will. Some of us, it seems, were being a little dramatic. On the other hand, DevOps has had huge effects on the way that developers work, because it points to the skills that the best developers have. For that reason, there remain tens of thousands of jobs for developers in the conventional sense.

    In short, developers work alongside DevOps engineers; they don’t compete with them for the same roles. So instead of seeing ourselves in competition, let’s try a little collaboration.

  • Code Quality Doesn’t Have to Be Like the Weather

    Code Quality Doesn’t Have to Be Like the Weather

    Sometimes code quality feels like the weather: everyone talks about it, but no one ever does anything. Of course, that’s not from a lack of good will; most folks would love to have a week or two set aside to just clean things up. Unfortunately, that’s not how the world works. The best course of action is to sneak in a little clean up here, and a little there as part of normal work. Fortunately, that’s actually the best way to go about it. At SonarSource, we call it the Clean as You Code methodology, and we’ve found that this behavioral approach to code quality is as important as the tools developers use to track it. 

    The idea behind Clean as You Code is to ignore the quality of old code and focus exclusively on the quality of new changes. This may sound radical, but bear with me. Why focus exclusively on today’s changes? Because dredging up legacy code for the sole purpose of addressing code quality likely requires layers of approvals and perhaps business testing that may be difficult to get. But developers have absolute control over the quality of the code they’re writing now, and they’ll take pride in setting and enforcing high standards for that code. Focusing exclusively on the quality of new code works in both legacy and greenfield projects, and for all quality axes. 

    Let’s take test coverage as an example. Many developers are on projects that have lower test coverage than they would like. But stealing an hour here and there to add tests for random methods is generally a frustrating and ultimately futile endeavor. Instead, start with today’s changes. Make sure they’re fully covered and don’t release until they are. That’s it, that’s all that’s required. Covering those one or two methods — or even one or two lines — may feel like a drop in the bucket, but over time it will have a real impact. In fact, that’s been exactly our experience.

    Since the early days of my company’s flagship product, we’ve had an internal standard of 80% unit test coverage. And yet in those early days, we routinely released with coverage in the ’60s. There was always the intent to write unit tests, but inevitably it was left to just before release. And then it became a scramble to find the biggest uncovered files and slog through their unfamiliar code to write tests. Among the problems with this approach was the fact that the developer who wrote the code often wasn’t the one who wrote its tests, and thus could never be quite sure of testing the right behavior. And of course, no one likes cleaning up after someone else.

    In the end, it was a painful and ultimately ineffective routine; coverage didn’t break 80% until July 2014 — approximately seven years after the project started, and about a year and a half after we first formulated and adopted Clean as You code. You can see the October 2012 inflection point in this graph of project coverage (yes, the first few years of data are missing; victim of an early structural refactoring):

    On November 9, 2011 test coverage was at 66.9%. After rising to 70.3% on July 23, 2012 it fell to 69.3% by that October. From that October 2012 inflection point, it climbed steadily for more than three years, crossing the 80% threshold in July 2014. Coverage today is at 86.2%, comfortably above the 80% goal.

    Today, we’re at 86% coverage and rising. The formula for getting there was simple: 

    • Set standards on the quality of New Code. Here “new” means anything added or updated in the New Code period.
    • Define the New Code period. This is the scope of concern, i.e., how far back to go for the purposes of applying your New Code standards. We set it to since the last release. 
    • Don’t release unless your standards are met.

    Of course, the first two steps are a lot easier than the last one, especially if meeting the standards is left to just before release. Every developer has likely felt pressure to push business changes into production sooner rather than later. That’s why this strategy is most effective when it’s applied as granularly as possible. Meeting the standards before release is the bare minimum, but it should also be a non-event.

    We’ve found Clean as You Code to be most effective when applied:

    • At the individual level — Good developers want to write good code. When developers take personal responsibility for the code they write today, it saves time in the long run and no one has to clean up after anyone else.
    • At the pull request — If each individual PR meets your standards, sub-standard code will never be merged. That means no one will ever be pressed by management to release sub-standard code, because it simply won’t exist in the main code base.

    But what about the crufty old code that exists in every project? You’re probably thinking that it doesn’t just magically disappear. But actually — gradually — it does. The graph above is the graph of overall code coverage on the project. By focusing on the coverage of New Code, we organically and automatically raised coverage on all code. This is not a one-off; your results will be the same. Over the course of a few years, normal change requests will lead you throughout the code base. Make sure the code you write for those changes is clean, and the rest will take care of itself.

  • 5 Ways Traceability Is Changing to Bolster the Remote Workforce

    5 Ways Traceability Is Changing to Bolster the Remote Workforce

    Traceability has always been a useful tool in the development process, but it has become especially important since the COVID-19 outbreak and the increased remote workforce. 

    Where developers and engineers were once working side-by-side, with the ability to discuss their process and keep their team informed, they are now navigating a remote collaboration landscape. According to a 2017 study done by Stack Overflow, there is a correlation for developers between remote work and job satisfaction, and the highest job satisfaction ratings are seen from developers who work remote full time. As technology has grown to make this process easier, remote working is expected to become a norm. 

    Advanced traceability has the potential to hold teams together by allowing increased visibility into each move throughout an entire project. Without traceability, it would be nearly impossible to keep remote teams aligned and on schedule.

    Product development tools have continuously been forced to evolve to keep up with the multi-dimensional nature of requirement, test and risk management. For these processes to be successful, all related variables must work together continuously, at scale, and across teams. 

    We’ve only just started to see how traceability tools can use updated capabilities to streamline the product development process, but we know enough to discuss two things: what’s happening now and what the future may hold.

    Traditionally, traceability could be compared to a map. While not limited to a single view, maps exist to help you navigate your way to a destination. Similarly, traceability leads product developers through every step of their processes, eventually helping them reach their goal. If your map was constantly changing you’d never be able to figure out where you were going, but what if people ahead of you could update it as they went along? This would keep you in the loop of the upcoming twists and turns, and no one would feel blindsided. Traceability makes it easy to share similar production changes with your entire team, all at once.

    In the traceability process, links are built automatically which lets major decision points, reviews and approvals be captured in final documents and reports. This allows for faster and more informed decision making and these live references can exist across versions. 

    With the switch to remote work across the globe, and no immediate end in sight, developers don’t have the option of working side-by-side with their colleagues. Because of this, it is pertinent that they are able to streamline their work in every way possible, and increased traceability is expected to be a pillar of that transition. 

    At the end of the day, connecting the dots is all about making sense of everyone’s decisions. Why did they follow that process, and what factors led them to make the choices they made? 

    In the early days of traceability there wasn’t always room to include every piece of information that you might find relevant down the line. Legacy tools such as the act of manual reporting through Word documents left much to be desired. Today, that’s becoming less of an issue, as developers are allowed more meaningful accountability and insight into interconnections as they happen.

    As we look ahead, we can expect to see these capabilities grow in five different ways.

    Less Manual Effort

    Updating your traceability reports with as little manual effort as possible will be essential to a streamlined, remote workforce. As traceability becomes more advanced, the work to create and maintain it should not become more difficult. 

    More Nuance Captured, Related and Parsed for Meaning

    Improvements in software will make data gathering more precise, and increase the number of items a team can consider relevant, traceable information. This will take additional workloads off of the developers as more items are automatically traced and easily accessible.

    More Attributes Can Define and Predict a Project’s Success 

    If you have a more data-rich, detailed record of activities, it is possible to understand the past with more context and less reliance on costly manual documentation or memory. 

    Dispersed Systems Holding Relevant Information Will Start to Feel Closer and More Interconnected

    Through more dense integration and aligned processes, systems feel more controlled and connected, giving users a more seamless experience.

    Expansion of Communication and Review Capabilities for Stakeholders Who May Be Impacted by Changes

    The availability of a full audit trail of participation will make a big difference in the ease of the review process. The ability to easily see who is impacted by changes will allow teams to proactively manage the effects of said changes.

    In response to the COVID-19 pandemic, and the number of companies who are maintaining their remote work policies, we can expect to see more innovations related to product development workflows. These innovations will enable easier remote collaboration between colleagues and across teams, overall streamlining the product development process.

  • The Secret to Winning at DevOps: Are You Up for the Challenge?

    The Secret to Winning at DevOps: Are You Up for the Challenge?

    The main idea behind DevOps is to enable companies to keep up with the increased software velocity and advancements in agile culture for a smoother end-to-end software delivery cycle.

    The main goal of DevOps is to accomplish integration and automation, which is why implementing this philosophy can be challenging. Not only do you need to replace older methods and practices, but you’ll also have to change the mindset of the developers and the operations team to ensure they work in sync.

    Several IT operations teams and software teams have adopted DevOps practices into their work culture for faster evolvement and improved innovations. The pipeline comprises continuous integration, testing, deployment, as well as monitoring application and system performance.

    Introducing new DevOps tools and changing the mindset to prepare teams for the fast-paced world remains crucial for a successful implementation.

    Despite the revolution that this philosophy brings to software development, several enterprises find themselves taking DevOps to an unproductive extreme. To remain productive, one of the aspects that teams need to work on is reducing rework, and the best way to ensure this is automation.

    Understand How DevOps Works

    Under a DevOps model, the development and operations teams are integrated into one to prevent them from getting siloed. This also improves collaboration and productivity.

    You see, it brings alive the possibility of both the teams thinking more alike, working together and sharing responsibilities. This is done by automating code testing and workflows, automating infrastructure and continuously measuring application performance.

    In some models, even the QA and security teams merge with the dev and ops. In cases where security becomes the primary focus, the name gets modified to DevSecOps.

    In essence, the focus of DevOps is on automating processes that were otherwise manual and slow. Teams use a technology stack and tooling that can operate and evolve applications more reliably and swiftly. As engineers will be able to accomplish tasks such as deploying code and provisioning infrastructure faster with reduced issues, teams can reach testing and maintenance stages quicker.

    Balance Between Standardization and Adaptability

    Software products are mostly developed from the customers’ perspective, and if not, from end-user experience. Often, developers work backward to identify customer needs and wants for ascertaining successful innovation.

    One of the biggest challenges when developing a software development life cycle (SDLC) strategy for organizations is to consider dynamic customer needs, strict compliance policies, unpredictable market trends and company goals. To ensure a consistent workflow, DevOps teams need to adopt standardization. In fact, workflows, technologies, processes, protocols and metrics need to be standardized before they can be automated.

    This is also the main reason why organizations adopting DevOps need to strike a balance between standardization and adaptability. One industry that has excelled at this has been the financial industry, which has been leading the charge when it comes to adopting the latest software delivery practices and technologies, including DevOps. Financial executives view DevOps as being a way to improve security and risk and governance strategies. 

    The result is that cloud-based financial services are now automating virtually all of their processes through their software delivering pipelines, which makes tasks such as scanning receipts, sending invoices, tracking expenses or making payments seamless as they sync to your account. This simpler process is beneficial for boosting developer productivity and resource utilization, and for enabling enterprise scale management. If anything automating processes is becoming necessary for achieving higher product quality, compliance and scalability. 

    As mentioned above, new DevOps tools need to be introduced to team members to keep up with the constantly evolving strategies and implementation. But to prevent the creation of silos between teams, mechanisms need to be developed to make the adoption of new technologies easier. 

    Achieving the delicate balance between standardization and automation will help eliminate communication gaps, performance bottlenecks and silos between the different teams.

    Benefits of Automation in the DevOps Landscape

    The following are the advantages of adopting a DevOps philosophy:

    • Code Development. Source control will keep everyone in the loop by managing, tracking and documenting any changes in code. This can be time-saving, and reduce the complexity of software projects.
    • Smoother Testing. Testing is a continuous process in DevOps frameworks that includes system communication, several test integrations, predicting and tracking issues, and integrating approved automated builds. In the absence of automation, executing and managing continuous testing could be a rather tedious job that might cause problems between developers and the operations team.
    • Better Visibility. The main job of the ops teams is to be aware of the code changes, ongoing problems and the impact of a specific code on the end goals. Plus, when they operate in a DevOps environment, they need to keep the developers in the loop as well.
      For example, if a system administrator from the ops team identifies code issues weeks after submission, it puts more pressure on developers. Now, the developers have two jobs: solve the problem in the previous code, and simultaneously work on making progress with the new code. This is what gets time-consuming, which can harm the company’s market standing. To remain ahead in the competition, innovation needs to be frequent and accurate.
      When there is a constant feedback loop between the dev, ops and QA, bottlenecks, and silos are eliminated, productivity is improved and customers are happier due to quicker innovation.
    • Continuous Integration and Delivery. Automation can help deliver appropriate software built, data, code changes and tests to target environments. An example is how web hosts for e-commerce businesses need to be updated frequently for robust deployments. Automated testing will help ensure that code is delivered properly and doesn’t introduce new bugs, thus creating a platform with a superior user experience.
      This, in turn, helps DevOps teams to introduce frequent software changes by deploying error-free codes and continuous testing.
    • Data Processing and Monitoring. The teams also need to measure and monitor the performance of their environment, which can be done by reading and analyzing system logs. But the existence of hundreds or thousands of servers in the environment can make it complicated.
      Automation will allow the teams to make sense of all the data and let them know how an application is performing and whether there are any bottlenecks.

    Getting the Balance Right

    Organizations need to realize that automation involves placing technologies around once-manual processes. The catch here is as the processes will become inherently repeatable, they need to be correct. Otherwise, organizations will only have flawed processes running faster, which will ultimately defeat the purpose of adopting DevOps in the first place.

    Companies need to understand adaptability as well. This can be done by mixing both the old as well as new systems. For this purpose, an inventory of all applications, data stores and development processes for promoting meta development processes that include design, development, testing, deployment, configuration management and so on can be made.

    In the end, the secret to winning DevOps is aligning DevOps tools with your organization’s goals – not following the footsteps of other organizations.

  • CNCF Elevates SPIFFE Spec to Secure App Services

    CNCF Elevates SPIFFE Spec to Secure App Services

    The Technical Oversight Committee (TOC) of the Cloud Native Computing Foundation (CNCF) announced that the open source Secure Production Identity Framework For Everyone (SPIFFE) specification and the SPIFFE Runtime Environment (SPIRE) have become incubation-level hosted projects.

    Andrew Harding, SPIRE maintainer and a principal software engineer at Hewlett Packard Enterprise (HPE), said the elevation of a potential standard to authenticate software services using cryptographic identities that are platform-agnostic could go a long way toward advancing the adoption of best DevSecOps practices.

    At the core of SPIFFE specification are short-lived cryptographic identity documents known as SVIDs that are invoked via an application programming interface (API). Workloads employ an SVID when authenticating to other workloads by establishing a TLS connection or by signing and verifying a JSON web token (JWT).

    Previously a sandbox level project, the SPIFFE specification is designed to reduce reliance on hard-coded secrets to authenticate application services, Harding said. Instead, developers will be able to more easily invoke multi-factor authentication to issue and verify identities for any type of application service. Each service is given its own identity, he noted.

    Amazon, Bloomberg, Google, HPE, Pinterest, Square, TransferWise and Uber are all contributors to SPIFFE. Since joining the CNCF last year contributors to SPIRE have added support for Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, Kubernetes and bare-metal servers.

    SPIFFE and SPIRE are designed to work across both monolithic and microservices-based applications. The latter are not likely to completely replace the former anytime soon, so IT organizations need a consistent approach to authentication regardless of how an application is built, noted Harding. SPIFFE and SPIRE together enable an IT organization to implement a zero-trust architecture spanning multiple applications, he said.

    Ultimately, Harding said the goal is to enable better application security without compromising flexibility. As an added benefit, SPIFFE and SPIRE don’t require developers to share application secrets to enable interoperability between services running on different platforms. That’s because SPIRE doesn’t generate SPIFFE identities that can be used to authenticate to other systems nor does it store existing keys such as a database password on behalf of a workload. Each SVID generated is unique to the service use case.

    As the number of services and platforms being employed continues to increase, it’s not practical to continue to rely on approaches to authentication that rely on hard coding. The level of dependency that exists between services requires a more frictionless approach to authentication.

    It may be a very long time before reliance on tokens such as passwords disappear. However, it’s clear specifications such as SPIFFE, in the long run, will transform application security. The challenge now is not only getting developers to appreciate a new approach but also convincing skeptical cybersecurity teams that long have relied on some form of hard or soft token to secure applications. Given the number of times those tokens are misplaced or lost, there are more than a few IT help desk professionals wishing tokens would become obsolete sooner than later.