Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Engineer jobs are being cut, cloud infrastructure is using too much energy, and Intel’s 802.11be silicon is alive. (more…)
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Herbert Diess is out at VW because software is hard (yo), fiber optic cable is hard to find, and the guy who said LaMDA was sentient is dumped by Google. (more…)
BMC this week announced it has added support for DevOps Research and Assessment (DORA) metrics within its portfolio of DevOps tools for mainframe environments.
John McKenny, senior vice president and general manager for intelligent Z optimization and transformation at BMC, said the latest edition of BMC Compuware zAdviser now includes a DORA KPI Dashboard that aligns with the widely-adopted framework for measuring DevOps efficiency defined by an arm of Google.
The DORA metrics track deployment frequency, failure rate, lead time for changes and mean-time-to-recovery (MTTR). Tracking those metrics is crucial for IT teams that have mainframes because they need to make sure applications continue to be deployed on the platform versus being usurped by another platform that is perceived to provide a faster alternative for builds and deployment, noted McKenny.
BMC also added support for automated webhook notifications to its BMC Compuware Abend-AID offering. That includes diagnostic and root cause analysis to resolve defects in test and production faster. In addition, BMC provides a connector to the machine-identity management platform created by Venafi. That integration promises to eliminate certificate-related outages that can derail an application development initiative.
In general, DORA metrics are being used to identify areas where DevOps teams can improve. It is up to each organization to determine to what degree those metrics will be used to coach teams versus enforce productivity mandates. However, given the overall shortage of available DevOps talent, few organizations are employing metrics to force DevOps teams to improve. In fact, there is no universal set of DevOps goals that every organization is trying to achieve. Rather, most organizations are trying to determine what set of DevOps best practices makes the most sense to implement given their own goals and internal culture. In the case of the mainframe, most organizations start with a few projects before they begin to employ DevOps more widely, noted McKenny.
The metrics defined by DORA framework are, of course, only a subset of the total metrics that DevOps teams should track. BMC, for example, makes it possible to track tools usage to provide DevOps teams with insights into what tools may no longer be relevant or required, noted McKenny.
Mainframe environments also have a long history of using waterfall-based approaches to building and deploying applications that many of them will continue to use alongside DevOps practices, depending on the type of application being built and deployed. In other instances, distributed applications built using DevOps practices are being integrated with mainframe applications that now need to be updated using the same workflow. The mainframe is no longer a platform that is managed in complete isolation from distributed computing environments.
The major challenge is that many organizations using mainframes often overestimate how difficult it is to adopt DevOps best practices, McKenny said. Regardless of the platform, there is no doubt the overall rate at which all applications are being built and deployed will continue to increase. The mainframe is proving to be no exception to that rule.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: Warren Buffett asks too much for wind energy, it’s “completely ridiculous” to say Google’s chatbot LaMDA is sentient, and Microsoft finally kills Internet Explorer. (more…)
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: The first silicon for Wi-Fi 7, Google’s search quality “is” failing, and what Severance tells us about The Great Resignation. (more…)
Google today revealed it has been working with GitHub to create a forgery-proof method for signing source code as part of an ongoing effort to better secure software supply chains.
Bob Callaway, technology lead for open source software supply chain security at Google, said a prototype of this method, written in the Go programming language, generates non-forgeable provenance using GitHub Actions workflows for isolation and code signing tools for authenticity provided by Sigstore. Projects that make use of GitHub runners to run jobs can now achieve the third level of security as defined by the supply chain levels for software artifacts (SLSA) framework to assure software artifacts are authentic and trustworthy, he said.
The reusable workflow also protects against possible interference from maintainers who could otherwise try to define the workflow in a way that interferes with the builder. The only way to interact with a reusable workflow is through the input parameters it exposes to the calling workflow, which prevents maintainers from altering information via variables, steps, services and defaults.
The goal is not only to ensure the provenance of individual software artifacts but also make it possible to identify which build system was employed to create that artifact, said Callaway. In addition to working with GitHub, Callaway added that Google expects to apply this method to securing other build systems that organizations used to construct applications.
Overall, Callaway said, Google is also working toward embedding security functions with DevOps platforms to ensure the integrity of software supply chains, in addition to educating developers on how to build more secure software.
To protect against the possibility of one job tampering with artifacts used by another job, Google’s method creates a trusted channel. Job outputs send hashes that are then used to verify the binary received via the untrusted artifact registry. The OpenID Connect (OIDC) protocol, which GitHub just opted to support, is then used to prove the identity of the workflow to an external service, such as Sigstore, by attaching a unique JSON web token (JWT) to each runner. The token contains verifiable information about workflow identity such as the caller repository, commit hash, trigger and the current workflow path and reference.
That makes it possible for the workflow to prove its identity to the Fulcio root certificate authority provided by Sigstore. Fulcio signs a short-lived certificate attesting to an ephemeral signing key generated in the runner. A record of that signing is kept in Sigstore’s transparency log Rekor. Users can then rely on the signing certificates to verify provenance in a way that is authenticated and non-forgeable. That approach means maintainers don’t need to manage or distribute cryptographic keys for signing, which until now have made it challenging to manage code signing at scale, Callaway noted.
In the wake of a series of high-profile security breaches involving open source software, Google and others have significantly increased the resources being applied to securing both open source and proprietary software within the context of a set of DevSecOps best practices. It may be a while before the benefits of that effort are pervasively employed by developers, but it’s clear that substantial progress is being made involving everything from the tools developers use to the build systems managed by DevOps teams.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: No remedy for banned Facebook users, new ARM-based VMs on Microsoft Azure, and The Great Resignation will still be a Thing for the foreseeable. (more…)
Thomas Kurian became the CEO of Google Cloud Platform (GCP) with a modest mandate: Turn Google Cloud into an enterprise cloud platform behemoth. Easy, right? By 2019 “Google” was already a verb because of its search engine dominance and the company’s revenue was north of $136.8 billion. So, why have I been closely tracking Google Cloud’s progress on winning enterprise cloud business? Let’s back up.
When Kurian left Oracle and joined Google, the company was an extremely successful advertising company. At the time, over 85% of Google’s revenue came from advertising. The search engine, email service and lightweight office productivity apps all served the ultimate goal of keeping eyeballs on Google sites so that users could be served more advertisements and increasingly more personalized ads based on a user’s Google interactions.
Google clearly has the scale, tools and technical expertise to provide businesses with what they need from a cloud vendor. When Kurian left Oracle, he was one of the highest-paid technology executives in the world (according to Oracle, his 2017 compensation package was around $36 million). So why would Google hire Thomas Kurian? Because enterprises require their technology and services partners to have more than just great tech. When advising enterprise clients, the following are the top three topics that come up when discussing the selection of a cloud vendor:
Thomas Kurian is well aware of the need to play well with other cloud providers and enterprise cloud providers. In fact, the widely held belief is that Kurian left Oracle because he and Oracle CEO, Larry Ellison disagreed on Oracle’s multi-cloud strategy—Kurian wanted Oracle’s packaged applications to be available on other vendors’ cloud platforms.
It’s clear that Google Cloud is focused on the enterprise. Google has no shortage of DevOps, data, machine learning and artificial intelligence tools to satisfy developers and data scientists. However, what Google needs are more features that enterprises expect from a cloud partner.
Google Cloud isn’t new to cybersecurity—the company has been securing its own cloud since its foundation. In addition, the company has been gaining enterprise traction with Google Workspace and Gmail and the security around these SaaS offerings is paramount.
By acquiring Mandiant, Google Cloud can more closely partner with cloud customers throughout the entire life cycle: From code creation (through a combination of Google’s existing Google Chronicle tools) through testing, threat detection and advisory work around incident response.
The debate around security and the cloud isn’t even close to being resolved. Many will tell you that cloud vendors invest millions upon millions of dollars more than any other company in the cloud. It’s imperative that cloud vendors don’t experience infrastructure or SaaS security breaches. However, security continues to be a roadblock for cloud adoption—and, most importantly, enterprise cloud adoption. While every enterprise is doing some work in the cloud, many are still reluctant to move critical workloads (especially their sensitive data) to the cloud.
Google Cloud should use Mandiant as the bedrock on which its enterprise cloud security business is built. Rather than having piecemeal parts and partners, businesses want their cloud providers to have opinionated frameworks and best practices. Mandiant has some of the best security minds in the industry and can help Google Cloud customers create secure instances. I expect Google Cloud to provide ready-to-provision cloud environments tailored for specific regulated industries by leveraging Mandiant’s expertise. Of course, customers aren’t going to want to necessarily adopt everything that Google Cloud suggests, and customers should be able to swap out components. However, many businesses are already overwhelmed with the number of cloud partners they have to engage with to create a secure cloud environment.
I expect AWS and Microsoft Azure will focus their attention on building out enterprise-focused security offerings. I recently wrote about why it made sense for Microsoft to purchase Mandiant. My general feeling was that Microsoft had many security offerings—ranging from simple consumer-grade virus scanning to enterprise offerings—but that the company lacked a cohesive enterprise security strategy. I still believe Microsoft needs to clearly define its enterprise security assets (and more coherently group them together) either through a reorganization and/or an acquisition. Like Microsoft, AWS has hundreds if not thousands of security offerings and partners. Although AWS is the cloud leader, the company is well behind Microsoft and Google in defining its cloud security strategy. The company needs to outline its enterprise cloud strategy, and cybersecurity needs to be one of the linchpins of that enterprise strategy.
Welcome to The Long View—where we peruse the news of the week and strip it to the essentials. Let’s work out what really matters.
This week: The return of the CEO who fired 900 staff on a Zoom call, Capitol Hill has a bill to kill ads, and a last-minute hiccup in the FAA/FCC 5G truce.
First up this week: Better.com, the DevOps-led mortgage lender, has its old CEO back. You probably remember Vishal Garg—he was the character who laid off 9% of his company on an open Zoom call.
Mr. Garg is being asked to help build “a respectful workplace.” But the famously combative CEO recently called investors “sewage,” threatened remaining employees with a “bloodbath,” and allegedly told a former business partner he would “burn him alive.”
Riley de León: Better founder Vishal Garg … returns as CEO
The move comes less than two months after Garg came under fire for laying off roughly 900 employees, or 9% of its workforce, via Zoom and subsequently stepped back at the request of Better’s board of directors. … According to an internal memo: … “CEO Vishal Garg has been taking a break from his full-time duties to reflect on his leadership, reconnect with the values that make Better great and work closely with an executive coach. … We are confident in Vishal and in the changes he is committed to making to provide the type of leadership, focus and vision that Better needs.”
…
The memo also reveals that board members Raj Date and Dinesh Chopra have resigned, though “not because of any disagreement with Better.” … Garg [had] cited market efficiency, performance and productivity as the reason behind the firings. [He later] accused the employees of “stealing” from their colleagues and customers by being unproductive and only working two hours a day.
…
In May, Better announced that it would go public. … Since then, multiple outlets have reported that Better has delayed its listing plans amid ongoing scrutiny.
With a reminder, here’s Emma Goldberg:
“If you’re on this call you are part of the unlucky group that is being laid off,” Mr. Garg told his workers [via Zoom]. “Your employment here is terminated effective immediately.”
…
Better.com has since conducted a “thorough, independent” review of its culture [and is] recruiting a new chairman for the board, a president and a chief human resources officer. … Some of the additional measures … include a training program on building “a respectful workplace” and a new ethics and compliance committee, reporting directly to the board.
Don’t hold back—tell us how you really feel, @PCSAemilianus:
What an utter pile of bull**** from this guy. He knew damn well what he was doing and didn’t care. You don’t “reflect” on that.
Dems want to ban targeted ads. A new bill would outlaw the sort of adtech that Google and Meta/Facebook have turned into an art form. It would also put the kibosh on data brokers’ business models.
This will be an uphill battle. But it’s one that’s worth fighting: Surveillance capitalism has gotten normalized, but if consumers fully understood the extent of the privacy invasion, they’d rise up with flaming pitchforks in hand.
Taylor Hatmaker: New privacy bill would put major limits on targeted advertising
The Banning Surveillance Advertising Act, introduced by Reps. Anna Eshoo (D-CA) and Jan Schakowsky (D-IL) in the House and Cory Booker (D-NJ) in the Senate, would dramatically limit the ways that tech companies serve ads. … Targeting based on “protected class information, such as race, gender, and religion, and personal data purchased from data brokers” would be off-limits.
…
Sen. Booker called the targeted advertising model “predatory and invasive.” … Rep. Eshoo said, “This pernicious practice … fuels disinformation, discrimination, voter suppression, privacy abuses, and so many other harms.”
…
The bill would empower the FTC and state attorneys general to [levy] fines of up to $5,000 per incident for knowing violations.
Trying to scan the bill, it’s Sam Biddle:
A federal ban on surveillance advertising sounds like an extremely radical long shot. But I think the only people who would genuinely oppose it are the relatively small sliver of the population who make their money conducting the surveillance.
…
If it goes anywhere, get ready for a barrage of “this will literally murder small business owners” propaganda from FB/Google/et al. [It] is orders of magnitude more significant than any of the wishy washy We Can Reform Facebook! proposals you’ve seen in recent years, in terms of privacy and countering the power of big tech.
Yay. Go GoTeam:
Exactly! It’s the government’s job to secretly track us, not advertisers!(?)
A couple of weeks ago, I told you the FAA backed down in its opposition to 5G NR band 77. Well, a lot can happen in two weeks. It seems the airlines weren’t happy and demanded extra interference-mitigation from the mobile carriers at the last minute.
The various industries involved—and their regulatory agencies—have had years to sort this out. And it smells very much like the FAA is the one failing in its duty.
Theo Leggett: Mobile firms agree another 5G delay at US airports
The much-hyped expansion of 5G networks in the US has been chaotic, to say the least. The rollout has been delayed twice — and now AT&T and Verizon have bowed to intense pressure, agreeing to defer opening some parts of the network near airports.
…
There was clearly time to come up with a mitigation plan — and other countries have been able to do just that. The question is, why were US regulators, telecoms operators, airlines and airports apparently unable to come up with a workable solution?
The FAA is “incompetent,” says David Von Drehle:
5G — the long-promised next step in cellular technology. … It wasn’t a secret. … Yet it seems to have caught the FAA by surprise. … Various compromises and delays [have been] offered by the wireless industry — all met with last-minute panic-mongering by the FAA.
…
The FAA’s foot-dragging raises a red flag over the agency’s competence. … If a challenge as slow-moving and widely publicized as 5G can catch the FAA unprepared, it’s hard to be hopeful about smooth landings in … other areas … such as keeping up with pandemic health measures, battling unruly travelers and finding the next generation of pilots, flight attendants and air traffic controllers.
Is there any doubt? No, opines @K0LWC:
There is no doubt this is a colossal screw up by the FAA, and less so, the FCC. The 5G rollout and the bands being bid on were not a surprise.
You have been reading The Long View by Richi Jennings. You can contact him at @RiCHi or tlv@richi.uk.
Image: Jan Valečka (via Unsplash)
