devopsy.kinsta.cloud

Tag: mobile applications

  • Bitrise to Invest $3M in DevOps Cloud for Mobile Apps in EU

    Bitrise to Invest $3M in DevOps Cloud for Mobile Apps in EU

    Bitrise, a provider of a DevOps platform for building mobile applications, plans to invest $3 million to create data centers in the European Union (EU) that meet sovereign cloud requirements.

    Company CEO Barnabás Birmacher said Bitrise has spent much of the past year integrating its stack and consolidating the infrastructure it needs to support its platform in the U.S. Now, Bitrise is taking the next step toward ensuring that any data used to build a mobile application doesn’t leave the EU at a time when many organizations are either voluntarily deciding to depend less on IT infrastructure in the U.S. or are being required to use IT infrastructure in a specific geographic region.

    To satisfy those requirements, Bitrise is acquiring the server and storage infrastructure it requires, which is then housed in a data center facility in Amsterdam that is owned by a third-party provider. That approach ensures that at any point necessary those servers and storage systems can be moved to another data center, noted Birmacher.

    Regardless of location, the data centers will be based on the same Apple M4 and Linux-based infrastructure that Bitrise has built a DevOps platform on top of to streamline the building and deployment of mobile applications.

    It’s not clear how fragmented software engineering is about to become as teams are required to ensure that application development projects only access data located in specific regions. Many DevOps teams have been relying on software-as-a-service (SaaS) application platforms that are designed to scale out across multiple geographic regions as additional compute resources have been needed. With the rise of sovereign cloud requirements, however, providers of those platforms need to ensure that any data being accessed never leaves a specific region.

    That issue can be especially challenging for organizations that may have relied on highly distributed teams of developers that may reside in multiple countries.

    In fact, one of the reasons more organizations are relying on the managed DevOps services that Bitrise provides is to help minimize that complexity, said Birmacher.

    As the pace of mobile application development continues to accelerate, more organizations are looking to rely on managed DevOps services, added Birmacher. They simply can’t afford to not only only build a DevOps platform, but also maintain, update and secure it, he noted. That’s especially the case when it comes to building mobile applications simply because there isn’t a lot of forgiveness when it comes to, for example, having to rollback an application once it’s been made available in an app store, so ensuring that every test has been properly conducted is crucial, said Birmacher.

    Regardless of who actually manages a DevOps environment, the need to continuously update mobile applications created additional challenges. End users expect that new features and capabilities will be added at a regular cadence. The number of organizations that can afford to invest in their own DevOps environment, as a percentage of those building mobile applications, remains comparatively small. So for the bulk of them, the only way to ensure best software engineering practices are being consistently followed is, after all, to rely on a service.

  • Tricentis Adds Device Cloud Service to Scale Mobile App Testing

    Tricentis Adds Device Cloud Service to Scale Mobile App Testing

    Tricentis has extended its cloud service for testing applications to include the ability to emulate multiple classes of mobile computing devices.

    Mav Turner, CTO for DevOps at Tricentis, said the Tricentis Device Cloud (TDC) eliminates the need for organizations to acquire multiple physical devices to test mobile applications at scale.

    Capabilities include the tracking of key performance indicators (KPIs) such as blurriness, slow downloads, HTTP redirects and network or connectivity issues that adversely impact the user experience, in addition to performance issues such as load times and excessive consumption of CPU, memory and battery resources.

    The grid-based service also uses machine learning algorithms to apply artificial intelligence (AI) to monitor application performance and detect video and audio quality issues.

    Overall, the goal is to make it simpler for DevOps teams to build and deploy mobile applications faster and make sure they are thoroughly vetted rather than waiting for feedback from end users to discover issues that could have been easily identified before an application is deployed, said Turner.

    The launch of TDC follows the company’s acquisition of Waldo, a provider of a software-as-a-service (SaaS) platform that provides IT teams with a no-code tool for generating mobile application tests. Waldo uses a virtual environment to simulate iOS and Android devices in a way that eliminates the need for physical devices to conduct tests. Instead, DevOps teams record their applications and then use the no-code tools to generate tests directly from within a browser.

    In the meantime, the debate over how far application testing should be shifted left toward developers continues to rage. In theory, the more developers test applications themselves the fewer issues there should be once an application is deployed in a production environment. However, there is still going to be a need for dedicated testing teams to conduct tests across multiple stages of the application development process to ensure quality. In fact, as more routine tests are conducted by developers, it should free up application testers to focus more on edge use cases that might otherwise not be tested before being encountered by end users, noted Turner.

    Testing mobile applications is more critical than ever because the cost of failure—in terms of impact on the business—is now much higher as more organizations depend on software to drive business processes. The challenge is that many of these app developers don’t have a software engineering mindset, so they need testing platforms that automatically create and run tests on their behalf in a way that can be customized for specific use cases. In time, many of those tests will be automatically created by artificial intelligence (AI) models that should reduce the cognitive load required to manage the testing process, added Turner. In effect, application testing will soon be democratized by AI, he noted.

    Over time, the quality of applications should steadily improve as many of the low-level mistakes that developers make are eliminated. That should improve everything from application security to the user experience before mobile applications are initially deployed and then continuously updated.

  • Report Surfaces DevOps Challenges for Mobile Applications

    Report Surfaces DevOps Challenges for Mobile Applications

    An assessment of 1,600 DevOps teams involved in building and deploying mobile applications found that 62% were adversely impacted by manual processes that slowed the rate at which these applications were deployed and updated.

    Based on the Mobile DevOps Assessment (MODAS) created by Bitrise, a provider of a continuous integration/continuous delivery (CI/CD) platform for building and deploying mobile applications, the metric measured the creation, testing, deployment, monitoring and collaboration phases of building and deploying applications.

    The survey also found (44%) of respondents reported their release approval process is mostly or entirely manual, with only 9% having fully automated application releases. Only 22% of teams said they’ve been able to complete internal release processes in less than an hour.

    The survey also found that nearly two-thirds of organizations (66%) have deployed applications that can’t be opened in two seconds or less, which is widely considered the accepted level of performance required.

    In addition, three-quarters of organizations (75%) required more than two days to address bug fixes. Only 21% of teams said that they had implemented some form of app performance monitoring to keep track of bugs, the report found.

    Daniel Balla, chief strategy officer for Bitrise, said MODAS applies many of the concepts from the DevOps Research and Assessment (DORA) metrics that Google now oversees. Those metrics, however, are not specifically designed to assess mobile application development initiatives, he noted.

    It’s not clear what percentage of applications DevOps teams are building today are deployed on mobile devices. But given the emphasis on digital business transformation initiatives, many of these applications are increasingly mission-critical to organizations. The general expectation among mobile application end users is that apps will be regularly updated with new functionality. However, if release processes are largely manual, regularly improving the user experience can become problematic. In addition to the increased likelihood that mistakes will be made, manual processes are often the reason why a vulnerability was introduced into an application environment.

    DevOps teams will also need to also consider the level of scale that will be required to support mobile app development, noted Balla. Many of the tools that developers rely on today to build applications were not necessarily designed to enable developers to build and deploy mobile applications at scale, he added.

    Finally, most enterprise applications need to run on multiple devices, so the tools used to create these applications can’t focus on applications that can only run on one platform, said Balla.

    Regardless of the approach to building and deploying mobile applications, the amount of focus on them within most organizations is high; any issues that arise are likely to be noticed by the highest echelons of an organization. That level of attention can easily put pressure on DevOps teams that frequently work on multiple projects. The challenge and the opportunity now is to create a set of DevOps workflows optimized for mobile applications that almost by definition require much more frequent updates than any other type of application.

  • Vercel Optimizes Apps Based on React Framework

    Vercel Optimizes Apps Based on React Framework

    Vercel, during its online Next.JS Conf event, announced an update to its open source reactive programming framework that adds support for automatic image optimization along with access to continuous Web Vitals analytics.

    Company CEO Guillermo Rauch said Next.js 10 also adds support for internationalized routing and automatic language detection and quick-start e-commerce capabilities.

    Pioneered by Facebook, reactive programming frameworks are gaining traction as the need to build more interactive applications to drive digital business transformation and other initiatives becomes more critical. Vercel makes it easier to build those applications via a managed serverless cloud environment.

    Image optimization becomes a problem for websites because over time successful waves of application updates conspire to slow performance. Next.js 10 gives developers a replacement for legacy HTML and browser image stacks, which support only one image size and type. Developers can automatically replace legacy HTML image tags with image components based on React that load in a progressive fashion, said Rauch.

    E-commerce applications are especially “ripe for revolution,” he said—as organizations increase their dependency on online interactions in the wake of the COVID-19 pandemic, they are discovering their existing applications are not only slow but also not especially engaging. The more satisfied customers are with an application experience, the more likely they will return to that website, Rauch noted.

    Vercel’s open source Next.js Commerce platform using Node.js 10 adds automation along with a data layer and reusable data primitives developed by BigCommerce to modernize e-commerce applications. Vercel is also in the process of testing a video platform built in Node.js that will be made available as an open source platform.

    Finally, a Next.js Analytics module provides continuous feedback to help developers better understand how their site or application performs. Page rankings on the Google search engine site are now being influenced much more by Google Web Vitals scores, Rauch said, and the analytics module is designed to identify First Input Delay and Cumulative Layout Shift issues that adversely impact the performance of React-based applications.

    Ultimately, the goal is to deliver a new generation of web and mobile applications. Organizations employing Node.js include Apple, Twitch, TikTok, Lululemon, Target, Lyft and Hulu. Companies such as Airbnb, Hashicorp, Washington Post and TripAdvisor also deploy their front-ends on the Vercel cloud platform.

    It may take a while before every company has modernized their web and mobile application portfolios, but at this juncture, it’s now a matter of when rather than if. Organizations that depend on legacy HTML approaches to building and deploying these applications will find that over time, the use of their applications—and, by extension, websites—will decline. At a time when organizations are more dependent than ever on web and mobile applications to remain relevant to customers, interactive applications may soon be nothing less than a matter of survival.

  • Why Mobile App Security is Like a Rubik’s Cube

    Why Mobile App Security is Like a Rubik’s Cube

    Now more than ever, mobile applications are driving modern business, and developing and launching them are top priorities for companies across industries.

    As of 2018, more than 194 billion applications had been downloaded from app stores, according to Credence Research. The global mobile app market was valued at $109.67 billion in 2018 and, at the time of the report, was set to see a 15.60% compound annual growth rate during the forecast period (2019-2027), according to the firm.

    Although only a small fraction of mobile applications will be used in the enterprise, the tidal wave of mobile apps off-the-shelf, corporate-developed and sponsored creates substantial new challenges. For DevOps teams, it means they must make their internal processes more agile and efficient. That’s a good thing. But it also means they face a critical step securing those apps, which can add weeks to development times and cycles.

    One problem is mobile apps run outside of the confines of corporate networks and can access services across the public internet. This makes mobile applications a huge security vulnerability point–especially if they aren’t architected properly and configured with proper security and access controls.

    A report by WhiteHat Security offers a stark reminder that mobile apps are riddled with security flaws, many of which go unremedied. Based on 17 million application security scans carried out in 2018, the firm found a 20% increase in vulnerabilities in the applications organizations tested for security flaws. Complicating matters, most enterprises face the risks presented by the use of personal mobile devices by their employees.

    It is not uncommon for enterprise users to have 15 to more than 80 enterprise applications on their devices. Enterprise must have control over the app and the data in the app before permitting widespread deployment.

    “That simply visiting a website can lead to your iPhone being hacked silently by some unknown party is worrying enough,” said Thomas Brewster, a cybersecurity reporter for Forbes, in reference to a recent, successful hack of an iPhone. “But given that, according to Google researchers, it’s possible for the hackers to access encrypted messages on WhatsApp, iMessage, Telegram and others, the attacks undermine the security promised by those apps.”

    Challenges of Securing Mobile Apps

    Why is app security such a challenge? For one thing, securing apps before release doesn’t happen just once; every time an app or OS is updated, whether pre- or post-release, it must be secured again.

    Today, it takes an average of five weeks to secure a mobile app before launch.

    What’s more, when third-party libraries used by the app are updated, the app must be secured again. DevOps teams need to ask themselves: “How much of the time during which this app is in production will it be vulnerable to a security breach?”

    But integrating security into mobile apps gets even more complex. Here’s why: Integrating app security by manual coding is hugely time-consuming and error-prone, given that implementing cybersecurity isn’t everyone’s cup of tea. For example, a developer may not implement the data security APIs everywhere in the app, resulting in some data being written unprotected.

    And another factor tangential to security–device adoption–enters the picture. Employees expect corporate-authorized and distributed mobile apps to provide the same user friendliness as any consumer app they are accustomed to. If an app is not easy to use they will shun it, and enterprises won’t derive the business and process benefits they expect from mobility. Enterprises that attempt to secure their mobile apps may resort to forcing employees to use a managed, corporate-supplied device in order to use the app, or introduce a cumbersome VPN/login experience that will allow employees to access key data on remote servers from within the app.

    In short, such security practices, while they may secure data, make the mobile app inconvenient, cumbersome and difficult to adopt and use.

    What Can Be Done?

    Today, many of enterprises’ mobile security protocols and practices are rooted in manual methods, and DevOps and security teams struggle to place security-hardened devices and apps in production. But two practices remove virtually 100% of the issues that plague enterprise teams today.

    1. No-Code Security Integration: A no-code security integration solution can embed military-grade data encryption into apps and deliver the enterprise-level security controls that organizations need to ensure that corporate data is always safe, even when the device isn’t under enterprise controls.
    2. Securing the App, Not the Device: Securing mobile apps–not the endpoint devices or device-resident containers they run in–decomplicates security while significantly reducing security risks. This practice enables developers to automatically embed the security controls into the organization’s apps, and it enables employees to use those apps without having to deal with device security restrictions.

    What’s more, when an app or the OS behind it changes, it’s a trivial matter to re-secure the app.

    Smart users of mobile devices take precautions to safeguard their data from hackers. While that’s a prudent move, the real job starts with the DevOps and security folks to solve the security-integration Rubik’s Cube once and for all.

    — Nikfar Khaleeli

  • Role of DevOps in Mobile App Development

    Role of DevOps in Mobile App Development

    Emerged out of Agile methods in 2001, DevOps basically represents a fundamental departure from the traditional waterfall software development approach.

    DevOps is a modern software development method that focuses mainly on the effective collaboration between software developers, project managers and operations staff, while also aligning with business goals at the same time.

    DevOps came into being when developers and operations staff came together to more effectively overcome the challenges associated with continuous software delivery.

    DevOps in Mobile Applications

    Peerbits takes a holistic view of mobile DevOps, defining it as a capability for continuous mobile app delivery that enables our clients to reduce time-to-market new features and seize new market opportunities simultaneously.

    The key principle in DevOps is continuous delivery, which means deploying the software (in this case a mobile app) and the environment on which it runs, automatically and on-demand, during any stage of the mobile app development cycle.

    DevOps basically applies the same principles whether you want to build an app for either mobile or web. However, the challenges in mobile DevOps are bit different and specific.

    Mobile DevOps Challenges

    The challenges in mobile DevOps mainly include:

    Different OS Versions: Most mobile apps have multiple target environments and multiple devices, which require dealing with different specs, different OS versions and different form factors.

    Furthermore, not only is there a wide range of operating systems running in the market, but there are also different installed versions.

    Take Android, for instance: The Android market accounts for almost 85 percent of the smartphone market. The below mentioned chart shows the breakdown of installed Android Versions as of Oct. 26.

    Image source: www.developer.android.com

     

    As you can see from the chart, the Android version 6.0, which according to Wikipedia is now unsupported, is still being used by 21.3 percent of Android users.

    This clearly indicates that only a few users update as soon as the new version comes along, while others don’t, either because they don’t want to or because their smartphone manufacturers are not providing newer OS updates.

    In addition to this, most Android smartphone manufacturers also tweak newer Android OS slightly, resulting into an increase in the OS fragmentation and making the launch times slower.

    Hardware: Smartphone hardware presents two primary challenges. First, smartphone manufacturers offer a good range of chipset, memory, storage options and, most importantly, different screen sizes. This makes it difficult to support each of them.

    Second, the mobile device war no longer is being fought only between Apple and Samsung. There are new smartphone manufacturers entering market more often than before. Out of these new rivals, there are also many manufacturers that offer low-cost models.

    Though Apple and Samsung might be dominating the Western markets right now, in China both of these brands account for only 13.7 percent and 20.7 percent respectively.

    In 2015, at least 18 new smartphone manufacturers entered in the market in Asia.

    This localization and fragmentation of available devices and their different OS versions adds a considerable complexity to the mobile application development as a challenge.

    Balancing Mobile App Quality with Always Changing Consumer Demand: As the app economy grew in last recent years, the need for businesses to get their mobile apps released in the market quickly also grew along with it.

    However, since the consumer expectations are also increasing, the quality of a mobile app is the most essential factor in retaining existing customers as well as attracting the new ones.

    In 2018 especially, this is more and more difficult, due to the ease in which customers can delete apps and give poor ratings and review to low-quality mobile apps.

    As a result, businesses need to be extra careful in terms of their app quality, while consistently adding value to keep their existing customers happy.

    All of these factors are putting strain on mobile app development teams, as the waterfall model approach is not a sustainable practice for today’s consumers.

    3 Rules for Successfully Adopting Mobile DevOps

    Adopting DevOps in your business mobile app needs only three considerations, which are explained below.

    Continuous Planning and Integration

    Continuous planning refers to bringing your entire mobile app project team—developers, project managers, operations staff, and other stakeholders—on the same platform to finalize the scope of the mobile app in the preparation of a launch plan.

    Continuous integration, on the other hand, ensures that the code submitted by one developer works with the code submitted by the other developer(s). Simply put, continuous integration in mobile DevOps demands frequent builds, which must be integrated with the last developed code.

    Continuous Testing and Monitoring

    Most mobile application testing is executed on simulators instead of actual devices. Plus, the testing is also manual. And given the number of OS versions alone, it is impossible to do manual testing for all versions.

    A mobile app can perform well in test environment, but it is very common that it will fail in the live environment.

    The reasons of these failures can be many, such as memory, network conditions, power, etc. It is necessary, therefore, for developers as well as businesses to make sure that the continuous monitoring is done via third-party SDKs for log, crash report and so on to find the root of the problem.

    Continuous Delivery and Deployment

    Continuous delivery refers to the practice that makes sure the code is deployed to the production environment by submitting each change to the production-like environment.

    Continuous deployment is the next step of continuous delivery. In continuous deployment, each change that has been approved by continuous testing gets deployed to the production environment automatically.

    Takeaway

    In our perception, there is no such thing as a separate DevOps for mobile application development. DevOps is a general approach that works for all components as well different kinds of application development.

    While there are certain challenges involved in adopting DevOps for mobile apps, but there also measurable benefits that makes the entire journey worthwhile.

    All in all, despite the cost to build an app and its initial pains, the benefits of DevOps make the investment worthwhile.

    — nasrullahpatel

  • Akamai Gives DevOps Teams More Control

    Akamai Gives DevOps Teams More Control

    When most DevOps teams think about platforms, it’s usually a conversation about some form of software sitting on a server in a data center. But many web and mobile applications employ a content delivery network (CDN) as the platform on which they depend most to run. Akamai Technologies is moving to provide DevOps teams with much greater visibility into and control over what’s occurring across its namesake CDN.

    Ari Weil, senior director of industry marketing at Akamai, says CDNs now play a pivotal role in enabling IT organizations to deploy web and mobile applications in the cloud. To provide DevOps teams with more control over those deployments, Akamai is committing to treat the core CDN as code that can be programmatically invoked in addition to providing real-time visibility into applications running on Akamai and simplyfing the modification of applications in production, says Weil.

    As part of that effort, Weil says, Akamai is expending the range of application programming interfaces (APIs) that it exposes via toolsets spanning frameworks such as Terraform, Varnish and WordPress. The goal is to expand significantly the level of scripting and automation enabled by the Akamai CDN. Akamai is also making available a testing suite that DevOps teams can employ to test and fix applications in real time.

    Akamai is making it possible to deploy custom configurations and code across Akamai’s CDN in minutes, including the ability to remove content in seconds and revert to past configurations whenever necessary.

    Akamai has also released mPulse Lite, a free version of a digital performance management tool that identifies ways to improve application performance and the end user experience, and its IoS mobile application and companion IoS watch app to specifically optimize the performance of iOS applications accessing the Akamai CDN.

    Most DevOps teams are hyperfocused on what occurs inside the data center. But in the age of extended enterprise the level of dependency on caching and security services provided enabled by a CDN has never been greater. The fact that Akamai has also begun a more DevOps initiative is also testament to how far the DevOps movement has been able to extend its influence. Historically, providers of external services have been reluctant to provide any visibility into how their network services operate.

    Weil notes that it’s apparent the developers are also exercising more influence and control over IT. As such, providers of external services are now under more pressure to programmatically expose their services in much the same way as any other cloud service. In fact, many cloud service providers are leveraging their global footprint to make available CDN services that rival Akamai.

    Regardless of the CDN chosen, developers are under more pressure than ever from the business to optimize the end user application experience. Mobile and web applications are core to any digital business transformation initiative. In the face of that pressure, DevOps teams are finding that having more control over the CDN used to deliver those applications is now an absolute necessity.

    — Mike Vizard

  • Minimum Viable App Doesn’t Mean Minimum Security

    Minimum Viable App Doesn’t Mean Minimum Security

    It’s estimated that the total market for mobile apps will hit $143 billion this year. A big portion of that budget will be enterprise mobile app development. By next year 25 percent of enterprise IT budgets will be aimed at their mobile app efforts. Yet, despite these efforts, most enterprises are still falling behind in their mobile app development pipelines by 12, 15 and even 20 weeks.

    To help clear that backlog and meet their internal mobile app demand, more enterprises are focusing on delivering the mobile apps with the features that hold promise to produce the most return on their efforts; that is, the apps that people likely will use and will do the most, for the least investment, to help to improve their daily work lives and productivity. Or, this minimum viable product (MVP) is the minimum required in an app to prove out its app concept.

    But when moving apps out quickly, enterprises risk skimping in areas of quality and especially security, which can pose a risk to data that should be handled with care, notes Isaac Potoczny-Jones, research lead, Computer Security with security research and development firm Galois.

    “There’s definitely a lot more development in mobile happening,” says Potoczny-Jones. “I think the [security] best practices in mobile aren’t as well-developed as best practices for the web. I think that’s getting a little bit better, and there’s a very fascinating challenge with security [with MVP] because security is a non-functional requirement.”

    Of course, apps must be developed with good mobile security—including app password management, server side controls, cryptography and other best practices—in mind. The OWASP Top 10 Mobile Security Risks provides an excellent overview of common mobile risks and associated mitigations.

    One of the challenges with mobile security testing is that the best practices and associated processes are not well understood by most, at least not yet, and quality mobile security testing tools are not deployed in many organizations. Plus, those organizations using some of the common mobile security testing tools find that they don’t always suffice and they often have to build their own automated toolsets.

    The risk with fast-tracked MVP apps is that they never get anywhere near a security test before being shipped to production. But these apps—just like any other apps that get near enterprise data and networks or may access sensitive, confidential or regulated data—must be vetted, threat modeled and tested (static and dynamic app testing), along with the usual quality tests. And with MVPs, it’s just as important that this testing be an integrated part of the process from the beginning.

    The best way to achieve this, of course, is through awareness and secure code training with developers.

    Companies may want to consider creating an MVP development guide that could detail security considerations for the MVP. Such a guide could help developers determine what security best practices to follow, as well as what apps need to be sent to the security team for reviews—and when.

    Potoczny-Jones says there’s no reason, except for maybe carelessness, why MVP apps are being built with minimum security considerations, as most lean development methodologies have security testing built into their processes. “Once you get these teams to include security testing being a part of [what they consider] ‘being done,’ which I don’t think a lot of people have, then they’re going to do the right things. You’re either going to start to build security either into the user stories or the acceptance testing,” he says.

    That’s for sure, and it shouldn’t be left to the end of the development process. “You can’t leave it to just be at the end of the process. If you leave security testing toward the end, naturally your schedule is going to slip. You’ll find that there’s a lot more work to do. Then you’ll be in this unfortunate position of having to decide whether to fix things and let the schedule slip, or choose to let something go out the door that’s not secure,” Potoczny-Jones says.