Leading off: @anildash at #VelocityConf, who is "from the internet." He wants to start with reminding us that technology isn't just a dumpster fire, that it can be used for good as well. But that the problems we're causing are getting worse.
@anildash "How did this happen?" asks @anildash. "We mostly mean well; there aren't many mustache-twirling villains except for Thiel who drinks the blood of young people." #VelocityConf
Who was making technology? We started off with the goal of democratizing technology, and initially lots of different people were participating and were leading (c.f. myspace, neopets, etc.)! #VelocityConf
And to be sure, they weren't modern web applications, but there was some freedom and openness to it when you could just upload a file to an FTP server, says @anildash.
But then we started getting "serious" about it and trying to reduce risks. #VelocityConf
by professionalizing it and trying to make things more secure and stable, we constrained who was able to create.
While we were enabling more deploys, the number of people who could participate was going down. #VelocityConf
"Well-intentioned attempts to reduce risk often create systems where the reduction of risk also results in a reduction of access to people with a lot of ideas and a desire to contribute."
Think about medieval castles that were all or nothing failure domains. #VelocityConf
This is a challenge to those of us that build systems and platforms. How do we enable people who are not on the teams who are not "allowed" to deploy code to participate?
Everyone's allowed to edit a spreadsheet or create a Trello card, but code is walled off. #VelocityConf
But we used to be afraid of "but what if a random employee emails the CEO?" or "what if people can see things that another team are talking about on Slack?" #VelocityConf
"Treating people like they're smart and trustworthy has a lot of benefits." --@anildash
We need to have sandboxes where people can feel safe to play and create, and eventually put things in front of the world. Are we setting boundaries correctly? Is the problem us? #VelocityConf
Culture change is difficult. Turning Fog Creek into Glitch... how long does it take to change our job descriptions or job ladders?
[ed: also, <3 to @anildash to being non-binary inclusive in describing gender diversity!] #VelocityConf
And you can enable people to just fix and change things without waiting for someone's permission. You don't have to be an engineer to make a change to a website. #VelocityConf
Titles or organization charts no longer divide us; we can empower people to create and put things out there. And it had taken @anildash a while to internalize that, even as the CEO of Glitch. #VelocityConf
We need to check our assumptions about who's allowed to write code and create. "Maybe my job is not to take their requirements and hand back something that I think meets their problem, but instead empower them to solve their own problems." -- @anildash#VelocityConf
"You may not do your banking system or RTOS this way, but we need to have a default bias towards allowing everyone in our organizations and communities to create." --@anildash
And it will bring about more joy of creation, even if it's terrifying at first. [fin] #VelocityConf
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Final talk I'll be getting to at #VelocityConf before I dash to Toronto: @IanColdwater on improving container security on k8s.
@IanColdwater She focuses on hardening her employer's cloud container infrastructure, including doing work on k8s.
She also was an ethical hacker before she went into DevOps and DevSecOps. #VelocityConf
She travels around doing competitive hacking with CTFs. It's important to think like an attacker rather than assuming good intents and nice user personas that use our features in the way the devs intended things to be used. #VelocityConf
My colleague @sethvargo on microservice security at #VelocityConf: traditionally we've thought of traditional security as all-or-nothing -- that you put the biggest possible padlock on your perimeter, and you have a secure zone and untrusted zone.
@sethvargo We know that monoliths don't actually work, so we're moving towards microservices. But how does this change your security model?
You might have a loadbalancer that has software-defined rules. And you have a variety of compartmentalized networks. #VelocityConf
You might also be communicating with managed services such as Cloud SQL that are outside of your security perimeter.
You no longer have one resource, firewall, loadbalancer, and security team. You have many. Including "Chris." #VelocityConf
The problems we're solving: (1) why are monoliths harder to migrate? (2) Should you? (3) How do I start? (4) Best practices #VelocityConf
.@krisnova is a Gaypher (gay gopher), is a k8s maintainer, and is involved in two k8s SIGs (cluster lifecycle & aws, but she likes all the clouds. depending upon the day). And she did SRE before becoming a Dev Advocate! #VelocityConf
"just collect data and figure out later how you'll use it" doesn't work any more. #VelocityConf
We used to be optimistic before we ruined everything.
Mozilla also used to not collect data, and only had data on number of downloads, but its market share went down because they weren't measuring user satisfaction and actual usage. #VelocityConf