Eli W-H

And folks tend to use them as a control for separation of duties. We can put the effort in to build and promote a positive culture around PRs in individual orgs, but we're still saying to auditors "this is how we ensure the company is protected"

Thanks! Definitely getting closer, yeah

It's still highly relevant. I think many folks who would find some of the practices familiar gained that familiarity by being around them without the underlying theory or drivers. A lot of the specific advice about different stages of the pipelines and lifecycle are still just as relevant now.

Rereading portions of Continuous Deliver for input on a long SDLC post I may eventually finish. It's always interesting to open a book like this 10+ years later and see how much became part of how we work and how much of the underlying value never made it into common usage.

Why Software Fails We waste billions of dollars each year on entirely preventable mistakes

This doesn't even feel like it was written 20 years ago: spectrum.ieee.org/why-software...

oh no, my "OKRs is just sparkling MBO" rant may have just gotten a new layer and an extra 50+ years of history. I really need to switch over to video games...

"The issue comes down to people. They are both the problem and the answer."

Yup, that's been my week too, I feel you...

The Art of Action by Stephen Bungay: Summary, Notes, Review Rating: 8/10. Bungay's expertful research into military learnings and how it can be applied to modern business and leadership. A big summary.

"What matters about creating alignment around a strategy is not the volume of communication, but its quality and precision."

I swear I intended to play video games this morning, got sucked into a great book summary instead. Lots of gems: www.lostbookofsales.com/notes/book-s...

Here is a very current example:
a lot of younger people have never done «trunk based development», they think GitHub PRs are the epitome of software development. But PRs were made to support a workflow that makes 100% sense in open source, but often just adds «quality theatre» for team development.

I'm glad "2 pizza teams" was one of the things we took from early Amazon management style and not "don't forget to look under your chair to see if you have been reassigned today".

And it is infinitly cheaper to fix security bugs BEFORE you ship rather than after"

I'm going to replace it with an AI Agent any day now, which automatically makes it fresh and new

Screenshot of a "Product" category with a "-1" indicator for unread items

Sometimes people think I'm joking when I say I break software by using it.

Today my RSS reader says I have -1 items waiting. One interpretation is that I've read so much this morning that I looped back around into the negatives. Or maybe I tapped the "Mark as Read" with the wrong finger...

A dense visualization that displays the list of responsibilities of a web service on the left as rows, from details about receiving the request through authentication, input parsing, performing application and business logic, and finally the stages of producing and sending the response. A second column reflects the same rows and whether these are typically framework responsibilities, configured by the developer, or code that developer writes. 5 more columns provide visualizations of the how the major components of a traditional 3 layer application, Onion Architecture, Clean Architecture, Clean Architecture misapplied with Mediatr, and Vertical Slices Architecture are each mapped to the responsibilities of the original rows on the left.

Slowly working on a new web architecture post (or maybe series, tbd). Diagram that started out being part of a discussion about how to thoughtfully design your architecture somehow ended up instead being a commentary about a few common architecture patterns.

$1k/yr I meant. Fine for a manufacturing plant, probably not for ecom or the growing SaaS markets. New Relic existed. I used Splunk's first cloud product (storm?) in 13-ish for a B2B, when they replaced that, the new version was already a multiple of the earlier one (2016-ish, API not included 🙄).

The only monitoring I remember in 09 was running something for $1/k (per server? core?) on prem (that solarwinds acquired?) that I was running SQL, HTTP and other checks through, they had just added a visual network map I think...

Look, if you're on us-west-2 and it has problems, then you have to explain a million times to everyone that it's not your app it's AWS.

If, however, you're on us-east-1, you don't even have to respond. They already know (and your ticket system is probably down anyway).

I've applied similar concepts for a small platform for institutional investors, a new team within a larger global non-profit for something similar to a hiring app (not truly regulatory, but big and global enough for _every_ privacy law to apply from anywhere), plus some far less regulated products.

"Customer X from Bank Y said the app is slow"
"Oh, let's pull up splunk and compare the client-side and server-side traces to see if it's the app, the internet, or something on the client"

I led engineering for a small SaaS company for commercial loan pricing in 2012-2017, we did Continuous Delivery and some of the early folks using CD to support separation of duties, etc. 45min to prod. Engineers talked to customers. Lots of observability experiments on diff platforms of the time.

Three months late, but I really liked this one: rebels.cs.uwaterloo.ca/papers/tse20...

Authors claim that type annotations catch ~15% of bugs found in the wild, with breakdowns of type of bug, how long they estimated annotations would take, etc.

and rarely someone that has actually succeeded more than once at leading a startup is put in charge and shows they not only have the experience leading startups to market, but also can navigation larger corporate environments (because you're really asking them to do both)

Generally being told to run like a startup translates to "why can't you just execute faster"

Occasionally it's "there's money in that market over there, please do something like X to extract it", which is at least a little closer to "startup"

The 1s problem with established companies running teams "like a startup" is most of the folks you're saying "be a startup" to don't have the experience of running a successful startup, they're going to copy the memes.

The 2nd problem is lack of direct contact with the market to learn differently.

Oh man, someone did actually threaten to report him yesterday because he was talking in a bad english accent, that might have been a code of conduct violation:

"Do not impersonate anyone else."

Also, let me tell you how useful: "You said something wrong at some point before we reviewed it at 2AM and we can't tell you what it was, so we're going to suspend you so you do better next time" is.

Especially with code of conduct like: "Do not disturb or interrupt gameplay."

Woke up to an email that one of my kids has been suspended from the Playstation network again. I'm fairly certain it was a retaliatory report. The process to get any info on what he was suspended for or to have it re-evaluated is "no, we don't make mistakes".

The S in MCP stands for security

Safety of JN.1-Updated mRNA COVID-19 Vaccines This cohort study investigates the association between booster vaccinations containing the JN.1 lineage and 29 serious adverse events in Denmark.

1.6 million people showed no statistical increase in 29 adverse events after mRNA covid vax
jamanetwork.com/journals/jam... #MedSky