staging-devopsy.kinsta.cloud

Tag: application development

  • Internal Makes On-Premises Edition of No-Code Tool Available

    Internal Makes On-Premises Edition of No-Code Tool Available

    Internal today launched an on-premises edition of its eponymous no-code development platform that promises to simplify application development backlog reduction for enterprise IT organizations.

    Arisa Amano, CEO of Internal, said many professional developers regularly find themselves building simple applications that, if given access to the right tools, could be built instead by end users. Internal was created to provide that capability either through a cloud service or, now, through an on-premises edition.

    The on-premises edition makes it simpler for developers to work with databases, application programming interfaces (APIs) and applications that reside behind a corporate firewall, Amano said.

    As organizations accelerate digital business transformation initiatives, professional developers are pressed to build and deploy more complex applications faster. Many lower-priority application development projects are sidelined simply because developers don’t have time to take them on. Internal, and other no-code and low-code application development tool providers, are making a strong case for enabling end users to build their own applications using graphical tools, or encouraging professional developers to use these tools to build less complex applications more quickly.

    A survey published by Internal finds 62% of respondents report their developers spend more than 25% of their time fulfilling requests to build internal tools. More than three-quarters of respondents (79%) said engineers use any extra time they can find to develop customer-facing features or other applications.

    Most of the projects filling application backlogs tend to involve workflows that span multiple applications running in a data center. The challenge organizations face is low-code and no-code tools that reside in the cloud can’t easily access that data. As such, Amano said there’s a clear need for a no-code tool that can be deployed in an on-premises IT environment.

    Of course, regardless of who builds the application, it still must be deployed. Challenges arise as developers build more applications, which must be concurrently deployed in production environments. The addition of no-code and low-code tools, and the applications created with those tools, will require organizations to rethink and refine their DevOps processes.

    Historically, professional developers have tended to view no-code and low-code tools as the application development equivalent of a black box preventing them from building reliable, robust applications that can scale. Many low-code and no-code applications that organizations build, however, are meant to used internally by a finite number of end users. At the same time, no-code and low-code tools become more robust with each major update.

    Whatever bias may exist, the current application development backlog in most organizations is only going to increase. Professional developers may prefer to write code at a lower level than a no-code or low-code tool allows; however, most business executives are more interested in application performance than in how it was constructed.

  • Design Systems: Development Choices for Meeting User Expectations

    Design Systems: Development Choices for Meeting User Expectations

    Modern software development trends involve design systems and modernization, and if we drill down further, the trend within the trend is about creating better user experiences. This means improving usability, emerging technology and performance enhancements. This is easier said than done. What does it mean for developers?

    Employing Design Systems

    What a designer sketches, a developer tries to replicate, often with varying degrees of success. When we introduce multiple screen sizes and form factors, the experience can vary greatly if the collaboration between design and development is not in sync. To combat this, many modern software development practices are beginning to employ the use of design systems to provide an outstanding experience to the end user and streamline processes internally.

    Typically, a design system consists of UI components and visual style guidelines, both in the form of reusable code and reusable design artifacts. The system could include UI patterns, foundational elements and design principles or guidelines. Many go as far as defining what tools should be used for optimal UI and UX. For example, one of the most widely known design systems—and most used, due to its open source nature—is Google’s Material Design.

    With a design system in place, developers and designers are singing from the same sheet of music. This eliminates many delays and inconsistencies and provides prescriptive guidance for both the visual and functional experience of the app. It allows developers to deliver the beautifully styled, feature-rich responsive experiences the end user has come to expect.

    Choices for Modernization

    For .NET developers, this could mean exploring Blazor, Microsoft’s answer to JavaScript, which allows developers to build interactive web UIs using C#. It could mean diving into.NET 5, which is the next step in building a unified platform, allowing developers to use it to target Windows, Linux, macOS, iOS, Android, watchOS, WebAssembly and more. Or, it could mean getting a jump on .NET MAUI, the welcome evolution of Xamarin.Forms, combining the best of Mono and .NET Core and allowing developers to build truly native desktop and mobile apps for any operating system from a single codebase and project system from their preferred IDE.

    For the JavaScript developer, modernization could mean looking toward Vue 3, which is a faster, smaller and more maintainable framework. Or, it could mean exploring Angular 10 and its warnings for CommonJS imports. Or maybe it’s truly understanding and appreciating the downplayed release of React 17, which now allows multiple versions of React on one page, making it easier to use React with other frameworks. Modernization is all about staying relevant, learning and leveraging the latest the industry can offer.

    Popular Frameworks

    For front-end development, React, Angular and Blazor are some of the most popular frameworks at the moment. Blazor is so new enough that you aren’t going to find anyone with years of experience, but it is a framework that is incredibly adaptable and easy to learn if you are C# developer.

    React and Angular are more mature and with their latest releases provide even more compelling reasons to build your web apps with them. The soft skills—the ability to communicate and collaborate—are some of the most in-demand skills today.

    Regardless of your front-end preferences, the proliferation of frameworks and new versions means that developers have more choices than ever for creating rich, interactive, modern experiences for multiple platforms and devices.

  • How To Foster a Culture of Citizen Developers

    How To Foster a Culture of Citizen Developers

    What can leaders do to encourage a thriving environment of citizen developers in their organization?

    Over the last several months, businesses of all sizes have had to embrace rapid change, as have their workforces. When it comes to IT departments, even before the pandemic many were fielding requests to implement new technology, customize solutions to niche problems and automate specific tasks at rapid rates. Unfortunately, these increased demands coincide with an ongoing developer drought, and paired with the pandemic, have put an added strain on some already thinly stretched IT teams.

    As a result, there has been an observable rise in citizen developers being tapped to relieve some of this burden. “Citizen developer” here is used to describe any programming novice or non-developer who has been tasked with the responsibility of constructing custom applications. This person has some familiarity with programming but may not have been formally trained and, therefore, may use their own set of tools and workarounds to complete the work. If leaders don’t make an effort to create standardization, the consequence can be high variability in quality, efficiency and output.

    And it doesn’t seem to be a passing phase. I recently spoke with Dave Garrett, chief strategy and growth officer at Project Management Institute. As we look to the future, Garrett believes that citizen developers will play a critical role in helping organizations stay agile and ensuring projects move forward without delay.

    Though it won’t solve all of your pressing technical concerns, the good news is that with smart strategies, a citizen development emphasis can ease the burden on IT teams and improve output. Garrett spoke to a sea change of new techniques being developed to respond to these growing needs.

    4 Elements of Strong Citizen Developers Culture

    1. Standard Toolsets

    To start, build a solid foundation by choosing standard toolsets. Be sure all development staff is made aware of the toolsets you’ve deemed standard, clarify that adopting them is a priority and ensure that all have access. Standard approaches to using these tools should also be established and communicated, such as programming languages and stylistic standards.

    “If you have a standard toolset and approach, then you have many people who can help,” Garrett said, emphasizing that by doing so, you are building a broader base of support. Having a larger pool of employees to pull from helps an organization stay on top of the necessary tasks and creates more freedom for open collaboration. As a bonus, professional developers are freed to focus on more advanced tasks, such as machine learning and or mathematically complex programming.

    In deciding which toolsets and approaches to make standard, Garrett said, ask yourself, What will get them from A to B most quickly and efficiently? One approach to this is low-code or no-code tools. He considers such platforms transformational in empowering citizen developers to express ideas tangibly without a great deal of coding.

    2. Technical Training

    From here, ensure that all development staff, especially your citizen developers, have been technically trained in adopting the standard toolsets and approaches that have now been established. This may include offering training in low-code UIs and instilling fundamental programming concepts such as boolean logic and conditional programming such as If/Then/Else statements.

    “Set a foundation of success for learners,” he said. For example, have them build something of value during training, making it as actionable as possible for the use cases they will be handling.

    3. Discouraging Use of Shadow IT

    Once you have established toolsets and training, leadership should do whatever’s possible to enforce the established standard’s adoption and discourage the use of shadow IT—tools, applications and workarounds not approved by leadership within the company. Shadow IT, as a practice, can be messy, creating high variability and making quality-control and collaboration difficult. “You want to avoid it,” Garrett said.

    4. Good Mentorship and Governance

    Another benefit of having a standard toolset and eliminating shadow IT use is that it enables more efficient mentorship—critical for inspiring citizen developers. IT teams are advised to identify a mentor or group of mentors proficient with the standard tools to offer ongoing guidance to the team’s citizen developers.

    Quality mentorship goes hand in hand with quality governance. “Governance” here is used to mean technical admins who enforce the use of technical standards, tools and programming styles. No-code tools require access control that reflects a citizen developer’s permissions.

    Building in Hyper Agility + The Two-Pizza Rule 🍕🍕

    One way to think, Garrett said, is hyper agile. This can apply to team size, smart PM cycle lengths and brainstorming techniques.

    Team Size

    In thinking of ideal team size, ask: How can the team be optimized to work quickly and efficiently? One suggestion Garrett had was to ensure your team isn’t too large to effectively train, mentor and govern. For example, as a rule of thumb, he mentioned the old “two pizzas” rule: A team size shouldn’t require more than two pizzas to share a meal.

    Sigh. Remember things like in-person training? Pizza parties? Obviously, old meetups can’t be executed exactly to plan these days, except with some clever contactless delivery tactics, but you get the idea. A strategically sized team will create an efficient workflow and collaboration in your team dynamics.

    Cycle Length

    As projects come in, an agile cycle length, or sprint, for completing a specific set of work should be determined. What is an efficient amount of time to expect a team to turn out a project? To determine this, sprints should start with a planning meeting during which the product owner defines the work criteria. The development team determines a realistic time frame to complete the work scope. The scrum master or team manager typically makes this call.

    The lengths of agile sprints can vary—some may be two weeks, while others may be 30 days—depending on the scope of work. Most project management experts recommend you aim to keep your cycle length consistent, so teams get used to working within a set amount of time.

    Brainstorming

    Bringing attention to how your team ideates together is an excellent way to build agile collaboration. Brainstorming as a development team fosters collaboration and allows you to aggregate the talent and pull ideas together for the best output, whether you’re trying to solve a niche problem or simply join forces around how best to complete the sprint.

    Garrett recommended bringing people together in smaller groups for round-robin brainstorms and creating as you’re ideating. “Thus, iterations happen fast,” and all team members are given a chance to express their ideas in a tangible way.

    Once citizen developers see success, you can then use the excitement of building applications and solutions together to drive things forward, he said. Your anchor is a cool product that gets people excited—great for both morality and high-quality output.

    When Are Citizen Developers Appropriate?

    The question should be asked: When is it appropriate to call on citizen developers? Garrett recommended performing a suitability assessment to identify the best use cases for citizen developers. This will help the organization understand when it’s smartest to bring them in.

    The easiest way to answer this may be to consider: When isn’t it appropriate? Assigning advanced processes to citizen developers such as algorithm-heavy, mathematically complex programming or core product functionality is usually inappropriate, he said. Instead, utilize citizen developer talent for constructing internal business utilities that can be automated easily.

    There are formal suitability assessment tools that look at scores and attributes for applications to help you make this call. “However, everyone’s different,” Garrett noted. “You have your own ways of working, given context, goals and what you’re trying to accomplish.” So it may make the most sense to perform your own internal suitability assessment.

    Do the Numbers

    According to a recent PMI report, over the past five years half of organizations have recognized team members who brought innovative ideas forward, but:

    • Only 25% required dedicated time for innovative thinking and idea generation.
    • Only 19% hosted a creativity lab or hackathon facilitated by a professional.

    By contrast, their research shows that those promoting innovative practices see stronger results. Case in point:

    • 80% of organizations that encourage project leaders to expand their role have invested in at least one innovative idea in the past five years.

    The trend PMI sees on this front is that organizations want to innovate, but don’t always know how to make it happen. So, how might they push innovation forward? If you can implement a strong citizen development toolset, you can “enable innovation to bubble up,” Garrett said. The hope is this guide offers a blueprint for fostering just that.

  • Netlify Extends JAMstack Reach to Edge Computing

    Netlify Extends JAMstack Reach to Edge Computing

    Netlify, at its JAMSTACK CONF VIRTUAL event today, announced Netlify Edge Handlers, which make it possible to extend a Git-based workflow to edge computing applications.

    Company CEO Matt Biilmann said Netlify Edge Handlers, available in beta, puts the primitives in place for deploying serverless web applications based on a JAMstack software architecture that employs JavaScript, application programming interfaces (APIs) and markup languages, otherwise known as JAM, to isolate front- and back-end components of an application.

    A Git-based approach will also enable DevOps teams to extend workflows to edge computing applications that can be deployed on any number of platforms, he said. As an extension of a Netlify platform written in a modern Rust programming language, Netlify Edge Handlers makes it possible to build and launch web applications and websites based on a JAMstack architecture from within a continuous integration/continuous delivery (CI/CD) environment.

    Prior to the availability of Netlify Edge Handlers, building and deploying web applications on edge computing platforms required extensive coordination across teams, the creation of detailed edge logic with many dependencies and deviation from standard web development best practices, Biilmann said. Now, developers can write simple JavaScript that builds and deploys to the network edge in a way that enables simplified A/B testing, custom authentication and API aggregation, he noted.

    Developers also can build and manage edge logic from preview to production, including deploying those applications via the existing Netlify multi-cloud network.

    More application code is being pushed out to the edge because many organizations are now processing and analyzing data closer to where it is created and consumed, as part of their digital business transformation initiatives. Web applications that execute closest on a node to the user eliminate or reduce roundtrip request and response flows with the client.

    Biilmann also noted that because those applications are employing a platform developed using Rust, they are also inherently more secure.

    There may come a day when there are more application workloads collectively running at the edge than there are on cloud computing platforms. However, if that goal is ever to be achieved, it needs to become easier for developers to build those applications. Given the fact those applications are also likely to be targeted by cybercriminals, it’s critical to ensure those applications are as secure as possible.

    In the wake of the economic downturn brought on by the COVID-19 pandemic, many organizations have accelerated digital business transformation initiatives, many of which depend on edge computing platforms. The only way to achieve that goal, however, is to make it possible to build these applications using JavaScript tools that most developers of web applications have already mastered. Otherwise, organizations will need to invest in training developers to master another framework for deploying edge computing applications. That would require time they might not have.

    Regardless of the path forward, a massive wave of edge computing applications soon will stretch the boundaries and limitations of whatever DevOps processes organizations have in place today.

  • Crowdtesting: How to Ensure Quality in Disruptive Times

    Crowdtesting: How to Ensure Quality in Disruptive Times

    The practice of crowdtesting has taken on greater importance during the COVID-19 pandemic, for good reason

    Entering 2020, digital transformation projects and initiatives dominated tech spending for most companies. But, between a global pandemic and fiscal uncertainty around the world, spending must be shrinking, right?

    Think again.

    If anything, the pandemic has created a sense of urgency for many companies, accelerating digital transformation in organizations. According to June data from TEKsystems, 56% of digital experience leaders—companies with mature digital transformation strategies—have increased spending on digital transformation. Remarkably, more than one-third of digital experience laggards—those that have historically had limited digital transformation initiatives in place—also increased spending on digital transformation projects.

    The rush can be attributed to COVID-19. For businesses, it has changed the future of work. Distributed workforces are nothing new, but very few companies were prepared to deal with a fully distributed model in which all employees are working remotely. The pandemic has changed buyer behaviors, too. In lieu of malls and brick-and-mortar stores, people have turned to e-commerce sites for the bulk of their shopping. Legacy companies, such as Pepsi, for example, are building direct-to-consumer e-commerce sites in response to the evolving market dynamics.

    Digital is now the primary means of communication for businesses. Digital quality is no longer a niche issue for the application and DevOps teams; it is a strategic business imperative in the C-Suite.

    Apps Everywhere, At All Times

    Apps need to be tested by real users, on every device, network and operating system, across the globe and at all times. The typical workday used to be 9 to 5, but that’s no longer the case. With most workforces now remote, the days are longer and the diversions greater (yes, I’m looking at you, juggling Zoom calls and your daughter’s remote learning plan at school). Customers, too, have higher demands for the technology they use. There can be no downtime; downtime means customers will look for alternatives, becoming ex-customers and resulting in lost revenues.

    In today’s extremely fragmented device landscape, QA teams face increasing difficulties in keeping up with the myriad device/OS combinations they need to test on. For obvious reasons, purchasing and maintaining a nearly endless pool of devices is not an option—not only is it too expensive but it’s also time-consuming and harms the team’s productivity.

    Beyond logistics, QA teams must collect data from real-world testing to make informed decisions. No matter how many test cycles are run, QA teams can’t uncover all unexpected bugs and edge cases unless they include in-the-wild testing in their strategy.

    To test anything related to hardware in an efficient manner, leveraging a community of remote testers is the best way to obtain reliable results without burdening internal QA resources, generating disproportionate costs or missing out on important use cases.

    Crowdtesting Replaces Offshoring as the De Facto Way to Test Software

    With a market greater than $50 billion in India alone, there is no denying the offshoring model worked. But, the pandemic exposed pre-existing cracks in the model, causing many businesses and entire industries to regroup, re-evaluate and find new ways to accomplish tasks that just a few months prior would have been routine.

    When the pandemic hit, the supply chain broke. Testing and product development facilities built on product teams working collaboratively in close proximity struggled to keep up with the most basic needs of their customers. Outsourcing companies and their employees lacked the infrastructure to work remotely, negatively impacting the business continuity of their clients.

    This new reality leaves companies that are used to the offshoring model for testing and QA with one big question: what is the best way to test software and digital experiences in a post-COVID-19 world?

    While crowdtesting has been a factor in application and digital testing for more than a decade, it has taken on increased importance as internal QA teams can no longer maintain business continuity while working remotely and the offshoring model has faltered amid the pandemic.

    The reason the crowdtesting model remains a reliable answer even during COVID-19 is that it is always done remotely, via a community of vetted testers who already work in remote environments. This setup allows testing teams to maintain business continuity, while often improving test coverage across devices, operating systems, geographies, demographics and more.

    As an example, let’s look at how the Israeli government used crowdtesting to bring its tracing app to the country. The Israeli Ministry of Health developed the app using cellular GPS data to provide alerts on areas with high concentrations of COVID-19 infections. The app is designed to prevent COVID-19 spread by notifying people who were in the vicinity of verified coronavirus carriers. Similarly, healthcare provider K Health has used crowdtesting to help it launch a new COVID-19 diagnostic feature. K Health was already using crowdtesting services prior to the onset of the pandemic to ensure its mobile app functioned properly across all relevant device/OS combinations and timezones but found the scalability and reliability of the model meshed perfectly with the demands on healthcare providers in the new normal. When K Health offered free services to all Louisiana residents, crowdtesters were there to scale testing at a moment’s notice and provide 24/7 test coverage for the K Health app.

    It was urgent to get the app out quickly, but it also needed to work properly. Did push notifications go through promptly and to everyone? Would the app work across devices, and in different configurations? Since launching the app in March, the Ministry of Health has been able to leverage continuous crowdtesting to identify dozens of bugs that could have prevented Israelis from using the app or trusting its results.

    For example, the testers discovered that the app crashed when it was used in dark mode, and certain situations led to the app showing that it detected data even when data and location services were off. Since this second error was directly related to the main functionality of the app, it represented a very critical bug for the Ministry of Health to fix.

    Crowdtesting uses real devices and real people in their daily environments, which accounts for all these variables that are not seen in traditional labs and offshoring facilities. That makes crowdtesting a valuable testing approach even after the COVID-19 pandemic and resulting lockdown ends.

  • Product vs. Project: Balancing Management Roles for Success

    Product vs. Project: Balancing Management Roles for Success

    Many businesses today rely on project management to ensure that all the activities that are required to help the business function are able to do so efficiently. The importance of project management is ingrained into many businesses, and doesn’t need to be justified—or does it? For software development companies, product management also needs to be considered just as much, if not more. To determine whether both or one is needed, and to what extent, business leaders need to first recognize the similarities and differences between the roles of the project manager versus the product manager, and what each can bring to the business.

    The key to understanding the differences starts with the descriptive writing mantra that everyone learned back in school: the 5 Ws (and 1 H), otherwise known as who, what, when, where, why and how. Though the who and where are generally self-explanatory, you can easily understand the difference between product management and project management by understanding which of the other four questions each job answers. Both positions fulfill critical roles in effective product delivery.

    Product Management: Getting Concrete Answers

    Product management answers the questions of “what” and “why.” These are important because, for every product you build, you need concrete answers to these questions.

    What

    The fundamental question that we’re asking here is, “What are we building?” Many enterprises have a product range that spans across dozens of different markets. Though this is great for the business and investors, it’s not an effective way for a team to work. When you ask a team to build or support a product, they need a clear vision of what that product will actually do. This is especially true for software products because it’s easy for them to lose their identity if they attempt to do too much.

    In a big enterprise, a “do everything” mentality can cost more over time. It’s likely that you have many software teams, and each one is building software that’s designed to suit a specific part of the market. When those teams implement software that duplicates some functionality already provided by your business, you’re wasting time and effort.

    This is where a good product manager is valuable. They help keep software teams focused on what they’re building and rein in the desire (by developers and executives alike) to grow the software outside the job it needs to do.

    Why

    The other major question that product managers answer is, “Why are we building this?” For developers, why is often more important than what. Work is almost always interconnected with the work of other teammates. When teams understand why they’re building something, it’s much easier to understand how those connections should work. It also gives developers information about which trade-offs they should make when implementing a feature, such as simplicity and usability versus speed.

    It’s the job of the product manager to understand and convey the why of the product. They do that by conversing with executives and project stakeholders to understand how this product fits into the overall business need.

    Project Management: The Thoughtful Side

    Project management, on the other hand, answers a different set of questions. A project manager’s job is focused on the how and when.

    How

    Large software projects are complex, with many interdependent and interlocking pieces. Efficient software project managers understand those interdependent requirements and plan for them. They organize the project’s tasks so that by the time someone is ready to work on one piece, its dependencies have already finished. Developer downtime is minimized and it enables those developers to focus only on the problems they need to solve for each task.

    Managing these kinds of interdependent requirements is the most valuable thing that project managers do for their software developers, though it can often be missed by executives, who are much more focused on the second project management question: when?

    When

    This is the visible project management question, “When is that project going to be done?” External stakeholders don’t care about how or why. They usually only care about what when the final product isn’t what they expected. But when is a question that’s top of mind for every single team leader who waits for a software project to be finished.

    This is also the most difficult question to answer. It’s almost impossible to reliably predict how long it will take to deliver a feature—not even a whole project, just one part of it. Something that seems simple at the outset turns out to be much more complicated. Alternatively, sometimes something you think might take two weeks instead takes only a day or two.

    The Balancing Act

    In most traditional cases, both product and project management are crucial for software delivery pipelines to run smoothly. However, many enterprises are now moving their deployment infrastructure toward a continuous delivery model, which adopts DevOps principles. For teams that practice continuous delivery, the question of when something is coming out can sometimes feel less important. Additionally, many software teams transition toward agile software principles, which makes the collective software team responsible for the question of how. Third-party planning tools can also make it easier for software teams to answer the how and when questions for themselves.

    For this reason, many teams are transitioning away from using dedicated project managers. Instead, they move much of that responsibility to the teams and focus their planning efforts on the product itself. However, the most successful projects answer all four questions effectively. When you don’t have a good answer to one or more of these questions, the project can end up stressful and frustrating.

    The people answering these questions might change over time, as it has changed already. The crucial point is to just ensure that you do have people who are dedicated to solving these questions and relaying this information to their teams. This is the smartest way to ensure projects stay on track and deliver the product that is expected and needed.

  • Report: Debugging Efforts Cost Companies $61B Annually

    Report: Debugging Efforts Cost Companies $61B Annually

    Undo, a provider of a software failure replay platform, this week published a report in collaboration with a Cambridge Judge Business School MBA project that estimates 620 million developer hours a year are wasted on debugging software failures, at a cost of roughly $61 billion.

    The report also notes software engineers spend on average of 13 hours to fix a single software failure.

    According to the report, 41% said identified reproducing a bug as the biggest barrier to finding and fixing bugs faster, followed by wiring tests (23%) and actually fixing the bug (23%). Well over half (56%) said they could release software one to two days faster if reproducing failures were not an issue. Just over a quarter of developer time (26%) is spent reproducing and fixing failing tests.

    On the plus side, 88% of respondents said their organizations have adopted continuous integration (CI) practices, with more than 50% of businesses reporting they can deploy new code changes and updates at least daily. Over a third (35%) said they can make hourly deployments.

    Undo CEO Barry Morris said the report makes it clear organizations need to be able to record software to reduce the amount of time it takes to find bugs. Unfortunately, even then finding a bug is still a labor-intensive process that can involve analyzing millions of lines of code. In the future, software replay systems will be infused with machine learning algorithms to accelerate the bug discovery process, he noted. As software becomes more instrumented, the observability data and metrics that machine learning algorithms require to detect patterns is becoming more accessible.

    In the meantime, while CI has been embraced, the continuous delivery (CD) side of the DevOps equation remains a challenge. Each platform software is deployed on is unique, so most organizations find automating software delivery problematic.

    Regardless of DevOps approach, it’s clear there’s still lots of room for improvement when it comes to developing software. Even the most advanced practitioners of DevOps are limited by the rate at which software bugs, including security flaws, can be discovered and remediated. Of course, there may come a day when machine learning algorithms automate much of that process, including determining which types of tests to run. For now, however, many organizations could streamline the software debugging process by recording instances of applications when they are built and when they are deployed. After all, each platform that software is deployed on has attributes that inevitably impact how software on the platform runs.

    As software continues to become more complex in the years ahead, challenges associated with debugging applications will only continue to grow. In the age of microservices, the issue that software engineers are trying to troubleshoot might not have anything to do with the code they wrote; rather, the issue emanates from a service they invoked via an application programming interface (API). Whatever the source of the problem, it’s apparent to all a lot of time and money is being wasted on debugging software that could be put to far better use.

  • Survey Sees Increased Agile Adoption During COVID-19

    Survey Sees Increased Agile Adoption During COVID-19

    A report published by Digital.ai, the parent company of CollabNet VersionOne, finds 43% of organizations have increased their reliance on agile application development methodologies in the wake of the COVID-19 pandemic, with 15% saying it has increased significantly in the last 90 days.

    The report also notes 33% of respondents say they have increased or expanded Agile adoption in the last 90 days to help manage distributed teams, while 55% said their company plans to increase the use of agile in the next 12 to 14 months.

    Based on a pair of surveys conducted prior to and after the pandemic started, the 14th annual “State of Agile” report also finds 60% of respondents credit agile methodologies with having helped increase speed to market, while 58% say it has improved team productivity. Another 41% say they are also better able to manage distributed teams.

    Mike O’Rourke, chief research and development officer for Digital.ai, said there is a clear correlation between the ability to manage distributed application development teams and successfully navigating the pandemic now that most application development and deployment teams are working from home.

    Many of those teams are also seeing application development deadlines being moved up as organizations prioritize digital business transformation initiatives that now are core to any business continuity strategy.

    That shift is also accelerating a shift toward focusing more on business metrics for measuring success as defined by, for example, the Scaled Application Framework (SAFe), said O’Rourke, noting as a result, there’s also a lot more focus on value stream management across the enterprise as business and IT teams work closely together. The survey finds just over half of the respondents report their organization has either already implemented value stream management (VSM) or are planning to do so.

    The survey also finds more focus on risk and compliance, with the number of respondents identifying and measuring technical risk prior to deployment increasing 54%, while the importance of automated audit compliance and governance across control points increased 10% year over year.

    Perhaps most surprising, the survey finds reducing project cost is cited as an important reason for adopting agile by only 26% of the respondents, a 41% drop from the previous year. The number of organizations focused on release planning decreased by 11%; however, organizations focusing on product road mapping increased 9% over the previous year. The survey also finds slightly more respondents are using automated acceptance tools (3%). Another 12% said they plan to adopt agile project management tools in the future.

    It’s not clear whether increased focus on application development might result in bottlenecks when it’s time to deploy those applications. Organizations that have already embraced best DevOps practices alongside agile development methodologies will naturally be in a better position to deploy applications. At the same time, increased focus on digital business transformation is likely to accelerate the adoption of both agile development methodologies and best DevOps practices across the enterprise.

    In fact, it’s arguable that organizations that are not able to build and deploy applications adroitly may soon find they are unable to compete at a time when software development has become critical to their survival.

  • Sacrificing Security for Speed: 5 Mistakes Businesses Make in Application Development

    Sacrificing Security for Speed: 5 Mistakes Businesses Make in Application Development

    Earlier this year, the Democratic party in Iowa announced its plans to use a smartphone app to calculate and transmit their caucus results. Using technology to improve the speed of governance, one would think, “What could possibly go wrong? A lot, apparently. The app’s failure on results day was attributed to reporting and coding issues.

    While security was the matter of concern from the day of its announcement, the inevitable happened. Data and security breaches happen almost every minute. University of Maryland researchers find cyberattacks every 39 seconds. The last decade has seen many data breaches, putting personal information of billions of users in the hands of dubious entities. Every enterprise, from Yahoo to Facebook and Target to Home Depot, has been under attack—and this is likely to continue. Research has found that cybersecurity breaches will result in over 146 billion records stolen by 2023.

    Poor security is putting enterprises, governments and citizens at risk every day. Yet, in a hurry to leverage technology, companies bring unsecured applications to market all the time. In essence, they sacrifice security for speed. Adding to this, today’s modern web and mobile applications are built with latest and greatest technology stacks and frameworks, heavily reliant on client side functionality, and integration to multiclouds and third party systems using a myriad of APIs. Also teams are more diverse and work collaboratively using remote workforces. 

    These trends increase the security challenges the application development teams need to be aware of, and leverage platforms that provide built-in controls and protection against these to avoid security breaches and attacks. 

    While prioritizing speed over security in application development take into consideration the following mistakes that you need to avoid and address.

    Not Looking at Data Security Holistically 

    Data tends to be the most important and valuable aspect of modern web applications. Poor application design and architecture leads to data and security breaches. Application development teams generally assume that by providing the right authentication and authorization measures to the application, data will be protected. This is a misconception. Right measures to provide data security involve focussing on data integrity, fine grained data access and encrypting data while in rest as well as in motion. In addition, data security needs to be looked at holistically from the time the request is made to the time response is sent back across all layers of the application runtime.

    Not Considering Security Across the Application Development Lifecycle 

    Today’s modern web applications are highly sophisticated and built with a big focus on simplistic user experience combined with high scalability. This combination can be challenging for application development teams from a security perspective. Most development teams focus only on silos when securing the application (only client, server or integration layer). Teams should focus on end-to-end full stack security when developing applications. Also application teams should enforce security best practices incorporated by default as part of the collaborative development process.

    Not Focusing on API Security

    Most of the modern web applications use APIs from systems and services which include internal enterprise systems, cloud SaaS APIs, partner APIs and third party product APIs. Today, almost all web applications tend to expose their own functionality to the external environment as a core set of APIs. What’s more, nearly 100% of web applications today tend to expose its own functionality as a core set of APIs to the external world. Teams need to make sure they are using external APIs with proper security guidelines and protocols as well as exposing their own APIs with multiple choices of protecting them. API access needs to be protected with both coarse grained as well as fine grained measures.

    Not Providing Strong Authorization and Authentication Methods

    Authenticating your application and authorizing what users can access is an important part of application security. Without this, you are leaving your attack surface wide open. Your application needs to incorporate stringent and strong measures for authentication to prevent unauthorized access. This includes multi-factor authentication, passwordless authentication, single sign on and if using passwords very strong password policies. It must also offer fine grained role-based access control preventing access of sensitive and confidential data to non-privileged users. Moving to a market with ambiguous weak authentication, lack of fine grained control, improper session control and insufficient logging might not seem like a probable risk until you’re attacked.

    Not Incorporating Vulnerability Testing Throughout the Development Lifecycle

    Security threats are evolving faster than anyone can keep track of. The Open Web Application Security Project (OWASP), a community of application developers and security professionals, identifies the top 10 security risks each application team must mitigate. This includes risks across injection, data exposure, misconfiguration, security deserialization and so on. Development teams should incorporate vulnerability assessment as a continuous process and not leave it at the end of the deployment cycle.

    Automating Security with Development Platforms

    Integrating security into your application development process does not have to slow you down. By utilizing key technologies such as a low-code platform, you can accelerate development and enable security procedures at the same time.

    While promising accelerated development, what an ideal low-code application development platform offers is a visual development environment and code-customization with two-way workplace sync with IDEs. It also enables autogeneration of code, ensures extensibility and reuse with prefabs, and allows for full integration with CI/CD pipelines. 

    One of the important features of a low-code platform is built-in security, one that ensures automation of the development of application-level security features. A perfect platform provides a configuration for prevention of security vulnerabilities such as XSS and CSRF and ensures in-built encryption, robust authentication and authorization systems, along with enterprise-grade auditability and traceability.

    While speed may be the name of the game, rolling out your applications without considering security would have little positive impact if they fail to function and are not secure. One of the best ways to integrate security across your application development lifecycle is to leverage the benefits of low-code platforms that are designed for professional development, those that have built-in, application-level security features. While your application development plans may be time-critical, security cannot be an afterthought, because sacrificing security for speed may make it longer for you to mitigate the risks than achieve your application development goals. 

  • GigaSpaces to Provide Free Go-Live Services

    GigaSpaces to Provide Free Go-Live Services

    GigaSpaces, a provider of a platform for processing analytics data in real-time, will be making available professional services for free during the duration of the COVID-19 pandemic as part of a Go Live initiative to reduce the total cost of acquiring and implementing its platform.

    Yoav Einav, vice president of product for GigaSpaces, said the economic impact of the COVID-19 pandemic shows it’s apparent organizations of all sizes will need to reduce their IT costs. At the same time, many organizations will need to keep IT projects moving forward as nascent digital business strategies now become business continuity strategies, he said. Most of those business continuity plans will be contingent on providing a better digital customer experience based on real-time analytics.

    GigaSpaces has been building up its professional services capability for the past several months and plans to tap into the expertise of third-party IT services providers to make sure there is enough available expertise in the right place to meet anticipated Go Live demand.

    GigaSpacesIt’s still unclear to what degree IT projects will be impacted by the COVID-19 pandemic. Undoubtedly, many IT projects are being paused or outright canceled, especially in vertical industry segments that have been among the hardest hit. Organizations that are moving IT projects forward, however, should expect to IT vendors to help reduce the total cost of implementing those projects by providing free additional services, as in the case of GigaSpaces, or at the very least much more flexible payment terms.

    There are, of course, some vertical industry segments where organizations are building new applications that are highly relevant. One GigaSpaces customer, for example, is racing to build an application that will make it easier to find critical healthcare supplies that are frequently out of stock when needed most, noted Einav. Other organizations are simply moving to reduce costs by offloading queries from traditional databases.

    In many cases, organizations will be evaluating which platforms to employ to build these applications not just on the raw performance attributes of the platform but also how quickly those platforms can be implemented. As such, the robustness of the IT services ecosystem, including its overall DevOps acumen, will become a more critical evaluation criterion.

    In the meantime, a major transition away from legacy batch-oriented applications toward applications that process data in near real-time that has been gaining momentum now for several years should continue. Most organizations are now going to require the sub-second performance of a financial services application. However, visibility into supply chains in near real-time is becoming a bigger requirement, especially when many of the organizations that make up the supply chain are potentially not as economically resilient as they once were.

    Less clear is the rate at which the transition to near real-time applications will now occur. However, at a time when competition between organizations is about to become more fierce than at any time in recent memory, many organizations are about to discover how big a difference modern applications can really make.

    — Mike Vizard