I like to think I’m a decent programmer with many lessons learned. Staff Engineer, 10YoE, Go, Java+Spring, DevOps, and Security (OWASP ASVS/Top10).

Shift security so far left, my product owner talks a little AppSec.

  • 0 Posts
  • 1 Comment
Joined 1 year ago
cake
Cake day: June 7th, 2023

help-circle
  • From the article:

    “Where it doesn’t work well is by asking developers to do all of that work without centralized expertise and tooling support.”

    IMO, developers should be given enough enough to get themselves in trouble. However there’s a team that owns and enables those processes.

    I’ve always thought of it like a team who owns an API. That API team owns the api, but if another team wants to use said API, cool, here’s some documentation for it (env configs, OAuth2.0 onboarding, distrolist, future features, etc.). Maybe, depending on the company, there’s a little more “ceremony” around how much the new team will be using the API just from a load perspective. But overall a team is allowed to digest the API with some guidance.

    IMO, this is what should be happening with DevOps/DevSecOps/Operations. They enable the developers to follow some general cookie cutter guidelines with the ability to request adjustments. However, the permutations in what a person can do in operations are so much higher than just a well defined API service.


    In my own career, I’ve found that “ace in my back pocket” is being able to handle a lot of my team’s DevOps and general automation of tasks. But when I’ve coached and mentored folks usually there’s a somewhat clear split between the developers who are interested in learning DevOps and those who just want to stay feature-devs.