security anti-patterns in your dev-ops design

The UK government has published this friendly guide to the most-common anti-patterns they have observed in large companies across the commonwealth realm.  And I, personally have seen all of them recently; Uh oh.

Reminder about Testing Accuracy in a population

Here a review of Bayes' Theorem and its application to remind us how estimations from small samples (even a million tests) are extremely inaccurate: 

P(A|B) = P(Covid|Test) = P(Test|Covid) * P(Covid) / P(Test) =
  0.99 * 0.01 / (P(Test|Covid)*P(Covid) + P(Test|~Covid)*P(~Covid)) =
  0.99 * 0.01 / (0.99*0.01 + 0.01*0.99) = 0.5

This question is on every MCAT exam but doctors forget it as soon as they begin practicing.

continuous delivery oppa gitops style!

Back in 2017, Alexis Richardson coined the term "GitOps" to describe operations by pull requests.  Now, the container solutions folks have written a fun evaluation of FluxCD, ArgoCD and Jenkins-X to compare continuous delivery pipelines in what they call "GitOps Style."  Oppa gitops style! GitOps Style can be summarized by these rules:

1. Store all Kubernetes resource configuration in Git
2. Use only pull requests to modify resources on that Git repo
3. Once Git is modified, apply changes to the cluster immediately and fully automated
4. If the actual state drifts from the desired state, either correct it or alert operators about it

The authors restrict their analysis to containerized kubernetes-managed environments.  But the principles apply broadly.

Genghis Khan and the Quest for G-d by Jack Weatherford

Dense and well-researched, mildly interesting, interesting revelations and bizarre twists. 3/5 Stars.

Good news about vaccine development

(click image to enlarge)

ArsTech published a great round-up of the 102 vaccine candidates' progress today and Bill Gates wrote up some details about how quickly we are moving. In broader terms, the capability these efforts enable will be re-used in the future as we enhance the health of all humans to treat and contain infectious disease.

Martin Fowler on Branching strategies in software

Martin Fowler wrote a fantastic explanation of the best patters for successful merging strategies, including my favorite short-lived feature branches pattern. Make sure to skim this one!

The long walk by Stephen King

I consider Stephen King to be one of the best 20th century writers in the English language and I am sorely disappointed he chooses to write in the "Horror" genre because I really don't like horror, even when the prose is crafted so exquisitely.  Every few months, I dip into a Stephen King book to be elevated by the sublime, exquisitely crafted writing and literary genius of this fabulous author.  I (almost) always enjoy the experience.  Great horror story, 4/5 Stars. @StephenKing: Please write more historical fiction and thrillers.

Maps, Territory, and Naming in our Software

I recently started reading through Kai Wai Cheung's book on "Naming things," in software development and wrote about why I am interested here in my blog.  I also gave this keynote presentation about inferring user identity a while back where I touched lightly and obliquely on this topic of naming variables and database fields with words such as "visitor" instead of customer to account for bots.  I have recently come across a few situations at work where the mental models of my peers are unrelated to the reality we are seeing. The problem is amplified by the names we attach to the entities we discuss, and the lack of shared meaning (common understanding ) among the people discussing "the territory" of our business phenomenon.

The Map Territory relation

From wikipedia: 

The map–territory relation describes the relationship between an object and a representation of that object, as in the relation between a geographical territory and a map of it."

In the example from my presentation on inferring a person's identity from their behaviors instead of relying on their cookies, sign-in credentials, what they have, what they know, etc. I recommend that database fields, object names, code variables, and other naming of the entity connecting to your web site be labeled "visitor" instead of "user."  And instead of confusing an account with a single, registered "user" we should carefully name the entity an account.  After all, one person or bot may have many accounts, and one "household," "shared," or "company" account may have many different people or programs operating using that account.

The same many-to-many mappings exist for devices to humans (or bots) and most other identifiers.

Cause - Effect Confusion

Among the many, odd business situations I encounter at work, one of the most frustrating is confusion and frequent self-deception about causation, correlation, bias, and the prediction afforded by evidence-based science.  I wrote about one example relating to agile practice a while ago. The "cargo cult" practice or belief that when B follows A that A causes B, or in Latin: post hoc, ergo propter hoc is much worse than one would expect in business.

As always, I welcome your comments, good, bad, and non-sequitor.

We are poisoning ourselves because of our paranoia

The US centers for disease control (CDC) has released a study indicating that Americans are poisoning ourselves trying to kill the respiratory infection over which the world has lost its collective mind.

YAML intellisense completion macro family for vim

If you spend a lot of time editing kubernetes YAML in vim, consider checking out this introduction to coc-vim and coc-yaml.  Video version here.