5 ms·

I've never met a developer that could setup a MPLS circuit or OSPF over an IPSEC tunnel. The author says that developers can do these things, but I highly doubt

by scurvy 11y ago

I've never met a developer that could setup a MPLS circuit or OSPF over an IPSEC tunnel. The author says that developers can do these things, but I highly doubt it. Let alone be proficient enough to do it in JunOS and IOS. Network operations should not be lumped in with devops.

uniclaude 11y ago
> The author says that developers can do these things. I couldn't find this in the article. You sound even more outraged and polarized than OP is. I've met more than one developer able to do this (hint, I can also do it). Some people are actually paid to write networking software, and they often have a clear understanding of how JunOS and IOS work. This said, for different reasons, I agree that network operations should not generally be done by your development team, but no one is arguing this anywhere.
- scurvy 11y ago
  No I wasn't really outraged at all. My stance is that at some point you should stop trying to hire "full stack" developers. Chances are, they're not very good at everything and will miss some tiny detail that blows up big or creates a mountain of technical debt. Outside the founders and first three engineers, you shouldn't be hiring "full stack." You should start to specialize and start fixing the first five employee's problems. As the business grows, you're going to need some specialization skills for some project or deal that comes your way. You should hire the right person for that job. Chances are, you needed them all along and this situation is a good catalyst to get them in.
amelius 11y ago
I think the point of the article is that if developers were required to do this, they could do it.
- bryanrasmussen 11y ago
  yeah I think I could figure out how to do it by reading a bunch of documentation, set up some scripts to do it, whenever I have to do it take longer than necessary until I had done it enough times that I had it as one of my remembered functions, and basically perform subpar on doing this thing. Which I guess is the author's point.
zamalek 11y ago
> The author says that developers can do these things, but I highly doubt it. Being able to do something from memory is something we only care about in high school. Take me, for example: did my router support L2TP termination? No. Did DD-WRT support it out of the box? No. What a developer can do is cobble together information in order to find a working solution. So would I, as a non-Dev-Ops be able to set up MPLS over IPSEC, having never done it before? Yes: I have Google and I have a brain between my ears.
- levosmetalo 11y ago
  And then you happily charge 10x more than a networking guy.
- devnonymous 11y ago
  As a sysadmin in a prior life, I see this as the equivalent of a non-developer (for instance, a sysadmin) asking can I create a site scraper using google, curl/sed/awk/..bash, copy/paste and a little bit of of brain between my ears ? Yes. As a developer you know there is a lot my subtlety to programming than that. I think what @scurvy was driving at is there is a lot more subtlety to network ops than developers would be willing to acknowledge.
  - deleted 11y ago
    [deleted]
  - scurvy 11y ago
    Yes, indeed that was my point. While the two examples I gave were easy to Google and get a "functional" setup going, there are enough things there to blow up in your face if you just go with the StackOverflow/ServerFault answers. You're going to run IPSEC, which DH group are you going to use? What cipher? How often are you going to rekey? Should rekeying be based on bytes, time, or both? Your Juniper box is connecting to a Linux tunnel server. What should your inner and outer identities be? I haven't even come to OSPF yet... While just an example, it shows that our professions all have subtlety and nuance to deal with. You gain the ability to handle this through experience, not Google. Throwing a "full stack" developer against every problem is definitely not the solution.
glenjamin 11y ago
Having recently tried to do this & similar in a "DevOps" capacity, before handing the task over to a network engineer, I have to concurr here. However, the problem seemed to stem from cryptic tooling and almost non-existant documentation (especially on OSS tools).
sargun 11y ago
Two things: 1) The developer would just say - no, instead I'm not going to use IPSec, and I'm going to bootstrap this myself with TLS. I'm going to push complexity UP the stack, not requiring esoteric network hardware to do this. 2) I think this is a bug. The fact that the underlying devices don't have easy to understand semantics is problematic. I think that if an interested developer had a program that requires MPLSoIPSEC, they would consider it, read the relevant RFCs, and then read Junos's documentation and give up - because it's locked down.
- scurvy 11y ago
  1) What if your deal partner (who intro'd the requirement for IPSEC) has a corporate security policy of IPSEC? You need the business, you'll do what they ask. Also, you can do IPSEC on every major OS, no hardware required. 2) Again, you could use Linux for this. You can ask the whitebox switch guys, but there's a lot of stuff Linux can't do. It's a great cause and I've got a few whitebox switches in my lab, but there's definitely still a place for Cisco and Juniper in this world.
mattkrea 11y ago
You are right but I don't think a lot of this is what is actually being done when it comes to whatever 'DevOps' means. Where I work I'll push into production a few times a day after testing in staging and the only changes really are what container is running what code. The firewalls and routing tables I don't manage and with good reason (unless they are on AWS since security groups are pretty cut and dry but even those basically don't change much after initial configuration)

by scurvy 11y ago

uniclaude 11y ago

> The author says that developers can do these things. I couldn't find this in the article. You sound even more outraged and polarized than OP is. I've met more than one developer able to do this (hint, I can also do it). Some people are actually paid to write networking software, and they often have a clear understanding of how JunOS and IOS work. This said, for different reasons, I agree that network operations should not generally be done by your development team, but no one is arguing this anywhere.

scurvy 11y ago
No I wasn't really outraged at all. My stance is that at some point you should stop trying to hire "full stack" developers. Chances are, they're not very good at everything and will miss some tiny detail that blows up big or creates a mountain of technical debt. Outside the founders and first three engineers, you shouldn't be hiring "full stack." You should start to specialize and start fixing the first five employee's problems. As the business grows, you're going to need some specialization skills for some project or deal that comes your way. You should hire the right person for that job. Chances are, you needed them all along and this situation is a good catalyst to get them in.

amelius 11y ago

I think the point of the article is that if developers were required to do this, they could do it.

bryanrasmussen 11y ago
yeah I think I could figure out how to do it by reading a bunch of documentation, set up some scripts to do it, whenever I have to do it take longer than necessary until I had done it enough times that I had it as one of my remembered functions, and basically perform subpar on doing this thing. Which I guess is the author's point.

zamalek 11y ago

> The author says that developers can do these things, but I highly doubt it. Being able to do something from memory is something we only care about in high school. Take me, for example: did my router support L2TP termination? No. Did DD-WRT support it out of the box? No. What a developer can do is cobble together information in order to find a working solution. So would I, as a non-Dev-Ops be able to set up MPLS over IPSEC, having never done it before? Yes: I have Google and I have a brain between my ears.

levosmetalo 11y ago
And then you happily charge 10x more than a networking guy.
devnonymous 11y ago
As a sysadmin in a prior life, I see this as the equivalent of a non-developer (for instance, a sysadmin) asking can I create a site scraper using google, curl/sed/awk/..bash, copy/paste and a little bit of of brain between my ears ? Yes. As a developer you know there is a lot my subtlety to programming than that. I think what @scurvy was driving at is there is a lot more subtlety to network ops than developers would be willing to acknowledge.
- deleted 11y ago
  [deleted]
- scurvy 11y ago
  Yes, indeed that was my point. While the two examples I gave were easy to Google and get a "functional" setup going, there are enough things there to blow up in your face if you just go with the StackOverflow/ServerFault answers. You're going to run IPSEC, which DH group are you going to use? What cipher? How often are you going to rekey? Should rekeying be based on bytes, time, or both? Your Juniper box is connecting to a Linux tunnel server. What should your inner and outer identities be? I haven't even come to OSPF yet... While just an example, it shows that our professions all have subtlety and nuance to deal with. You gain the ability to handle this through experience, not Google. Throwing a "full stack" developer against every problem is definitely not the solution.

glenjamin 11y ago

Having recently tried to do this & similar in a "DevOps" capacity, before handing the task over to a network engineer, I have to concurr here. However, the problem seemed to stem from cryptic tooling and almost non-existant documentation (especially on OSS tools).

sargun 11y ago

Two things: 1) The developer would just say - no, instead I'm not going to use IPSec, and I'm going to bootstrap this myself with TLS. I'm going to push complexity UP the stack, not requiring esoteric network hardware to do this. 2) I think this is a bug. The fact that the underlying devices don't have easy to understand semantics is problematic. I think that if an interested developer had a program that requires MPLSoIPSEC, they would consider it, read the relevant RFCs, and then read Junos's documentation and give up - because it's locked down.

scurvy 11y ago
1) What if your deal partner (who intro'd the requirement for IPSEC) has a corporate security policy of IPSEC? You need the business, you'll do what they ask. Also, you can do IPSEC on every major OS, no hardware required. 2) Again, you could use Linux for this. You can ask the whitebox switch guys, but there's a lot of stuff Linux can't do. It's a great cause and I've got a few whitebox switches in my lab, but there's definitely still a place for Cisco and Juniper in this world.

mattkrea 11y ago

You are right but I don't think a lot of this is what is actually being done when it comes to whatever 'DevOps' means. Where I work I'll push into production a few times a day after testing in staging and the only changes really are what container is running what code. The firewalls and routing tables I don't manage and with good reason (unless they are on AWS since security groups are pretty cut and dry but even those basically don't change much after initial configuration)