4 ms·

It certainly helps if one begins with experienced engineers. I am not talking about personal projects, I am discussing funded startups. If your team has not run

It certainly helps if one begins with experienced engineers. I am not talking about personal projects, I am discussing funded startups. If your team has not run servers on their own in the past, get a different team. It is not as if there is not a giant population of grey beards with this knowledge seeking work... I accept your points, but far too many inexperienced devOps are given keys that should not have them. From your Docker story, it sounds like poor decision making on your behalf. Just because a developer knows Docker does not mean they know how to expose that securely to the public - far too many devs believe that's not their job.

ghaff 5y ago
>It is not as if there is not a giant population of grey beards with this knowledge seeking work... Really? There is a giant population of senior experienced engineers looking to do basic a lot of basic sys admin stuff? And they're willing to work for peanuts, right? By the way, I totally agree with your basic point. The developer probably downloaded some images from a random public repo. As you say, far too many devs think security is someone else's problem and then get upset when the security person blocks their app going into production.
lbriner 5y ago
I'm not sure which companies you are talking about here. I work for a small startup and between us, we have plenty of experience of maintaining servers but that doesn't mean I would bet my company existence on me not forgetting to setup the firewall correctly. It also doesn't account for all of the out-of-hours stuff we need to do. Even with a hosted solution and a lot of paid-for services like Cloudflare, we still have to check out every unusual error email, everything that seems out of the ordinary. If you are 200+ people, great, you probably already have a team to manage this. If you are small like 90% of companies then you won't and I want to spend my time on the things I am expert in.
qayxc 5y ago
> Just because a developer knows Docker does not mean they know how to expose that securely to the public While that's certainly true, I think you missed the part where the guy specifically applied for a DevOps position. The "Ops"-part wasn't optional and exposing a test system to the public in the first place is a big fail in and of itself obviously. But that's besides the point: the point was that operating even a single server is more complex than many people tend to admit and you just confirmed this statement. I also don't understand how you jump from "it's not hard" and "big scary nothing" to "funded startups" and getting a "different team" preferably consisting of knowledgeable "grey beards". Which is it? Is it simple enough to learn on a rainy weekend or do you actually need dedicated trained and/or experienced professionals, because far too many devs are unsuitable for this? I have trouble following your train of thought tbh.
whoknew1122 5y ago
If something were truly basic and elementary, you should be able to do it after reading a book or passing a multiple-choice test. Now you're saying "if your team isn't experienced, get a more experienced team." Seems like we're moving the goalposts here. If it were so basic, the DevOps person they hired should've been able to do it after taking a 6-7 hour docker course.

ghaff 5y ago

>It is not as if there is not a giant population of grey beards with this knowledge seeking work... Really? There is a giant population of senior experienced engineers looking to do basic a lot of basic sys admin stuff? And they're willing to work for peanuts, right? By the way, I totally agree with your basic point. The developer probably downloaded some images from a random public repo. As you say, far too many devs think security is someone else's problem and then get upset when the security person blocks their app going into production.

lbriner 5y ago

I'm not sure which companies you are talking about here. I work for a small startup and between us, we have plenty of experience of maintaining servers but that doesn't mean I would bet my company existence on me not forgetting to setup the firewall correctly. It also doesn't account for all of the out-of-hours stuff we need to do. Even with a hosted solution and a lot of paid-for services like Cloudflare, we still have to check out every unusual error email, everything that seems out of the ordinary. If you are 200+ people, great, you probably already have a team to manage this. If you are small like 90% of companies then you won't and I want to spend my time on the things I am expert in.

qayxc 5y ago

> Just because a developer knows Docker does not mean they know how to expose that securely to the public While that's certainly true, I think you missed the part where the guy specifically applied for a DevOps position. The "Ops"-part wasn't optional and exposing a test system to the public in the first place is a big fail in and of itself obviously. But that's besides the point: the point was that operating even a single server is more complex than many people tend to admit and you just confirmed this statement. I also don't understand how you jump from "it's not hard" and "big scary nothing" to "funded startups" and getting a "different team" preferably consisting of knowledgeable "grey beards". Which is it? Is it simple enough to learn on a rainy weekend or do you actually need dedicated trained and/or experienced professionals, because far too many devs are unsuitable for this? I have trouble following your train of thought tbh.

whoknew1122 5y ago

If something were truly basic and elementary, you should be able to do it after reading a book or passing a multiple-choice test. Now you're saying "if your team isn't experienced, get a more experienced team." Seems like we're moving the goalposts here. If it were so basic, the DevOps person they hired should've been able to do it after taking a 6-7 hour docker course.