4 ms·
I like the general idea, but it feels a bit weird to describe what each specific person did and naming them. Only thinking about working on this team gives me a
by shafyy 2y ago
I like the general idea, but it feels a bit weird to describe what each specific person did and naming them. Only thinking about working on this team gives me anxiety. Also, the weekly cadence is a bit high?
- redrove 2y agoExactly, this only made me feel sorry for the people working there. Weekly updates by naming and shaming every team member would cause me so much anxiety even if they were just internal. I’ve been on SRE/infra teams my entire career.
- lbotos 2y agoI'm not on SRE teams so I'm curious how your team works: - Is it remote? - What is the update cadence? - Is this information shared with Manager and "manager communicates team status"?
- tptacek 2y agoWe talked with the team before this went up --- originally, it had people's full names on it, which nobody liked. I think a lot of people here have had bad experiences in other company cultures that don't apply here; we're a profoundly bottom-up team (we don't have product managers, ICs [across the board] own chunks of the roadmap, EMs don't assign work) and signing names to things that get done probably makes more sense here than it does elsewhere. That's not to say we don't have internal dysfunctions, or that we don't do things that annoy engineers. Just that that our dysfunctions are different. Weekly feels right to me. We'll see how it goes.
- kungfufrog 2y agoJust out of curiosity, and since this is vaguely related to the content, how has Fly.io adjusted to SOC 2 when it comes to infrastructure changes and deployment? I read a while ago about how you guys passed SOC 2 which was an enlightening read, but I'm curious what systems you have put in place to keep velocity going and how you manage change more generally across infrastructure? My current experience is that once we started transition to SOC 2 compliance and brought in new processes everything crawled to a halt, we now have multiple layers of reviews and scheduling, and the bureaucratic process is followed at the cost of expediency and doing sensible things in a sensible way (i.e., everything must follow the process, no matter how trivial or significant.)
- tptacek 2y agoWe have a "SOC2 review" regime, for a security-sensitive subset of our code. The very most important thing to remember about SOC2 is that your auditors are attesting that you meet a standard that you yourself set. If you set a standard for yourself that every single change anywhere is going to be reviewed in triplicate, that's what auditors are going to check you on. So the key is to be extremely deliberate about the standard you're setting in your initial Type I. Every auditor is going to want to see some kind of change review, but the purpose of that change review is something you determine, not them. For us, the SOC2-auditable change review process is about ensuring that people merging PRs aren't 3 raccoons in a trenchcoat; it's not a vulnerability management process. The trap people fall into is that SOC2 is often the point at which they start paying attention to security process as a whole, and they led SOC2 lead security process for them. No! Death! Be thinking about security from day 1, and have clarity about what subset of your security process you want SOC2 to measure and track.
- kungfufrog 2y agoThank you so much for the considered response. Very insightful and it's given me some food for thought.
- lopkeny12ko 2y agoIf you are a member of the team, and are actually getting things done every week, what is there to be anxious about? It's a great accountability mechanism.
- shafyy 2y agoIt would just stress me out. But I guess everbody is different.