15 ms·
Encouraging to know this model scales to 100 employees at least. Purely out of intellectual interest, I wonder if a company the size of Google or Facebook coul
by wamatt 14y ago
Encouraging to know this model scales to 100 employees at least.
Purely out of intellectual interest, I wonder if a company the size of Google or Facebook could also ship in this way, or if the whole release manager/team is essential.
- xxpor 14y agoAmazon generally doesn't have release teams (except for the retail website). I can't find it right now, but I know someone gave a talk on Apollo, which is how Amazon does deployments.
- shabble 14y agoI think I know the thing you mean, but I can't find it either. I did find 'flippers' from Flickr[1] which sounds like a very similar "keep it all in master and turn stuff on and off" methodology. [1] http://code.flickr.com/blog/2009/12/02/flipping-out/ http://code.flickr.com/blog/2009/12/02/flipping-out/
- xxpor 14y agoHere we go: http://news.ycombinator.com/item?id=2971521 http://news.ycombinator.com/item?id=2971521
- bdonlan 14y agoI think you might be looking for this: http://www.youtube.com/watch?v=dxk8b9rSKOo http://www.youtube.com/watch?v=dxk8b9rSKOo
- jrockway 14y agoSarbanes-Oxley puts a big damper on production deployments at big companies. I don't fully understand it so I won't try to explain it. (I will complain though: the law says developers shouldn't have control over production systems. If that's a requirement, who's going to write the software?)
- tomjakubowski 14y agoWait, what? Could someone elaborate on S-O restricting developer control over production systems?
- kscaldef 14y agoA lot of this stuff is open to interpretation by auditors. SOX doesn't literally specify any of this sort of stuff. In my experience, SOX usually ends up meaning that developers don't have access to production systems, or significantly limited access. However, a continuous deployment system should generally be very much in the spirit of SOX, in that it's pretty hard to do without well-defined, highly-repeatable, automated and auditable processes.
- cam- 14y agoEveryone just 'knows' what is in Sarbanes Oxley but when you ask them to point it out to you in the legislation they cannot find what they were so certain about 2 minutes prior. We have compliance people and auditors are always coming in, but when someone claims something is required for Sox compliance, challenge them on it as 99% of the time it is a convention because someone told them, or they did it like that somewhere else once, rather then what is required by law. At the least it will make them justify the compliance/overhead they are causing you to do as an engineer. Here is the legislation if you want to read through it or use it to challenge someone's assumptions about the Sarbanes-Oxley; http://www.sec.gov/about/laws/soa2002.pdf http://www.sec.gov/about/laws/soa2002.pdf
- scylla 14y agoI don't know if that's a SOX law. However, I do know that it is a PCI requirement. A single person shouldn't be able to introduce new code and then be able to push their own change out to production.
- willthames 14y agoCan you point to the bit in the PCI spec that says that? My understanding is that people should only have access to the systems they require. But that doesn't stop a developer having access to a continuous deployment server that can push code that meets requirements to production. But that's based on my memories, and may not reflect reality.
- andyjohnson0 14y agoArs has an interesting article about Facebook's release engineering process [1] with a discussion on HN. My impression is that the different scale and technology mix at FB would make it difficult for them to deploy as frequently as github. [1] http://arstechnica.com/business/2012/04/exclusive-a-behind-the-scenes-look-at-facebook-release-engineering/ http://arstechnica.com/business/2012/04/exclusive-a-behind-t... [2] http://news.ycombinator.com/item?id=3803026 http://news.ycombinator.com/item?id=3803026