David Kirkpatrick

James Berthoty gave a powerful talk at Upstream this year, walking us through the hell of understanding where vulnerabilities actually lie, and why firing "fix this" at upstream application libraries is a waste of your time, and maintainers' time. This is a great watch if you need to feel seen as a developer, or a great share if you need a little more empathy from an adjacent team at your company 😇 See the full talk, How can we get CVEs out of GitHub Issues?, here: https://lnkd.in/eg4tuGCp

8

Had a chat with Eric Meyer and Brian Kardell about CSS masonry, does it belong in the grid spec or not? With a bit of a discussion about how and why we ask for developer feedback on CSS. https://lnkd.in/d3C-_dwq #css

33

Interesting discussion with Dave Farley and Emily Bache. There are a lot of things that I agree with in it, however the one main sticking point that I have is that a true "engineer" in the more common incarnations, Mechanical, Civil, etc, require registration and licensing from a local state/district and/or governing body. I'd LOVE for programming to have such a system, but we currently don't. That's one reason why I settle with code craft and call myself a crafter. I agree it's not a perfect term, but to me its better than giving the false impression that there's a standard of skillset or understanding like other engineering disciplines. What do you think? https://lnkd.in/gXqmkden

15

31 Comments

https://lnkd.in/eeK6tQUP Mentoring really has been one of the most rewarding experiences.

7

1 Comment

We got on the subject of #ThirdPartyServices, specifically the hidden traps you overlook when choosing to use them. My colleagues Nikita Ragulya and Alexander Ryazantsev already shared their experiences about the headaches these can cause in a project. Oh, I have something to add to this. Costs! Guess what, I even have an entire article about it! You can read the full thing if you want, but I’ll sum it up here in a few words. People think that the small fees for using #ThirdPartyServices are nothing compared to the cost of developing similar features in-house. That’s true. But over time, those small expenses add up, penny by penny, and you might be stunned by the total. In my article, I talk about a real-life case: a customer had been using #GoogleAds for years and decided to switch to their own code. Not to cut costs, but to provide a better interface for content managers. And they were stunned when the platform made over a million dollars in profit in the very first month with the internal ad placement. So, when you’re looking at the costs of custom development and #ThirdPartyServices, just remember - things aren’t that simple! But let me also say - Yes, it’s important to consider all this, but there’s no need to demonize. Often, #ThirdPartyServices are super convenient, affordable, practical, and great. #Cyfrania My article link: https://lnkd.in/e8KtiyFE

18

After a year of work my book Building A Startup - A Primer For The Individual Contributor is finally available! https://lnkd.in/erThxvpP If you’re working in or around startups as an IC or technical leader this book is for you. It’s based on 20 years of startup work and will help set you up for success to do more with less, move faster and more correct, and spend more time building features and product people love and less time banging your head at roadblocks and bottlenecks.

115

12 Comments

Having a ton of fun writing an ORM for V2 of Case Kit. Typescript has such an incredible type system. I have autocompletion for column names, the ability to include relations, relations of relations, etc etc etc... all returning properly typed data (no classes in sight). It's been really satisfying seeing it coming together, and it's been great getting my hands dirty with some (relatively) complex generics. And to head off the obvious question… why aren’t I just using Prisma? Well there’s a couple of things I’m doing differently that I think are marginally better: there’s no code generation involved here, it’s just types (inspired by Drizzle); there’s no Rust binary you need to deploy, and it hews much closer to Postgres behaviour and syntax (the aim here is not to abstract away which database you’re using). But the real blocker to me using Prisma was that its extensions don’t support modifying queries of nested relations - a hard requirement for me due to the way I have multitenancy and soft deletes set up. It’s not shown in the video but the Case Kit ORM lets you write simple middleware that will be applied to every level of a nested query. Perfect for setting timestamps or adding clauses on tenant id or things like that.

21

Imagine this - you're onboarding a new engineer onto a codebase, and they hit every error/exception after every CLI command. They're trapped in the proverbial "config hell". Then a security vulnerability for their toolchain comes out, and they have to go through "config hell" all over again! And then when it's finally working, they realize they need more compute, load their application onto some beefy cloud hardware --- but forget to turn it off ($$$!!) Multiply this problem by the number of engineers you're onboarding/supporting and this is the nightmare scenario of wasted time and money for Enterprise CTOs/CIOs. Coder solves these problems with it's Cloud IDE -- getting engineers to their 'flow state' faster. Thrilled to enable developer productivity with the Coder team.

19

2 Comments

I just blogged about the benefits of contract-first API development. If you and your team aren't following this approach, I encourage you to read on and learn why you may be missing out on a practice that can help your team be more productive.

8

Are you looking to improve your development team's focus and accelerate cycle time? 🤔👨‍💻 My latest blog post gives a concise overview of why vertical slicing could be the solution you've been looking for! 🚀💻 With a few examples of its benefits, you can quickly assess whether this approach is right for your team. 🔍💡 As a special bonus included all of the Lucidchart and Noun Project links 👇 #verticalslicing #softwaredevelopment #developmentefficiency #productivityboost

15

Check out our second AI feature we've added to the platform below!

19

1 Comment

If you have built and operated an application or service that relies on an operational database in production, you will immediately understand the insane amount of value that these features deliver.

10

Should senior tech leaders commit code? I'm not talking about tinkering in a sandbox or replit for fun. I mean to your company's live systems? I truly believe if you're going to support the people who work in tech, you have to know how that role feels. Not 10 years ago, Now. I believe all senior leaders in tech focused companies should attempt this at least once, tech background or not. Today I did a very simple PR, I had support and I was called out for using the wrong wording for review by one of our engineers 😍 (Which I LOVE, folks should feel safe enough to call you out!) but I did it. I really enjoyed it. A spark of what techie me used to feel flared up again. This is what got me into this industry. I was creating ❤️ Engineers were happy to critique me, and I value that, this is where they are the experts. No free pass for the director! Their comments were of course, correct 😍 I also felt the frustration of some of our processes (we've all got things that could be better!!) and with that visibility I can help drive change. I've challenged the whole engineering management team to do the same.(Phil Doyle, ☁️Andy 🔒 Bold, Anita Dreosti, Dean Stevens) Should senior leaders commit code? HELL YES!! A huge thank you to Paul Reardon for keeping me (and our company) safe and walking me through processes I'd not done before. I've had an awesome day 😎

94

6 Comments

We love hearing from people who use Time Travel Debugging (TTD) to dramatically reduce the time spent diagnosing issues. Our security team recently worked with the compiler team to solve a nasty deadlock when using ASAN and shared their journey. In the narrative below they make use of the reproducibility that trace files offer along with hardware breakpoints to solve the problem. If you already know how to debug with Windbg the barrier of entry to TTD is low. As a bonus tip, you can use the timeline view to construct call queries or memory queries instead of using breakpoints and stepping through execution. Or, you can use “dx -g” with a call or memory query to generate a table of information about the call parameters / memory values / etc (my favorite!) Do you have a good story to tell? Please share as inspiration for all of us! ----- When rolling ASAN out across Windows, we hit an interesting bug on a particular build target. Without ASAN the program worked as expected, however when we turned on ASAN we experienced a deadlock every time. I threw the program into TTD and the problem reproduced immediately. From the trace, I could see all threads were blocked on a lock. From there, I rewound the trace to the start, setting a breakpoint on the locking functions, conditional on my specific blocking lock, then executed forward. Very quickly I could see that one location locked the lock, but its epilog ended up calling unlock with a different point. Returning to the trace with the compiler team later, we were able to narrow down the issue to a specific place where, under ASAN combined with a tailcall, the stack would not be appropriately adjusted causing the saved registers to be clobbered. These clobbered registers then got fed into the unlock routine, leading to the inconsistent lock state and eventual deadlock. The fix for this issue is in VS 2022 17.10 Preview 3. Start to finish, from reproducing outside of the debugger to identifying the offending codegen took around four hours, with another hour spent later with the compiler team to identify the specific behavior that was at fault. Without a TTD trace, root causing this would have taken much, much longer. While I find TTD valuable in day-to-day debugging, especially in instances of toolchain issues, the time saved by the replayability is incredible.

45

4 Comments

Just launched a HUGE update to SciSummary. You can now ask questions about figures and tables in papers and get answers specifically from those tables/figures. It's able to interpret the data in the tables within the context of the paper itself, not as a standalone entity. You can even see here it's smart enough to extract data from the tables! Upload any PDF of a research paper and try it out for free today on SciSummary. https://scisummary.com #DataExtraction #Research #ArtificialIntelligence #Science

24

1 Comment

Maybe it's a hot take, but I've always found production support rotation to be an engaging and low-stress part of building software. Production support is a critical part of any startup's process (at least if you have users). But beyond the process, production support *culture* has a huge impact on the happiness of both your customers and your team. Here's how I frame it to keep things engaging, rewarding and low-stress. https://lnkd.in/eFd9MCcu

12

Be sure to mark your calendars for this one! #kcdnug #dotnet #questanalytics

3

I first came across Kyle's Jepsen series (https://jepsen.io/) back in 2015 and since then I have learned a lot about distributed systems and databases through his analyses on how these systems break and what guarantees they truly uphold in case of unexpected, but realistic, failures. We had a great time talking to Kyle about how he built a business around his passion for distributed systems, the mechanics of starting a consulting business (pricing and structuring contracts) and how to get better at writing. Whichever database or queues you work with, chances are, Kyle has analyzed how it breaks. Even if you don't listen to the podcast, I highly encourage software engineers to check out https://jepsen.io/analyses and build a better understanding of the system you use in production.

15