this post was submitted on 20 Oct 2024
3 points (56.5% liked)
Programming
17423 readers
41 users here now
Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!
Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.
Hope you enjoy the instance!
Rules
Rules
- Follow the programming.dev instance rules
- Keep content related to programming in some way
- If you're posting long videos try to add in some form of tldr for those who don't want to watch videos
Wormhole
Follow the wormhole through a path of communities !webdev@programming.dev
founded 1 year ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Your proposed solution to overly complex systems seems to be to ignore the requirements that make them complex in the first place. If that works for you, this is a perfectly fine approach. But most companies with actual signed SLAs won't accept "we'll just have a few seconds of downtime/high latency every time a developer deploys something to production #yolo".
Also, series F but they're only deploying on one server? Try scaling that to a real deployment (200+ servers) with millions of requests going through and see how well that goes.
And also no way their process passes ISO/SOC 2/PCI certifications. CI/CD isn't just "make do things", it's also the process, the logs, all the checks done, mandatory peer reviews. You can't just deploy without the audit logs of who pushed what when and who approved it.
You're not wrong, but not everything needs to scale to 200+ servers (...arguably almost nothing does), and I've actually seen middle managers assume that a product needs that kind of scale when in fact the product was fundamentally not targeting a large enough market for that.
Similarly, not everything needs certifications, but of course if you do need them there's absolutely no getting around it.
For sure, in PCI environments this doesn’t work. And in the Series F company we don’t use this approach for that very reason. But there’s tons of companies that don’t have or need external certifications, and it works for that much more common scenario. For the small web (i.e. most of the web), it’s ideal.
The important takeaway isn’t “wow, doing production builds on your PC isn’t secure.” Do it on a dedicated box in production, then. The important takeaway is there’s a mountain of slow things (GitHub workers, docker caching, etc) which slow developer velocity, and we should design systems and processes which remove or eliminate those pains.