As I am sitting at Schipol Airport, contemplating that the airport is so big it has a branch of the Rijksmuseum, I can’t help but thinking about the fabulous conference I’ve just been to. The DevOps Enterprise Summit 2023 has exceeded my expectations. But before I get to there, I’d just like to develop the airport metaphor a little bit. So here I am, looking at culture.

Why was it that at Schipol, one of the busiest airports in the world, it was a breeze to get through security, airport security agents were smiling, cracking jokes, I could leave my laptop, toothpaste and deodorant in the bag and they have art in the middle of the airport, goddammit.

Contrast that to when I set off from Manchester, where the security guys looked stressed, kept shouting to step forward onto the orange square and reminded us that if we don’t remember to take our toothpaste out of the bags, we will probably have to stay at security for hours and miss our flights. And the only artful thing in Manchester involved finding a path through the neverending duty-free shopping temple.

I thought this was about DevOps

Well, it is. Earlier in the day, Jason Cox opened up the second day of the DevOps Enterprise Summit 2023 conference with a magical tour of Disney’s DevOps culture. And what a journey that was. Much like their rollercoaster rides in the Disney resorts, the talk was peppered with popular culture. I’m not sure whether I will dare the Disney copyright lawyers by reproducing an image, but let’s suffice to say it was illuminating. Sod it, here goes:

Jason is in charge of the shared technical services that make all of Disney work - the film productions, the streaming services, the rides and probably the legal department too. And there were three points that really resonated with me. Jason described the importance of

1. Listening
2. Empathy
3. Actually Helping

Instead of waiting for teams to come to him for help, he would seek out problems. His teams would actively try to understand the issue, rather than telling their internal customers what they did wrong. Actually helping rather than just referring to a ticketing system.

How simple is that!

Probably not as cool as revealing that the Disney Shared Services team transformed technology so far that engineers can sit in the ride on their laptop, make a commit and test it on the next round. How’s that for a fast feedback loop (-the-loop).

There’s a really important lesson in there for me. Good software engineering is not about reacting to problems, but to seek out fires before they burn. It’s not about throwing technology at a problem, but to really gain an understanding of what is needed. That means being proactive and creative.

Be Fast, Stay Fast

Next along were Fernando and Thomas from Adidas. It can’t have been fun for them over the last few years. The headcount halved, the pandemic played havoc with their supply chain (insert inappropriate joke about viruses in software supply chain here) and their most profitable collaboration ended when Kanye went off the rails.

And yet, it was really interesting in how they used language to create abstractions for their service catalogue. Rather than talking about hundreds of services, they would group them into capability diamonds. And those diamonds can then be used to communicate and reuse capabilities, allowing them to pivot and exploit new market opportunities quickly.

Interesting how important a shared language is.

Failure without Pitchforks

Next was Jennifer, who gave an insightful talk about learning. My biggest takeaway was that

Learning in adults is all about confidence and fighting imposter syndrome

She described how learning is something that needs to be targeted and depends on the maturity, familiarity and experience of the students. And failure is an opportunity to improve and learn, not for brandishing pitchforks.

Saving Christmas

While we’re on the topic of pitchforks, Simon Skelton from John Lewis Partnership and Chris Rutter from Equal Experts gave us a whistlestop tour on how they took the partnership from 12 releases a year to safer and easier deployments. A couple of weeks ago, I was at an internal JLP conference which showed off how easy it was to stand up pipelines these days. They dared to do a live demo then and managed to go from zero to deployment in 30 minutes. No live demo in Amsterdam, but impressive to see how they were able to stand-up

• Cross-cutting security controls
• Bring-your-own scanners
• Common dashboards and visibility for stakeholders

with just a couple of weeks of spiking and largely open source software.

Now that’s what I call a safe Christmas! (Because Christmas only truly starts when the John Lewis Christmas ad airs on telly).

Why are we counting?

Next up, my head nearly exploded. John Willis went back into history to describe who influenced Deming, and we looked at DevSecOps through an operational lense. If I can be honest, some of this went straight over my head and at the beginning of John’s talk I wondered what I was doing there. But by the end, I liked where the themes were going:

• The method of measurement is important
• In complex systems, definitions matter
• Charts should not be used to answer questions but to find patterns and ask new ones
• Verification and validation are two different things

This started me thinking about governance, and how we can check and control. Definitely not the easiest talk to listen to, but certainly thought-provoking.

Crisis? What Crisis? That Crisis!

By now, my head is filled with lots of ideas, and to be honest, the intensity of the conference was making my head hurt. Well, it would have done, if the adrenaline of excitement wasn’t keeping me going.

I’ll lump together the next few talks - and I’ve skipped some entirely (no reflection on the quality) but they were interesting experience reports. Ranging from Marks and Spencers who went from being stuck in the mud where good people were leaving to pushing Developer Experience (DevEx) so far that new joiners can commit on the first day. There was Sophie from UCL who reported that the pandemic had been the force for agile change and how they were able to bring DevOps to university and Stephen Magill who also used history to illustrate how crisis drives regulation, culminating with Log4j driving us to SBOM and Cambridge Analytica to GDPR.

Never let a good crisis go to waste

Churchill’s quote (as used by Stephen) provides a great way of linking those three together. And it’s true, I often find that the only time something gets done, is when something went wrong. You could argue, failure is not an option, it is inevitable. But it’s how we react, what we learn from it that shows what we’re made of.

We’re doing quotes now?

There are two further quotes that I’d like to highlight

No roles, only role models

Topo Pal described what made him decide to go to Fidelity. I think that’s a great quote as it shows the importance of working together and treating each other as humans, not a hierarchy. I am a fan of flat structures. (shameless plug: Equal Experts is pretty good at that too - something that the name suggests)

And lastly, it was Jon Smart’s turn for a little history lesson, starting from the first tribes (not the Spotify ones, the prehistoric ones), via the industrial revolution to soulless cubicle farms led us down the garden path of silos.

Incentives Eat Everything Continuously

Humans are driven to

• Seek incentives
• Avoid threats

And so much can be explained by this. From office politics, to promoting useless colleagues away from where they can do damage, to the fight shadow IT and real IT.

Final Thoughts

There has to be a Better Values Sooner Safer Happier way! I think that’s what made me think at Schipol airport. I thought, Schipol is much bigger than Manchester, so it’s going to be a nightmare. I’ll be stuck at security for ages, and will probably have to walk miles and miles to get from the entrance to the gate. But for all its size, it felt smaller, easier and friendlier. And I think there’s a lesson there. No matter how big the company, it is always possible to organise such that teams are smaller. It is not a given that big corporations are massive behemoths that can’t change direction easily and have layer upon layer of hierarchy shouting at you what to do.

Be smaller, be more agile, be faster. Be more Schipol!

Tags does-2023 conference agile security

If you'd like to find more of my writing, why not follow me on Bluesky or Mastodon?