GitHub GitHub Universe 2020: Enterprise - Developer Experience, 11 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Getting better together: What enterprise can learn from global patterns - GitHub Universe 2020

Description

Presented by Nicole Forsgren, VP Research & Strategy, GitHub

In 2020, we’ve had to rethink how to collaborate and build software in the world’s largest trial of remote work. As the year comes to a close, what lessons can we bring to our organizations to empower development teams and embrace the challenges set before us? And what does it all mean for the future? Dr. Nicole Forsgren will share insights on the findings from her past work and the 2020 State of the Octoverse report, including how open source is at the forefront of collaboration.

For more from GitHub Universe 2020, visit https://githubuniverse.com

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

Hi everyone thanks for joining me. I am here to talk all about really some of the latest research. I don't know if you've heard I like research, I like strategy. I really like data. Why? Because it helps us get better. So I do research and strategy here at github in a previous life. Back in the day, I was actually writing mainframe programs, so it feels appropriate that I'm here hanging on the enterprise channel that I was a software developer. I was an engineer. I was building systems, I was supporting them.

A

I was assist admin and then I decided to go. Do some research? I was lead investigator on the state of devops reports for years or the accelerate. Some of you may have heard of it. A lot of that work was based on helping us understand some of the core principles, capabilities practices and processes to help companies of all sizes understand how we can help build and develop software for high performance so that we can really do things that are dope. So what have I been up to lately? I just joined github earlier this year.

A

Well, we just released the state of october's report last week. It was a birthday present to myself and everyone else. We took a slightly different approach this year, so in addition to sharing with the world how github has grown and changed, we also did some deep dives. So if you go to the website, octoverse.github.com you'll see a little button. That says download three reports. Now you don't have to. I was also a professor, so I'm not going to assign some homework, but you may find them really interesting, because the site will walk you through.

A

Some of the highlights that I love it will also share some of the background, some of the nuance, some of the detail or you can watch this talk and I'll walk you through some of my favorites. So let's dig into it.

A

We had quite a year. We have now grown to over 56 million total developers on github. That's some power when we say community, we say community. Now we also see 72 percent of fortune. 50 companies are using github enterprise.

A

Just in the last year, in the last 12 months, we see over 60 million repositories. Were created and 1.9 billion with a b contributions were added in the last year I mean when I say, we've had quite a year. We had quite a year, I don't know about you.

A

We've also had quite a year. We could take a moment. We can feel that right and so when we were designing the research and the research questions that kind of guided our investigations.

A

We wanted to see what this might look like, what we're feeling, what we're doing and how it shaped, not only the activity that we see among developers, but how it might shape and inform our practices moving forward.

A

So this is what we'll talk about today, juggling work and play how automation makes things better and the patterns that we see working better together and then we'll wrap up with securing our systems.

A

So, let's jump in the wayback machine because again this year feels like it's a wayback machine. What we did is we took an investigation across four time zones to see if there are some interesting patterns.

A

These four time zones for development activity include the uk time zone, u.s eastern time zone, u.s, pacific time zone and japan standard time zone. Now we selected these because we have some uh some strong data in these so that they won't be overly influenced by any. You know, significant uh standout organizations and these these time zones also had some pretty strong shelter in place orders now the one I'm displaying here is uk time zone.

A

There are a couple things to notice here, as you take a look at this chart. uh That line where everything's kind of centered is our zero. So if we hadn't seen any changes in activity noticeably compared to the prior year, everything could kind of be hanging along there.

A

uh Here's what we take a look at first, we worked longer take a look at those purple bars uh as we kind of chug along up until shelter and place orders. We see a strong covet effect as we compare the time difference between our first and last get push to the main branch in any repository that we're working in, we see a strong increase right. People are working longer hours.

A

Now I will say a little bit of this is expected right, because once people start working from home even before covet, we tend to work a little bit longer hours because we lose this boundary between work and life, but we see this grows for a while until maybe people are getting used to it a little bit right. Maybe we start adjusting. Maybe we get a little bit better at creating boundaries. Maybe we create a commute right? Maybe we take a lap around the block to kind of separate work and home.

A

So then our next question is well. Are we spreading out work or are we actually doing more work? That's the green line you see is is how much work are we doing for this? We proxied it with the number of pushes that we're doing per day per day. So here we kind of see that kind of jog, along that zero line.

A

Until we initially see shelter and place, orders go into effect and it kind of takes a dip as we're suddenly adjusting to uncertainty and change, and so many things are happening, um kind of comes even and then it jumps. Quite a bit, so it's interesting because overall and we see this fairly consistently across the time zones, many people are both working longer hours and getting more done wonder how we all feel about that. I don't know about you, I feel it so what else did we see, though?

A

We saw that people are really turning to open source. We saw contributions to open source jump initially 40 compared to last year and then, when they settle out, they settle out at about 25 increase compared to the previous year. So as we're all sitting home, what are we gonna? Do we're gonna pick up hobbies.

A

Some of us named the sourdough starter. Some of us played video games. Some of us tried to open source to learn, create turn to our community. It's kind of exciting, because there's so much for us to do. But then then we step back and we're like wait. There are only so many hours a day. How are we working more and on open source more so we took a look by day of the week.

A

Here's what we saw now we are working more. These are kind of light out, but laid out by days of the week, starting with monday uh we're working as much on saturdays and sundays, as we are on mondays.

A

Take from that what you will, but we're working more on tuesdays, wednesdays, thursdays, fridays spend development time we step down that work on saturdays and sundays, and look what happens to open source. So the bars are the are our work, work days, work hours, open, source kind of chugs along and it jumps up on the weekends we're creating time for open source. This is a great opportunity for us to disconnect uh reach out pair with our community.

A

I think it's important for enterprises and teams and managers and leaders to realize that open source is something else. It's something different. We should create space in our corporate cultures and our corporate policies to make sure that we allow our developers this space.

A

Why? Because productivity is personal right, it does provide us this escape.

A

Now I've been chatting with researchers conducting dozens of experiments across and research across many many other teams, and we do see that productivity is personal, as we saw in the previous charts. Many people are spreading out their days.

A

Flexibility is key here and one tip we can say to anyone here: managers developers, one of the big tips we see resonate with many many people- is that it's important to manage your energy, not just manage your time. Some people are finding great success by focusing in the mornings or by focusing late at night.

A

Sometimes people are finding great success from finally having flexibility in the middle of the day to work out or take a nap or or kind of have that flexibility.

A

One of the great things that we also find is that not only do we have a little more flexibility with our work times and our work schedules now that we're home, but by having great flexible tools that allow teams to collaborate across time zones across contexts and across geographies leveraging things like inner source can really help.

A

Because things like automation are really enabling this, we did an additional analysis. We found that once an open source repo starts using actions on their pull requests. We see an 18 faster time to merge that pull request and an increase of 30 more pull requests merged.

A

Now we chose pull request as kind of that interesting perfect little inflection point, because that means you can automate notification of asking people to take a look at that pr or you can then kick off the rest of your development workflow.

A

So look at the impact of automating just one aspect of your workflow: it helps reduce, toil work. It helps reduce manual work, the things that are important to do, but we may not love doing it frees up time to do the things that we love. It improves our developer experience it kind of greases the wheels for the rest of what's great.

A

And I think that's also important to realize. Is this isn't just about productivity?

A

Yes, we see amazing productivity gains and that's important, especially in a year like this, but it's also about making tech sustainable and if we think back beyond march march march, so many marches this year, um devops was kind of the original hipster for building systems and making tech more sustainable.

A

It was really about improved technology, an improved process and better collaboration and better communication, so that we could take care of ourselves and we could take care of our teams and, while it's true in open source, there's nowhere that it's more true than enterprise systems.

A

So speaking of communication and collaboration, we also saw this happen at scale. As we look again, it's so interesting right. We see this covered effect appear so many places as we kind of chug along the air by the way that that quick jump on the left uh is thanksgiving holiday. We saw a shift in it across weeks, uh but as we take a look at pr merge times once shelter in place, orders occur across all open source repositories.

A

Pr merge times drop, which means they're. Getting faster and they got up to seven and a half hours faster. Remember this is a sign of collaboration.

A

People are maybe they're home, but but we had so many things we could do from home. We were eager to reach out and work together and create and build wonderful things, but it wasn't just open source.

A

It was also our our our working together right in our enterprise repositories. We saw this in enterprise. We saw this in paid team repos. We got up to five and a half hours faster. We really were working together and collaborating better and collaborating faster.

A

We really figured out how to get this done and I think it's exciting and and not just with prs, not just core in the code, but talking about all of the things that make our projects and our community great github, released and announced discussions earlier this year. So we took a look at the next.js repository and how they were using discussions, and it was great to see and kind of exciting to see how this grew over time, and what we found is that it really helped keep this community more resilient and more sustainable.

A

What some of our other analysis found is that some of the best ways to invite and encourage and foster newcomers to stick with the community are with issues the challenge with issues that can burn out maintainers. So the exciting thing is that we also found that one of the best ways to encourage newcomers is with discussions.

A

Discussions is a way to engage talk about. What's happening, learn new norms. Now some of you may be thinking well, what does this have to do with me, nicole? This is enterprise track.

A

This is great because, as we think about scaling our solutions and scaling throughout our enterprises think about things like centers of excellence or communities of practice. This helps make sure that our expertise isn't siloed. This helps us spread that excellence.

A

It's a lot like inner source right. We have so many things. We have expertise. We have process there's so many things that we can share now speaking of open source and building and sharing that expertise.

A

We also looked at at how open source is used and across all of the package ecosystems that github supports, so many of them most of them over 90, rely on open source, and I think that's so exciting and so wonderful, because there is this amazing amazing resource, that's available to almost everyone right. That's incredible!

A

We also then took a look to say uh to ask ourselves what does that mean in terms of dependencies right, because we also need to be thinking about security. So what does this mean in terms of our security posture?

A

What we found is that it's super important to secure our code, because any piece of software can have hundreds and thousands of dependencies, and this chart here shows you both direct dependencies. If something that you directly pull in a library or file has a dependency or if a transitive dependency or how many transit dependencies it has. So, if anything, you know in turn pulls out a file.

A

What we found is that any piece of code or any repo has a 59 chance of getting a security alert in the next year uh for those active repositories with supported package ecosystems. Now, in case you're, saying wait. This means I can't use open source, that's actually not the case at all, because then our follow-on analysis asked: where do these vulnerabilities come from?

A

Most vulnerabilities are mistakes only 17 of them are explicitly malicious things like backdoor attacks, and they result in only 0.2 percent of alerts in the in the very commonly and most used, repos um and and most use files. 83 of of these vulnerabilities are the result of mistakes.

A

So it's important to remember anyone. Anyone can make a mistake and anyone can insert a mistake into your code base so by leveraging the power of community. That means that anyone in this community can help find these vulnerabilities and fix them for you. You've suddenly got a huge home team advantage.

A

So what does this open source vulnerability timeline? Look like. It actually takes over four years, uh often to find a vulnerability. Once it's introduced. um This seems kind of long.

A

It's actually not totally unheard of uh the only analysis that we could see that was similar to this was from an od analysis, which is kind of like comparing apples and oranges, but ran ran this analysis and it was about five five years to identify vulnerability, but once that vulnerability is identified, it takes uh the community just over four weeks, almost four and a half weeks to fix the vulnerability takes about 10 weeks to identify the community and then one week to fix.

A

I will note that, for people using github advisory database, we can alert 20 times faster because we don't need to run through several steps of animated areas and imports now another benefit of automation, repositories that automatically generated a pull request using dependabot to fix patch their software 1.4 times faster.

A

So many times, people ask me what does shift left look like if I want to be doing devsecops? What does that look like this is what that looks like we can scale what it is that we find we can build that into our development workflow.

A

We have so many opportunities to to build security in so again we're leveraging the wonderful things that the security community finds for us. We can build in that patch automatically, and it just happens now, I'm about out of time. So let me share just a few more favorites that I had in the findings.

A

We did more work overall this year. So then we ran another analysis. How did we get more work done? Were we just creating, like giant files, turns out no pr size overall didn't change?

A

This one made me personally very happy, because much of my prior work shows that some of the best ways to get work done is to work in small batches, so pro tip keep working in small batches. It makes your releases faster and more stable and it makes it easier to be running your pr's now. What else github is the home for more than just developers in our community report we ran an analysis that went beyond just one year in arrears.

A

We went back seven years in some cases to see how our community is changing and growing, and we found that while we are growing overall and we still have many developers, so many more people are joining the community. We see scientists, we see people in education.

A

We see people in data like data analysts, there's there's a space for so many people here, managers leaders, so many people are joining github and github is a place not just for code, but it's a place for so many different file types. The platform itself is maturing becoming a place for many different types of creation.

A

We also found that the most critical vulnerabilities are caught in code review code review, not just for code and and linting in tabs free spaces. It's also, most importantly, for security and our security vulnerabilities, okay, listen, there's! So much more. There go check out the report, go check out the site octavers.github.com.

A

Now here's the slide take a picture. You'll get credit, even if I'm sure you've been tweeting at your favorites. Here's here's our tldr. We talked about juggling work and play how automation makes things better, working better together and securing our systems thanks. So much for coming.