►
Description
Featuring: Sid Sidhu, Box; Natalie Bradley, Accenture Federal Services; Thomas Aidan Curran, Deutsche Börse Group; Michael Filosa, GitHub
Highly regulated industries such as financial services, healthcare, and government all struggle with implementing modern software development practices due to the burden of regulatory compliance. Processes established years ago still govern, despite the software development landscape changing dramatically. What we’ve come to discover, however, is that organizations are implementing new and innovative solutions around tools, process, talent and culture to help scale their releases. In this panel, you will hear experts from Box, Deutsche Börse and Accenture Federal Services discuss strategies to overcome the constraints of how their software is developed, tested and maintained while staying compliant with regulations.
About GitHub Universe:
GitHub Universe is a two-day conference dedicated to the creativity and curiosity of the largest software community in the world. Sessions cover topics from team culture to open source software across industries and technologies.
For more information on GitHub Universe, check the website:
https://githubuniverse.com
A
Hello,
everyone.welcome
real
life.
What
do
you
think
of
the
keynotes
whoo
good
stuff,
so
I'm
excited
to
have
this
conversation
today.
What
we
really
want
to
share
with
you
today
is
the
perspective
of
three
different
types
of
companies
who
are
trying
to
solve
for
the
same
problem.
Developing
software
securely
fast.
You
know
fast
pace,
innovate
quickly.
Without
you
know,
taking
on
unnecessary
risk.
A
You
know
the
experience
that
they're
going
through
right
now
with
their
modernisation
journey
myself,
I'm
Mike,
Filosa
I
am
a
solution
engineer
on
the
East
Coast,
with
github
and
with
github
for
about
three
years
and
I
work
with
a
lot
of
the
financial
services
customers
in
New
York
in
New
England
as
well.
So
I'll
offer
some
some
thoughts
as
we
go
through
as
well.
B
Life
yeah,
oh
yeah,
awesome!
So,
like
you
mentioned,
you
know
where
we
come
in
as
we
are
servicing
customers
and
the
healthcare
industry
and
the
financial
services
and
some
of
the
same
challenges
as
github
has.
So
that's
where
you
are
talking
about
compliance
issues
not
just
for
a
specific
vertical,
for
example,
financial
healthcare,
but
we
have
to
make
sure
we
are
compliant
and
secure
as
pertains
to
all
of
the
customers.
We
are
servicing
and
we
are
modern,
innovative
cloud
provider.
So
it's
an
interesting
balance
off.
B
You
want
to
make
sure
you
can
move
the
code
through
the
pipeline
fast.
You
want
to
make
sure
you're
right
engineers
can
I
trait
quickly,
and
you
want
to
make
sure
you
know
you
do
not
hinder
the
speed
of
innovation
at
the
same
time,
staying
compliant
and
secure.
So
in
terms
of
the
question
you
asked
about
where
we
are
in
that
journey,
I
think
in
terms
of
our
software
development
practices,
I
would
say
we
are
pretty
far
advanced,
especially
for
a
company
our
size.
Now,
there's
always
room
for
improvement.
A
C
C
We
have
set
up
a
enterprise
level,
DevOps
platform
and
a
couple
of
our
client
spaces,
and
the
uptake
of
that
has
been
significant,
but
it's
not
without
a
lot
of
work
with
our
security
folks,
the
senior
leadership
teams,
anyone
that
will
basically
listen
to
us
about
how
cool
it
is
and
why
it's
better
and
why
it's
safer
and
more
cost
effective.
It's
been
a
challenge,
but
we're
three
years
in
and
the
success
we've
had
has
been
pretty
significant,
which
we
will.
D
So,
though,
and
this
in
our
case,
we
had
clear,
we
went
to
the
CEO,
got
a
memo
got
a
date
and
people
listened,
but
in
the
end
the
doing
part
is
really
important
and
I.
Think
the
you
know
the
normal
propensity
to
not
do
things
in
these
organization
is
very
high,
because
it's
walled
off
and
it's
hard
to
get
transparency.
But
now
we
we
can
get
these
transparency
on
every
everything
that
Deutsche
börse,
a
group
does
in
terms
of
software
today
is
in
github
yeah.
A
Just
a
brief
observation,
I've
seen
when
I
talked
to
customers
that
deploy
github,
oftentimes
regulatory
compliance
or
security
becomes
sort
of
a
safety
objection
that
some
of
these
other
digital
use.
Well,
we
can't
do
that.
We
don't
work
that
way.
We
have
to
follow
this
process
that
we've
had
for
five
10
15
years.
If
you
experienced
any
of
that
in
your
organization,
trying
to
you
know
modernize
that
and
push
them
a
little
bit
in
that
direction.
Is
that
something
that
you've
had
to
deal
with
them?
Yeah.
D
I
think
that's
that's
a
very
also
very
common,
roadblock
I
would
say
for
a
lot
of
organizations.
I
think
we
probably
all
see
that,
but
again
the
arguments
we
could
make
were
one
having
it
fully
transparent.
One
single
source
of
truth
in
terms
of
software
and
source
code
is
ultimately
better
for
security.
We
have
a
better
manageability.
We
have
transparency,
we
can
see
everything,
everyone
does
more
or
less,
and
it
gives
us
more
automation
potential
again.
A
C
C
Doing
software
development
and
80
percent
doing
administrative
work,
bringing
in
tools
like
github,
where
they
can
start
with
an
actual
product,
baseline
or
lines
of
code
to
share
and
replicate,
has
significantly
improved
what
we're
doing,
but
finding
discs
and
USBs
and
servers
underneath
people's
desks
with
bits
and
pieces
and
parts
of
software
and
binaries
and
dependencies
I
mean
if
they
were
actual
tangible
objects.
You
know
hiding
in
people's
closets,
they
were,
it
was
a
mess
and
so
for
us
to
be
able
to
show
an
organization
and
putting
that
together.
B
Just
want
to
add
two
things
to
that.
So
it's
interesting
when
you
mentioned
that
you
know
when
we
talk
about
how
things
have
been
done
historically
or
when
the
compliance
requirements
are
put
forth
or
that's
the
reason
not
to
do
something.
It's
also
I
think
important
to
dig
deeper
and
see.
Are
you
using
those
compliance
requirements
as
implementation
details
where
they're
like
okay?
B
This
is
how
we've
done,
and
this
is
how
you
won't
implement
it.
This
is
really
the
compliance
control
we
wanna
take
care
of.
Are
there
any
other
ways
we
can
satisfy
it
and
the
other
thing
I
want
to
add
there?
Was
you
know
it's
so
for
us,
it's
we've
been
on
get
and
you
know
we've
been
using
it
of
enterprise,
but
when
you
have
music
requirements
come
in
for
compliance,
you
also
want
to
make
sure
that
they
don't
hinder
the
speed
of
innovation.
B
So
it's
interesting,
you
know,
for
you
know
a
group
like
mine,
where
we
are
sort
of
mediate,
you
know,
and
in
between
person,
between
your
compliance
team
and
your
engineers.
So
it's
it's
a
challenge
where
you
do
want
to
implement
those
controls.
They
are
important
for
business.
At
the
same
time,
you
want
to
make
sure
it's
not
slowing
engineers
down
it's
not
reducing
the
productivity
so
coming
up
with
creative
tools,
auditing,
for
example,
you
know,
maybe
you
can
leverage
github
whatever
you
know,.
B
You
you
can
use
those
things
and
there
are
the
creative
ways.
For
example,
you
know
you
need
to
have
some
further
metadata
around
commits
and
anything
you
can
automate
that
way.
It's
not
a
Productivity
impediment
for
you
engineer
at
the
same
time,
you're
solving
for
those
compliance,
things
and
I
think
looking
creativity
creatively,
add
those
things
definitely
helps
yeah.
A
From
my
perspective,
a
lot
of
the
challenges
can
be
aided
by
workflow
and
by
automation,
the
workflow
to
Thomas's
point.
You
know,
features
in
github
that
can
allow
this
to
happen.
Other
products
that
come
into
play
really
could
enable
so
that
peace
of
mind
that
security
teams
need,
in
order
to
understand
that
the
risk
is
being
controlled.
That
there's
an
audit
trail
for
what's
happening,
is
an
approval
process
for
for
changes
to
get
into
production.
That
that,
to
me
is
the
biggest
sort
of
point
that
needs
to
get
made
to
these
organizations.
A
D
Think
the
you
know,
first
of
all,
I'd
fit
well
any
like
finance
is
a
highly
regulated
industry,
but
it's
still
not
as
regulated
as
telecom
or
healthcare.
I.
Think
there's.
You
know
in
every
one
of
these
industries,
some
very
specific
framework
for
regulation.
One
thing
to
keep
in
mind,
which
is
unique
though
I
think
for
many
people
here,
is
that
the
software
development
process
itself
is
also,
you
could
say,
semi
regulated.
So
you
have
to
have
a
lot
of
transparency
about
how
product
development
works
and
in
particular
it
has
to
be
auditable.
D
Someone
comes
from
you
know
a
regulator
and
wants
to
see
certain
things
that
happen.
So
I
would
recommend
very
early
on
to
think
about.
You
know
how
to
get
a
get
flow
like
process
in
place
and
and
show
it
to
auditors
and
show
them
the
tools
and
by
the
way,
get
github
involved
in
the
discussion
and
get
them
get
auditors
the
right
type
of
tool
chest
you
know,
keep
in
mind
that
these
these
companies
in
general
or
these
agencies
are
not
exactly
modern
software
developers
them.
D
C
Our
struggle
is
a
lot
with
security.
We
have
I've,
seen
Heath
right,
503
compliance
regulations
and
to
build
an
awesome
product
in
weeks
or
months.
It
will
take
nine
months
to
a
year
to
get
it
accredited
and
usable
on
a
production
system
and
that's
what
we're
struggling
with
the
most
is
to
get
security
and
the
C
the
senior
leadership
team
to
recognize
that
the
products
that
come
out
of
like
a
DevOps
pipeline
are
quality
and
there's
visibility
and
there's
consistency.
C
Resiliency
and
the
products
teams
are
doing
things
earlier
and
more
often
and
they're
more
secure.
But
it's
that
that
hurdle
of
well
all
of
these
boxes
have
to
be
checked
and
all
of
this
paperwork
that
no
one
really
looks
at
has
to
be
completed.
How
do
we
streamline
that?
And
how
do
we
get
there?
Acceptance
to
change
such
a
incredible
policy.
A
So
let
me
shift
gears
a
little
bit
and
talk
about
how
cloud
affects
this
I
know.
Box
probably
has
a
pretty
good
perspective
on
this.
What
are
you
seeing?
I
mean?
Obviously
your
customers
believe
in
adopting
the
cloud
right
with
respect
to
their
future.
How
does
that
have
an
impact
on
their
regulatory
requirements?
I
mean
they
must
be
pretty
demanding
requirements
on
you.
B
It
is
demanding
and
I
think
it
goes
through.
Your
whole
stack.
You
know,
for
from
my
perspective,
how
does
that
affect
our
code
pipeline?
For
example?
How
are
we
deploying
in
shipping
code
and
do
we
have
the
right
controls
in
place?
Are
we
making
it
easy
to
do
the
right
thing,
not
just
by
developers
which
is,
can
they,
you
know,
add
tests
more
easily?
What
does
that
process
like,
but
also
maybe
for
a
compliance
and
security
teams?
How
easily
audit
about
something
is
I?
Think
from
the
customers
perspective?
B
It's
I'm
not
fully
qualified
to
answer
this,
but
at
the
same
time,
if
you
look
at
over
the
past
couple
of
years,
some
of
the
things
that
have
happened
in
security,
so
then
you
have
to
talk
about
your
product
and
how
secure
it
is
and
that
cloud
environment.
And
then
you
have
features
like
we
have.
You
know
enterprise
key
management
where
you
get
to
store
the
key
that
in
decrypt
the
data.
B
C
The
environment
that
I
work
in,
we
have
a
private
cloud
air-gapped
from
the
network,
so
nobody
can
Google
really
cool
things,
but
our
developers
think
that
that
means
it's
more
safe
and
secure.
Our
senior
leadership
thinks
the
complete
opposite
that
it's
the
cloud
and
you
send
data
up
in
a
balloon
and
it
lives
there.
So
we're
changing
it's
another
kind
of
a
learning
curve
at
a
maturity.
Adoption
that
we're
having
it's
teams
to
recognize
the
security
of
it.
Due
to
the
sensitivity
of
a
lot
of
the
data
that
we
store.
C
Only
certain
projects
are
allowed
in
the
cloud,
and
that
is
through
a
rigorous,
incredible
security
process
to
determine
that
they're
secure
their
boundaries
are
all
tied
off
all
those
great
things.
So
it's
it's!
It's
a
journey
that
we're
kind
of
in
the
middle
of
we
have
a
majority
of
all
of
our
projects,
moved
to
our
private
cloud,
but
there's
still
so
many
that
have
yet
to
be
accepted
to
move
but
I
think
it's
really
just
learning
and
maturity
more
so
than
the
difficulty
of
the
platform
itself.
I.
D
B
D
P
we
use
Microsoft
Azure
and
an
AWS,
primarily
we
use
AWS
I
would
say
as
the
bulk
of
developers.
There
was
a
tremendous
amount
of
concern
at
you
know
all
the
top
management
about
moving
product
development
to
the
cloud
it
began
with
one
simple
thing
which
is
speed.
You
know
we've
way
too
slow
in
in
sort
of
lockdown.
D
Just
you
know,
islands
of
siloed
software
development
and
the
cloud
gives
us
a
lot
more
transparency
and
a
lot
of
speed,
but
again
moving
things
to
the
cloud
you're
going
to
have.
We
moved
github
very
early
to
the
cloud
as
well,
so
we've
moved
the
whole
getup
Enterprise
onto
AWS
AWS.
In
particular,
none
of
the
four
cloud
platforms
are
qualified
for
productions
great
software
today
in
the
finance
industry.
So
that
means
in
our
case,
in
in
Europe.
We
have
to
get
and
go
to
with
AWS
to
the
regulators
and
implement
a
number
of
things.
D
You
know
sort
of
data,
location,
data,
privacy,
encryption,
hardware,
encryption
keys,
who
holds
the
keys,
so
there
are
a
lot
of
things
for
developers
that
are
more
complicated,
including
also
augmenting
the
security
models
of
cloud
providers.
A
lot
of
simple
stuff
doesn't
work
when
you
do
that,
if
you're
looking
to
you
know
Travis
or
circle
or
or
Jenkins,
you
have
different
key
structures
and
different
authentication
sort
of
structures.
D
When
you
try
to
automate
things,
sometimes
it
breaks
down,
you
have
to
be
a
little
bit
aware
of
those
things
were
early
on,
but
across
the
board,
I
think
it's
given
our
organization
a
lot
more.
First
of
all,
it's
given
the
security
teams,
a
lot
more
responsibility
to
think
and
work
like
developers,
so
they
have
to
come
up
with
solutions
that
developers
can
use.
As
an
example,
you
know
you
need.
If
you
want
to
implement
a
security
model
on
top
of
I
am
and
AWS,
then
it
has
to
be
API.
D
Do
you
have
to
be
able
to
get
two
tokens
in
and
out
of
it
very
easily?
If
you
can't
do
that,
and
you
have
big,
you
know
that
developers,
sort
of
revolt
and
won't
but
again,
github
gives
us
a
lot
more
transparency
and
code
reusability
across
all
of
the
different
products
that
helps
us
tremendously.
So
cloud
I.
Think
again,
you
you
look
at
different
deployment
options
in
the
cloud.
D
Some
of
that
will,
you
know,
will
be
helpful
to
look
at
different
tools,
also
besides
github,
maybe
stuff,
like
terraform,
that
it
help
you
go
across
the
different
clouds,
but
definitely
I
would
say
if
you
ask
people
today
after
a
year
of
working
on
AWS
I,
think
we
trained
600
developers
already
in
it.
I
think
you
know
one
would
want
to
go
back
to
whatever
the
way
it
was.
The
other
thing
to
keep
in
mind
in
the
cloud
is
you
have
to
really
purpose
your
developers
and
that's
also
in
regulated
industries.
D
Awkward
I
mean
you
know,
you
want
your
developers
to
have
actually
really
powerful
machines,
so
they
can.
They
can
do
stuff
themselves
and
they
can
use
the
cloud
for
the
right
stuff.
That's
important
and
you
want
to
implement
and
github
models
that
accommodate
for
that,
for
instance,
we
look
a
lot
at
like
PR,
velocity
and,
and
you
know
not
don't
keep
a
lot
of
code
open
and
off
the
cloud.
So
a
lot
of
those
things
are
just
also
getting
people.
B
Think
I
wanted
to
highlight
something
he
said
so
for
us,
what
has
been
helpful
is
leaning
on
the
security
teams.
Okay,
this
is
where
the
world
is
going.
This
is
we
bought
into
it.
We
think
this
is
the
way
to
go
now.
You
help
us
be
secure
in
that
world
and
that
that
conversation
helps
drive
some
of
the
controls
you're
implementing
and
you
know
what
else
you
bring
there
so
for
us,
definitely
leaning
on
them
and
working
closely
with
them
has
helped
accelerate
the
speed
at
which
we
can
adopt
some
of
the
new
technologies.
Yeah.
A
A
So
when
you're
talking
about
automating
a
lot
of
the
sort
of
tasks
you
need
to
do
to
track
change
in
software,
you
can
do
that
all
the
way
through
the
pipeline
very
nicely
with
the
cloud
strategy
today,
right
so
I've
seen
a
lot
of
the
financial
companies
and
healthcare
companies
that
have
adopted
github
Enterprise
have
a
portion
of
their
workload,
begin
to
move
into
the
cloud
and
more
and
more
of
that,
especially
in
those
companies
that
have
I,
think
succeeded.
But
I
wanted
to
switch
gears
a
little
bit
and
talk
about
Talent.
A
I
know
as
a
developer
for
my
experience,
if
I
work
at
a
company
and
it's
frustrating
to
build
software,
because
I
have
to
jump
through
15
16
steps
to
get
my
my
product
in
in
the
eyes
of
people
in
the
hands
of
people,
I
think
engineers
are
hard
to
attract.
If
you
don't
create
an
environment
that
allows
them
to
succeed,
right
and
I.
Think
it
does
relate
to
this
discussion,
because
the
companies
that
are
are
doing
well
in
this
space
are
tackling
this
challenge
and
doing
a
good
job
of
allowing
those
developers.
A
B
It's
very
closely
related
when
we
talk
about
if
I'm
meeting
productivity
engineering
and
we
are
essentially
building
tools
that
are
used
by
developers,
I
think
that
has
a
direct
impact
on
how
fast
they
can
innovate,
how
fast
they
can
titrate
and
if
we
have
impediments
in
that
workflow,
that's
very
demoralizing
and
if
you're
competing
with
another
company
that
is
far
ahead
of
you
on
that
curve.
You
will
be.
C
I'm
in
an
environment
where
security
clearances
are
required,
so
hiring
talent
that
already
comes
with
these
skill
sets
is
really
difficult.
So
we
spend
a
lot
of
time
on
kind
of
maturing
our
developers,
but
what
we
found
github
great
example
is
they
are
using
it
in
their
real
lives.
Grad
students,
college
students,
all
know
github,
so
we're
looking
more
at
providing
the
tools
that
the
developers
want
to
see.
Not
what
someone
in
a
high-level
position
was
told.
C
C
He's
a
developer
had
been
working
straight
out
of
college
in
an
agency
for
eight
months,
and
he
was
just
about
to
leave
because
he
thought
that
it
was
so
stagnant
and
so
hard
to
get
anything
done
and
when
he
heard
that
we
had
github,
he
is
like
I
feel
like
I'm
in
college
again
and
I'm,
using
really
cool
things,
and
he
started
recruiting
friends.
We're
like
this
is
so
exciting
all
because
we
have
a
tool
that
the
outside
world
actually
has.
So
it's
worked
out
well,.
D
Yeah
I
think
I
can
add
a
little
bit
of
just
sense.
Of
first
of
all,
github
was
a
reaction
to
some
extent
on
not
having
the
talent.
In
other
words,
implementing
github
was
the
first
step
in
making
the
workplace
more
attractive,
for
we
had
a
lot
of
problems,
hiring
new
people,
and
we
couldn't
hire
these
people
because
it
was
a
horrible
place
to
work.
I
mean
you
didn't,
have
any
visibility.
What
other
teams
were
doing
you
couldn't
share
stuff
with
others?
D
You
couldn't
find
anyone
if
you
were
looking
on
Java
or
Python
or
stuff,
like
that,
you
had
a
lot
of
trouble
that
the
built
in
organization
didn't
realize
it
was
sort
of
out
of
date
and
out
of
sync
with
how
that
the
rest
of
the
world
works.
So
that's
one
thing
that
github
help
solve.
Second
thing
is:
when
you're
running
and
you're
running
to
recruit
new
teams.
D
Of
course
they
want
to
use
modern
tools.
We
have
now
I
would
say
a
really
strong
group
of
passionate
github
users
that
we
can
also
dispatch
to
talk
to
other
developers
and
they
find
each
other.
Also.
We
also
use
public
github
comm
for
some
of
our
stuff
to
help
just
interface
with
customers.
Actually,
we
have
used
github
as
the
sole
way
of
interacting
with
Amazon,
with
Microsoft
Google
ASAP,
a
lot
of
other
companies
that
we
just
use
github
repositories
to
do
it.
That's
the
other
part
of
github
that
we
should
also
mention
in
our
industry.
D
We
we
want
to
use
github
also
to
include
a
lot
of
the
let's
call
them
non
developers
in
the
organization
and
get
them
working
on
everything
from
agreements
to
a
lot
of
people
that
are
doing
things.
You
know
you
could
think
it's
almost
development,
but
it's
Indian
turns
out
they're,
very
ball
gardens
like
cloudera
and
other
types
of
data
science
products,
and
you
have
these
data
scientists
that
are,
you,
know,
super
smart
people,
but
they
don't
understand
software
development
and
and
then
getting
github
actually
in
use
in
play.
D
It's
challenge
for
the
company
I
think
to
go
out
and
actually
create
more
integration
with
these
type
of
tools,
so
we
can
onboard
them
into
the
software
community
as
opposed
to
having
these.
You
know
isolated
worlds.
The
cloud
also
helps
with
that,
but
again,
I
think
having
more
talent
that
is
aware
of
github
in
the
beginning
helps
get
those
teams
I
think
in
in
the
bigger
sort
of
github
community.
In
our
case,
yeah.
A
And
I
just
wanted
to,
you
know,
touch
on
something.
You
said
there
related
to
open
and
transparency,
you
kind
of
alluded
to
with
finding
people
finding
people
finding
resources,
finding
repositories
that
can
sound
very
scary
to
someone
who
doesn't
understand
what
that
is
when,
when
it
comes
to
regular
compliance
er,
what
does
that
mean
everything's
out
there
to
be
seen
what
about?
If
what,
if
we
have
confidential
information
inside
this
repository?
What
if
we're
dealing
with
you
know
trade
secrets
or
things
that
we
can't
expose
anybody
else
in
one
of
the
challenges?
A
I
have
and
maybe
you've
run
into
this
when
you've
talked
to
folks
inside
your
organization's
around
github.
Is
it's
not
always
everything's
transparent
right?
You
have
the
concept
of
an
organization
right,
you
can
scope
the
the
content
to
the
different
audiences
and
you
can
make
exceptions
for
certain
types
of
code.
So
have
you
had
to
have
those
conversations
internally?
Maybe
Thomas?
You
may
be
a
good
person
to
go
to
first
yeah.
D
I
mean
we
sat
down
at
a
very
you
know,
start
from
github,
probably
I
mean
I
put
together.
You
know,
I
know
10
15
people
that
volunteer
because
they
like
github
to
just
think
about
how
to
implement
it.
So
we
do
some
unusual
things.
If
you
look
at
it
from
a
developer
standpoint,
we
have
a
dev
repository,
which
is
all
inclusive
all
organization
and
everything's
in
there.
But
then,
when
you
want
to
release
something
that
goes
into
a
release
repository
and
that's
more
or
less
that
that's
it's
solely
for
documentation
and
for
regulatory
reasons.
D
So
we
have,
you
know
a
isolated
area
where
we
can
just
release
stuff
from,
and
that's
so
that's
very
important,
I
guess
in
setting
it
up.
It's
also
important
to
think
about
different
policies.
There's
a
lot
of
a
lot
of
stuff,
that's
regulated,
or
at
least
compliance
around.
How
did
how
did
release
new
features?
So
there
has
to
be
a
sort
of
four
or
six
AI
concept
that
you
have
to
implement
and
have
code
reviews
and
reviewers
and
and
and
sort
of
committers.
D
Let's
call
it
comfort
when
we're
talking
about
regulation
is
extremely
important
and
shared
across
a
team.
We
also
use
slack.
We
have
a
very
vibrant
github
channel
in
slack,
so
developers
can
also
trade
notes.
It's
very
technical,
but
I
think
we
have
a
lot
of
people
in
it
that
are
also
doing
you,
know,
product
management
or
business
analysis
and
they
add
and
and
contribute
to
stuff,
as
well.
C
C
B
B
And
as
as
you,
we
grew
as
a
company,
you
have
more
and
more
compliance
and
security
requirements
coming
in.
So
how
do
you
maintain
that
culture,
and
still,
you
know,
you
know,
bring
in
these
compliance
requirements?
So
for
us,
what
has
helped
is
you
know,
for
example,
with
github
Enterprise
being
able
to
even
say?
B
Ok,
this
piece
of
code
is
critical,
and
this
piece
of
code
requires
this
set
of
people
to
review
it
and
bringing
in
requirements
or
having
controls
like
that
has
helped
us
still
keep
things
as
transparent
as
they
as
people
want
it
to
be
at
the
same
time,
have
those
checks
in
place
in
the
pipeline.
So
you
know
you
satisfy
compliance
requirements,
yeah.
A
And
you
know
just
to
add
a
little
bit
on
Gibbs
journey
there,
so
we
were
very,
very
open
as
an
organization
we
still
very
are
quite
open,
but
we
are
now
going
through
a
lot
of
the
same
things.
You've
gone
through
and-
and
you
know,
for
example,
having
to
request
access
for
certain
repositories-
was
something
that
when
I
started
to
get
help,
you
just
were
able
to
just
access
them
right.
A
Now
you
get
a
go,
so
there's
a
process
in
place
and
there's
audit
trails,
and
you
know,
checks
and
balances,
which
is
a
good
thing
right
for
a
company
maturing,
but
it's
it's
very
different
than
then
Thomas's
experience,
probably
quite
quite
a
bit
different
right.
You
want
to
add
anything
to
that.
We.
D
Had
we
had
a
lot
of
I
mean
you'd,
be
surprised,
I,
guess
or
maybe
not,
but
even
like
the
senior
executive
board,
you
know
was
extremely
paranoid
about
having
all
the
source
code
in
one
place
and
there
wasn't.
You
know
there
was
really
a
lot
of
negativity
around
well
someone's
gonna
steal
our
entire
source
code.
Repository
in
this
is,
you
know,
was,
was
super.
They
were
super
hyped
up
about
that
and
you
know,
but
I
remember,
going
to
like
a
board
meeting
with
a
USB
stick
and
just
this
is
our
complete
source
code.
D
You
know,
and
it
was
everything
MVS
set,
OS
VMs
and
all
the
Linux
stuff,
but
you
get
I
think
a
lot
of
irrational
thoughts
around
what
secret
what's
important
to
keep
secret
and
what's
really
super
valuable
and
you
need
a
process
to
go
through
that.
I
have
to
say
you
know
philosophically
I'm
from
day
one
said:
look,
you
know
there.
We
have
to
keep
everything
open.
D
A
So
we
have
about
five
minutes
left.
What
I'd
like
to
do
is
ask
if
you
could
offer
something.
Maybe
in
a
positive
note,
maybe
a
experience
to
the
customer
made
a
transformation,
the
small
win,
a
big
win
and
leave
that
leave
the
room
here
with
some
inspiration
for
knowing
that
they
can
actually
solve
these
problems.
D
So
I
think
a
lot
of
times.
You
know
everyone
here
probably
can
imagine
doing
all
their
stuff
in
github,
but
you
have
a
lot
of
decision
makers
and
companies,
especially
these
regulated
industries.
No
one
on
the
board
of
Deutsche
Bursa
has
a
computer
background
right.
So
getting
people
to
understand
what
you're
talking
about
is
extremely
important
and
I.
Remember
signing
up
my
boss
onto
github.
You
know
it
was
a
Friday
afternoon.
I
explained
I
tried
to
explain
to
him.
This
is
really
cool.
You
can
watch
everything
you
can
see.
D
What's
going
on,
you
can
see
if
something's
working
and
who's
doing
what
and
he
just
didn't,
get
it
because
he
didn't
develop
software.
So
I
signed
him
up
to
github.com.
Got
him
and
I
said.
Look
just
so
you
can
get
a
feel
of
how
it
works.
Why
don't
we
watch
a
project
and
I
went
to
docker
and
signed
him
up
to
watch
docker
and
literally
when
he
got
off
the
plane.
He
was
like
his
wife
picked
him
up
and
said
someone
hacked
our
email
account
because
they
had
all
these.
D
You
know
information
activity
from
docker,
very
vibrant
stuff,
so
but
I
said
to
him,
you
know
yeah,
okay,
we'll
turn
it
off,
but
isn't
that
the
type
of
things
you
want
to
get?
You
want
a
lot
of
information
about.
What's
going
on
and
github
helps
you
get
that
so
I
think
it's
one
of
the
things
that's
great
about
the
product
is
collaboration,
but
it's
also
a
way
for
non-technical
people
to
get
more
visibility
and
I.
Think
the
better
you
can
communicate
that
with
examples.
D
C
We
a
huge
success
for
us
coming
from
completely
siloed
need
to
know
only
people
don't
like
to
talk
to
each
other.
We
have
thousands
of
repos
in
github
right
now,
and
over
50%
of
them
are
public.
Our
users
know
what
that
means.
The
pull
requests
are
incredibly
high.
I
think
that's
that's
a
huge
change
for
in
our
organization,
it's
very
exciting
and,
as
all
of
you
taxpayers,
this
is
very
rewarding.
I.
B
Think
it's
important
to
share
the
wins
and
the
positive
things
that
come
from
it.
For
me,
you
know
as
a
manager
when
I'm
out,
you
know
looking
for
talent
if
I
when
I
can
point
somebody
a
prospective
employee
to
our
open
source,
a
repo,
and
they
can
look
at
the
code,
which
is
a
great
win,
because
you
can
actually
see
what
you'll
be
doing
when
you
join
the
team,
so
I
think
there's
the
talent
piece
of
it
and
the
other
big
thing.
B
I've
learned
over
the
past
couple
of
years
is
the
better
or
the
closer
I
work
with
our
compliance
and
security
teams,
those
experts
and
think
of
them
as
partners
to
collaborate
with
and
making
our
pipeline
more
secure,
more
compliant.
The
easier
the
journey
is
versus
viewing
them
as
adversaries
who
are
trying
to
slow
us
down.
So
that
that's
been
that's
been
very
helpful
for
us
great.
A
Thank
you,
I
mean
I'll,
just
add
real
by
me.
A
lot
of
this
sounds
to
be
about
you
know,
creating
conversations
evangelizing,
educating
others
that
may
not
have
a
background
in
software
may
not
understand.
You
know
what
some
of
the
lingo
means
understand.
What
the
process
and
the
workflows
are
may
not
understand
what
can
be
automated
and
what
can't
be
automated.
So
evangelizing
sounds
like
it's.
It's
a
big.
You
know,
motivator
for
getting
organizations
to
change.
I
do
want
to
mention
I,
think
most
people
know
probably
github
customers
in
some
way.
A
It
don't
be
shy
about
engaging
github
to
help.
With
these
conversations
we
love
these
conversations.
We
can
help
with
these
demonstrations.
We
can
help,
show
and
educate
and
evangelize
on
your
behalf.
If
you
don't
want
to
be
the
one
to
evangelize,
because
we
have
seen
companies
start
in
a
place
where
no,
we
can't
work
that
way,
that's
just
too
risky
for
us
and
then
move
all
the
way
to
automating.
A
lot
of
this
I
think.
D
One
of
the
things
we
did
early
on
I
mean
I.
Think
like
Marco
Marco,
are
you
there
Marco
yeah,
so
we
got
people
from
github
very
early
on
to
come
in
and
they
just
were
so
good.
They
did
so
much
work
to
show
developers
how
to
use
github
how
github
uses
github,
how
to
really
streamline
get
you
know,
system
set
up,
etc.
That's
very
important,
but
it
doesn't
stop
there.
You,
when
you
get
github,
set
up
you
then,
especially
in
our
case
we
realize
after
a
year
you
know
people
develop
different
habits.
D
You
have
to
relook
at
things.
You
have
to
be
a
little
bit
paranoid
you
have
to
do.
Health
checks,
keep
a
lot
of
data
and
see
how
the
whole
overall
environment
is
working
and
hygiene
of
it
and
I
think
that's
super
important
github
can
be
super
helpful
there
and
I
think
that's
one.
We
went
to
github
two
weeks
ago
and
just
actually
asked
that
come
help
us.