How culture can improve engineering velocity, efficiency, and - PowerPoint PPT Presentation

How culture can improve engineering velocity, efficiency, and quality David Mercurio Stripe - Payments Infrastructure Snapchat - Memories Backend Facebook - Infrastructure, Platform, Personalized Videos

Efficiency is Leverage Getting a lot done with a little

Privacy Checks Before After 1. Define CanSee privacy check 1. Define a PrivacyPolicy for for node type node type 2. Load a bunch of data 2. Define a PrivacyRule list for that policy 3. Filter data that fails canSee() checks 3. Pass in $viewer when loading data 4. Every data load automatically executes the privacy rules

<?hh class PhotoPrivacyPolicy { public function rules(Photo $photo, Viewer $viewer): vec<PrivacyRule> { return [ 
 AllowIfViewerIsOwner($viewer, $photo), DenyIfViewerIsBlocked($viewer, $photo->getOwner()), DenyIfViewerInHiddenList($viewer, $photo), ... AllowIfViewerIsFriendsWithOwner($viewer, $photo), DenyOtherwise(), ]; } }

AllowIfViewerCanSeeAllContent($viewer, $video)

request metadata & signed urls uploads & downloads https://storage.example.com/bucket/video.mp4?Signature=4439b0b99c1a45b8c83331bcc0350241 Content-Length: 2411724 Content-MD5: 7507d76ec916acf676af82d63a746641 ...

{ 'Content-Length': ‘2411724’, 'Content-MD5': ‘7507d76ec...’, <service-specific-headers>, } request headers & signed urls abstractions & decision logic dumb (service-agnostic) client

Download Object • streaming • connection quality • object location Upload Object • continuable • user location • uptime status abstractions & decision logic dumb (service-agnostic) client

PCI Compliance 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks 5. Protect all systems against malware and regularly update anti-virus software or programs 6. Develop and maintain secure systems and applications 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes 12. Maintain a policy that addresses information security for all personnel

PCI Compliance 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters 3. Protect stored cardholder data 4. Encrypt transmission of cardholder data across open, public networks 5. Protect all systems against malware and regularly update anti-virus software or programs 6. Develop and maintain secure systems and applications 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes 12. Maintain a policy that addresses information security for all personnel

token apiori token

Trust and Amplify Develop one another in the short and long term

Onboarding and Rotational Programs Bootcamp Hackamonth • “Commit code on your first day” • Full engagement and disengagement (vs “20% time”) • Low urgency bug fixes, small features • Bidirectional knowledge sharing • Early foundation for cultural values • Bus factor • Prioritize productivity • Retention • Shared ownership • Team selection

Onboarding and Rotational Programs /dev/start Rotations • Bidirectional knowledge sharing • Impactful, low-urgency, well- scoped group projects • Bus factor • Second set of peers • Retention • Mentorship opportunities - but • New offices also bottleneck • Knowledge and culture • Seattle, Dublin, Singapore, Remote • Leadership team too!

We Haven’t Won Yet Identifying and resolving unaddressed risks

Big Red Button

Review Process • Blameless • Identify potential remediations • Code changes • Process improvements • Expose and rectify common issues • Enable incident tracking and analysis • Knowledge sharing

References • Stripe • https://stripe.com/jobs/candidate-info • https://www.infoq.com/presentations/stripe-api-pci • https://speakerdeck.com/amyngyn/big-red-button-how-stripe-automates-incident- management-sf-women-in-infrastructure • https://twitter.com/dps/status/1100072703007117313 • Facebook • https://www.infoq.com/presentations/Evolution-of-Code-Design-at-Facebook • https://code.fb.com/culture/bootcamp-growing-culture-at-facebook/ • https://code.fb.com/production-engineering/facebook-engineering-bootcamp/ • Snap • https://investor.snap.com/~/media/Files/S/Snap-IR/reports-and-presentations/snap-q4-and- full-year-2017-earnings-transcript.pdf

Questions?