devopsdays Philadelphia 2019

Bridget records live at devopsdays Philadelphia 2019 with Peter Shannon, a senior software engineer at Instacart and head organizer of the event, Jocelyn Harper, a senior associate software engineer at Capital One who gave the opening keynote, and Tim Gross, a software engineer at HashiCorp working on Nomad, who has keynoted Philly in past years. The conversation is about ethics, data and the responsibility of technologists.

Curating a Single Track

Peter says the program is single-track, in its fourth year, so it has to balance culture talks, technical talks and talks that feel timely. Attendees complain in both directions, that it's too cultural and that it's not cultural enough. Peter tries to make the opening talks lean cultural and relevant to the moment, and if possible frames other talks around that theme.

Indifference and Software Defining Culture

Jocelyn's keynote was about ethics in technology and the responsibility technologists have. Jocelyn says technologists can seem indifferent to the problems that larger tech companies they use or work for cause for people who aren't technologists. These conversations aren't new, and Jocelyn says social media, Twitter especially, has been a vehicle for people who might not have been heard inside companies.

Tim's earlier talk at Philly turned Conway's Law around: the systems we build and the choices around them also shape our organization's culture and the wider culture. That includes building for reliability so people trust each other, and which technical communities you join, such as a language community with toxic behavior. Tim continued the theme at devopsdays Minneapolis the year before, on whether we build technologies with a good purpose or a neutral one that can be used in bad ways.

Do You Need This Data?

Bridget says technologists tend to look at the happy path and ask how realistic it is that something will never be abused. Peter says engineers look at data as inputs to a service, where the inputs can be extremely sensitive and could harm the people the data is about if they got into the wrong hands. Jocelyn says we've reached the point where we take all the data because it comes with it, and should ask "do we really need this data in order to perform the function that we have?"

Tim gives an example from a job a couple of jobs back, a sensor that counted people and detected movement through a space. The designers saw how individual tracking could be abused and designed it so that identifying individuals was impossible, which became a competitive advantage because customers also didn't want their workers tracked. It also detected mannequins moved through a doorway as people, which Peter confirms meant people carrying mannequins in retail. Peter says the general consensus is the opposite, recalling Etsy's "if it moved, graft it" for metrics, and that for customer data it's "Storing bits is cheap." Bridget answers that it's cheap until the lawsuit, and cites a line Bridget can't attribute, that PII is like toxic waste, something you have to carefully corral.

Peter has worked at two organizations with HIPAA data and says the care was amazing, with legal review, access controls and training, but most other data gets a shrug. Tim adds that seemingly meaningless data points can be combined in harmful ways, and says data lakes are a blob of data with models applied that aren't magic, since "we're really encoding like, all the biases of the people who are doing that work into those models." Tim's example is parole models, and "oh, weird, it turns out that that algorithm is completely racist." Peter adds "And they blame the algorithm, not the people who wrote it." Jocelyn says the question is also why the data is collected, and that "just collecting data just to have it" isn't a good enough reason.

Neutral Tools and Responsibility

Tim says some technologies are neutral, like Kubernetes, and all can be turned to bad ends, but asks whether there are any good uses for facial recognition. Jocelyn says many engineers see it as a job and don't think about the impact, and hopes people take away that "it's your responsibility to think about that," and that not being on the executive board doesn't mean you can't have an opinion about what your work is used for. Bridget says you don't need a dramatic splash, and that if you think about operability and how systems break, that extends to data breaches and privacy, such as a provider who emailed that everything had been in an S3 bucket open to the world.

Money, Regulation and GDPR

Peter says it comes down to money: if a breach would be company-ending it gets bolted down, but if the cost of fixing is more than the cost of the damage, it doesn't. Tim says companies have been allowed to externalize these costs, like pollution, and that if technologists don't fix it themselves, lawmakers may eventually decide how technology works, which probably won't be a good technical solution. Jocelyn thinks it will take federal law with real penalties. Bridget notes GDPR has penalties with teeth, and that some US companies respond by dropping Europe. Tim says California enacted a similar law, and most US companies won't cut off California. Peter says a toothless law won't work, and fines need to scale per infraction, not be a one-time fee.

What Individuals Can Do

Tim says technologists have a lot of privilege and power, and "if I were to ask who here is hiring, everybody would raise their hand." That power includes choosing who to work with, which projects and who the customers are, and Tim says it's time to exercise it together. Jocelyn says to start at work by being the squeaky wheel, and outside work, to start on Twitter, where Jocelyn began before podcasts and talks, and says "Twitter activism does work." Peter echoes the "vote with your wallet" idea for where people work, acknowledges leaving a job on principle is hard for some, and says that if people banded together and left companies that don't meet their standards, it "would really, really send ripples through the industry."

Bridget chats with guests Peter Shannon, Jocelyn Harper, and Tim Gross in front of a live studio audience at devopsdays Philadelphia 2019.

• Jocelyn Harper's keynote at devopsdays Philly 2019: CI/CD (Constantly Ignoring, Constantly Deflecting): A Case Study of Pervasive Indifference in Technology
• Tim Gross's talk at devopsdays Minneapolis 2018: They Didn't Stop to Think if They Should: Machine Learning and the Internet of Unpatched Things

Community & Event Stuff

If you have an upcoming conference you would like to see promoted on ADO, you can fill out the handy form at arresteddevops.com/conf

Upcoming conferences

Open CFPs

• lots of DevOpsDays

Discount codes

• ADO2019 for 20% off lots of devopsdays
• Velocity Berlin Nov 4-7 2019 - discount code "ADO2019" gives 20% off for Gold, Silver, and Bronze passes