<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:content="http://purl.org/rss/1.0/modules/content/"
    xmlns:atom="http://www.w3.org/2005/Atom" xmlns:media="http://search.yahoo.com/mrss/" version="2.0">
    <channel>
        
        <title>
            <![CDATA[ development process  - freeCodeCamp.org ]]>
        </title>
        <description>
            <![CDATA[ Browse thousands of programming tutorials written by experts. Learn Web Development, Data Science, DevOps, Security, and get developer career advice. ]]>
        </description>
        <link>https://www.freecodecamp.org/news/</link>
        <image>
            <url>https://cdn.freecodecamp.org/universal/favicons/favicon.png</url>
            <title>
                <![CDATA[ development process  - freeCodeCamp.org ]]>
            </title>
            <link>https://www.freecodecamp.org/news/</link>
        </image>
        <generator>Eleventy</generator>
        <lastBuildDate>Sat, 30 May 2026 22:25:58 +0000</lastBuildDate>
        <atom:link href="https://www.freecodecamp.org/news/tag/development-process/rss.xml" rel="self" type="application/rss+xml" />
        <ttl>60</ttl>
        
            <item>
                <title>
                    <![CDATA[ What is Trunk Based Development? A Different Approach to the Software Development Lifecycle ]]>
                </title>
                <description>
                    <![CDATA[ The Software Development Lifecycle (SDLC) is different at every company. The version control system used, peer review process, code review process, design review process, how you do CI, automated testing, and manual testing – all vary greatly dependi... ]]>
                </description>
                <link>https://www.freecodecamp.org/news/what-is-trunk-based-development/</link>
                <guid isPermaLink="false">66bc5609da80a491ea5a5f6d</guid>
                
                    <category>
                        <![CDATA[ development process  ]]>
                    </category>
                
                    <category>
                        <![CDATA[ Git ]]>
                    </category>
                
                    <category>
                        <![CDATA[ software development ]]>
                    </category>
                
                <dc:creator>
                    <![CDATA[ Kealan Parr ]]>
                </dc:creator>
                <pubDate>Tue, 18 Jun 2024 12:55:00 +0000</pubDate>
                <media:content url="https://www.freecodecamp.org/news/content/images/2021/01/Trunk-based-development.png" medium="image" />
                <content:encoded>
                    <![CDATA[ <p>The <strong>Software Development Lifecycle</strong> (<strong>SDLC</strong>) is different at every company.</p>
<p>The version control system used, peer review process, code review process, design review process, how you do CI, automated testing, and manual testing – all vary greatly depending on where you work.</p>
<p>How a company plans, writes, builds, reviews, deploys, and releases software is optimized for their particular use-case, all with their own strengths and drawbacks in mind.</p>
<p>I started reading about how different big tech companies run their Software Development Lifecycles (<strong>SDLC)</strong> and heard the term <strong>Trunk</strong>-<strong>Based Development</strong> a few times. This is a practice Google follows and I was curious about how it's different than the way most other companies develop software.</p>
<h2 id="heading-two-different-ways-to-do-branching">Two Different Ways to Do Branching</h2>
<h3 id="heading-release-branching">Release Branching</h3>
<p>There are two common approaches to enable multiple developers to work on one codebase.</p>
<p>The first we'll refer to as the <strong>release </strong>branching<strong>** method. I've also seen it called </strong>feature branching**. But both of these same approaches follow the same general pattern.</p>
<p>Usually via Git, developers all clone the codebase (so they all have identical copies on their machines). Then they make a new feature/release branch based on <code>main</code>, and merge as the work is completed. The emphasis here is that they only merge once, at the end, when all the work is complete – and they merge the <em>whole branch</em> into <code>main</code>.</p>
<p>Here's an overview for how developers use the <strong>Release </strong>Branch<em>**</em> method:</p>
<p><img src="https://www.freecodecamp.org/news/content/images/2024/06/ex1.png" alt="Image" width="600" height="400" loading="lazy">
<em><strong>Release </strong>Branching<strong> </strong>development workflow visualised.</em></p>
<p>The white dots represent commits, and the bottom solid black line is <code>main</code>. This is a very simple example, as <strong>release branches</strong> often end up with far more commits than I've shown in the diagram (sometimes hundreds).</p>
<p>Developers branch off <code>main</code>, make their changes, and then when it's complete/has passed code QA, it gets merged back into <code>main</code>. That's <strong>release branching</strong>.</p>
<h3 id="heading-trunk-based-development-tbd">Trunk Based Development (TBD)</h3>
<p><strong>T</strong>runk-<strong>B</strong>ased <strong>D</strong>evelopment (TBD) is the second approach. Here, each developer splits the work they will do into small batches and merge into <code>main</code> (which is often referred to as the <strong>trunk</strong>) multiple times.</p>
<p>In small teams, they normally don't create a branch and merge the branch into the trunk. They commit <em>directly</em> into the trunk without branches.</p>
<p>In a larger team (with checks and approvals necessary for MR's), they use <em>short-lived</em> branches. One <strong>release branch</strong> with 100 commits in TBD would be 10 merge requests with 10 commits each.</p>
<p>In TBD, their code changes generally don't stay around for more than a few hours. They constantly get merged and integrated with the code everyone else is writing.</p>
<p>Jez Humble is a Site Reliability Engineer at Google, and author of <a target="_blank" href="https://www.amazon.com/dp/0321601912?tag=contindelive-20">Continuous Delivery</a>, who says "branching is not the problem, merging is the problem" – which is exactly what TBD tries to solve.</p>
<p>It aims to avoid painful merges that so often occur when it is time to merge long-lived branches that have diverged histories from the trunk, or even merge multiple branches together into one from different teams/developers before merging with the trunk.</p>
<h2 id="heading-does-tbd-work-at-scale"><strong>Does TBD Work at Scale?</strong></h2>
<p>In a <a target="_blank" href="https://www.youtube.com/watch?v=W71BTkUbdqE">Google talk</a>, Rachel Potvin, who's an Engineering Manager at Google, described one codebase that has (as of Jan 2015):</p>
<ul>
<li>1 billion files</li>
<li>2 billion lines of code</li>
<li>86 terabytes of content</li>
<li>45,000 commits per workday</li>
<li>15 million lines changed in 250,000 files per week</li>
</ul>
<p>They used TBD in this codebase and it served their use cases very well. As Google is made up of many talented (most importantly, <strong>experienced</strong>) engineers, they rarely break their builds.</p>
<p>Google also has a very thorough, strict code QA process (read about it <a target="_blank" href="https://www.freecodecamp.org/news/what-google-taught-me-about-code-reviews/">here</a>) which, when using TBD, allows for fast, efficient software delivery.</p>
<p>TBD also works well for Agile methodologies where you have to ship software frequently to get feedback from your consumers/customers. You can continually integrate and get a good snapshot of your current state.</p>
<p>Let's briefly discuss some TBD strengths.</p>
<h3 id="heading-strengths-of-tbd">Strengths of TBD</h3>
<ul>
<li>Feedback (whether from code QA, or peer review) comes quickly, as you merge daily. This can stop you from doing the wrong thing for 3 weeks, and then getting feedback that your work isn't correct at the very end, causing you to miss deadlines.</li>
<li>There's a mental benefit to TBD, where developers feel like the trunk is <strong>our</strong> code, rather than everyone having their own feature branches and thinking this branch is <strong>my</strong> code. This can foster a more collaborative culture, increasing communication.</li>
<li>It results in early integration with all the other in-flight projects/tickets and helps you promote code re-use. It's much harder to "use code" that isn't merged into <code>main</code> and you don't know when will be complete. It also stops merge hell when your 9 month old release branch needs to be merged back into the trunk.</li>
<li>Large projects with lots of work involved are forced to be broken down into smaller deliverables. This is much better for estimating timelines and also for breaking up your code into modular pieces.</li>
<li>When lots of developers work in isolation on release branches, it can be harder to spot junior developers struggling in their own branch. But if they're expected to be committing their work daily, you can monitor their daily output and assist them when necessary.</li>
<li>TBD really cleanly ties in with continuous integration. With lots of small, incremental commits to an eventual finished project, you get an always tested, always integrated codebase with (minimal) horrible merges.</li>
</ul>
<h3 id="heading-weaknesses-of-tbd">Weaknesses of TBD</h3>
<ul>
<li>One of the challenges of this approach is that you have an increased chance of breaking the trunk, and stopping lots of people from working. You have to make sure your commits run unit tests along with a good code review process so you don't lose time reverting commits all day.</li>
<li>Your commit history into <code>main</code> will likely be more verbose and it can be harder to see if something is wrong. If you are called at 3 AM and asked to fix a bug on your prod site with some dodgy commits that went on during business hours, would you prefer a day with 1 commit or 200 commits?</li>
<li>If you don't have a fast build process, you will spend a long time waiting for things to build while your team constantly commits.</li>
<li>Often times with TBD you are incrementally adding new code to do something new, but you also need the "old" paths you're replacing to still work. Because of this you need to rely on feature toggles (normally from a database) to turn things on and off. This can add an extra level of complexity with debugging.</li>
<li>A final challenge can be that, when you have constant commits, you are constantly in a state of churn. You need to make sure your team regularly pulls from the trunk and doesn't end up tripping over one another while merging things.</li>
</ul>
<h2 id="heading-how-to-release-software-with-trunk-based-development">How to Release Software with Trunk-Based Development</h2>
<p>Teams using TBD will typically have a different release process than a team using feature branches.</p>
<p>Generally, if you use release branches, you release <code>main</code> whenever you have something that gets merged in (tickets, completed projects, and so on). Or some teams release <code>main</code> on a schedule, like once every week.</p>
<p>Here's an overview of how TBD teams do their releases:</p>
<p><img src="https://www.freecodecamp.org/news/content/images/2024/06/ex2.png" alt="Image" width="600" height="400" loading="lazy">
<em>Overview of TBD process</em></p>
<p>In TBD, branching is used for releases to allow everyone to keep committing into <code>main</code>.</p>
<p>They provide a "snapshot" of your codebase at a stable state, ready for deployment and release.</p>
<p>The only reason the TBD diagram above may need extra details is when something goes wrong with the release of prj-123. Then we commit the result into the trunk and cherry pick the commits into our release branch to get it in a workable state as soon as possible.</p>
<p>Some places, if they are releasing regularly, don't even branch and can just release the trunk whenever it's required. It depends on your company oftentimes.</p>
<h2 id="heading-conclusion"><strong>Conclusion</strong></h2>
<p>There is a whole site based on the theory and practice of TBD. Feel free to read more <a target="_blank" href="https://trunkbaseddevelopment.com/">here</a>.</p>
<p>I hope this has explained what <strong>Trunk Based Development</strong> is and why it's used. It certainly helps alleviate some of the issues around merging long-lived branches containing major rewrites.</p>
<p>I share my writing on <a target="_blank" href="https://twitter.com/kealanparr">Twitter</a> if you enjoyed this article and want to see more.</p>
 ]]>
                </content:encoded>
            </item>
        
            <item>
                <title>
                    <![CDATA[ How I Added Some Structure to a Start-up's Development Team - And What I Learned from the Process ]]>
                </title>
                <description>
                    <![CDATA[ By Hughie Coles Until recently, I'd spent the last 4 years of my career at FinTech start-ups. I'd always worked for smaller companies, and being at a start-up was the next logical step in looking for roles where I could make the biggest difference.  ... ]]>
                </description>
                <link>https://www.freecodecamp.org/news/how-i-added-some-structure-to-a-start-up-dev-team/</link>
                <guid isPermaLink="false">66d45f3133b83c4378a517d8</guid>
                
                    <category>
                        <![CDATA[ agile ]]>
                    </category>
                
                    <category>
                        <![CDATA[ development process  ]]>
                    </category>
                
                    <category>
                        <![CDATA[ leadership ]]>
                    </category>
                
                <dc:creator>
                    <![CDATA[ freeCodeCamp ]]>
                </dc:creator>
                <pubDate>Sun, 24 May 2020 22:48:00 +0000</pubDate>
                <media:content url="https://www.freecodecamp.org/news/content/images/2020/05/you-x-ventures-Oalh2MojUuk-unsplash-1.jpg" medium="image" />
                <content:encoded>
                    <![CDATA[ <p>By Hughie Coles</p>
<p>Until recently, I'd spent the last 4 years of my career at FinTech start-ups. I'd always worked for smaller companies, and being at a start-up was the next logical step in looking for roles where I could make the biggest difference.  </p>
<p>But a common problem with early-stage start-ups is that it's kind of a free-for-all in terms of how they're managed. </p>
<p>These companies tend to be run by people who don't have a ton of experience running companies. And management tends to consist of founders and those who got in early, not necessarily those who excel in leadership roles. (No shade – good person + talented doesn't necessarily mean they're a good boss or leader).</p>
<p>During my time at one such start-up, I was promoted from senior developer to lead developer. </p>
<p>The catalyst for this change was that the development team lacked leadership. The CTO had too many responsibilities, and the job of keeping the dev team engaged and productive was falling through the cracks. </p>
<p>On top of this, we didn't have a project manger, and our product managers were too inexperienced to introduce any kind of structure.</p>
<p>This is the story of the wins and losses, and how to add process to a company that has none.</p>
<h2 id="heading-events-leading-to-the-change">Events leading to the change</h2>
<p>First, a little bit of background. My previous job had been as a developer at a digital agency. This agency was a hard-core scrum shop that had trained all of their employees fairly thoroughly in scrum, and agile in general. </p>
<p>So I came from an environment with a lot of process. That's partially why I left to pursue a start-up. </p>
<p>About a year in, I started to notice some issues. Firstly, the developer turn-over was growing. Developers weren't feeling engaged. They were handed half-baked projects with no context on how it would aid the growth of the company, no input in the design or planning, and with nowhere near enough detail.</p>
<p>Then came a project that crystallized our problem. The product that I worked on had the concept of bills (payables) and invoices (receivables). We were working on a new feature that would allow users to upload an image of an invoice and have it input manually by a service. </p>
<p>The problem was that the product manager kept saying "bills" instead of "invoices". There was no user story, no ticket, this was all in the mind of the product manager. Requirements were communicated verbally or in slack messages. The developer working on the project had only ever been told "bills". </p>
<p>It wasn't until the CTO overheard a conversation a few days before release that we realized that we'd targeted the wrong aspect of the system. </p>
<p>Luckily, bills and invoices were, for the most part, symmetrical in our system, so it wasn't much work to make the change. It just became very clear that we had a problem.</p>
<p>Given my background and the fact that I was one of the most senior and tenured developers at the company, it made sense for me to take the lead. </p>
<p>Since I was leading the initiative, I chose to implement a scrum-type process.  In the remainder of this article, I'll outline <strong>what</strong> we did, <strong>how</strong> we did it, and <strong>why</strong> it was done, as well as my <strong>learnings</strong>.</p>
<h2 id="heading-getting-buy-in">Getting Buy-in</h2>
<p>I'm gonna preface this by saying that I don't like handing commandments down from on high. I feel like a leader-team relationship is a collaborative one. I may occasionally play leader because it's my nature, but it's important that ideas are discussed and that people feel their opinions are heard and valued.</p>
<p>The first step was to gather the developers to have a discussion.  In this initial discussion, I outlined what I felt our issues were.  This included lack of clarity on requirements, sliding deadlines, and our complete lack of a testing strategy.  The discussion validated my thoughts, because the team felt the same way.  </p>
<p>The rest of the meeting consisted of me outlining scrum, what elements I felt could benefit us, and what that would look like. I also discussed some things that I learned about test plans and systematic QA that I learned in my agency days.  We then went around the table, giving thoughts, asking questions, and tweaking.</p>
<p>I conceded that manual testing wasn't fun or ideal for the dev team, but until we could justify a full-time QA engineer, we had to do the best with what we had.</p>
<p>Learnings: </p>
<ul>
<li>If you have a good idea, all you need is a chance to prove its worth. </li>
<li>Enlist your team to help build this together, make everyone part of the solution and they'll own it with you.</li>
</ul>
<h2 id="heading-our-version-of-scrum">Our Version of Scrum</h2>
<p>After describing what a "full" scrum process would look like, I laid out to the team what the purpose of each aspect and ritual was.  I wanted to highlight where we could get the most gains. No one wanted 10 hours of meetings per sprint.  </p>
<p>Speaking of sprints, we decided to start with a 2 week time-box with an eye on moving it to 3 weeks if we wanted less overhead and could afford less frequent releases.</p>
<p>The process I put in place was as follows.</p>
<p>We'd have a sprint started with a 2-hour grooming/planning meeting on a Monday morning. In this planning meeting we (the dev team and the product manager) did a pass over the backlog.  This pass consisted of clarifying the story to clear up misunderstandings; estimating using story points; and prioritizing based on company road-map.  The team then picked out the amount of work we felt we could do, based on priority, and brought it into the current sprint. </p>
<p>This work was a collection of user stories. The product manager would leave, and the dev team would break these stories down into tasks, get a general sense of who would work on what, and then we got to work.  This gave the product manager transparency on what we could deliver, which was sorely lacking.  It also gave the team their full workload for 2 weeks, which allowed us to plan and pace accordingly.</p>
<p>The next week and a half were dev days. This included peer code reviews on feature branches before they were merged. Dev hands-off was the Wednesday of the 2nd week at noon. We would then prepare the QA build, QA spreadsheet (more on this in a bit), and start manual testing.  </p>
<p>The idea was to finish the initial QA pass by the end of the Wednesday, and spend Thursday and Friday in a bug fix/test loop until we were satisfied with the build.  </p>
<p>At this point, the build would be handed off to the CTO for a final code review, and it would be deployed the following Tuesday. Issues found in the code review would be fixed and tested on the Monday if needed.</p>
<p>Friday afternoon we would have a blameless retrospective/postmortem. Here we laid things bare. It's important to acknowledge what went poorly, and to address the cause(s) so that we could avoid it in the future. </p>
<p>All of the developers (including myself) learned a lot through this process. I feel like we're all better off after having gone through it. I actually overheard the CEO suggest doing blameless postmortems a few weeks after we started doing them on the dev team. It was nice to see that our ideas were catching on. </p>
<p>This was one of the big wins. We learned why a feature was needed, what the intention behind it was, and all of the details and expectations.</p>
<p>Learnings:</p>
<ul>
<li>Split and join meetings based on your team's needs.  Don't do things "just because"</li>
<li>Share your progress outside your department.  Sometimes your ideas can provide benefits outside of your team.</li>
</ul>
<h2 id="heading-a-testing-framework-that-you-can-believe-in">A Testing Framework That You Can Believe In</h2>
<p>This company had never had a formal testing process. This meant no test plan, no peer testing, just a developer verifying that it worked, and it going to production.  </p>
<p>In my experience, developers are as good at testing as they are at estimating, so we needed to change that. We had a good suite of automated tests (unit and integration), but no end-to-end tests. I also prefer to have some exploratory testing as well. In the past, I've seen it uncover weird behaviors that automated testing can miss.  </p>
<p>We set up a google doc with all of the tickets (including links to the user stories) in the first column, and all of the developer names (and the PM) in the first row. The idea was that every ticket had to have 2 X's, both from people who didn't work on the feature. This divide and conquer strategy allowed us to test very thoroughly in a fairly short amount of time. </p>
<p>Learnings: </p>
<ul>
<li>Lean hard on automated testing.  It's reliable and finds many classes of bugs with no manual time.</li>
<li>Test with a plan.  You're going to waste a lot of time just wandering.  A systematic approach can make manual testing more efficient.</li>
</ul>
<h2 id="heading-success">Success</h2>
<p>What was the result? I don't have exact numbers, but the defect rate plummeted. There were no longer rushed hot fixes to production. The work promised was delivered. Features were being released on time. </p>
<p>We were moving faster than ever, and the developers were happier. We were working as a team instead of in silos, we all knew each others' features intimately because we all went through the user stories and estimated together. There was no more of this "oh, I can't touch feature X, I didn't work on it" siloing stuff. </p>
<p>One dev who was planning on leaving stopped looking. It was great.</p>
<p>Learnings:</p>
<ul>
<li>Keep adjusting your process based on results.  It's an ongoing process.</li>
<li>Sometimes people don't want to leave a company, they want to leave a situation.</li>
</ul>
<h2 id="heading-an-abrupt-end">An Abrupt End</h2>
<p>But nothing gold can stay :) Ok, that's a bit dramatic. While the dev team was gelling, increasing our velocity, and building more camaraderie, management was going in a different direction. </p>
<p>The CEO had done a ton of reading and decided that OKRs were what was gonna get the company to the next level. Unfortunately, it was decided that OKRs would go down to the individual level, meaning that the team would no longer be pooling work, breaking it down and tackling it together. Instead, each developer would work out (or in practice, given) a set of KRs, and they alone would be responsible for delivering on them.  </p>
<p>We were back to silos. The development team pushed back, we tried to compromise, to stop OKRs at the team level, but it was no use. The dream was dead. Yes, again with the drama, but it was a little sad. </p>
<p>This change coincided with a slight change in power structure, my title as lead developer became little more than a platitude, "leadership" said some very unkind things to the development team (somewhere along the lines of "get on board or get out"), which led to half the dev team, including myself, leaving within a month.</p>
<p>Learnings:</p>
<ul>
<li>Good ideas don't always win out.  Even in a situation like this, you can learn a lot.</li>
<li>Recognize when you can no longer make a difference. </li>
</ul>
<h2 id="heading-mistakes-were-made">Mistakes Were Made</h2>
<p>Given the way that last paragraph ended, you may thing that I was about to enumerate the mistakes that the company made. But I'm not going to do that. </p>
<p>It's been about a year since I left, and in that time I've learned a thing or two. There were some serious gaps in the process that we'd created. These were things that I just didn't really understand or know about at the time. It was due to my shortcomings, but we all get better every day. </p>
<p>In hindsight, here are some major things I'd missed:</p>
<h3 id="heading-we-werent-measuring">We weren't measuring.</h3>
<p>How do you know you've done it right if you didn't take measurements before and after? We had no telemetry, very little alerting, and frankly, if a feature had negative impact, we didn't know about it.</p>
<h3 id="heading-too-much-manual-testing-not-embracing-automation">Too much manual testing, not embracing automation.</h3>
<p>What we were really missing was a nice suite of automated E2E tests. We started working on these near the end, but we didn't prioritize them enough. Many of the errors we found during manual testing could have been caught during some acceptance tests using cucumber, or some E2E selenium tests.</p>
<h3 id="heading-big-bang-releases">Big bang releases.</h3>
<p>I know a common part of scrum for many companies is the idea that all of the sprint work is demoed and released together. </p>
<p>The problem with this is two-fold. Firstly, at a start-up you need to move quicker. You need to beat others to the punch and get value out to customers and feedback from customers as quickly as possible. And the tighter that feedback look is, the better.  </p>
<p>Therefore, multiple releases per sprint would have been better. It's more difficult to coordinate testing and QA, but it's still better to release quickly and often. </p>
<p>Secondly, the larger the release, the more risk is involved. Releasing smaller chunks means that fewer changes are released at one time. If there's any issue, it's easier to identify and fix, and a rollback won't affect other, correctly functioning features.  </p>
<p>So I've learned that releasing in verticals that are as small as possible is the safest, least coupled way of releasing software.</p>
<h2 id="heading-conclusion">Conclusion</h2>
<p>For all of the missteps and the unfortunate ending, I feel like the experience was a success. I learned what it meant to guide a team of developers through a process, to take feedback and apply it, and to try and discard ideas that, even though they are "supposed to be there", just didn't fit our team.  </p>
<p>It's important to cater your process to your team and organization. You have to add enough process to guide, but not so much to hinder. It taught me how to implement process, to push ideas forward, to help others be heard, and how to lead from within a team.  </p>
<p>Although it ended poorly, it was a big step forward in my career, and really solidified my ability and desire to lead.</p>
<p>You can find more of my articles on my <a target="_blank" href="https://medium.com/@hughie.coles">medium blog</a>.</p>
 ]]>
                </content:encoded>
            </item>
        
            <item>
                <title>
                    <![CDATA[ If You Want to Build a Secure Treehouse (or Software Application), Start at the Bottom ]]>
                </title>
                <description>
                    <![CDATA[ If you’ve ever watched a kid draw a treehouse, you have some idea of how applications are built when security isn’t made a priority.  It’s far more fun to draw the tire swing, front porch, and swimming pool than to worry about how a ten-thousand-gall... ]]>
                </description>
                <link>https://www.freecodecamp.org/news/if-you-want-to-build-a-treehouse-start-at-the-bottom/</link>
                <guid isPermaLink="false">66bd8f6127629f4c5e1893b4</guid>
                
                    <category>
                        <![CDATA[ Application Security ]]>
                    </category>
                
                    <category>
                        <![CDATA[ cybersecurity ]]>
                    </category>
                
                    <category>
                        <![CDATA[ development process  ]]>
                    </category>
                
                    <category>
                        <![CDATA[ information security ]]>
                    </category>
                
                    <category>
                        <![CDATA[ threat modeling ]]>
                    </category>
                
                <dc:creator>
                    <![CDATA[ Victoria Drake ]]>
                </dc:creator>
                <pubDate>Sun, 17 May 2020 20:52:28 +0000</pubDate>
                <media:content url="https://www.freecodecamp.org/news/content/images/2020/05/cover.png" medium="image" />
                <content:encoded>
                    <![CDATA[ <p>If you’ve ever watched a kid draw a treehouse, you have some idea of how applications are built when security isn’t made a priority. </p>
<p>It’s far more fun to draw the tire swing, front porch, and swimming pool than to worry about how a ten-thousand-gallon bucket of water stays suspended in midair. </p>
<p>With too much attention spent on fun and flashy features, foundations suffer.</p>
<p><img src="https://victoria.dev/blog/if-you-want-to-build-a-treehouse-start-at-the-bottom/for-the-turrets.png" alt="A comic I drew about building castles with poor foundations. It’s not that funny." width="600" height="400" loading="lazy">
<em>A comic I drew about building stable foundations. It's not that funny.</em></p>
<p>Of course, spending undue hours building a back end like Fort Knox may not be necessary for your application, either. Being an advocate for security doesn’t mean always wearing your tinfoil hat (although you do look dashing in it) but does mean building in an appropriate amount of security.</p>
<p>How much security is appropriate? The answer, frustratingly, is, “it depends.” The right amount of security for your application depends on who’s using it, what it does, and most importantly, what undesirable things it could be made to do. </p>
<p>It takes some analysis to make decisions about the kinds of risks your application faces and how you’ll prepare to handle them. Okay, now’s a good time to don your tinfoil hat. Let’s imagine the worst.</p>
<h2 id="heading-threat-modeling-whats-the-worst-that-could-happen">Threat modeling: what’s the worst that could happen?</h2>
<p>A <em>threat model</em> is a stuffy term for the result of trying to imagine the worst things that could happen to an application. Using your imagination to assess risks (fittingly called <em>risk assessment</em>) is a conveniently non-destructive method for finding ways an application can be attacked. </p>
<p>You won’t need any tools – just an understanding of how the application might work, and a little imagination. You’ll want to record your results with pen and paper. For the younger folks, that means the notes app on your phone.</p>
<p>A few different methodologies for application risk assessment can be found in the software world, including the in-depth <a target="_blank" href="https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final">NIST Special Publication 800-30</a>. Each method’s framework has specific steps and output, and will go into various levels of detail when it comes to defining threats. </p>
<p>If following a framework, first choose the one you’re most likely to complete. You can always add more depth and detail from there.</p>
<p>Even informal risk assessments are beneficial. Typically taking the form of a set of questions, they may be oriented around possible threats, the impact to assets, or ways a vulnerability could be exploited. </p>
<p>Here are some examples of questions addressing each orientation:</p>
<ul>
<li>What kind of adversary would want to break my app? What would they be after?</li>
<li>If the control of <em>x</em> fell into the wrong hands, what could an attacker do with it?</li>
<li>Where could <em>x</em> vulnerability occur in my app?</li>
</ul>
<p>A basic threat model explains the technical, business, and human considerations for each risk. It will typically detail:</p>
<ul>
<li>The vulnerabilities or components that can cause the risk</li>
<li>The impact that a successful execution of the risk would have on the application</li>
<li>The consequences for the application’s users or organization</li>
</ul>
<p>The result of a risk assessment exercise is your threat model. In other words, it's a list of things you would very much like not to occur. </p>
<p>It is usually sorted in a hierarchy of risks, from the worst to the mildest. The worst risks have the most negative impact, and are most important to protect against. The mildest risks are the most acceptable — while still an undesirable outcome, they have the least negative impact on the application and users.</p>
<p>You can use this resulting hierarchy as a guide to determine how much of your cybersecurity efforts to apply to each risk area. An appropriate amount of security for your application will eliminate (where possible) or mitigate the worst risks.</p>
<h2 id="heading-pushing-left">Pushing left</h2>
<p>Although it sounds like a dance move meme, <em>pushing left</em> refers instead to building in as much of your planned security as possible in the early stages of software development.</p>
<p>Building software is a lot like building a treehouse, just without the pleasant fresh air. You start with the basic supporting components, such as attaching a platform to a tree. Then comes the framing, walls, and roof, and finally, your rustic-modern Instagram-worthy wall hangings and deer bust.</p>
<p>The further along in the build process you are, the harder and more costly it becomes to make changes to a component that you’ve already installed. </p>
<p>If you discover a problem with the walls only after the roof is put in place, you may need to change or remove the roof in order to fix it. Similar parallels can be drawn for software components, only without similar ease in detangling the attached parts.</p>
<p>In the case of a treehouse, it’s rather impossible to start with decorations or even a roof, since you can’t really suspend them in midair. </p>
<p>In the case of software development, it is, unfortunately, possible to build many top-layer components and abstractions without a sufficient supporting architecture. </p>
<p>A push-left approach views each additional layer as adding cost and complication. Pushing left means attempting to mitigate security risks as much as possible at each development stage before proceeding to the next.</p>
<h2 id="heading-building-bottom-to-top">Building bottom-to-top</h2>
<p>By considering your threat model in the early stages of developing your application, you reduce the chances of necessitating a costly remodel later on. You can make choices about architecture, components, and code that support the main security goals of your particular application.</p>
<p>While it’s not possible to foresee all the functionality your application may one day need to support, it is possible to prepare a solid foundation that allows additional functionality to be added more securely. Building in appropriate security from the bottom to the top will help make mitigating security risks much easier in the future.</p>
 ]]>
                </content:encoded>
            </item>
        
            <item>
                <title>
                    <![CDATA[ What is Agile and How You Can Become an Epic Storyteller ]]>
                </title>
                <description>
                    <![CDATA[ Running a team of developers is hard. Trying to coordinate a mountain of work while keeping everyone productive is a challenge itself. But on top of that, you have to keep open communications with a client. How can we use agile to relieve some of tho... ]]>
                </description>
                <link>https://www.freecodecamp.org/news/what-is-agile-and-how-youcan-become-an-epic-storyteller/</link>
                <guid isPermaLink="false">66b8e3940cedc1f2a4f706a1</guid>
                
                    <category>
                        <![CDATA[ Software Requirements ]]>
                    </category>
                
                    <category>
                        <![CDATA[ agile ]]>
                    </category>
                
                    <category>
                        <![CDATA[ agile development ]]>
                    </category>
                
                    <category>
                        <![CDATA[ development process  ]]>
                    </category>
                
                    <category>
                        <![CDATA[ project management ]]>
                    </category>
                
                    <category>
                        <![CDATA[ Scrum ]]>
                    </category>
                
                    <category>
                        <![CDATA[ software ]]>
                    </category>
                
                    <category>
                        <![CDATA[ software development ]]>
                    </category>
                
                    <category>
                        <![CDATA[ Software Engineering ]]>
                    </category>
                
                    <category>
                        <![CDATA[ tech  ]]>
                    </category>
                
                    <category>
                        <![CDATA[ technology ]]>
                    </category>
                
                <dc:creator>
                    <![CDATA[ Colby Fayock ]]>
                </dc:creator>
                <pubDate>Tue, 12 May 2020 14:45:00 +0000</pubDate>
                <media:content url="https://www.freecodecamp.org/news/content/images/2020/05/intro-to-agile-1.jpg" medium="image" />
                <content:encoded>
                    <![CDATA[ <p>Running a team of developers is hard. Trying to coordinate a mountain of work while keeping everyone productive is a challenge itself. But on top of that, you have to keep open communications with a client. How can we use agile to relieve some of those pain points?</p>
<ul>
<li><a class="post-section-overview" href="#heading-what-is-agile">What is agile?</a></li>
<li><a class="post-section-overview" href="#heading-what-are-some-concepts-you-should-know">What are some concepts you should know?</a></li>
<li><a class="post-section-overview" href="#heading-stories">Stories</a></li>
<li><a class="post-section-overview" href="#heading-epics">Epics</a></li>
<li><a class="post-section-overview" href="#heading-sprints">Sprints</a></li>
</ul>
<div class="embed-wrapper">
        <iframe width="560" height="315" src="https://www.youtube.com/embed/1GPYnoG_nkE" style="aspect-ratio: 16 / 9; width: 100%; height: auto;" title="YouTube video player" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen="" loading="lazy"></iframe></div>
<h2 id="heading-what-is-agile">What is agile?</h2>
<p>Agile is a software development methodology that stems from the idea of breaking up large amounts of work into smaller pieces. This gives product managers, developers, and any stakeholder a better understanding of the work.</p>
<p>Historically, software development was a slow process where major changes to requirements could put large strains on teams. </p>
<p>When following the agile methodology, the smaller chunks of work help teams become more flexible, and dare I say <em>agile</em>. And in the process it helps them deliver features faster and respond to changes quicker.</p>
<p><img src="https://www.freecodecamp.org/news/content/images/2020/05/jira-project-board.jpg" alt="Image" width="600" height="400" loading="lazy">
<em>Example Jira project board from <a target="_blank" href="https://www.atlassian.com/software/jira">atlassian.com/software/jira</a></em></p>
<p>These ideas have been broken up into different frameworks of approaching this methodology. Two of the common ones are <a target="_blank" href="https://www.scrum.org/resources/what-is-scrum">Scrum</a> and <a target="_blank" href="https://en.wikipedia.org/wiki/Kanban_(development)">Kanban</a>. </p>
<p>For this walkthrough, most of these concepts follow along the Scrum framework, but there are certainly concepts that apply to both and others.</p>
<h2 id="heading-what-are-some-concepts-you-should-know">What are some concepts you should know?</h2>
<p>I'd argue half of being productive as a developer in an agile world is simply understanding the terms. Typically the project manager runs the show, so if you can be on the same page with what they're talking about, it will make the process a lot easier.</p>
<p>There are books, courses, and certifications based around learning the nuances of the agile methodology. I'm not going to go deep into some of the philosophical aspects or some of the deeper parts, but I'm going to cover a good set of key concepts that will help you hit the ground running when you start your new job with an agile team.</p>
<h2 id="heading-stories">Stories</h2>
<p>A story is typically the smallest defined piece of work. This usually comes in the form of a new ticket that you create in the project tool you're using whether it's <a target="_blank" href="https://www.atlassian.com/software/jira">Jira</a> or even <a target="_blank" href="https://help.github.com/en/github/managing-your-work-on-github/about-issues">Github Issues</a>.</p>
<h3 id="heading-expressing-stories">Expressing stories</h3>
<p>When working on a project, you'll probably run into a variety of ways people express stories. But a good guideline is to work through the concept of the word "story" itself and explain the work that needs to be done in that way.</p>
<p>For instance, if you would like to provide the ability for the people who use your website to share a blog post on Twitter, you may want to write the story as: As a reader, I want to share the post I just read to Twitter.</p>
<p><img src="https://www.freecodecamp.org/news/content/images/2020/05/jira-story-summary.jpg" alt="Image" width="600" height="400" loading="lazy">
<em>Creating a new story in Jira</em></p>
<p>Using that pattern of "as a [person], I want to [action]" helps provide context as what state somebody may be in when visiting their site and what they're trying to achieve. This can be particularly helpful if you're developing features for people who are logged in that are different from guests.</p>
<h3 id="heading-details-and-requirements">Details and requirements</h3>
<p>While the title of a story is an important representation of the work, you'll also want to provide additional specifics. </p>
<p>At a minimum, that should be done by adding a thorough description and a set of acceptance criteria that can help give the developer context and requirements. Depending on the team, this can also include tools like tags or categorizations that make it easier for the team to visualize groups of work.</p>
<p>Providing a strong set of requirements helps both the developer working on the story and the person reviewing it have a measurement to determine if it's actually complete. Without it, everyone's just guessing.</p>
<p>A good way to phrase these are: verify [requirement]. Back to my example of sharing a post on Twitter, maybe some of the requirements to that story would be:</p>
<ul>
<li>Verify when clicking the share button a new tweet is created</li>
<li>Verify the tweet includes a link to the current blog post</li>
</ul>
<h3 id="heading-amount-of-work-or-level-of-difficulty">Amount of work or level of difficulty</h3>
<p>Each story is represented by a number of points. Those points are a way to express how much effort a team of developers expects one story to be. That effort can mean a variety of things though whether it's simply how difficult the team expects the work to be or the amount of risk or uncertainty a particular story has.</p>
<p>One way teams represent this is with the <a target="_blank" href="https://en.wikipedia.org/wiki/Fibonacci_number">fibonacci sequence</a>, where the amount of points can be 1, 2, 3, 5, 8, etc. Where a negligible text update might be 1 point, adding a new form to a page could be 3 points.</p>
<p>Typically you'll want to avoid pointing stories too high, as you get above 5 points, there's more than likely a way you can break up the work to make it more manageable. While you could easily create a massive 13 point story to accomplish all aspects of a feature, it usually makes sense to tackle the work in smaller, more focused chunks.</p>
<p>Either way, these points all add up together to give your team a rough estimate of how much work a group of stories would take to complete.</p>
<h2 id="heading-epics">Epics</h2>
<p>While stories have a goal of defining a bite-sized piece of work, epics are a way to group those pieces of work together to represent a feature.</p>
<h3 id="heading-defining-stories-as-a-feature">Defining stories as a feature</h3>
<p>A good way to explain this is with another example. If you're working on an application that requires the integration of authentication, you may want to create a new epic simply called "Authentication". </p>
<p>Inside that epic, you could find stories like:</p>
<ul>
<li>As a guest, I want to sign into the application with my email address</li>
<li>As an authenticated user, I want to change my password</li>
<li>As the security team, I want to prevent spam and abuse of user authentication</li>
</ul>
<p><img src="https://www.freecodecamp.org/news/content/images/2020/05/jira-epic-authentication.jpg" alt="Image" width="600" height="400" loading="lazy">
<em>Example of an Authentication epic in Jira</em></p>
<p>With your epic defined, you're giving your team a path to calling a feature complete while also understanding the entire scope of that work. This is important when it comes to planning out the work to be done.</p>
<p>Defining your stories in your epic gives you a sense of how much work something takes, but it doesn't help you figure out how long it would take, which is where sprints come in.</p>
<h2 id="heading-sprints">Sprints</h2>
<p>Sprints are a way of planning out how the work will actually get done. While similar to epics in that they are a way to group chunks of work, sprints typically represent a period of time in which a particular chunk of work will be done.</p>
<h3 id="heading-time-per-sprint">Time per sprint</h3>
<p>A common way of defining a sprint is two weeks of work. During those two weeks, your team will have a particular velocity, or average amount of work you can complete, for an individual sprint. This velocity is represented by a number of points that is a sum of the average velocity of each of the developers working on that sprint.</p>
<h3 id="heading-points-per-sprint">Points per sprint</h3>
<p>Though many fiercely argue you shouldn't use time to represent that velocity, points will roughly translates to an average amount of time of work for each developer. While 1 point for an experienced developer could be 1 hour, that same 1 point could mean 3 hours for a less experienced developer.</p>
<p><img src="https://www.freecodecamp.org/news/content/images/2020/05/jira-project-roadmaps.jpg" alt="Image" width="600" height="400" loading="lazy">
<em>Example project roadmap from <a target="_blank" href="https://www.atlassian.com/software/jira">atlassian.com/software/jira</a></em></p>
<p>But once you have this number of points that your team averages in a sprint, you'll know how many story points you can expect to plan to be completed. This planning goes sprint to sprint as you spread out a group of stories or an epic so you can predict when a feature will be complete.</p>
<h2 id="heading-how-agile-fits-with-your-team">How agile fits with your team</h2>
<p>Try to remember that the Agile methodology through Scrum, Kanban, or any other framework is just that – a framework. While it's probably a good idea to follow the process when you first start out, listen to your team and try to mold it to your own experiences.</p>
<p>Each team works a little bit differently and forcing a process onto that team can cause more harm than good, but there will always be a learning curve for any process. Fight the eye rolls until everyone gets the hang of it and have frequent retrospectives to see what works and what doesn't.</p>
<p>At the end of the day, the processes your team follows should mostly be invisible, working for you instead of against you. Find what works best for your team and share your experiences for others to learn!</p>
<h2 id="heading-whats-your-teams-process">What's your teams process?</h2>
<p><a target="_blank" href="https://twitter.com/colbyfayock">Share with me on Twitter!</a></p>
<div id="colbyfayock-author-card">
  <p>
    <a href="https://twitter.com/colbyfayock">
      <img src="https://res.cloudinary.com/fay/image/upload/w_2000,h_400,c_fill,q_auto,f_auto/w_1020,c_fit,co_rgb:007079,g_north_west,x_635,y_70,l_text:Source%20Sans%20Pro_64_line_spacing_-10_bold:Colby%20Fayock/w_1020,c_fit,co_rgb:383f43,g_west,x_635,y_6,l_text:Source%20Sans%20Pro_44_line_spacing_0_normal:Follow%20me%20for%20more%20JavaScript%252c%20UX%252c%20and%20other%20interesting%20things!/w_1020,c_fit,co_rgb:007079,g_south_west,x_635,y_70,l_text:Source%20Sans%20Pro_40_line_spacing_-10_semibold:colbyfayock.com/w_300,c_fit,co_rgb:7c848a,g_north_west,x_1725,y_68,l_text:Source%20Sans%20Pro_40_line_spacing_-10_normal:colbyfayock/w_300,c_fit,co_rgb:7c848a,g_north_west,x_1725,y_145,l_text:Source%20Sans%20Pro_40_line_spacing_-10_normal:colbyfayock/w_300,c_fit,co_rgb:7c848a,g_north_west,x_1725,y_222,l_text:Source%20Sans%20Pro_40_line_spacing_-10_normal:colbyfayock/w_300,c_fit,co_rgb:7c848a,g_north_west,x_1725,y_295,l_text:Source%20Sans%20Pro_40_line_spacing_-10_normal:colbyfayock/v1/social-footer-card" alt="Follow me for more Javascript, UX, and other interesting things!" width="2000" height="400" loading="lazy">
    </a>
  </p>
  <ul>
    <li>
      <a href="https://twitter.com/colbyfayock">? Follow Me On Twitter</a>
    </li>
    <li>
      <a href="https://youtube.com/colbyfayock">?️ Subscribe To My Youtube</a>
    </li>
    <li>
      <a href="https://www.colbyfayock.com/newsletter/">✉️ Sign Up For My Newsletter</a>
    </li>
  </ul>
</div>
 ]]>
                </content:encoded>
            </item>
        
    </channel>
</rss>
