episode 6: sam guckenheimer episode transcription

Episode 6: Sam Guckenheimer Episode Transcription

© 2021 Tasktop Technologies Incorporated. 1

Mik Kersten: Hello, and welcome to the Mik + One podcast, where I sit down with industry leaders to discuss the Project to Product movement. I'm Mik Kersten, founder and CEO of Tasktop, and bestselling author of Project to Product: How to Survive and Thrive in the Age of Digital Disruption with the Flow Framework™. On today's episode, my plus one is Sam Sam Guckenheimer, a product owner for Azure DevOps. Sam's a regular keynote speaker and the author of four great books. Sam provided some tremendous advice on the Project to Product manuscript, and today he addresses some much more profound topics as he answers my questions on how organizations should think about the Turning Point and the Age of Software, as well as technology and innovation during and beyond the pandemic. I hope that you enjoy his very profound insights. So, with that let's begin. Mik Kersten: Welcome everyone. I'm here with Sam Guckenheimer today. Sam is the product owner of Azure DevOps at Microsoft and more importantly, he's been one of my mentors and inspirations over the years. He gave me some of the most pointed and powerful feedback when I was writing Project to Product that has stuck with me, and that was learning the importance of even more as I've been pursuing the book over the last couple of years. So, we'll hit on some of those points. But Sam, welcome to the show. And why don't we just get started and dive into the situation that we're seeing today, the conversations you and I have had around what's happening in terms of technological revolutions and Turning Points, and go from there. So, welcome. Sam Guckenheimer: Thanks for having me, Mik. I mean, I love the podcast you did with Carlota Perez. It's funny, I listened to that literally on the last day before I started sheltering in place. It was a March 6th, then I was walking around Frankfurt and then flew home the next day, and I've been sheltering in place since. Mik Kersten: That's right. I remember our quick correspondence then. Yeah. For me, I recorded that, it must've been, I think it was end of January, if I recall correctly. Since then, I've been corresponding and having calls with Carlota Perez really the end of February and March, around what exactly is happening here because I think she's been telling us about the way these revolutions work, the way they build bubbles, the way that the bubbles will actually cause all sorts of interesting things to happen, be it income inequality, be it over-investment in certain sectors, be it the various balloons that we see, and then they come to these Turning Points. Mik Kersten: And what triggers the Turning Points is never predictable, but we both emailed each other on the same day saying, "Oh, it looks like this is it. This is a deep enough, and big enough thing that this is fundamentally different than what we saw in 2000 and 07, 08 as well. It's much more broad. And in these major changes that her models predict we have as organizations and the economy, try to master one kind of production, this waves of disruption that are catalyzed by these economic events. This looks like it could be the one." Sam Guckenheimer: Yeah, I think it is. I've been a fan of her work for years. I do think we're seeing a change due to Covid-19 that is unlike anything in our lifetimes. It is I think, most comparable to what happened coming out of the "roaring twenties" into the great depression. I think we're clearly seeing levels of unemployment and economic displacement that we haven't seen since then. And because this is first and foremost a public health crisis, we're really seeing huge tragedy in public health, and behavioral change that will be necessary



for all of us. I think the acceleration of economic changes is going to be qualitatively unlike any of the "disruptions" we heard about around the 2008 financial recession or the dot-com stir, any of that. We're talking about something that is much more fundamentally going to change the look of how we live and work after, than before. Mik Kersten: Yeah, exactly. A lot of my conversations with Carota Perez were about this, as she's been doing a bunch more work about the historical context of each of the Turning Points. And then one of the key things that she said to this, that these points are not as discrete as we like to see them, but they always have a start and then when they end, they trigger the deployment period. They trigger the change, they trigger the rebuild. So one thing I learned that I had not, from reading her book, had an enough of an appreciation for and from our past conversations is that multiple of the Turning Points actually had multiple crashes. There were multiple events. And the way that she took me through that, the way that to think about it is that, she always called it and it's been like this, she's been describing it this way, but that these events will happen. And then either we actually enter the Turning Point, or we start like with the dot-com crash, there's some rescue packages and so on. And then it snaps back to installation conditions. Sam Guckenheimer: I think one of the best analogies for what we're going through is the history of electrification. So, if you look at that history, it actually started in the late 19th century. And it started with Edison inventing DC generation and the light bulb and so forth. And at that time, the JP Morgans and the very rich would build their power plants, so that they could use electric lights. And the idea that if you wanted to get off kerosene light, you needed to build your own power plant was the model. And that came Westinghouse and Tesla, and alternating current, and Edison thought that, he electrocuted elephants and did all this crazy stuff in order to hang on to the DC power generation model, which was, I mean, clearly Edison was brilliant and the whole idea was right, but that was not how you were going to be able to distribute electricity. But it wasn't until the depression in the 1930s that we had rural electrification, and it was really the change in the private to public sector relationship that allowed rural electrification to bring the benefits of that broadly to so much of the population. Sam Guckenheimer: And I think that was one example of a flattening of income and equality that happened after the great recession by using what was the previously available technology. I think the other thing that we saw starting beforehand but then accelerating then, was the total change in how people thought about manufacturing. So, manufacturing had been initially designed around the central power source, and then with the invention of the assembly line, that was possible only because you could now have many electric motors distributed through a plant horizontally, and we went from vertical plant design to optimize the proximity to the central power source, to optimizing a form of flow in the plant, and then the mass electrification spread that further. And you saw that of course, in North America, and then under what were then developing regimes, you saw electrification spread. So, I think we are now at the point where it's not electrification, but it's things like broadly available broadband, rural broadband, 5G, it's use of the public cloud, it is acceptance of the cloud and the public infrastructure in place of archaic private infrastructure. Sam Guckenheimer: Three months ago you still would hear all these discussions of, "Oh no, we'll never put FUBAR in the public cloud." And now all of a sudden, "Oh. Well, maybe the cloud's better than not being able to work." And so I think data centers will be closed, the way private power plants were closed. And I think that we'll really see a huge change in how people work, and with it a necessary change in how we regulate tech and think about the corresponding ethics of what we're doing.



Mik Kersten: Yeah. So, Sam, a few key points here, and I think it's really interesting to me that you're bringing up the electrification aspect of it. Because I think you and me, when we do travel, when we used to travel, I should say, we would go and look at these amazing private power plants with kerosene lamps everywhere and wonder how long this can keep up. Because these investments all these large organizations make, and mute kerosene lamps, and better sources of kerosene, and more people to light them. That's what was so stark to me and in realizing this Turning Point had to come. Is because those investments of rebuilding the wheel, reinventing old wheels, they could not last. And so before we get into that though, I think the interesting thing about Carota Perez models is you've got this installation periods, where these new periods are created. And what I talked a lot about in my book is that in the 1970s it was a microprocessor, and then Microsoft, we started this age of software and digital. Mik Kersten: And so, I think what's so interesting now is, and it's actually so imperils, the stories that you just told with electricity, is that the technologies are there already. That we've actually got, if Perez's models are right, we've actually got all of the technologies, the practices that we need in order to get us into a rebuild and into these infrastructures that will actually power the deployment period. Power where more organizations, more individuals have access to the new ways of working and scaling the new ways of production, which is through software. You're at Microsoft, Microsoft is already done. It's figured this out. It's helped start the age of software. But now the interesting thing is that if that infrastructure becomes more broadly available, and this is top of mind for me because a couple of days ago I interviewed Brian Fleming, the SVP of Technology at T-Mobile. 5G's there. Cloud is there already. Modern delivery practices both from a management and a technical point of view are all there. Mik Kersten: So, can you just say before we dig into to how organizations can think about and leverage this. Can you just say a little bit more about what worked, let's say in the rebuild after the great depression, and the new deal around organizations leveraging this infrastructure, and around individuals getting access to this infrastructure, and that actually having driven down equality with a combination of regulation and technology. But it truly feels to me like we're seeing some profound parallels right now. Sam Guckenheimer: It used to be that a barrier to entry to any manufacturing was access to a power source. Then the initial phase of electrification was, well actually you could set up your own electrical power plant, but people didn't understand that they needed to, or that they had the option to design factories differently. Then we got to the Ford era when people said, "No, no, no. We can have many electric motors, and we can change the factory design." And then we got to mass electrification with broad distribution of national grids, and anyone could plug in to power anywhere, and you just assumed it turned on. Well, that's I think the transformation we're about to see where anyone can plug into computing and it turns on. We still have gaps that I hope now get closed in terms of internet availability and broadband. But that's where I think we are. Sam Guckenheimer: And I think that's the equivalent of the mass electrification that we saw during the new deal. I think you'll see that that is going to democratize the way people work, and companies organize in a way that has not happened yet. And I believe with that comes the notion that you optimize, not for the capital-intensive stuff, you optimize for flexibility. I mean, the availability of electricity everywhere meant that everyone could have a washing machine. So, you had all of a sudden a new world of appliances, and you had a tremendous



impact on the standard of living because all of a sudden, all of these people, mostly women, who spent hours of their lives doing laundry now didn't have to, and that's a very mundane example. Sam Guckenheimer: But if you think about how our economy is organized, it's organized around this, for the last many decades, big companies with big data centers. And the access to computing capacity has largely been controlled by how those things are managed. And you have to wonder, do they matter anymore? Are those like those DC power plants? Look at what we're doing, we're having a video conference. Video conferencing minutes have increased 100X in the last six weeks, because of Covid. All of a sudden, we're seeing scale growth in things people weren't thinking about. My family's thinking, and saying, "Hey, should we start doing regular video chats," and things like that. It's becoming part of the fabric of life. No one thought about it before. It was like, "Oh yeah." Or if they were doing it, they were using these clunky high latency services. Now it's like, "Sure, we do it." Mik Kersten: Yes, exactly. So, I think we've seen how quickly we can adapt, and it has been amazing, not to say I think it's been easy, but it has been amazing. But I think, Sam, just rewinding a little bit to your example, because I think what was so stark to me in writing Project to Product, is your example with Ford. Prior to the Turning Point, prior to the crash of 29, the great depression, he figured out that new factory design. He figured out that you were able to create a much broader, much larger factory with electricity. And then, of course, this key piece of infrastructure that you're talking about that came to play with the AC infrastructure that enabled everyone to do that after. And I think what you're saying is we've got that now. Mik Kersten: We've got this Turning Point today, and the companies who figured out what Ford figured out, talking back then. But today, the example I gave in my book, one of the examples was Microsoft. The companies that figure out what Microsoft has figured out, because Microsoft will have no problem getting through this Turning Point, will be a key part of the rebuild, will be a key part of providing more of the cloud infrastructure, and the services that drive both consumers and business to thrive through the rebuild. Because they're going to be new things. Now it's video conferencing, well, there'll be more down the road. So, I think you and I share a common frustration, which is that over this growing bubble mentality, there's not been enough of a driver for organizations to make these changes. Mik Kersten: The new ways of production that the tech giants, companies like Microsoft have mastered, they're already there. And contrasting those to what I saw, and what really I documented in this recent post you helped me with on Covid-19 bringing about the Turning Point, it was completely bubble mentality. It was thinking, "We'll take our time getting rid of our own power plants, that we have four of globally. And eventually we'll look at cloud, but we'll worry about security and cloud, but not worry about the fact that people who specialize in security are probably better than the security we're doing ad hoc all over these data centers and so on." Mik Kersten: So, there's been, I think this mentality and there's been that that joke going around is, who's driving your digital transformation? Is it the CEO, is it the CTO, or is it Covid-19? We're now, I think actually seeing that the third one... And a bunch of organizations, I think were on the right course of action. But what really concerned me over the last two years since publishing Project to Product, was just how slow it was going. Leadership realized this, CEOs and boards realized this, but within these organizations, the move to cloud, the move to modern tool chains and really what powers today's creative factories of software, was just



glacially slow. So, you said this fascinating thing to me earlier, which is if there was ever an Occam's razor for core versus context, this is it. Can you speak a bit more to that? Sam Guckenheimer: Yes, of course. I think the pandemic is Occam's razor, for core versus context. Jeffrey Moore has been talking, I think for decades, about looking at your investments in terms of what's core - that is unique and differentiating for your business - versus context - that is something that everyone has and it's table stakes. So, are you running your own email server? Well, why? That's context. You can get email as SAS, and it's better, and it's more economical, and there's absolutely no reason for you to have your own resources devoted to that. Same thing for CRM. Same thing for payroll. Same thing for all of these other business systems, and to a large extent the growth of SAS has been an illustration of people realizing we're better off just buying the finished service in, than trying to run it ourselves. Sam Guckenheimer: And he, of course, he Jeffrey Moore draws on the second axis, mission critical, and not mission critical. And where things are mission critical like email, or payroll, or what have you, you get a SAS, you pay for it. That becomes part of your supply of doing business. And the places where you invest uniquely are places where you differentiated core. Also, you realize that over time your core differentiation itself becomes diffused through replication in the marketplace, and itself becomes context, and you need to disinvest in what was important some time ago because it was differentiating then, and now say, "Wait a minute. We should stop trying to run that ourselves, and we should just buy it in." And so, you see this continual evolution of where a business needs to focus, and we've been preaching this stuff for a long time. Sam Guckenheimer: I think the pandemic makes it absolutely visible, as to, "Well, do we need this high-priced office space? Do we need these many stores in these many malls? Do we need to have these many retail branches for our bank? Do we need to have so many people doing so many undifferentiated things?" And the answer of course is, "Well we once did, but we probably don't tomorrow." And as we do physical distancing in the pandemic, a lot of those things will become very clear, and people will ask as we come out of the pandemic, do we need to keep doing things the way we did before, or did we learn that a bunch of things are unnecessary? And I think we're going to learn that a bunch of things are unnecessary. Sam Guckenheimer: And for all of the talk about disruption and change, and all that stuff that we've had through startups, and investment, and venture capital, this is the point at which we are forced through the health crisis to behave differently. And the questions that were interesting discussions at conferences, suddenly become very visceral, and very much everyday experience. So, I think that business practices will change. We will become more reliant on ubiquitous technology, the cloud, the internet, the availability of high-quality services. We will see a lot of that context get appropriately shelved as waste, and we will see the survivors coming out of the crisis as the ones who can appropriately focus on their new core. Mik Kersten: So well-put Sam. What I'd like to dig into now is the patterns of who will be the survivors. And I think, you mentioned a bunch of the context, and core, and that I think will be more obvious from a business perspective, as organizations adjust. So, the notion of branches, and physical retail locations, and so on. And the thing I'm seeing, that again, I think you're so attuned to that others are not, is there's going to be now this shift to the organizations who invest properly in digital and in software, as they move away from physical. That the ones who do it well will thrive, and the ones who don't are just out of time. So, first of all, there'll be a cohort of organizations that have just moved too slowly and they will get this place that's



unfortunate, but it is something that obviously we've been talking about for a couple of years. I think the key thing is unless they move very, very quickly right now, for some of them it might be too late. Mik Kersten: Then, there are those ones who will take this seriously, as a way of basically restructuring, rebalancing around the core versus context. And the thing that's always concerned me and really the mission of Project to Product, is that while at a business level these organizations are very good at it because their leadership is good, it's been difficult to connect that to software delivery. So, within Microsoft you're constantly reevaluating, "Well, what is our core? Is some of this getting commoditized? Do we bring in some open source? Because if we keep investing in this part of our platform, well that's a dead end, and we can actually leverage this." So you think of your software portfolio, as a product portfolio holistically, and understand whether something's creeping up from elsewhere in the market, from the bottom, and open source and so on. Mik Kersten: And so the concern for me is, I guess, what are some of the... Because I think you know them. We've talked about them. You know these patterns of reuse, be it infrastructure, or opensource, or tooling. Can you just share a bit more? Because again, my concern is that Microsoft knows how to measure these things. Microsoft knows how to spot platform dead ends. Microsoft knows how to look at things from both delivery velocity point of view, and tech debt point of view, and a commoditization, or a context, things turning into context point of view. If you could just share some of your thinking about how you actually look at your value streams. These notions of reuse, because again I think you nailed it, which is the organizations that don't very quickly move their investment to core, and differentiated core, are going to have a very hard time, which then means a hard time for their staff and a harder time for the rebuild. Sam Guckenheimer: The key virtue that will be rewarded is a flexibility or business agility. We've talked in the past about the idea that requirements are perishable. Well, a whole bunch of requirements just perished. The pandemic has killed them off. And the realization you have when you look at that, is that what's important is not that we can keep doing what we said we were going to do more efficiently, so much as that we can optimize our time from idea to data. In other words, we can create a world and a way of working in which we go from wanting to do something for the business and having the data that substantiates or diminishes the hypothesis in that idea. And the reason that's so important is that we're not right all the time. In fact, we're right a minority of the time. We think we're right, maybe a third of the time with the ideas that we have. Sam Guckenheimer: So you want to give yourself per month, per week, the maximum number of chances to test those ideas, to get the evidence to substantiate or diminish the idea. And if it has the result you want, you want to have the opportunity to double down quickly. And if it doesn't have the result you want, you want to be able to pivot quickly. And the more you can do that, not only the more chances do you have to get it right and make an improvement, but in fact you build up a compound interest, where the value of every move gets to build on the value of the previous move, and that flexibility, I think that's the core dev ops concept that is being able to get that flexibility. Sam Guckenheimer: Now, you cannot do that if you're carrying debt. You cannot do that if you have one backlog for the features you're going to do, and another backlog for all the engineering work you're going to do. You have to get clean, and stay clean. And that means get out of the debt, pay it down, be in a situation where you don't have the impediments that keep you from moving forward because of all of these bugs you've got to deal



with, all of these security issues, all of these info issues, all of these permissions, all of these whatever’s. You get rid of all that stuff, and you really think about optimizing that end to end idea to data. It's a mindset shift from a world where we grew up thinking about time between failures. MTBF, mean time between failures was the big thing. Sam Guckenheimer: And when we had a very high cost of distribution and cost of repair because we were shipping widgets, or once upon a time in software we actually shipped physical media, we get out of that time between failure mentality to thinking about time to recovery. And if you can try and experiment, you can do so on a sample, you can do so progressively as you collect positive evidence, you can expand the impact radius. If you collect negative evidence, you can revert as we build up that pipeline for progressive delivery, and we optimize for that data informed way of working, we're able to respond flexibly to the new set of conditions. And it's the companies that think that way, that are going to thrive in the new world. You asked about how we work at Microsoft? Well, at Microsoft, we're doing now on the order of 90,000 production deploys per day. And we only can do that because we have built up the automation with suitable safeguards in our pipelines that allow us to trust the deployment. Sam Guckenheimer: Now, during the pandemic we've been much, much more selective about what payloads we deploy. So, we made the batches smaller in most cases, and we've doubled down on other areas like teams for video conferencing, and distributed meetings, and so forth. But because we have that hardened pipeline, and those ways of working where we can trust the machinery, we can move fast. And we try very hard. I mean, this is what, Azure DevOps, my product line's all about, we try very hard to take what we learn internally for ourselves. We call this first party and make it available to our customers third party in our parlance. So, it's not that we try to hang onto these secrets or anything like that, we're very open about sharing. I curate a website where we publish a bunch of this stuff. In fact, that the second most active project on GitHub, in the world, is the documentation for Azure. I mean, that's all on GitHub. Mik Kersten: Really? Wow. Sam Guckenheimer: And you can improve the docs with a pull request if you find an error, and what have you, and everyone does, and we've just put all the documentation into open source, like that in order to make it as good as possible. And if you look at the pandemic response, all of the action that's happening is scientists sharing data, and models, models about pandemic spread, and genomic models about the virus, and variants, and antibodies on GitHub. So, this new way of working regardless of the politics, and all the blab blah that pollutes your ears, the real way people are working is already in this post pandemic connected world. Mik Kersten: Yeah. I think exactly. I think that's the key things, we're already seeing those new ways of working right, and we're already seeing the interesting point that you just made because announcing that the Covid-19 model from the Imperial College of London, is the second was trending project on GitHub today. So, those ways of working are already there, and again, my concern is back to the fact that they're not evenly distributed at. So, I think we need to help the economy, we need to distribute those new ways of working as fast as we can, stop the reinventions of the wheel. Now, I think this was such a key thing that you said, Sam, about the importance of speed of decisions we're making. So, every time you tell me how many times Microsoft deploys per day, I'm amazed. But I still find it boring at this stage because it's now in such high tens of thousands. 90,000 is amazing, but-



Sam Guckenheimer: That's the goal is to make it boring. Mik Kersten: Exactly. Sam Guckenheimer: Deployment should not be a big event. Keeping business as usual. Mik Kersten: Exactly. And then the other thing that you're saying is, because it's boring, the amount of data driven decision making that enables, and how quickly you can shift investments between your various product value streams are tailored, as you mentioned, with a batch size, or the changes you're putting, that you're investing in is just amazing. But here's just a learning from you from last week. We did this workshop with a large healthcare company, really critical to what's going on right now with the pandemic. And one thing that was amazing is that we did it with 60 attendees remotely, and people actually participated. This is in the height of things, they had just been sent home, they were a little late in their area, so a week prior, everyone's still adjusting. But the amount of dedication I saw from all these IT and software people in this organization to improvement was amazing. Mik Kersten: And then I realized, it's just the distance where they are, or many of these organizations are to where Microsoft is today, and other innovators are today, is just so broad because you're getting feedback so quickly at a business level, from changes that you've put into production on a daily, weekly, monthly basis. You've got this closed feedback loop, this PDCA loop or however you look at it with your planning system, and your OKRs that's able to have you move quickly. And you said such a key thing is organizations that will be able to move quickly, make decisions quickly, will be so much better off than the ones who won't. So, I realize this yet again, they are so many companies have not put in... To your point, I'll be blunt, I think anyone who's trying to right now innovate on their own data centers rather than on the public cloud, for potentially a hybrid cloud, which introduces a whole bunch of other complexities, has a big problem. Mik Kersten: If you're not using Covid as a catalyst to accelerate that times 100, that's an issue because again, if you're going to learn quickly, you need to deploy quickly. You need to move fast, and you need to put in a place your IT investments on top of that, not reinventing that wheel. But the thing that I was learning is we need to point out to these organizations, this is now back to this big workshop, we need to teach these organizations why and how to invest. So, what I saw, and this is where I was thinking, okay, these Flow Metrics, they're helping. They're helping because what happened is, and they had been doing measuring their Flow Metrics on these value streams for months. So, they were actually able to say... And Sam, I want to point out, this problem I see with some of the technology laggards is, their business feedback loop is so much slower than yours. Mik Kersten: It's that because their automation's not there, the tech debt is high, the amount of rework and rebuilding the wheel is high. It's six months before they get business feedback on something. So, I realized, okay. And, of course the Flow Framework is meant to be as, input and Flow Metrics, what kind of business outcome you get, which to you, you can actually see and measure with your AB testing in hours or days. So, I realized these Flow Metrics are actually helping because these hypotheses these things made, and doing test



automation investment, meant that their feature flows were no longer spiking up and down. They had actually smoothed it, made batch sizes smaller, and not had the dev teams do a whole bunch of defects by getting the results of manual tests back. I mean simple and insane as it sounds, that's actually the state of practice for so many organizations. Mik Kersten: And tell me what you think of this, but it's two things then you want. The big thing that needs to happen is you need to get that business feedback loop to be like Microsoft's, as a business. To do that, you need that automation infrastructure investment and whenever you make that investment, you need feedback. Did it work, did it not? Did our flow increase? Did our flow time get shortened and so on? So, I am hoping that these Flow Metrics help on that front. Sam Guckenheimer: Yes. So, I think that Flow Metrics are really important for understanding end-to-end, and getting out of optimizing silos. From optimizing silos to optimizing value streams. I do want to say, and you mentioned this healthcare company, that a lot of organizations are in regulatory environments, where... And I believe, I just want to clarify right now, I'm not a libertarian, I'm not an anarchist. I believe in product safety regulation. I believe that medical innovation should go through double-blind trials, and all of these things. I think those are there for good reason, but you need to think of them as constraints on how you work, not as objectives. It hit me between the eyes when in another context, I heard a customer describe regulatory compliance as an objective, and it totally missed the point. Sam Guckenheimer: You don't get quality through regulatory compliance. You get quality through delighting the customer, or achieving the stellar medical result, or what have you. Doing it in a compliant way, and in a safe way, that's a constraint on how you do it. It's a necessary constraint. And in fact, I think in a great many areas, we don't have enough regulation. The ethics of regulation will also change radically through this pandemic. For example, privacy has been fortunately a hot topic since GDPR and the California Consumer Privacy Act. And I'm staunch believer in data privacy. I got off Facebook in 2011, and haven't been on since. But if you ask me, do I think it makes sense to do contact tracking for understanding the spread of the virus? I would say absolutely. And would I consent to having my data used for purposes of public health? I would say absolutely. Sam Guckenheimer: I don't consent to having my data used for behavioral prediction for advertising, and I want those ads out of my face. And I'm happy to pay a subscription, instead of having the ads in my face. But we have not had the discussion about what the suitable ethics are. Facial recognition, another great example. Washington State, just this week passed to my knowledge, the world's first law around permitted and illegal uses of facial recognition technology. Can you do mass surveillance? No. Can you try to rescue a child who's been kidnapped? Yes. Those ethical considerations about product safety in the physical world came about also, in the last major transformation, people started worrying about product safety when we had things like automobiles, and pharmaceuticals, and appliances and all these kinds of things, and we need product safety in the digital world. Sam Guckenheimer: That's a constraint of doing business. It's not an objective. The objective is getting to the first positive result. And the result is in the eyes of the end consumer, or citizen, or beneficiary. Are we making more people safe and healthy and happy, or are we ticking the boxes and keeping them as customers because we've put up artificial barriers to switching that are too painful? Well, I mean, I can tell you how I feel about my



cable company. We clearly need to understand, and honor the importance of the regulatory environment, and make it better, and make it meaningful in a world that becomes data-driven rather than algorithm driven. At the same time that we create the safe pipelines, to do more of the right thing at better frequency. Mik Kersten: Yeah. And Sam, first of all, I could not agree more, and so amazingly put. One thing that Perez did say is that in these Turning Points, regulation catches up to technology. As you said, product safety caught up to manufacturing at one point, and we were all better off with the product as a result. And I was actually at a, just a month ago, my last trip at a US manufacturer, one of our customers, and we were talking about pipeline safety as you mentioned, because we saw in some of their metrics, one of their bottlenecks was their consumption, they actually did understand, I think there was innovative thinkers there, how important core versus context was. So, they were ramping rapidly up the consumption of open source. They're already doing it. There's a lot going on over there, obviously with the need to move faster on autonomous, and so on, and innovation in general. Mik Kersten: And so they said, "Well, how are you guys doing it?" And we said, "Well, the last six years, we've been doing open source for ages." It's just in that pipeline. It's exactly as you put it, it's a constraint on their pipeline. So, if someone basically adds to any one of our value streams, an open source probably that does not meet our legal requirements, the build breaks. And there's a ticket created, and it's resolved. And it's just part of the safety of the pipeline. And they just reinvented that wheel, a month back, and they were proving it out on a small project. Now, of course they are product safety thinkers culturally, so they already got there. Mik Kersten: But what's amazing to me is again, how much the compliance and regulation, I don't think is an excuse. It's a constraint, and you can absolutely innovate with that constraint in mind. So, I think again, the thinking that you apply to your portfolio, it absolutely, for some of the most regulated portfolios and safety critical software and mixed software-hardware I've seen there, there are people doing it the right way. Sam Guckenheimer: Yeah. Let's take that example because that's a beautiful example. The safe consumption of open source. This has been an increasingly scary area. We've seen for the first time in the last 18 months, initially with the events-stream library on Node. We've seen bad actors plant vulnerabilities in open source dependencies, in order to exploit particular targets. So, our current state of practice for open source safety is that we do this scanning in the pipeline. We make sure that there are no known vulnerabilities, we register the components so that we can remediate in the event of future vulnerabilities being discovered. We checked the IP licensing, and we have these prophylactic shields that we've built into our pipelines to automate them. Well, where it's going in the age of diffusion is that in addition to the prophylactic shields, we make open source safer up stream. Sam Guckenheimer: So, if you look at the moves that GitHub is taking, with LGTM and advanced security, what they are doing as they pick up NPM now, assuming that acquisition goes through, the goal is to get to a point where the dependencies are known good, and have been scanned for not just identified vulnerabilities, but for unidentified zero days. And that's the direction that GitHub is driving with a code QL technology. That's an example of changing from saying, "Huh, we test this electrical device in a laboratory to make sure that under all of these circumstances, it doesn't catch fire." To saying, "We are going to build it in a way that the



materials are not themselves flammable." So, it's a clear indicator of the shift across the inflection point in this economic transition that we're looking at. Mik Kersten: Absolutely. And I think it's again, the maturity with which you and other organizations are considering, basically your supply chain dependencies on your context, on that you're bringing in. And the fact that this is a part of your value stream. If you just ingest code libraries and leave it at that, you've missed the boat. Whereas, there are ways to do it safely, and actually Oege De Moor, who did assembly, we were collaborating early days around aspects and security. So, what's amazing to me is through something like GitHub, how consumable these best practices are today. So again, just back to that not re-inventing the wheel, but safe and disciplined approaches to consuming third party stuff, and open source in your value streams. So Sam, we're at time. This has just been amazing. Any other ground we haven't covered that you want to get across? But I think incredibly valuable, what you've said so far in terms of all those leaders of technologies who want to help their organizations double down on a differentiated core, do it quickly, deploy fast and learn fast. So anything we've missed? Sam Guckenheimer: Yeah. So I would say to the leaders, focus on your new core. If you don't have one, create a lighthouse as quickly as possible. And that means not an innovation lab, or a research lab off in some remote office in a corner. It means something important to the business that's going to be highly visible where you can work in the new way, without the old impediments. Makes that lighthouse successful, and make envy your friend. Get everyone to say, "Hey they're doing better. They're having more fun. It looks like a great party over there. How come we're not invited?" And get that virtuous cycle going by proving the success, and letting success breed more success, and letting the fun at the party make everyone else jealous and make them request invitations, rather than as a leader saying, "Hey guys, everything you know is wrong. You're doing things wrong. We need to change. I'm going to force this through, and after you learn the new ways, you'll be happy." Make them say, "Wait a minute. We see those folks over there. They're happy. They're having fun. We want to be invited." Mik Kersten: Sam, I love that you brought that in because with my own staff, I've been trying to emphasize that. These are very trying times for people, but people who feel like they're making an impact, they're having fun, they're delivering things that are being used, and making a difference through their own craft. Those are the people, that that happiness and productivity I think is so key to helping our staff. And using envy as a tool to bring more people to the party, be it on Zoom, or Teams, or whatever I think is the right way to go. Sam Guckenheimer: That's a great example, bringing this back to the pandemic. Healthdata.org is from an epidemiology group at the University of Washington, and they started locally looking at models for the virus spread, and infection rates here in King County, Western Washington, Washington state. And then said, "Wait a minute. We've got something here that's generally valuable." So, now you go to their website there, and they have models for the 50 US States, and they're updated daily. And that's the stuff that suddenly is becoming the real data in the daily briefings instead of all of the blah blah of conjecture. And it's a beautiful current example of doing something important, visible, and contagious in the right way. Mik Kersten: That is a great example. And Sam, thank you for incredibly actionable advice for everyone who's listening. So, tell us if people want to learn more from you, where to find you, this idea website that you mentioned, just give us some coordinates online.



Sam Guckenheimer: Oh yeah. So, if you want to read about our practices as Microsoft, the URL is www.aka.ms/devops. If you want to try out Azure DevOps, it's dev.azure.com, and it's free for teams up to five, and it's a few dollars a month if you get bigger, and really pennies. So, I recommend those things. Of course, everyone knows github.com for the hosting and consuming your open source, and on the GitHub site you can also learn about GitHub private instances and the like. So, those are all readily available to the public. Mik Kersten: Excellent. Well thank you so much, Sam. Stay safe and everyone please, please do reach out to Sam and flood him on Twitter with your questions, because I've always seen Sam as someone who's well ahead of the curve in terms of where organizations need to be and need to be thinking, and so I'm putting so much of that into practice. So, thank you again Sam. Sam Guckenheimer: Thank you, Mik. Great talking to you as always. Mik Kersten: Thank you to Sam for joining me on the podcast. As always, I encourage you to leave a review or follow me and my journey on LinkedIn, Twitter @Mik_Kersten, or using the hashtags Mik+One, or Project to Product. Sam's Twitter handle is @SamGuckenheimer. And know that I have a new episode every two weeks, so hit subscribe to join us again. You can also search for Project to Product to get the book, and remember that all author proceeds go to supporting women and minorities in technology. Thanks. Stay safe. And until next time.

episode 6: sam guckenheimer episode transcription

Documents