Whilst I personally don't have first hand experience with GitHub's security team - your experiences and suppositions perfectly match my own general observations with our sector.
I've had the pleasure of working with absolutely outstanding security professionals, doing exactly what you see - relatively thankless work.
Due to the alignment of incentives, it can in fact be worse than merely thankless and face internal opposition - so the perverse reality of Microsoft/GitHub needing to feel more pain is sadly likely true.
This article's author is wonderfully honest about having not worked at a larger company and is right to call out the issues that are all about organisational alignment/ownership.. or lack thereof.
You could never pay me enough money to be responsible for security at GitHub though, that's for sure.
Strongly inclined to agree here: Having recently joined a small applied AI startup and we were discussing the need for E2E tests. My initial gut reaction (which I kept quiet) was that such things turn into unmaintainable messes which delay releases and increasingly reduce in value.
I recognised this was grounded in an entirely different world of software engineering and organisation size though. I followed a path of thinking about what went wrong historically and how might they be solved: Better structure, discipline, resources - all of the things which agentic AI facilitates.
You are right about most skipping this part: But I view it as being like a sewerage and sanitation system - largely invisible and not thought about but critical for long-term health.
Also this ties in very nicely with Netflix's approach to Chaos Engineering and enabling it at broader scale.
> You are right about most skipping this part: But I view it as being like a sewerage and sanitation system - largely invisible and not thought about but critical for long-term health.
And like sewage and sanitation the infrastructure is a lot more complicated than people think.
I’m curious what happens when they need to make a DRU of Stripe or another payment processor.
Thanks for sharing this - it looks very promising in terms of capabilities to address many of my own issues with building out agents. Effectively you've implemented a lot of things I planned to do but in a robust manner and so have saved me a great deal of effort.
Edit to add: This might spur on a few more to start doing that, but people are quick to forget/prioritise other areas. If this keeps happening then it will change.
It's an awesome project and I imagine it has saved countless production incidents. The amount of times I've said "it was probably certificate expiry" and been correct is reasonably high.
In my own cases of responsibility, Caddy would have eliminated them had it been around. Instead I've learned to be paranoid, though having things like this are far better in terms of easing cognitive burden.
Cheers for all of the hard work by you and other maintainers.
I too have used Caddy on multiple production systems. It's a great bit of software.
I try to avoid engaging in online flame wars but I will say that the developers - including Francis - have been nothing but helpful and courteous to me personally and I've also learned a lot from their numerous positive contributions to Caddy-related forums.
My 1st thought: The comment to which you are replying is why I'm not sure I'd have the patience to maintain an OS project. Though the older I get, the better I get at ignoring certain things.
My 2nd thought: Actually, this is very likely a culture/communication difference whereby both people care (I'm a big fan of Erin Meyer's work here)
My 4th though: Perhaps I can make 'enemies' become friends if they both have disdain for AI ;)
Note: I would absolutely not submit this as-is. Caddy's an amazing project though I am not very familiar with its implementation and I'd seek to understand it, conventions etc. and make some obvious improvements to the code which has been generated - but this was a minor bit of fun. I created 4 separate versions and only in one of them did anything with TLS related get amended.
I'm not sure if they've changed the process since your issues (hopefully) - I was using their trial and when it expired had to go through the KYC process. They under-promised by saying two working days to reach out, but everything was wrapped up within an hour and done over email.
I nearly moved away from Twilio having read the negative feedback, but my personal experience so far was very prompt support.
Hey, that's good to hear. Was it a recent experience for you? Maybe they heard some of the feedback and acted on it.
This encourages me to revisit them, not because I'm unhappy with my current provider, but rather because Twilio offers what I need (a number that can receive and send SMS) in regions where my current provider doesn't.
I ought to caveat that from a KYC perspective, I likely would have been 'easy' since my career history involves many well-known companies and the requested account was for a UK company that has been running for nearly 20 years.
Though I'm no longer personally in the UK. Microsoft on the other hand: It was impossible for me to open up an Azure account even with their Customer Support. Suspect I will have to use Tailscale to bypass overly rigid geographical controls.
I've had the pleasure of working with absolutely outstanding security professionals, doing exactly what you see - relatively thankless work.
Due to the alignment of incentives, it can in fact be worse than merely thankless and face internal opposition - so the perverse reality of Microsoft/GitHub needing to feel more pain is sadly likely true.
This article's author is wonderfully honest about having not worked at a larger company and is right to call out the issues that are all about organisational alignment/ownership.. or lack thereof.
You could never pay me enough money to be responsible for security at GitHub though, that's for sure.