Notes on data, AI, IT
and security
No marketing fog. The way I think about real problems with founders and managers.
"We need a real-time dashboard" is not a question
Why a request for real-time data usually means something else - and how to get to the actual question.
Microservices are not a free lunch
What a manager needs to know about the real trade-offs of microservice architecture before the team starts building it.
ETL pipelines fail quietly and that destroys data trust
How ETL pipelines degrade data quality without anyone noticing, and what to do before the dashboards become decorative.
Access rights that outlive the employee
Why revoking permissions at offboarding is not a formality, and how to keep it from falling through the cracks.
Event sourcing: build the audit trail before the features
Why event sourcing is not an architecture fashion but a practical answer to the question of what happened in your system yesterday.
Analytics databases and operational databases are different tools
Why one database cannot do both transactions and analytics well - and what to do about it.
Deep learning: what is behind the hype and what is not ready yet
What the current wave of interest in neural networks means for companies that do not have a research lab.
Trusting the software supply chain
Business depends on other people's components and updates. That is an architecture question, not just a security question.
Metadata is not an appendix to data
Why a data catalog and metadata ownership are an infrastructure question, not bureaucracy.
DevOps is culture first, tooling second
Why buying a CI/CD platform does not make a company DevOps, and what needs to change before you pick a tool.
Architecture questions at year end: what to settle before 2015
A few questions about IT architecture worth asking yourself at the end of the year - not for a report, but so that 2015 starts without unnecessary baggage.
NIST Cybersecurity Framework as a language between security and management
What the first version of NIST CSF offers and why it is primarily a risk management tool, not a technical standard.