标签：#management

IBM and HashiCorp have announced new LDAP secrets management capabilities in IBM Vault Enterprise 2.0, introducing a redesigned architecture to manage LDAP credentials, support password rotation, and automate the identity lifecycle. By Craig Risi

Why This Deserves More Attention Than It Gets Credential leaks are one of the most common and preventable security incidents in software. Bots actively scan GitHub for newly pushed API keys, database URLs, and private credentials — and they find them within minutes of a commit going public. Rotating compromised credentials is painful, and in some cases the damage is done before you even realize what happened. This isn't just an enterprise problem. It happens on solo side projects, open-source repos, and internal tools at startups. And the root cause is almost always the same: someone treated secrets like regular configuration and didn't have a clear strategy for keeping them out of version control, logs, and error messages. The patterns in this guide aren't bureaucratic overhead. They're the minimum viable approach for any app that talks to a real database or a real API. What Environment Variables Actually Are An environment variable is a key-value pair that lives in a process's environment — a set of values the operating system makes available to any running program. Every process inherits the environment of the process that spawned it. In Node.js, you access them through process.env : const port = process . env . PORT ; const dbUrl = process . env . DATABASE_URL ; In Python: import os port = os . environ . get ( ' PORT ' ) db_url = os . environ . get ( ' DATABASE_URL ' ) The core idea — and the reason env vars are the standard approach — is that they decouple what the app does from where it runs . The same application code can point at a local development database or a production cluster. The code doesn't change; only the environment does. This is the heart of the 12-Factor App principle: store config in the environment, not in the code. The .env File: What It Is and What It Isn't In local development, you don't set environment variables by hand before every terminal session. Instead, you use a .env file — a plain text file at the root of your project with one key

Every weekday, we averaged 10 groups. Every weekend, 15. Same karaoke bar. Same staff. Same songs. For a long time, I just accepted that gap as "normal." Weekends are busier. That's just how hospitality works, right? Wrong. It took me years to realize I wasn't looking at a staffing problem. I was looking at a funnel problem — and I had no idea what a funnel even was. The moment I noticed something was off One Tuesday afternoon, a group of four walked past the front door, looked at the menu board outside, and kept walking. I watched from the counter. I had open rooms. Competitive prices. Cold drinks. Everything they needed. But they left anyway. That one moment stuck with me. Why did they walk in? Why did they look? Why did they leave? I started tracking these moments obsessively. Not with software — just a notebook and a lot of attention. Here's what I found over six weeks: Weekdays : About 40 people walked past who paused at the sign. Of those, maybe 15 came to the door. Of those, 10 groups actually came in and paid. Weekends : About 90 people paused. 30 came to the door. 15 groups booked a room. The conversion rate was almost identical — roughly 25% from "stopped to look" to "became a customer." The difference wasn't that we were worse at converting on weekdays. We just had fewer people at the top. That's a funnel. I didn't know the term at the time. But what I was describing is exactly what marketers call a marketing funnel : Awareness — people notice you exist Interest — they stop to look Consideration — they walk to the door, check the price Action — they book a room and pay Most businesses obsess over the bottom of the funnel. Better sales scripts. Discount campaigns. Loyalty cards. I did the same. I ran Tuesday specials. I trained staff to upsell drinks. I rearranged the menu. None of it closed the gap. Because the gap wasn't at the bottom. It was at the top. On weekdays, I simply had fewer people aware we existed. What I tried instead Once I framed it as a f

I and I imagine a lot of other folks, don't believe the future of work should be a smaller group of executives commanding a larger system of people and machines. We have seen what AI can do not just to software product quality without guardrails, but to the junior and midlevel team members who are laid off or never hired at all in exchange for better profit rates with AI tokens vs human salaries. That is just the old hierarchy with better software. The history of work has always had this tension. You can go back to the start of US history and look at the military, commissioned officers were trained and trusted to command while enlisted service members carried out the work and risk. In the corporate and business world, executives and managers became the people who planned, measured, and optimized, while workers became the people being measured. Those structures were not only about class, but race and in America they were built inside a society already shaped by racism, classism, unequal education, unequal access to capital, and unequal access to leadership. AI now forces us to confront that history again. If we are not careful, AI will not flatten organizations. It will make the hierarchy invisible. Instead of a manager with a clipboard, we will have an algorithm. Instead of a foreman with a stopwatch, we will have dashboards, productivity scores, automated performance reviews, and AI systems that decide who gets opportunity and who gets replaced. That is not progress. The goal should not be to replace people with AI. The goal should be to replace bureaucracy, repetitive work, bad process, and unnecessary gatekeeping. What I am trying to do at Buildly is simple: AI should remove drudgery, not dignity. Automation should increase agency, not surveillance. Productivity gains should be shared, not extracted. Hierarchy should be functional, temporary, and accountable — not a measure of human worth. This is why we talk about AI-native product development differently. An AI

Hello Dev.to Hello everyone, This is my very first post here at Dev.to. I am curious about how companies go about running their business in the backstage and, specifically, what kind of challenges do they face in their inventory management, warehousing, workplace technologies, and overall business systems. There have been plenty of times that I witnessed how little operational inefficiencies turn into big business problems when left untreated for too long. I intend to share my observations and learnings regarding the topics of inventory management, asset management, workflow improvement, and business systems used by companies to keep themselves organized and efficient. Please note that I am not here to pretend having all the right answers. It's simply an attempt at learning and exchanging ideas within the industry. See you around!

OpenAI details Codex Windows sandbox architecture, showing how SIDs, ACLs, restricted tokens, and dedicated sandbox accounts enable safe execution of autonomous coding tasks. The design balances isolation with real developer workflows and shows how OS security primitives must be composed for AI agents on local development environments. By Leela Kumili

A few weeks back I had an agent reconciling a vendor list. It ran clean. No error, no crash, output...

Ramp has nearly tripled its valuation over the past year as investors scramble to grab a part of the fast-growing startup.

Node.js will change its release schedule starting with version 27 in October 2026, moving from two major releases per year to one. All releases will become Long-Term Support (LTS), removing the distinction between odd and even versions. An Alpha channel for early testing will also be introduced. This decision addresses maintenance challenges and aims to align with user needs. By Daniel Curtis

This article was originally published on davidohnstad.com . I cross-post here to reach the Dev.to community. { " @context ": " https://schema.org ", " @graph ": [ { "@type": "Person", " @id ": " https://davidohnstad.com/#author ", "name": "David Ohnstad", "url": " https://davidohnstad.com ", "sameAs": [ " https://www.linkedin.com/in/davidohnstad/ ", " https://orcid.org/0009-0007-9023-7456 ", " https://davidohnstad5.mystrikingly.com/ ", " https://github.com/davidohnstad40-netizen ", " https://hashnode.com/@davidohnstad ", " https://davidohnstad.com ", " https://davidohnstad.net ", " https://davidohnstad.info ", " https://david-ohnstad.com ", " https://davidohnstadminnesota.com " ], "jobTitle": "Senior Data Product Manager", "worksFor": { "@type": "Organization", "name": "Veeam Software", "url": " https://www.veeam.com " }, "alumniOf": { "@type": "CollegeOrUniversity", "name": "College of St. Scholastica" }, "address": { "@type": "PostalAddress", "addressLocality": "Duluth", "addressRegion": "MN", "addressCountry": "US" }, "description": "Senior Data Product Manager at Veeam Software, MS and MBA from the College of St. Scholastica, based in Duluth, Minnesota. Specializes in data architecture, AI/ML integrations, and SaaS platform development." }, { "@type": "Article", " @id ": " https://davidohnstad.com/data-product-manager-org-structure-reporting#article ", "headline": "Data Product Manager Org Structure: Reporting Lines That Matter", "description": "David Ohnstad reveals where data product managers actually fit in org charts and why reporting lines determine success. Real insights from a data PM restructure.", "url": " https://davidohnstad.com/data-product-manager-org-structure-reporting ", "datePublished": "2026-05-29T14:06:18Z", "dateModified": "2026-05-29T14:06:18Z", "author": { "@type": "Person", " @id ": " https://davidohnstad.com/#author " }, "publisher": { "@type": "Organization", "name": "David Ohnstad", "url": " https://davidohnstad.com ", "logo": { "@type"

A while back I set three targets for my engineering team. Not velocity. Not story points. Not "things shipped." Just three numbers. Together they tell me whether the work is moving the way it should, or whether next week is shaping up to be a fire-fighting week. I check two of them most days. The third I used to watch closely...until we lost the tool that measured it. Here they are, and why they earned their spot. Why these and not just velocity The first metric most engineering managers reach for is velocity. Story points completed, tickets closed, work merged. Velocity is worth watching. It is a lagging indicator...it tells you what already happened...but it still shapes what comes next. When a sprint's work doesn't get finished, it rolls into the following one, and that rollover eats into whatever you had planned. What velocity doesn't tell you is how the work moved...whether it moved in a way that's going to come back and bite you. For that you need numbers that describe the shape and quality of the work, not just the amount of it...ideally ones that flag a problem while there's still time to act. These three do that. 1. Average PR size Target: under 300 lines changed per PR. What it tells me: how well the team is decomposing work. A team consistently shipping oversized PRs isn't producing more... they're producing PRs that no reviewer can read carefully. Big PRs get rubber-stamped. Rubber-stamped PRs are where production bugs hide. The 300-line target isn't magic. It's roughly the size below which most reviewers will actually read every line. I tell my team to aim for under 300 changes and to treat 500 as a hard ceiling, give or take a handful of genuine exceptions. Past 500 changes, I consistently see quality, review time, and thoroughness all drop sharply...the PR stops getting read and starts getting skimmed. When the team's average creeps up over a few weeks, I have an early signal that one of three things is happening: Stories are too coarse. The work does

One of the biggest myths in the software industry is that great engineering teams are built by hiring great engineers. They aren't. I've worked with incredibly talented developers who eventually became disengaged, indifferent, and unwilling to contribute beyond the bare minimum. I've also worked with average developers who grew into exceptional engineers because they were surrounded by a culture that rewarded curiosity, ownership, and continuous improvement. The difference was never talent. The difference was culture. The Toxicity Nobody Talks About When people hear the term toxic workplace , they usually imagine shouting managers, impossible deadlines, public humiliation, and constant pressure. Those environments certainly exist. But some of the most damaging engineering cultures are far more subtle. On the surface, everything appears professional. Meetings are calm. Nobody raises their voice. Everyone speaks politely. The company presents itself as collaborative and mature. Yet beneath that polished exterior exists a culture that quietly destroys accountability and discourages anyone from caring too much. A Simple Pull Request That Revealed a Bigger Problem Recently, while reviewing a pull request, I asked a few straightforward questions: Why are we passing an empty string to a component that doesn't function without an ID? Why is a skeleton component living in a file where it doesn't logically belong? Could this conditional statement be simplified for readability? These weren't major architectural concerns. They weren't requests to redesign the application. They were ordinary engineering discussions—the kind that happen every day inside healthy teams. When Ownership Disappears What happened next was far more interesting than the code itself. Instead of discussing whether the observations were valid, the conversation immediately shifted toward ownership. Who originally wrote the code? Who moved the code? Who was responsible for introducing it? The discussion was n

This is a complete guide with steps by step process to deploy the gRPC and how to use Azure API Management to import the gRPC API. It cover step‑by‑step guide to deploying a gRPC API on Azure API Management (APIM), grounded in the Microsoft documentation and a real-world deployment workflow. NOTE: This post is published already in GITHUB here. https://github.com/shailugit/apimGrpc/blob/main/README.md The API Management can expose gRPC services, but with important constraints: APIM supports gRPC by importing a .proto file and forwarding calls to a gRPC backend. gRPC requires HTTP/2 end‑to‑end. gRPC APIs are supported in Self-hosted gateway and not supported in APIM v2 tiers. You can't use the test console to test gRPC The major steps claissfied in two major steps Creating a gRPC server Calling the gPRC application using APIM 1. Creating gRPC Application Typical backend deployment steps include the following Create a .NET gRPC server application Create a .NET gRPC client application Test the setup locally Publish the .NET gRPC server to Azure WebApp and verify the service works directly over HTTPS Step-1 As a first step we will be building a .NET gRPC server application. You can skip this step in case you already have gRPC server application. If you would like to view .NET Core sample used for this sample project, please visit here . Step-2 As a second step we will be building a .NET gRPC client application. You can skip this step in case you already have gRPC client. If you would like to view .NET Core client used for this sample project, please visit the below here . Step-3 Once your client and server code is ready here are the steps to Test your application locally Step-4 Deploy the server to Azure WebApp To understand how-to deploy a .NET 6 gRPC app on App Service, please visit here . Please make sure to enable HTTP version, Enable HTTP 2.0 Proxy and add HTTP20_ONLY_PORT application setting as gRPC only work using http2.0 as shown below 2. Calling gRPC from APIM T