Tobiaswasle

Improvements in communications technology have led an increasing number of teams that work in a Remote-First style, a trend that was boosted by the forced isolation of Covid-19 pandemic. But a team that operates remotely still benefits from face-to-face gatherings, and should do them every few months.

Remote-first teams have everyone in a separate location, communicating entirely by email, chat, video and other communication tools. It has definite benefits: people can be recruited to the team from all over the world, and we can involve people with care-giving responsibilities. Wasteful hours of frustrating commutes can be turned into productive or recuperative time.

But however capable folks may be at remote working, and however nifty modern collaboration tools become, there is still nothing like being in the same place with the other members of a team. Human interactions are always richer when they are face-to-face. Video calls too easily become transactional, with little time for the chitchat that builds a proper human relationship. Without those deeper bonds, misunderstandings fester into serious relationship difficulties, and teams can get tangled in situations that would be effectively resolved if everyone were able to talk in person.

A regular pattern I see from those who are effective in remote-first work is that they ensure regular face-to-face meetings. During these they schedule those elements of work that are done better together. Remote work is more effective for tasks that require solo concentration, and modern tools can make remote pairing workable. But tasks that require lots of input from many people with rapid feedback are much easier to do when everyone is in the same room. No video-conference system can create the that depth of interaction, staring at a computer screen to see what other people are doing is draining, with no opportunity to pop out for a coffee together to break up the work. Debates about product strategy, explorations of systems architecture, explorations of new ground - these are common tasks for when the team is assembled.

For people to work effectively together they need to trust each other, aware of how much they can rely on each other. Trust is hard to develop online, where there isn't the social cues that can happen when we are in the same room. Thus the most valuable part of a face-to-face gathering isn't the scheduled work, it's chitchat while getting a coffee, and conviviality over lunch. Informal conversations, mostly not about work, forge the human contact that makes the work interactions be more effective.

Those guidelines suggest what the content for a face-to-face should be. Working together is both valuable in its own right, and an important part of team bonding. So we should set a full day of work, focusing on those tasks that benefit from the low-latency communication that comes from being together. We should then include what feels like too much time for breaks, informal chatter, and opportunities to step outside the office. I would avoid any artificial “team building” exercises, if only because of how much I hate them. Those who do gatherings like this stress the value from everyone energized afterwards, and thus able to be more effective in the following weeks.

Remote teams can be formed at large distances, and it's common to see members separated by hours of travel. For such teams, the rule of thumb I would use is to get together for a week every two or three months. After the team has become seasoned they may then decide to reduce the frequency, but I would worry if a team isn't having at least two face-to-face meetings a year. If a team is all in the same city, but using a remote-first style to reduce commuting, then they can organize shorter gatherings, and do them more frequently.

This kind of gathering may lead to rethinking of how to configure office space. Much has been made of how offices are far less used since the pandemic. Offices could well become less of a day-to-day workspace, and more a location for these kinds of irregular team gatherings. This leads to a need for flexible and comfortable team gathering spaces.

Some organizations may balk at the costs of travel and accommodation for a team assembly like this, but they should think of it as an investment in the team's effectiveness. Neglecting these face-to-faces leads to teams getting stuck, heading off in the wrong direction, plagued with conflict, and people losing motivation. Compared to this, saving on airplanes and hotels is a false economy.

They’re everywhere we look. Here are a few thoughts on the ones that won’t go away:

First, is it a problem or a situation? Problems, by definition, have solutions. You might not like the cost of the solution, the trade-offs it leads to, or the time and effort it takes, but problems have solutions.

On the other hand, situations don’t. Situations are simply things we need to live with.

Once we realize that a problem we have isn’t a problem at all, but actually a situation, it’s easier to do our best to move on and thrive. Focusing on a situation is usually a source of stress, not a way forward.

Second, has anyone else ever solved a problem like this one in a useful way? If not, it might be a situation. See question one.

Third, if the problem has been around for a while, it might not be an easy problem. Those tend to get solved right away. It’s probably a problem that involves more effort or trade-offs than you were hoping for. Resetting our expectations for what it might take to solve gives us the chance to recalibrate it as a situation we’re willing to live with, simply because the cost of the solution is too high.

And finally, some problems get better if we’re willing to talk about them. Some situations, on the other hand, simply get worse when we focus our energy and community on them.

      

Happy to see 20×200 is still a thing. Love that they made art buying affordable. A few pieces that caught my eye. (Each piece is linked)

Click here to go see the bonus panel!

Hovertext:
The cool thing is you can do this for any interaction. Weddings, Bar Mitzvahs, Funerals...

Rapid Development with GraphQL Microservices

by Dane Avilla

The entertainment industry has struggled with COVID-19 restrictions impacting productions around the globe. Since early 2020, Netflix has been iteratively developing systems to provide internal stakeholders and business leaders with up-to-date tools and dashboards with the latest information on the pandemic. These software solutions allow executive leadership to make the most informed decisions possible regarding if and when a given physical production can safely begin creating compelling content across the world. One approach that is gaining mind-share within Netflix Studio Engineering is the concept of GraphQL microservices (GQLMS) as a backend platform facilitating rapid application development.

Many organizations are embracing GraphQL as a way to unify their enterprise-wide data model and provide a single entry point for navigating a sea of structured data with its network of related entities. Such efforts are laudable but often entail multiple calendar quarters of coordination between internal organizations followed by the development and integration of all relevant entities into a single monolithic graph.

In contrast to this “One Graph to Rule Them All” approach, GQLMS leverage GraphQL simply as an enriched API specification for building CRUD applications. Our experience using GQLMS for rapid proof-of-concept applications confirmed two theories regarding the advertised benefits of GraphQL:

• The GraphiQL IDE displays any available GraphQL documentation right alongside the schema, dramatically improving developer ergonomics for API consumers (in contrast to the best-in-class Swagger UI).
• GraphQL’s strong type system and polyglot client support mean API providers do not need to concern themselves with generating, versioning, and maintaining language-specific API clients (such as those generated with the excellent Swagger Codegen). Consumers of GraphQL APIs can simply leverage the open-source GraphQL client of their preference.

Our experience has led to an architecture with a number of best-practices for teams interested in GQLMS as a platform for rapid development.

Graphile

During early GraphQL exploration efforts, Netflix engineers became aware of the Graphile library for presenting PostgreSQL database objects (tables, views, and functions) as a GraphQL API. Graphile supports smart comments allowing control of various features by tagging database tables, views, columns, and types with specifically formatted PostgreSQL comments. Documentation can even be embedded in the database comments such that it displays in the GraphQL schema generated by Graphile.

We hypothesized that a Docker container running a very simple NodeJS web server with the Graphile library (and some additional Netflix internal components for security, logging, metrics, and monitoring) could provide a “better REST than REST” or “REST++” platform for rapid development efforts. Using Docker we defined a lightweight, stand-alone container that allowed us to package the Graphile library and its supporting code into a self-contained bundle that any team can use at Netflix with no additional coding required. Simply pull down the defined Docker base image and run it with the appropriate database connection string. This approach proved to be very successful and yielded several insights into the use of Graphile.

Specifically:

• Use database views as an “API layer” to preserve flexibility in order to allow modifying tables without changing an existing GraphQL schema (built on the database views).
• Use PostgreSQL Composite Types when taking advantage of PostgreSQL Aggregate Functions.
• Increase flexibility by allowing GraphQL clients to have “full access” to the auto-generated GraphQL queries and mutations generated by Graphile (exposing CRUD operations on all tables & views); then later in the development process, remove schema elements that did not end up being used by the UI before the app goes into production.

Database views as API

We decided to put the data tables in one PostgreSQL schema and then define views on those tables in another schema, with the Graphile web app connecting to the database using a dedicated PostgreSQL user role. This ended up achieving several different goals:

• Underlying tables could be changed independently of the views exposed in the GraphQL schema.
• Views could do basic formatting (like rendering TIMESTAMP fields as ISO8601 strings).
• All permissions on the underlying table had to be explicitly granted for the web application’s PostgreSQL user, avoiding unexpected write access.
• Tables and views could be modified within a single transaction such that the changes to the exposed GraphQL schema happened atomically.

On this last point: changing a table column’s type would break the associated view, but by wrapping the change in a transaction, the view could be dropped, the column could be updated, and then the view could be re-created before committing the transaction. We run Graphile with pgWatch enabled, so as soon as any updates were made to the database, the GraphQL schema immediately updated to reflect the change.

PostgreSQL composite types

Graphile does an excellent job reading the PostgreSQL database schema and transforming tables and basic views into a GraphQL schema, but our experience revealed limitations in how Graphile describes nested types when PostgreSQL Aggregate Functions or JSON Functions exist within a view. Native PostgreSQL functions such as json_build_object will be translated into a GraphQL JSON type, which is simply a String, devoid of any internal structure. For example, take this simplistic view returning a JSON object:

postgres_test_db=# create view postgraphile.json_object_example as
  select json_build_object(‘hello world’::text, 1, ‘2’::text, 3)
  as json;
postgres_test_db=# select * from postgraphile.json_object_example;
          json
— — — — — — — — — — — — -
{“hello world”: 1, “2”: 3}
(1 row)

In the generated schema, the data type is JSON:

The internal structure of the json field (the hello world and 2 sub-fields) is opaque in the generated GraphQL schema.

To further describe the internal structure of the json field — exposing it within the generated schema — define a composite type, and create the view such that it returns that type:

postgres_test_db=# CREATE TYPE postgraphile.custom_type AS (
  "hello world" integer,
  "2" integer
);

Next, create a function that returns that type:

postgres_test_db=# CREATE FUNCTION postgraphile.custom_type(
  "hello world" integer,
  "2" integer
)
RETURNS postgraphile.custom_type
AS 'select $1, $2'
LANGUAGE SQL;

Finally, create a view that returns that type:

postgres_test_db=# create view postgraphile.json_object_example2 as
  select postgraphile.custom_type(1, 3)
  as json;
postgres_test_db=# select * from postgraphile.json_object_example2;
 json
— — — -
(1,3)
(1 row)

At first glance, that does not look very useful, but hold that thought: before viewing the generated schema, define comments on the view, custom type, and fields of the custom type to take advantage of Graphile’s smart comments:

postgres_test_db=# comment on
  type postgraphile.custom_type
  is E’A description for the custom type’;
postgres_test_db=# comment on
  view postgraphile.json_object_example2
  is E’A description for the view’;
postgres_test_db=# comment on
  column postgraphile.custom_type.”hello world”
  is E’A description for hello world’;
postgres_test_db=# comment on
  column postgraphile.custom_type.field_2
  is E’@name field_two\nA description for the second field’;

Now, when the schema is viewed, the json field no longer shows up with opaque type JSON, but with CustomType:

(also note that the comment made on the view — A description for the view — shows up in the documentation for the query field).

Clicking CustomType displays the fields of the custom type, along with their comments:

Notice that in the custom type, the second field was named field_2, but the Graphile smart comment renames the field to field_two and subsequently gets camel-cased by Graphile to fieldTwo. Also, the descriptions for both fields display in the generated GraphQL schema.

Allow “full access” to the Graphile-generated schema (during development)

Initially, the proposal to use Graphile was met with vigorous dissent when discussed as an option in a “one schema to rule them all” architecture. Legitimate concerns about security (how does this integrate with our IAM infrastructure to enforce row-level access controls within the database?) and performance (how do you limit queries to avoid DDoSing the database by selecting all rows at once?) were raised about providing open access to database tables with a SQL-like query interface. However, in the context of GQLMS for rapid development of internal apps by small teams, having the default Graphile behavior of making all columns available for filtering allowed the UI team to rapidly iterate through a number of new features without needing to involve the backend team. This is in contrast to other development models where the UI and backend teams first agree on an initial API contract, the backend team implements the API, the UI team consumes the API and then the API contract evolves as the needs of the UI change during the development life cycle.

Initially, the overall app’s performance was poor as the UI often needed multiple queries to fetch the desired data. However, once the app’s behavior had been fleshed out, we quickly created new views satisfying each UI interaction’s needs such that each interaction only required a single call. Because these requests run on the database in native code, we could perform sophisticated queries and achieve high performance through the appropriate use of indexes, denormalization, clustering, etc.

Once the “public API” between the UI and backend solidified, we “hardened” the GraphQL schema, removing all unnecessary queries (created by Graphile’s default settings) by marking tables and views with the smart comment @omit. Also, the default behavior is for Graphile to generate mutations for tables and views, but the smart comment @omit create,update,delete will remove the mutations from the schema.

Conclusion

For those taking a schema-first approach to their GraphQL API development, the automatic GraphQL schema generation capabilities of Graphile will likely unacceptably restrict schema designers. Graphile may be difficult to integrate into an existing enterprise IAM infrastructure if fine-grained access controls are required. And adding custom queries and mutations to a Graphile-generated schema (i.e. to expose a gRPC service call needed by the UI) is something we currently do not support in our Docker image. However, we recently became aware of Graphile’s makeExtendSchemaPlugin, which allows custom types, queries, and mutations to be merged into the schema generated by Graphile.

That said, the successful implementation of an internal app over 4–6 weeks with limited initial requirements and an ad hoc distributed team (with no previous history of collaboration) raised a large amount of interest throughout the Netflix Studio. Other teams within Netflix are finding the GQLMS approach of:

1) using standard GraphQL constructs and utilities to expose the database-as-API

2) leveraging custom PostgreSQL types to craft a GraphQL schema

3) increasing flexibility by auto-generating a large API from a database

4) and exposing additional custom business logic and data types alongside those generated by Graphile

to be a viable solution for internal CRUD tools that would historically have used REST. Having a standardized Docker container hosting Graphile provides teams the necessary infrastructure by which they can quickly iterate on the prototyping and rapid application development of new tools to solve the ever-changing needs of a global media studio during these challenging times.

Beyond REST was originally published in Netflix TechBlog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Oh I want to watch this: The Booksellers

– I am so grateful for this wonderful article on my co-working community Friends Work Here over on 99u.

– Say it with a pin makes really fun pins. (They sent me some custom ones they made for me and they are stunning.)

– 11 Reasons Not To Become Famous

– Craig Mod shares what he learned running a paid membership program.

– This is all kinds of wonderful: An Artist Used 99 Phones to Fake a Google Maps Traffic Jam

– 20+ Questions to Ask for 2020 (via Jocelyn)

– A wonderful 7min listen: Carl Sagan And Ann Druyan’s Ultimate Mix Tape

– I keep coming back to this interview with Adrienne Maree Brown. So full of goodness.

– What do you really want? A wonderful (and rare) interview with Michael Singer who wrote the Untethered Soul. A book that changed my life in 2018.

– Tattly’s newest collaboration with Lara Gastinger makes me so very happyy.

– I like this minimal pet bed.

– This minimal and modular shelving system makes me swoon.

– I was recently sent one of these Asparagus Fern Kokedama. It makes me giggle every time I water it.

– You, Me, We! is a a super adorable eset of fill-in books that give parents and children an opportunity to express themselves and connect with each other in the process.

– This wooden toy telephone is delightful.

– Sound Print app lets you find quiet places, date spots, restaurants. I am super sensitive to noise, especially in restaurant settings. I appreciate this so much.

– You are a creatively minded, kind human in search of a new job? Here’s a job board for you matching you with creative companies.

– A big thank you to Parsons at Open Campus for sponsoring my blog this week.

Service: hier steht der PDF-File von DD348 (Einsicht ist gut, Regeln sind besser) zur Verfügung, wenn Sie alles gerne als Offliner lesen möchten: DD348 als PDF

Es ist schon Tradition im law blog: In der Vorweihnachtszeit verlosen wir unter allen Lesern den bekannten und beliebten Anwaltskalender des Karikaturisten wulkan. Auch dieses Jahr ist es wieder soweit. Es gibt insgesamt 10 Exemplare des Kalenders für das Jahr 2019 zu gewinnen. Wie, das steht weiter unten.

Zunächst aber der Hinweis, dass es sich bei dem Kalender auch um ein tolles Weihnachtsgeschenk handelt. Die zwölf großformatigen Juristenmotive kommen im klassischen Schwarz-Weiß-Design. Der Kalender kostet 20,95 € zuzüglich 5,50 € Versandkostenpauschale. Es handelt sich um den Subskriptionspreis; ab dem 1. Dezember kostet der Kalender 25,95 € zuzüglich 5,50 € Versandkostenpauschale.

Der Kalender wird frei Haus geliefert, gerne aber auch an eine Wunschadresse. Wie immer ist der Kalender nur im Direktvertrieb beim Zeichner selbst erhältlich. Bestellung via E-Mail: wulkan@arcor.de. Per Telefon: 0172 200 35 70.

Aber, wie gesagt, wir verlosen ab heute auch 10 Exemplare des Kalender. Es gibt zwei Möglichkeiten der Teilnahme:

1. Einen Kommentar zu diesem Beitrag schreiben. Bitte auf jeden Fall die E-Mail-Adresse gesondert reinschreiben. Das Kommentarsystem zeigt mir die hinterlegten E-Mail-Adressen leider nicht mehr komplett an, vermutlich aus Gründen des Datenschutzes. Ich kann also ohne Nennung der Mail-Adresse im Kommentartext Gewinner nicht benachrichtigen.

2. Wer aus verständlichen Gründen keine E-Mail-Adresse in den Klartext des Kommentars schreiben möchte, sendet einfach eine E-Mail an folgende Adresse: anwaltskalender@web.de.

Die Gewinnchancen sind auf beiden Wegen gleich. Die Gewinner werden ausschließlich über die hinterlegte E-Mail-Adresse benachrichtigt. Die Teilnahme am Gewinnspiel ist bis zum 13. November 2018 möglich.

Viel Glück!

I asked almost 500 leaders from all over the world what questions they ask during a one-on-one meeting. Here’s what they said…

That one-on-one meeting is scheduled on your calendar this week. So, what should you talk about?

As a manager, executive, or business owner, this is one of the most recurring and perplexing situations you’ll face. Should you prepare an one-on-one meeting agenda ahead of time? Does it feel too stiff to do so? Should you simply have general meetings topics ready to go? What are the questions you should asking during this one-on-one?

We posed this dilemma to The Watercooler, our online leadership community with almost 500 leaders from all over the world, to see what they had to say. From that conversation, I’ve shared what these managers, business owners, and executives from The Watercooler have found to be the best questions to ask during a one-on-one meeting.

Take a look and see if you agree…

#1: How’s life?

On the surface, this doesn’t seem like a significant question to ask. After all, some managers default to asking this question as a crutch when they’re not sure how to open up a one-on-one meeting. However, this question can be actually quite powerful, if you can embrace a greater intention behind it: To build trust. When asked, most Watercooler members agreed on the importance of having trust and a strong personal rapport going into the one-on-one. The more you know about a coworker’s dreams, hobbies, pets, children’s names, etc., the greater the sense of trust is. And the greater the trust, the easier a tough conversation is. As a result, many managers from theWatercooler kick off their one-on-one with a “get-know-you” question like, “How’s life?” or “How’s [insert spouse’s name]?” or “What are you up to this weekend?”

One manager in particular emphasized the importance of talking about life outside of work way before you even have the one-on-one. That way, you build a foundation of trust to use if you need to bring up a difficult topic during your one-on-one. Prior to a one-on-one, here are some of the top 25 get-to-know you questions that can help with this.

#2: What are you worried about right now?

During a one-on-one, you want to figure if there’s anything bothering an employee, before it’s too late and they decide to leave or their performance is affected. Few questions do that an well as as this one. Recommended by a few of the Watercooler members (and a question I regularly asking during my one-on-ones), this question can help unearth the deep-seated concerns, confusion, or uncertainty an employee might be facing. A slight variation to this question that may unearth even more specific answers is: “When’s the last time you were worried about something?” This question is rooted in a specific moment of tension that can help make it more concrete for an employee when reflecting on if there’s something they might be worried about.

#3: What rumors are you hearing that you think I should know about?

Asking this question can bring to light rumors that you can dispel before they spin out of control. But on top of that, as one Watercooler member said: “What the rumor mill is saying is also often a compass pointing to places where people feel stressed.” Ask this question to uncover a deeper, disconcerting source of unease or frustration for employees. You’ll want to pay attention to that.

For one Watercooler member, asking this question had a direct effect on her entire team’s morale: She was able to nip a rumor in the bud very quickly about why an employee was fired.

#4: If you could be proud of one accomplishment between now and next year, what would it be?

To get a coworker thinking about their personal goals over the next six months, as well as their long-term careers, one manager in The Watercooler recommended asking this question. You may not get a meaningful response every single time from every employee you pose it to, as some employees may find it difficult to answer on-the-spot. However, it’s a great way to spark the initial conversation with an employee about future goals. Not to mention, it’s a more thoughtful question than simply asking, “What goals do you have for yourself?”

#5: What are your biggest time wasters?

No one likes to waste time. Few feelings are as stifling and demoralizing, especially in a work setting. As a result, asking this question during a one-on-one is imperative. Once you ask this question, be prepared to think on and follow with concrete ideas for how you think that person’s time won’t be wasted.

#6: Would you like more or less direction from me?

Feeling micromanaged is often another source of stress for an employee — and it’s one of the most common. As a manager, it can easily to unintentionally give an employee too much guidance. At the same time, employees find it equally frustrating when they’re hung out to dry with no support. When you ask this question, you can then adjust your management style and techniques. Furthermore, asking this question also signals to your coworker that you recognize the value of providing the right level of support as a manager. As a leader, this question shows you’re self-aware.

#7: Would you like more or less feedback on your work? If so, what additional feedback would you like?

Watercooler members suggest asking this question, because you’re most-likely going to get a resounding “yes.” After surveying hundreds of companies and thousands of employees through Know Your Company, we’ve found that 80% of employees say, “I want more feedback about my performance.” Your one-on-one is the perfect opportunity to figure out exactly what kind of feedback someone would like.

#8: Are there any decisions you’re hung up on?

One of the best ways to help coach an employee is to give them some support on a decision that they’re wrestling with. They could be quite distraught because they’re not sure with path to take — and you can help. Asking this question during the one-on-one is a wonderful way to alleviate the potential pain they may be feeling around a tough decision.

Whether your one-on-ones are weekly, once a month, or once a quarter, I’d highly encourage you to place one or two of these questions in your typical meeting agenda. Based on the experiences of Watercooler members who’ve asked these questions, you’re guaranteed to learn something new and create a stronger rapport with your team.

Looking for a few more resources on how to have a productive one-on-one?

• Here’s the one question I would NOT asking during a one on one.
• Here’s how to have an honest one-on-one with an employee.
• Here’s how to prepare for a one-on-one as an employee.

P.S.: Please feel free to share + give this piece 👏 so others can find it too. Thanks 😄 (And you can always say hi at @cjlew23.)

The 8 best questions to put on your next one-on-one meeting agenda was originally published in Signal v. Noise on Medium, where people are continuing the conversation by highlighting and responding to this story.

the application is performing slowly and your software provider says that you need to increase hardware performance

(HT mariomarra)

A Calder inspired mobile. Made me look.

AWS Least Privilege for Distributed, High-Velocity Development

by Jason Chan, Patrick Kelley, and Travis McPeak

Today we are pleased to announce two new open-source cloud security tools from Netflix: Aardvark and Repokid. Used together, these tools are the next logical step in our goal to run a secure, large scale Amazon Web Services (AWS) deployment that accommodates rapid innovation and distributed, high-velocity development. When used together, Aardvark and Repokid help us get closer to the principle of least privilege without sacrificing speed or introducing heavy process. In this blog post we’ll describe the basic problem and why we need tools to solve it, introduce new tools that we’ve developed to tackle the problem, and discuss future improvements to blend the tools seamlessly into our continual operations.

IAM Permissions — Inside the Cockpit

AWS Identity and Access Management (IAM) is a powerful service that allows you to securely configure access to AWS cloud resources. With over 2,500 permissions and counting, IAM gives users fine-grained control over which actions can be performed on a given resource in AWS. However, this level of control introduces complexity, which can make it more difficult for developers. Rather than focusing on getting their application to run correctly they have to switch context to work on knowing the exact AWS permissions the system needs. If they don’t grant necessary permissions, the application will fail. Overly permissive deployments reduce the chances of an application mysteriously breaking, but create unnecessary risk and provide attackers with a large foothold from which they may further penetrate a cloud environment.

Rightsizing Permissions — Autopilot for IAM

In an ideal world every application would be deployed with the exact permissions required. In practice, however, the effort required to determine the precise permissions required for each application in a complicated production environment is prohibitively expensive and doesn’t scale. At Netflix we’ve adopted an approach that we believe balances developer freedom and velocity and security best-practices: access profiling and automated and ongoing right-sizing. We allow developers to deploy their applications with a basic set of permissions and then use profiling data to remove permissions that are demonstrably not used. By continually re-examining our environment and removing unused permissions, our environment converges to least privilege over time.

Introducing Aardvark

AWS provides a service named Access Advisor that shows all of the various AWS services that the policies of an IAM Role permit access to and when (if at all) they were last accessed. Today Access Advisor data is only available in the console, so we created Aardvark to make it easy to retrieve at scale. Aardvark uses PhantomJS to log into the AWS console and retrieve Access Advisor data for all of the IAM Roles in an account. Aardvark stores the latest Access Advisor data in a database and exposes a RESTful API. Aardvark supports threading to retrieve data for multiple accounts simultaneously, and in practice refreshes data for our environment daily in less than 20 minutes.

Introducing Repokid

Repokid uses the data about services used (or not) by a role to remove permissions that a role doesn’t need. It does so by keeping a DynamoDB table with data about each role that it has seen including: policies, count of permissions (total and unused), whether a role is eligible for repo or if it is filtered, and when it was last repoed (“repo” is shortened from repossess — our verb for the act of taking back unused permissions). Filters can be used to exclude a role from repoing if, for example, if it is too young to have been accurately profiled or it is on a user-defined blacklist.

Once a role has been sufficiently profiled, Repokid’s repo feature revises inline policies attached to a role to exclude unused permissions. Repokid also maintains a cache of previous policy versions in case a role needs to be restored to a previous state. The repo feature can be applied to a single role, but is more commonly used to target every eligible role in an account.

Future Work

Currently Repokid uses Access Advisor data (via Aardvark) to make decisions about which services can be removed. Access Advisor data only applies to a service as a whole, so we can’t see which specific service permissions are used. We are planning to extend Repokid profiling by augmenting Access Advisor with CloudTrail. By using CloudTrail data, we can remove individual unused permissions within services that are otherwise required.

We’re also working on using Repokid data to discover permissions which are frequently removed so that we can deploy more restrictive default roles.

Finally, In its current state Repokid keeps basic stats about the total permissions each role has over time, but we will continue to refine metrics and record keeping capabilities.

Extending our Security Automation Toolkit

At Netflix, a core philosophy of the Cloud Security team is the belief that our tools should enable developers to build and operate secure systems as easily as possible. In the past we’ve released tools such as Lemur to make it easy to request and manage SSL certificates, Security Monkey to raise awareness and visibility of common AWS security misconfigurations, Scumblr to discover and manage software security issues, and Stethoscope to assess security across all of a user’s devices. By using these tools, developers are more productive because they can worry less about security details, and our environment becomes more secure because the tools prevent common misconfigurations. With Repokid and Aardvark we are now extending this philosophy and approach to cover IAM roles and permissions.

Stay in touch!

At Netflix we are currently using both of these tools internally to keep role permissions tightened in our environment. We’d love to see how other organizations use these tools and look forward to collaborating on further development.

Introducing Aardvark and Repokid was originally published in Netflix TechBlog on Medium, where people are continuing the conversation by highlighting and responding to this story.

Die Digitalisierung verlangt eine Identifikation, das denke ich schon immer. Nun ist mir wieder einmal ORCID „über den Weg gelaufen“, weil sich gerade Institutionen und Bibliothekare streiten, ob nun alle Forscher oder gar Menschen eine ORCID haben sollten oder nicht. Meine Frau ist ja Bibliothekarin und hat eine verächtliche Bemerkung aufgeschnappt. Jemand schnaubte: „Sollten Wissenschaftler eine Hundemarke tragen wollen?“ Deshalb wärme ich das Thema einmal auf.

Die Open Researcher & Contributor ID soll helfen, einen Forscher eindeutig zu identifizieren. Bei mir geht das Identifizieren ganz gut, weil mir bis heute kein anderer Gunter Dueck begegnet ist. Ich finde meine Publikationen im Netz ohne Probleme. Bei Google Scholar werden gefühlt gut 500 Einträge von mir aufgeführt, die alle von mir zu sein scheinen. Hoffentlich stimmt das alles so, es gab nämlich besonders früher und auch noch bis heute die Unsitte, den Vornamen auf wissenschaftlichen Aufsätzen abzukürzen. Da bin ich nur G. Dueck. Ja, Pech – davon gibt es dann doch wieder so einige (Dueck ist eine deutsche Form vom holländischen Dyck, wie „vom Deich“, in Holland ein Name wie Müller oder Schmidt). Wer hat sich das Abkürzen bloß ausgedacht? Es müssen Biochemiker oder Astronomen gewesen sein, weil dort das ganze Labor oder die Galaxie Mitautor sein kann und dann die Titelseite zu lang wird. Bei Mathe ist es schon schwach verdächtig, wenn es zwei Autoren sind – da kann doch wohl nur einer von beiden den echten Einfall gehabt haben?

Egal. Schon die Suche nach den Werken meiner Tochter Anne stellt sich als schwierig heraus. Wir kannten bei der Wahl dieses schönsten Vornamens die Problematik noch nicht. Anne Dueck gibt es öfter auf der Welt… Stellen Sie sich nun vor, sie heiratet und nimmt einen anderen Namen an (nur mal vorgestellt!), dann findet man nichts mehr richtig, ohne ihre Biografie zu kennen.

Und das sind nur Miniprobleme. Leiden Sie doch einmal mit, wenn jemand Peter Müller oder Maria Schneider heißt. Haben Sie verstanden? Nein, immer noch nicht. Es gibt wohl je (!) einige zehn Millionen Menschen, die Lee, Zhang oder Wang heißen, Singh kommt auch so oft vor oder Nguyen… Schon allein im Institut meiner Frau gibt es „Doppelte“ und sie muss stets nachfragen, was nun von wem ist, wenn der Institutsjahresbericht korrekt werden soll.

Wäre das nicht fein, wenn wir alle eine ORCID neben unserem Autorennamen angäben? Auch „nichtwissenschaftlich“? Für Journalisten, Blogger, alle? Ich für mich denke, dass es noch so um die 100 kleine Artikel im Internet gibt, die ich hier und da gepostet habe. Die sind für meine Werksammlung „verloren“ oder ich muss Buch führen. Ich habe einige Zeit die „Belegexemplare“ als Print im Keller gesammelt, die blättere ich aber doch nie mehr durch. Die sind für die Biographie „weg“. Sollten wir nicht auch alle Blog-Beiträge mit der ORCID kennzeichnen? Unsere Fotos auf Flickr und Instagram? Na, Hetzbemerkungen am besten auch…

Und da schimpfen Leute, wie gesagt: „Ich will keine Hundemarke tragen! Dann kann ja jeder sofort surfen, was mit mir zu tun hat! Soll ich den Spionen in die Hände spielen?“ Ich weiß, Leute, aber trotzdem: ORCID.

Ihr Gunter Dueck,

http://orcid.org/0000-0003-1800-9700

oder mit Google-ID:

https://scholar.google.de/citations?user=w-ItbssAAAAJ&hl=de

• Firewall Rules
• Networking
• Google Cloud Storage Buckets (GCS)
• Service Accounts (IAM)

Security Monkey’s History

Future Plans for Security Monkey

• We have begun the process of moving the service watchers out of Security Monkey and into CloudAux. CloudAux currently supports the four GCP services and three (of the 45) AWS services.
• We have plans to move the security checks (auditors) out of Security Monkey and into a separate library.
• Admins may change polling intervals, enable/disable technologies, and modify issue scores from within the settings panel of the web UI.

• On AWS, CloudTrail will trigger CloudWatch Event Rules, which will then trigger Lambda functions. We have a working prototype of this flow.
• On GCP, Stackdriver Logging and Audit Logs will trigger Cloud Functions.
• As a note, CloudSploit has a product in beta that implements this event driven approach.

• These can be used to provide new notification methods or correct problems.
• The documentation describes a custom alerter that sends events to Splunk.

Special Thanks

• Google: GCP Support in CloudAux/Security Monkey
• Bridgewater Associates: Modularization of Watchers, Auditors, Alerters. Dozens of new watchers. Modifying the architecture to abstract the environment being monitored.

There’s not really any normal way to start a relationship. Some people go on a date, and then another date, and then another, and one day it’s just clear to both of them that they’re in a relationship. Some people start seeing each other, but they keep things black and white until a “So are we doing this?” conversation makes it official. Sometimes a platonic friendship forms first and tension builds under the surface until an unexpected kiss lights the friendship on fire.

But there’s usually some first time that this happens:

And suddenly, you’re here:

Your new relationship is with you all the time, even when you’re not together.

You’ve left the rest of shitty humanity behind, and it feels great. Then this happens:

And all the song lyrics make sense.

It goes on like this for a while, but as the months pass, you notice things changing. The unicorns turn into horses and then bikes and then one day, you’re not riding anything at all. The perfect person you found starts to say and do imperfect things. Some of those funny quirks you adored early on seem to be striking you as more annoying than funny. And it starts to dawn on you that you might be dating a fucking dick.

Sometimes things go further south, as butterflies and rainbows turn into frustration and disillusionment, and the relationship that used to lift you up seems to now be boxing you in.

All of the negative qualities you couldn’t see in the fog of love are suddenly right in your face, like a weight that’s dragging you down.

A lot of relationships end right about here.

But maybe, having seen the dark side of your partner, you step back and take a long look at both the good and bad together. You put away both the rose-colored glasses and the shit-colored glasses and see who you’re really dating: a three-dimensional, one-of-a-kind, beautiful, piece-of-shit human being.

Who’s the best.

And the worst.

And your teammate.

And your rock.

And you decide you like what you’ve got.

And your lives go on together.

But just when things get simple, something else starts to happen:

Society, in most parts of the world, doesn’t like when a relationship lasts too long. To society, a relationship is simply a testing ground—an incubator that prepares you for The Decision. And if too many years go by in a relationship without The Decision being made, society decides that something must be wrong. To help right the wrong, society will begin to apply pressure on the couple, from all angles.

Some people are bigger than society. Most of us are not. For most of us, society’s rules are our rules, and as you and your person walk down your blue balance beam, you can feel the walking space melt away around you. It’s time to make The Decision.

Your relationship needs to be converted into Everything Forever or Nothing Ever Again. Soon.

The typical human isn’t really equipped to make The Decision. We evolved to live short lives, during which life-altering 60-year commitments weren’t a thing. We evolved in small communities without nearly as many available options. And most of us, when presented with The Decision, have relatively little relationship experience and an incomplete understanding of our own adult selves—selves that in many cases only recently started existing.

But society doesn’t care. So you decide.

Humans have come up with four main methods to make The Decision:

Method 1) Let the other person decide

The easiest way to handle The Decision is to just not really handle it. You take a passive approach, as if you’re on a raft, going down a river, and you have no control over where the current leads you—you’re in the hands of momentum and inertia. Once you hit your mid-20s, you just wait until you get into your next relationship and then marry whoever that person happens to be, whenever/if-ever that person decides it’s time, regardless of how right or wrong the relationship is for you.

Method 2) Let your primal forces battle it out

For people determined to more actively make The Decision, the next easiest way to go is to let your emotions and primal forces figure it out. Making The Decision provides a reminder that “you” is actually a collection of voices, each weighing in from different parts of evolutionary history. Each voice has its role in the homeostasis of our normal lives, but when it’s time for something as rare and important as The Decision, there’s suddenly a brawl in your head for influence—and no one brawls harder than your primal forces. Some of the major players:

Love

Deep down, most people are sympathetic characters. And when you’re in a relationship for enough time, you’ll usually end up loving the person—even if you don’t like them. You know their whole story, which makes you care about them and the fact that they rely on you makes you feel a tremendous loyalty to them. This is the kind of love you feel for your family and closest friends, and it can exist in full force even after the feeling of being “in love” has faded. And for many people, this deep emotional connection makes it basically inconceivable to ever break up with their partner. This is a beautiful way to make The Decision when you’re in a strong, healthy relationship, and a tragedy when you’re not.

Fear

Humans specialize in making critical life decisions based on fear, and when it comes to The Decision, there’s a lot to be afraid of.

When a fearful person takes a look to the left side of the balance beam, they might see all kinds of things:

The right side of the beam isn’t much better.

Different people feel these fears at different levels of intensity, and for someone whose fear tends to run their life, it’s usually pretty simple: the particular fear that grabs them hardest by the collar ends up making The Decision.

Ego

Your ego, meanwhile, is busy staring down at a clipboard. Depending on what your ego values, that clipboard might display a checklist describing your ideal partner—their appearance, age, family background, intelligence, job, wealth, general personality type, etc. Or maybe the clipboard has a story written on it, one that was written long ago about how your life should go. Your ego will examine your current situation and see how it measures up to what’s written on the clipboard, and it’ll base The Decision on its findings.

While all of this analysis is going on, your ego sometimes also finds itself getting very hungry—for admiration, attention, and conquest. If this hunger gets too intense, it can overwhelm an ego to the point where it may sway its vote, no matter what the clipboard says.

Sex Drive

Your sex drive is not a complicated character. If it has a grilled cheese sandwich every day for lunch and then one day, you ask it if it would like to try the buffet, it’s going to say yes. Unless, of course, the grilled cheese is super fucking incredible.

So these four primal forces, along with a few others, all voice their opinion at the same time. In some people, all of the voices are in agreement about the verdict. In others, the voices disagree, but one of the voices is so loud that it drowns out the others. In both of those cases, The Decision is pretty easy.

But what happens when your primal forces provide no clear answer?

Method 3) Turn to your gut

For some reason, we have wise stomachs, and when The Decision isn’t obvious, sometimes asking your gut can do the trick.

Your gut relies on your intuition and asks one simple question:

And what makes your gut your gut is that when it answers that question, it doesn’t deliberate—it just knows the answer: a simple yes or a simple no. The gut doesn’t deal with nuance, which makes it a good match for something big and binary, like The Decision.

And for a lot of people, this works.

But there are some people who won’t end up being passive Deciders, or emotional Deciders, or gut Deciders—who won’t turn to any primal or instinctual voice when it comes to this particular decision. They’ll get to the bottom of this in spite of those voices—based on experience and evidence and data and facts. They won’t be instinct-driven or fear-driven or ego-driven or sex-driven—they’ll be guided by rationality.

The brain Deciders.

And when it comes time for them to make The Decision, they’re in big trouble.

Method 4) Figure it out in your brain

The prefrontal cortex is kind of like the brain’s brain. It’s the part of you that sorts through information and makes plans and predictions and weighs evidence. It’s great at using what it learns to draw conclusions about how to act or what to do—as long as it knows the rules of the game and has access to the right information. And when it’s time for The Decision, your brain will do what it always does when confronted by a fork in the road—it’ll attempt to think and assess and analyze its way to the optimal rational answer.

Something as important and permanent as The Decision requires conviction, and conviction requires a source. No source of conviction, no Decision.

The source of the heart’s conviction is its love and care for the other person. The source of the ego’s conviction is its belief in its clipboard. Fear and sex drive derive their conviction from the obvious—fear and sex. The source of the gut’s conviction is an instinctive feeling that emerges from experience. And an inertia-y person gets their conviction from the conviction of someone else. Those sources are what allow people to make The Decision with relative ease.

The brain hears these voices, but it discredits their conviction in each case because the certainty emerges from what the brain sees as an irrational place. For the brain, the only respectable source of conviction is sound evidence.

And good luck with that.

If you’re typically a brain person, when it comes to The Decision, you want to try to not be you. Because the brain, for all its merits, does not do well in this situation, where the outcome is critical and evidence is hard to come by. Let’s look at how it might go:

Maybe you start by looking over to the marriage side of the balance beam—where you see a house.

That’s the house of the life you’re about to sign up for. You really enjoy your relationship, so you’re excited about what might be inside that house. But the house is also mysterious, because you don’t really know what either you or your partner will be like as a spouse or how either of you will grow or change in the future. Not much concrete evidence there.

So you turn and look over at the breakup side of the beam. You see a path, and a couple walking down it.

That road is whatever life you’d end up living if you were to move on from your relationship, and that’s the marriage you’d end up in. The marriage that might have been.

What kind of marriage would that be, and what adventures lie down that road? Maybe your life on that road would be much happier than whatever’s in that house on the other side, and maybe your current partner would end up happier somewhere else too. Or maybe you’d look back and realize that you made the biggest mistake of your life. Without knowing anything about that other path, there’s no way to compare it to the house on the other side. Again, no real evidence.

So you take a closer look at the one thing you have actual information about: your current relationship.

You decide to make a big chart where you list all the things you like and don’t like about your relationship—a relationship-assessment chart. You end up here:

Fucking great—now what? All relationships—the good ones and the bad ones—have a chart that looks like that, with things in all four of those zones: blue, green, yellow, and red. And without much relationship experience or marriage expertise, you have no good way to evaluate whether your particular diagram looks as promising as you hope it does or whether there are red flags in it that you’re not seeing that will lead to major issues later. You try comparing your relationship to those that your friends are in—but it’s hard to know what really goes on in other relationships, and each one is so complicated and unique anyway that it’s mostly apples and oranges.

Without any way to construct an airtight argument in either direction, you’re left feeling very little conviction about the situation. Because the stakes are so high, you become paranoid about making the wrong choice, and every time you think you might have an answer, you second-guess yourself.

The whole thing quickly becomes a mindfuck. You try talking yourself into feeling good about marriage by reminding yourself that every relationship has flaws and that marriage is all about acceptance—but then you realize that that’s also exactly how someone sounds when they’re talking themselves into settling for the wrong person. In both of those cases, the green and red zones of the diagram provide more than enough material to construct a full “why this is a great decision” argument. Likewise, if you wanted to play devil’s advocate and look at the reasons this might not be the right marriage for you, the blue and yellow sections of the diagram would make it easy—whether breaking up is a wise move or a foolish one.

And because the diagram and its four zones allow you to so effortlessly construct whatever convincing narrative you want to about your relationship and The Decision, you worry that anything that feels like conviction is just you falling for a narrative created by fear or ego or some other deep-down motivation.

Unable to come to a trustworthy conclusion, the brain person becomes a Paralyzed Pre-Marriage Relationship Person. A PPMRP has three options:

1) Procrastinate. Until you die, until your partner dies, or until your partner breaks up with you.

2) Turn back around and succumb to one of the primal forces. Maybe if you wait for a while, your fear of being single at 36 will overpower your dedication to rationality?

3) Come up with a decision-making litmus test that actually works.

Assuming you don’t find the first two options ideal, let’s talk about litmus tests.

The “actually works” part of option 3 is important, because people often come up with decision-making litmus tests that don’t actually tell you anything. For example:

An overly-broad, one-size-fits-all litmus test is a bad litmus test.

Like, “If I’m still toiling over this three years in, that’s probably a sign this isn’t the right thing for me.” Or, “I’m sure if we’ve been together this long, there’s a good reason for that.” Or, “If I still have the desire to sleep with other people, it must mean my heart’s not in this.”

Litmus tests like those suggest that everyone who toils over the marriage decision should break up or that every couple who’s together for a long time should get married or that no one in a great relationship still wants to sleep with other people. Different people do things like toil or stay together or feel promiscuous—or 100 other things—for totally different reasons, so broad statements like those don’t help with anything.

A litmus test that always yields the answer “We should get married” is a bad litmus test.

Like, “When I picture them standing on the altar with someone else, it’s a horrible thought—that must mean it’s the right move to marry them.” Or, “When we broke up for three days last month, I missed them unbearably—and it told me all I need to know.” Or, “I care about them more than anything and really want the best for them—that’s how I know I want to be with them.”

All these litmus tests tell you is that you A) feel possessive, B) feel attached, and C) love the person. In most long relationships—good and bad—the people in them feel all three of these things. The only real information you learn with tests like these is that you are, in fact, in a relationship.

A litmus test that always yields the answer “We should break up” is a bad litmus test.

Any version of the question, “Is this person a great match for me in every important way?” or “Is this person the best person for me?”

No, the person isn’t a great match for you in every important way. That has never happened before in our species. Likewise, there are at least a few hundred million people in the world that match your sexual preference. Only one of them is the best possible person for you. The chances that you were ever in the same square mile as that person are tiny, and the chances that you’re currently dating them are you’re not currently dating them. Litmus tests like these either require you to have a delusional view of your partner or the world, or they’re pretty much guaranteed to yield the conclusion that you need to break up and continue your quest for The One.

People struggling with The Decision crave guidance, and while statements like all of these can feel like a rescue line out of the PPMRP quagmire in the form of some larger wisdom, they don’t actually tell you anything about what you should do.

A good system for tortured brain people

I’m not an expert on this, nor am I married—but I’ve read a lot about it, and I’ve had a front row seat for a large handful of case studies, watching friends go through The Decision and talking to them about it while it was happening. And I think if we just use common sense, we can probably figure out what a hopeless brain person can do in this situation—so let’s give it a try.

To me, a good system might be as simple as these two steps:

Step 1) Find out where your gut is leaning, using thought experiments.

The gut is a real thing. And for our purposes here, your gut is the little kid in you who just wants one outcome more than the other.

The problem for brain people is that they’re by definition not gut people. The gut draws its wisdom from a mysterious place the prefrontal cortex does not understand, which makes brain people suspicious of the gut’s conclusions.

And suspicion is fine here, since your gut’s wisdom is limited by your experience and guts are often proven wrong with time—but the gut’s opinion is still important information.

Gut people have good practice at communicating with their gut about important decisions. Brain people do not—and the usual gut question—”does this feel right?”—won’t work. So we need to use thought experiments to isolate the gut’s voice amongst the cacophony in your head. Exercises like these are best designed by you, for you, since only you know you. But here are some ideas:

One kind of thought experiment creates a simulation in your head, which acts like a fishing fly, and our goal is to try to get the gut to be fooled by the simulation for a moment and jump at the bait, revealing what it really wants.

Something like: “Imagine you were being arranged married by the town matchmaker and she handed you an envelope with your to-be spouse’s name written inside. You open the envelope and it’s the name of your current partner.” This image might just make your gut jump up for a second and say, “Phew!” Or maybe instead, it would deflate just a little, just for a moment. If either happens, that’s good information.

Another type of thought experiment tries to get at the general yes or no feeling the question “does this feel right?” is supposed to reveal, but with some real on-the-nose imagery.

Like: “Picture two gravestones next to each other—yours and your partners. Does that feel right?”

Some of the most telling thought experiments help hear what the gut’s saying by trying to remove the often deafening voice of fear from the question and seeing if that changes anything.

For example, to test whether a resistance to breaking up is just a dread of the actual breakup itself, you could ask: “If there were a big green button in front of me that, if pressed, would make me fully single, where everything has been worked out with getting our things from each other’s apartments, where everyone in my life already knows, and where I’m totally emotionally recovered and moving on—in fact, I have a date tonight—would I press the button?”

Or if the real fear is of being single for years and years and never finding a new relationship, the button could do all of those things but also include “and I’m immersed in a new relationship.”

A fear of eternal commitment could be sussed out with a question like, “What if The Decision weren’t between breaking up and marriage, but only between breaking up and committing to the relationship for the next five years?”

If thought exercises like these leave you with the feeling that your inner inner self is “pulling” for the relationship, that’s promising.

But it’s not enough.

Step 2) Figure out what your deal-breakers are.

Let’s bring back our relationship assessment chart:

As we established earlier, this chart doesn’t provide much insight into how The Decision should go, because almost every relationship—the good and the bad, the healthy and the harmful, those built to last and those doomed to fail—has a chart like this, where it checks some of the right boxes and some of the wrong boxes, and also misses some of each. And yet, certain charts map out happy couples and others do not. So what’s the difference?

Deal-breakers.

Even though these charts show that there are many, many things we want from a relationship, our ability to be happy only depends on a small percentage of them.

Our relationship chart is like a happiness puzzle, and the items in the green and yellow zones are the pieces. The right question to ask about the chart isn’t, “Is this perfect for me?” or, “Will I automatically be happy if this is my chart?” The right question is, “How can I work with these pieces to figure out how to make myself and my partner happy?” If you’re a good puzzler, with some work and compromise—i.e. some adultness—you’ll probably be able to figure it out.

Unless the chart is missing one of your deal-breakers.

Your deal-breakers are the things that, if not part of your relationship, will guarantee your unhappiness. They’re things that no amount of hard work or compromise or maturity can fix. Your must-haves—and your must-not-haves.

A deal-breaker usually comes in the format:

There’s no way I can figure out how to be happy with someone who is / isn’t ____.

There’s no way I can figure out how to be happy with someone who does / doesn’t ____.

There’s no way I can figure out how to be happy with someone who values / doesn’t value ____.

There’s no way I can figure out how to be happy with someone who treats me / doesn’t treat me ____.

There’s no way I can figure out how to be happy with someone who believes / doesn’t believe ____.

Or maybe:

Out of principle, I will only be with / will not be with someone who ____.

Most real deal-breakers will be broad—e.g. “I may be able to fall in love with a negative person, but I could never be happy with that person.” Or, “I will never be with someone who makes my self-esteem lower.” Or, “I could never be happy with someone who isn’t intellectually curious.” Or something clean-cut like, “I could never be happy with someone who refused to have children.”

Deal-breakers that are more specific in nature can in some cases make sense—maybe you love dogs so much that it would truly impede you from being a happy person if you ended up with someone who didn’t want to own a dog—but they should be rare.

The key with all of these is that there are very few. These aren’t wants—these are needs. Your wants are important, but remember, the only people even eligible for the deal-breaker test are those who have already passed the gut test—plenty of your wants have already been taken care of in step 1 of our system.

Knowing your deal-breakers can help you know the right relationship when you see it, but it can also go a long way for anyone already in a relationship, because it lends insight into one of the trickiest aspects of a relationship: compromise. A great way to be unhappy is to refuse to compromise on things you wish were true about your relationship that aren’t. But another great way to be unhappy is to be too willing to compromise on your deal-breakers. That’s why this is so important—deal-breakers not only help Deciders and single people figure out what should be unacceptable in a relationship, they also remind already-Decided people that most of the problems in their relationship are probably non-deal-breakers that it’s okay to chill out about. Because so many relationship problems boil down to one or both members treating non-deal-breakers like deal-breakers—or vice versa.

And that’s really it. This gut check / deal-breakers system suggests that the mindfuck of The Decision is actually pretty simple—if a relationship successfully makes it through both steps 1 and 2, get married. If it doesn’t, don’t.

At least that’s what the system says.

But who knows. Relationships are impossibly complicated. And making a black-and-white binary decision about something that’s anything but black-and-white is kind of an insane thing to do.

And of course, even if it’s the right system, it’s not actually easy because assessing step 1 and step 2 isn’t easy. Getting a reading from your gut that you can trust is no small task for someone who typically lives in their brain—and figuring out what your deal-breakers are requires a serious deep-dive into your soul.

But for now, at least it’s a system—and a system you can hang on to. Which is just what some of us need.

___________

If you’re into Wait But Why, sign up for the Wait But Why email list and we’ll send you the new posts right when they come out. It’s a very unannoying list, don’t worry.

If you’d like to support Wait But Why, here’s our Patreon.

___________

If you liked this:

Another Wait But Why deep dive into the quandaries of figuring out who to marry: How to Pick a Life Partner

Some further issues, over in the world of single men: 10 Types of 30-Year-Old Single Guys

Once you finally make The Decision, you go straight into another Decision: How to Name a Baby

The post The Marriage Decision: Everything Forever or Nothing Ever Again appeared first on Wait But Why.

Small Victories takes files in a Dropbox folder and turns them into a website. Here are some super fab examples:

Try it yourself: Small Victories

Fujairah ist ein Geheimtipp für Besucher der Vereinigten Arabischen Emirate. Es ist zwar ein sehr kleines Emirat, hat aber viel zu bieten. Landschaftlich und kulturell kommen Touristen auf ihre Kosten und auch wer einfach nur relaxen möchte, ist hier genau richtig. Auch mit orientalischem Flair und modernen Reizen geizt Fujairah nicht. Für Action ist aber auch gesorgt: Schnorcheln, tauchen, hochseefischen, kiten, Quad fahren, Jeep-Safaris und vieles mehr. Fujairah zählt zu den besten Wassersportgebieten der Vereinigten Arabischen Emirate.

Bei verschiedenen Veranstaltern bekommt Ihr gerade einen coolen Deal. Ihr übernachtet im Top 5* Le Meridien Al Aqah Beach Resort. Das Hotel befindet sich an der Ostküste der Vereinigten Arabischen Emirate, im Emirat Fujairah zwischen dem Hajargebirge und dem Indischen Ozean. Das First-Class-Hotel liegt direkt an einem ca. 250 m langen Strandabschnitt des Strandes von Al Aqah.

Ehemalige Gäste loben vor allem die schöne Außenanlage mit den Pools, die sauberen und modernen Zimmer, den Service, die Nähe zum Strand und die vielen Aktivitäten vor Ort sowie das leckere Essen.

Abflug ist ab München im September. Gegen einen geringen Aufpreis auch ab Frankfurt, Hamburg oder Düsseldorf. Im Preis ist ein tägliches Frühstück enthalten sowie der Transfer vom Flughafen zum Hotel. Auch mit dabei sind die Zug zum Flug Tickets - mit diesen könnt Ihr von ganz Deutschland aus zum Abflughafen anreisen (ICE, IC, EC).

Mehrmals die Woche bietet das Hotel einen Shuttle-Service ins Zentrum nach Fujairah an. Jeden Sonntag könnt Ihr kostenlos in die Dubai Mall fahren.

Einreise: Die Reisedokumente müssen noch mindestens sechs Monate nach dem beabsichtigten Ausreisedatum gültig sein. Deutsche Staatsangehörige dürfen ohne Visum in das Hoheitsgebiet der Vereinigten Arabischen Emirate einreisen und sich dort zu touristischen, geschäftlichen (ohne Arbeitsaufnahme) oder zu Besuchszwecken für die Dauer von höchstens 90 Tagen innerhalb von 180 Tagen aufhalten. Weitere Informationen gibt es hier.

Kreditkarte / Mietwagen: Eine Kreditkarte benötigt ihr für diese Reise auf jeden Fall, schon allen um einen Mietwagen zu bekommen. Auch die Hotels werden beim Checkin nach einer Karte als Kaution fragen. Zudem könnt ihr mit vielen Karten sogar gebührenfrei vor Ort Bargeld am Automaten ziehen. Falls ihr also noch nicht versorgt seid, schaut am besten auf unseren Vergleich der besten kostenlosen Kreditkarten.

Klima: Im September erwarten Euch noch knackige Temperaturen bis zu 37 Grad. Mit 12 Sonnenstunden am Tag und so gut wie nie Regen, könnt ihr hier noch einmal richtig Sommer-Urlaub machen!

In his, to my mind, fair defense of Uber, Mark Suster made a very important observation about the reality of business:

Let’s put this into perspective. As somebody who has to rub shoulders with big tech companies often I can tell you that there is much blood spilled in the competitive trenches of Apple, Twitter, Facebook, Google and so on. Changes to algorithms. Clamping down on app ecosystems. Changing how third-parties monetize. Kicking ecosystem partners in the nuts.

Be real.

It’s a brutally competitive world out there because there are extreme amounts of money at stake. I’ve been on the sharp end of it and it doesn’t feel nice. And I pick myself back up, dust off and think to myself that I need to think through the realpolitik of power and money and competition and no matter how unpleasant it is – it’s a Hobbesian world out there. It ain’t pretty – but it’s all around us.

This is particularly relevant to Uber: the company is looking to raise another $1 billion at a valuation of over $30 billion, and, as I wrote when the company raised its last billion, they are likely worth far more than that. Still, though, skeptics about both the size of the potential market and the prospects of Uber in particular are widespread, so consider this post my stake in the ground¹ for why Uber – and their market – is worthy of so many sharp elbows. I expect to link to it often!

There are three perspectives with which to examine the competitive dynamics of ride-sharing:

1. Ride-sharing in a single city
2. Ride-sharing in multiple cities
3. Tipping points

I will build up the model that I believe governs this market in this order; ultimately, though, they all interact extensively. In addition, for these models I am going to act as if there are only two players: Uber and Lyft. However, the same principles apply no matter how many competitors are in a given market.

Ride Sharing in a Single City

Consider a single market: Riderville. Uber and Lyft are competing for two markets: drivers and riders.

There are a few immediate takeaways here:

• The number of riders is far greater than the number of drivers (far greater, in fact, than the percentage difference depicted by this not-to-scale sketch)
• On the flip side, drivers engage with Uber and Lyft far more frequently than do riders
• Ride-sharing is a two-sided market, which means there are two places for Uber and Lyft to compete – and two potential opportunities for winner-take-all dynamics to emerge

It’s important to note that drivers in-and-of-themselves do not have network dynamics, nor do riders: Metcalfe’s Law, which states that the value of a network is proportional to the square of the number of connected users, does not apply. In other words, Uber having more drivers does not increase the value of Uber to other drivers, nor does Lyft having more riders increase the value of Lyft to other riders, at least not directly.

However, the driver and rider markets do interact, and it’s that interaction that creates a winner-take-all dynamic. Consider the case in which one of the two services – let’s say Uber – gains a majority share of riders (we’ll talk about how that might occur in the next section):

• Uber has a majority of riders (i.e. more demand)
• Drivers will increasingly serve Uber customers (i.e. more supply)
• More drivers means that Uber’s service level (i.e. car liquidity) will improve
• Higher liquidity means that Uber has a better service, which will gain them more riders

In this scenario Lyft by necessity moves in the opposite direction:

• Lyft has fewer riders (i.e. less demand)
• Drivers will face increasing costs to serve Lyft riders:
  • If there are fewer Lyft riders, than the average distance to pick up a Lyft rider will be greater than the average distance to pick up an Uber driver; drivers may be better off ignoring Lyft pickups and waiting for closer Uber pickups
  • Every time a driver picks up a rider on one service, they need to sign out on the other; if the vast majority of rides are with one service, this, combined with the previous point, may make the costs associated with working for multiple services too high²
• Drivers will increasingly be occupied serving Uber customers and be unavailable to serve Lyft customers (i.e. less supply)
• Fewer drivers means that Lyft’s service level (i.e. car liquidity) will decrease
• Lower liquidity means that Lyft has an inferior service, which will cause them to lose more riders

The end result of this cycle, repeated over months, looks something like this:

There are three additional points to make:

• It doesn’t matter that drivers may work for both Uber and Lyft. If the majority of the ride requests are coming from Uber, they are going to be taking a significantly greater percentage of driver time, and every minute a driver spends on a rider job is a minute that driver is unavailable to the other service. Moreover, this monopolization of driver time accelerates as one platform becomes ever more popular with riders. Unless there is a massive supply of drivers, it is very difficult for the 2nd-place car service to ever get its liquidity to the same level as the market leader (much less the 3rd or 4th entrants in a market)

• The unshaded portion of the “Riders” pool are people who regularly use both Uber and Lyft. The key takeaway is that that number is small: most people will only use one or the other, because ride-sharing services are relatively undifferentiated. This may seem counterintuitive, but in fact in markets where:

  • Purchases are habitual
  • Prices are similar
  • Products are not highly differentiated

  …Customers tend to build allegiance to a brand and persist with that brand unless they are given a good reason to change; it’s simply not worth the time and effort to constantly compare services at the moment of purchase³ (in fact, the entire consumer packaged goods industry is based on this principle).

  In the case of Uber and Lyft, ride-sharing is (theoretically) habitual, both companies will ensure the prices are similar, and the primary means of differentiation is car liquidity, which works in the favor of the larger service. Over time it is reasonable to assume that the majority player will become dominant

• I briefly mentioned price: clearly this is the easiest way to differentiate a service, particularly for a new entrant with relatively low liquidity (or the 2nd place player, for that matter). However, the larger service is heavily incentivized to at least price match. Moreover, given that the larger service is operating at greater scale, it almost certainly has more latitude to lower prices and keep them low for a longer period of time than the new entrant. Or, as is the case with ride-sharing, a company like Uber has as much investor cash as they need to compete at unsustainably low prices

In summary, these are the key takeaways when it comes to competition for a single-city:

• There is a strong “rich get richer” dynamic as drivers follow riders which increases liquidity which attracts riders. This is the network effect that matters, and is in many ways similar to app ecosystem dynamics (developers follow users which which increases the number and quality of apps which attracts users)

• It doesn’t matter if drivers work for both services, because what matters is availability, and availability will be increasingly monopolized by the dominant service

• Riders do not have the time and patience to regularly compare services; most will choose one and stick with it unless the alternative is clearly superior. And, because of the prior two points, it is almost certainly the larger player that will offer superior service

Ride Sharing in a Multiple Cities

It is absolutely true that all of the market dynamics I described in the previous section don’t have a direct impact on geographically disperse cities, which is another common objection to Uber’s potential. What good is a network effect between drivers and riders if it doesn’t travel?

There is, however, a relationship between geographically disperse cities, and it occurs in the rider market, which, as I noted in the previous section, is the market where the divergence between the dominant and secondary services takes root. Specifically:

• Pre-existing services launch with an already established brand and significant mindshare among potential riders. Uber is an excellent example here: the company is constantly in the news, and their launch in a new city makes news, creating a pool of riders whose preference from the get-go is for Uber

• Travelers, particularly frequent business travelers, are very high volume users of ride-sharing services. These travelers don’t leave their preferences at home – when they arrive at an airport they will almost always first try their preferred service, just as if they were at home, increasing demand for that service, which will increase supply, etc. In this way preference acts as a type of contagion that travels between cities with travelers as the host organism

Most important of all, though, is the first-mover effect. In any commodity-type market where it is difficult to change consumer preference there is a big advantage to being first. This means that when your competitor arrives, they are already in a minority position and working against all of the “rich get richer” effects I detailed above.

This explains Uber and Lyft’s crazy amounts of fundraising and aggressive roll-out schedules, even though such a strategy is incredibly expensive and results in a huge number of markets that are years away from profitability (Uber, for example, is in well over 100 cities but makes almost all its money from its top five). Starting out second is the surest route to finishing second, and, given the dynamics I’ve described above, that’s as good as finishing last.

Tipping Points

What I’ve described up to this point explain what has happened between Uber and Lyft to-date. Still, while I’ve addressed many common objections to Uber’s valuation in particular, there remains the question of just how much this market is worth in aggregate. After all, as Aswath Damodaran, the NYU Stern professor of finance and valuations expert detailed, the taxi market is worth at most $100 billion which calls into question Uber’s rumored $30 billion valuation.

However, as Uber investor Bill Gurley and others have noted, Damodaran’s fundamental mistake in determining Uber’s valuation is to look at the world as it is, not as it might be.⁴ Moreover, this world that could be is intimately tied to the dynamics described above. I like to think of what might happen next as a series of potential tipping points (for this part of the discussion I am going to talk about Uber exclusively, as I believe they are – by far – the most likely company to reach these tipping points):

• Tipping Point #1: Liquidity is consistently less than 5 minutes and surge pricing is rare – Once Uber becomes something you can count on both from a time and money perspective, rider behavior could begin to change in fundamental ways. Now, Uber is not just for a business meeting or a night out; instead, Uber becomes the default choice for all transportation. This would result in dramatically increased rider demand, resulting in complete Uber domination of driver availability. This would have several knock-on effects:

  • Driver utilization would increase significantly, increasing driver wages to a much more sustainable level
  • Competitor liquidity would decrease precipitously, leading to rider desertion and an Uber monopoly; this would allow Uber to raise rates to a level that is more sustainable for drivers, further increasing supply and liquidity

  By all accounts Uber is already close to this level in San Francisco, and there are lots of anecdotes of people all but giving up cars.⁵ The effect of this change in rider behavior cannot be overstated, especially when it comes to Uber’s potential valuation: taxis have a tiny share of the world’s transportation market, which means to base the company’s valuation on the taxis is to miss the vast majority of Uber’s future market opportunity

• Tipping Point #2: Uber transports not just people – Uber has already done all kinds of experiments with delivering things other than people, including Christmas trees, lunch, a courier service, even drugstore items. However, any real delivery service would need to have some sort of service-level agreement when it comes to things like speed and price. Both of those rely on driver liquidity, which is why an Uber logistics service is ultimately waiting for the taxi business to tip as described above.

  However, once such a delivery service is launched, its effect would be far-reaching. First, driver utilization would increase even further, particularly when it comes to serving non centrally located areas. This would further accentuate Uber’s advantage vis-à-vis potential competitors: Uber service would be nearly instant, and drivers – again, even if they nominally work for multiple services – would be constantly utilized.

  Moreover, there is a very good chance that Uber could come to dominate same-day e-commerce and errands like grocery shopping: most entrants in this space have had a top-down approach where they set up a retail operation and then figure out how to get it delivered; the problem, though, is that delivery is the bottleneck. Uber, meanwhile, is busy building up the most flexible and far-reaching delivery-system, making it far easier to move up the stack if they so choose. More likely, Uber will become the delivery network of choice for an ecosystem of same-day delivery retailers. Needless to say, that will be a lucrative position to be in, and it will only do good things for Uber’s liquidity.

Why Uber Fights

The implications of this analysis cannot be underestimated: there is an absolutely massive worldwide market many times the size of the taxi market that has winner-take-all characteristics. Moreover, that winner is very unlikely to be challenged by a new entrant which will have far worse liquidity and an inferior cash position: Uber (presuming they are the winner) will simply lower prices and bleed the new entrant dry until they go out of business.

To put it another way, I think that today’s environment where multiple services, especially Lyft, are competing head-on with Uber is a transitional one. Currently that competition is resulting in low prices and suppressed driver wages, but I expect Uber to have significant pricing power in the long run and to be more generous with drivers than they are now, not for altruistic reasons, but for the sake of increasing liquidity and consistent pricing.

In short, Uber is fighting all out for an absolutely massive prize, and, as Suster noted, such fights are much more akin to Realpolitik. As Wikipedia defines it:

Realpolitik is politics or diplomacy based primarily on power and on practical and material factors and considerations, rather than explicit ideological notions or moral or ethical premises

It’s ethics – or, to be more precise, Uber’s alleged lack of them – that has been dominating the news most recently, and is what inspired Suster’s post. And, to be very clear, I can understand and share much of the outrage: in my Daily Update I have compared Uber to Wall Street and said that Emil Michael should be fired (both links members-only) for his comments suggesting Uber might investigate journalists – Sarah Lacy in particular – who disparage the company.⁶

However – and one of the reasons I’m writing this article – I am also very aware of just how much is at stake in this battle. Lyft has raised $332.5 million from some very influential investors, and I don’t for a minute believe that they don’t want to win just as badly as Uber does. It’s perfectly plausible, if not probable, that Lyft and its backers, overmatched in a head-on battle with Uber, are conducting a guerrilla campaign with the aim of inspiring so much disgust in riders that Uber’s liquidity advantages start to slip (and to be clear, such a campaign – if it exists – is only possible because Uber’s management speaks and acts poorly frequently).⁷

To be perfectly clear, I don’t know anything further about this situation – or other recent Uber PR fiascos, like this Verge piece about stealing Lyft drivers – beyond the size of the potential prize, as detailed here, and the reality of human beings and their incentives in the presence of such outsized rewards. In my experience the truth ends up being far more gray than the press – which really hates threats to journalists – has characterized this most recent episode.

In fact, in some ways I’m actually far more concerned about Uber’s perceived lack of ethics than most, because if I’m right, then Uber is well on its way to having monopoly power over not just taxi services but a core piece of worldwide infrastructure, and nothing about this crisis gives me confidence in the company’s ability to manage that gracefully.⁸ I get that Uber’s willingness to fight unjust laws is what got them to this point, but as James Allworth and I discussed on the most recent episode of Exponent, there is a deeper moral code that ought to govern Uber’s actions. Moreover, Uber needs rider goodwill to prevail in the many markets where it is facing significant regulatory resistance: it is local citizens who determine whether or not local laws and regulations will be changed to accommodate Uber, and Uber is making it very difficult to rationalize advocating for them, or, if my Twitter account is any indication, to even ride with them.

Ultimately, this blog generally seeks to analyze business, not render moral judgment or tell anyone what products or services they should or should not use. I myself am mixed: I plan on spending some time in the white part of that graph above, at a minimum. I hope, though, that you now appreciate exactly what is at stake and why so many elbows are being thrown.

The post Why Uber Fights appeared first on stratechery by Ben Thompson.

“Insomnia is a glamorous term for thoughts you forgot to have in the day.”
- Alain de Botton