Testing in prod, engineering balance, and thinking fast and slow!💡
Monday Ideas — Edition 138
🔒 Codacy Security — security made simple for devs
Hey! This week I am happy to promote Codacy Security, which is here to make your code more secure without slowing you down.
With tools like Static Application Security Testing (SAST) to catch issues like XSS or SQL injection, and Supply Chain Security (SCA) to keep your dependencies in check, it’s got you covered.
It also finds hard-coded secrets, scans Infrastructure-as-Code (IaC) for misconfigurations, and helps with runtime vulnerabilities through Dynamic Application Security Testing (DAST).
Bonus? Pen testing services are part of the deal. Supporting 49 languages, Codacy plugs right into your workflow, making security a seamless part of your DevSecOps journey.
Back to this week’s ideas!
1) 🎆 Let’s make 2025 the year you test in production!
Testing in production has a bad reputation because many people conflate it with testing only in production — which of course is a different thing!
Testing in prod matters because, no matter how good your staging environment is, it is never going to be exactly like prod. It is not possible to have the same concurrency, the same chaos, the same variability, because every moment in production is unique.
When I interviewed Charity Majors last year she said you may or may not have a staging environment — that’s up to various factors — but you can’t not invest in good production tooling.
Counterintuitively, the right mindset, most of the times, is to invest in fixing problems faster, rather than preventing problems.
The former leads to speed, flow, and CD. The latter leads to gating, batching, and pain.
You can find the full interview with Charity below! 👇
2) ⚖️ Balance your engineering investment
We are wrapping up the results of our survey about how teams use data to get better, and — spoiler alert! — one of the practices that is coming out as an absolute winner is to intentionally allocate engineering time across multiple areas.
Unless you already have a good way of doing this, I recommend starting with the Balance Framework, which helps you understand the nature of the engineering work.
Based on the framework, work is divided into two main areas:
🔴 Mandatory investments — to support running the business (a.k.a. keeping the lights on, KTLO).
🟢 Elective investments — anything that is up for discussion and can be prioritized.
Elective investments are further divided into three categories:
🔨 New things — work towards your business objectives, like new products, features, or integrations.
🔧 Improving things — improvements to existing features, including performance, reliability, and security.
⚙️ Productivity — improvements to engineering productivity. This may affect operations and other departments’ productivity as well.
Categorizing all of your work helps you have conversations based on data rather than intuition. You can define priorities, defend them based on grounded evidence, and build a sustainable work balance.
We wrote a full piece about this, which you can find below 👇
3) 🧠 System 1 vs System 2
Two months ago I reviewed Daniel Kahneman’s cornerstone work: Thinking, Fast and Slow — and I still think about it often.
Kahneman's central thesis revolves around two modes of thought: System 1 and System 2. This concept is fundamental to understanding how we make decisions:
1️⃣ System 1 — is fast, intuitive, and emotional. It operates automatically and quickly, with little or no effort and no sense of voluntary control.
2️⃣ System 2 — on the other hand, is slower, more deliberative, and more logical. It allocates attention to effortful mental activities that demand it, including complex computations.
What's surprising — and somewhat unsettling — is how much we rely on System 1, even when we think we're being logical and methodical. We often pride ourselves on our analytical abilities (especially in engineering 🫠), but Kahneman shows that we're far more inclined to do quick, intuitive judgments.
The main problem is that we don’t have a reliable way to figure out when to engage System 2 — the analytical side — vs. accepting the quick answer provided by System 1.
This is perfectly displayed in the famous bat and ball problem:
"A bat and ball cost $1.10. The bat costs one dollar more than the ball. How much does the ball cost?”
Most people answer 10 cents, which is System 1 stuff. The correct answer (5 cents) would require engaging System 2, but we usually accept the quick answer because it looks good.
This reminded me of chess. During lunch I often watch Hikaru videos, where he often talks about the problem of knowing when to spend your time. Modern chess has shifted more and more towards shorter time controls (e.g. 10-minute games), which means players spend little time, on average, on every move. What’s interesting, especially in grandmaster games, is that players do not spend a similar amount of time on every move — they blitz most of them (i.e. few seconds) and spend long chunks of several minutes on a few crucial ones.
Blitz moves are System 1 — quick judgment and pattern-matching — while the long ones are when players engage their analytical brains.
Knowing when it is worth spending more time on a move — i.e. when to engage System 2 vs when to trust intuition — is a crucial quality that separates outstanding players from the good ones.
Ok, but chess is time-constrained: in real life, couldn’t we deliberately skew towards System 2 most of the time? No sir, because System 2 is 1) slow, and 2) extremely costly, while System 1 is basically free.
Using System 2 quickly leads to cognitive strain, so we can rely on it sparingly.
Kahneman then goes on to explain all kinds of biases that plague our minds — and reading about these was definitely a humbling experience.
You can find my full review below 👇
And that’s it for today! If you are finding this newsletter valuable, consider doing any of these:
1) 🔒 Subscribe to the full version — if you aren’t already, consider becoming a paid subscriber. 1700+ engineers and managers have joined already! Learn more about the benefits of the paid plan here.
2) 📣 Advertise with us — we are always looking for great products that we can recommend to our readers. If you are interested in reaching an audience of tech executives, decision-makers, and engineers, you may want to advertise with us 👇
If you have any comments or feedback, just respond to this email!
I wish you a great week! ☀️
Luca