What developers really need to be productive

Welcome to Runtime! Today: a new study examines the factors that really separate productive software organizations, Microsoft releases more details on the breach of its systems, and the quote of the week.

(Was this email forwarded to you? Sign up here to get Runtime each week.)

There was no mention of food

Developer productivity was a hot topic in 2023 as companies looking for ways to cut costs started looking more closely at one of the more expensive line items on their payroll. After McKinsey weighed in with advice that was almost universally panned by anyone who has ever managed a team of developers, Microsoft thankfully commissioned a study released earlier this month that examined the real factors that improve developer experience and organizational performance.

Led by Dr. Nicole Forsgren, who was instrumental in developing the ideas behind the DORA productivity metric, a team of researchers asked professional developers a series of questions about their daily work. The study presumed that individual developers, development teams, and companies all want to ship code quickly with a minimum of distractions, which is easier said than done inside an awful lot of companies.

"... there is a difference between simply writing code and writing code in an environment that is optimized for writing code," the authors wrote (emphasis in original).
Software developers, it turns out, are pretty much normal people working in organizational environments often filled with frequent distractions and frustrating policies that impact their ability to actually focus on coding.
"Intuitively, there is acceptance among technical leaders that good developer experience enables more effective software delivery and developer happiness," according to the authors.
But despite growing acceptance that developer experience is paramount, there are still a ton of companies that haven't embraced the organizational structures that really help make developers more productive.

The study asked developers to rate how their work environments performed across three key metrics.

The first one was the concept of "flow state," which measured how often developers were able to enter a zone of concentration focused on a task at hand before getting interrupted to do some sort of ridiculous training program, for example.
The second involved "feedback loops," or the time required to get answers to basic questions about the direction of a product as well as getting final approval to ship.
The third was described as "cognitive load," meaning how easy developers find working with their company's developer tools and policies.

"This is the first study we’re aware of that analyzes the statistical relationships between DevEx factors and outcomes at the individual, team, and organization levels," the authors wrote, and they reached some interesting conclusions.

Developers need space in their days reserved for what the study called "deep work" that allows them to reach the flow state, which can be difficult to do in the modern corporate environment but was common practice among developers who worked for profitable companies.
Code repositories and developer tools should be easy to understand and use; "unintuitive tools and processes can be both a time sink and a source of frustration—in either case, a severe hindrance to individuals’ and teams’ creativity," the authors wrote.
And "teams that provide fast responses to developers’ questions report 50 percent less technical debt than teams whose responses are slow," which allows companies to move more quickly as the needs of the business change.

Dark and stormy

After a week of criticism over the lack of details it provided in a seismic Friday news dump, Microsoft released more information Thursday evening about the attack by a hacking group linked to Russia that stole emails and documents from some members of its senior leadership team.

The company confirmed that the group Microsoft calls "Midnight Blizzard" gained access to a legacy test tenant account (which are generally used to try out new Microsoft 365 features) that was not protected by multifactor authentication, as several security experts had speculated earlier this week. The attackers then "leveraged their initial access to identify and compromise a legacy test OAuth application that had elevated access to the Microsoft corporate environment," and used that OAuth application to grant themselves access to the mailboxes affected by the hack.

"If the same team were to deploy the legacy tenant today, mandatory Microsoft policy and workflows would ensure MFA and our active protections are enabled to comply with current policies and guidance, resulting in better protection against these sorts of attacks," the company said. It also outlined several steps that other companies can follow to determine if they were also hacked, which became more important after HPE disclosed this week that it had also been hacked by the same group.

Quote of the week

"There’s no AI exemption from the laws on the books, and we’re looking closely at the ways companies may be using their power to thwart competition or trick the public." — FTC Chair Lina Khan, announcing an inquiry into the relationship between Big Cloud and AI startups OpenAI and Anthrophic.

The Runtime roundup

Salesforce kicked another 700 people out of its "ohana" because they weren't working on the things it now finds important, apparently.

Microsoft Teams was down around the world for an extended period on Friday, which is really more of a feature than a bug heading into the weekend.

The U.S. Department of Commerce is trying to force cloud providers to disclose when foreigners train large-language models on their servers.

Semafor had an interesting profile of Armada, a startup working on providing rugged mobile data centers that can be deployed in remote or hostile locations.

Thanks for reading — see you Tuesday!