Welcome!

@DevOpsSummit Authors: Pat Romanski, Liz McMillan, Yeshim Deniz, Elizabeth White, Jason Bloomberg

Related Topics: @DevOpsSummit, Linux Containers, @CloudExpo

@DevOpsSummit: Blog Feed Post

Top 11 Misconceptions About APIs By @PaulSBruce | @DevOpsSummit #API #DevOps

APIs permeate the connected world, used by technical and non-technical professionals alike

by Paul Bruce

APIs permeate the connected world, used by technical and non-technical professionals alike. At some point, we all work with APIs, building them, selling them, maintaining them and consuming them. With so many viewpoints and opinions, misconceptions can quickly emerge, clouding the decision-making process and hindering execution of improvements to the business of API delivery.

This article focuses on dispelling some of the most common myths around the API lifecycle, so that you don't fall at the mercy of misinformation in your own process. The points in this article are graciously lent by Ole Lensmar, CTO at SmartBear, based on his recent talk at AppsWorld North America on the topic.

Myth #11: APIs only solve a technical problem
APIs don't have buttons and flashy graphics, but that doesn't diminish their importance to non-developers. Business decision makers all need to know that APIs can speed time-to-delivery by compartmentalizing work projects, providing well-modeled 11 myths of apis 1data to business users through spreadsheets, and even act as their own product in the data economy.

If your organization has pigeon-holed APIs to be a geeky, technical asset solely existing for the benefit of the developer, you may find that simply sitting down with the right non-technical business owner, say the CTO or Director of IT, is just the kick start you need to break through this misconception. A 15-minute review of the non-technical reasons that APIs are a big deal to everyone in your organization might be just what the doctor ordered.

Myth #10: APIs are secondary to a business
Even if APIs are perceived as just "glue" for your organization, or if instead of shipping a public API you use them internally, integrations between systems are a vital part of the health and function of a business.  Just ask11 api myths 2 the finance department to go without a few critical integrations that depend on APIs, and you'll see how quickly business as usual will come grinding to a halt.

Similarly, many organizations use some form of traditional database scheme behind the scenes. You wouldn't call the code and queries in the database "secondary" to the business, and so you shouldn't when it comes to the APIs that connect the systems an organization uses. Every company is a tech company in the information age, and understanding the importance of the working components underlying your business model protects you from bad or uninformed decisions when it comes time to change.

Myth #9: Their API will always be available
Do you think that third-party API you just integrated with will be around forever? API companies, especially those who only produce APIs, can very quickly crumble unless they have a healthy ecosystem and leadership to back them.You must choose your third-party integrations wisely, because if they happen to fold, you may be in for quite the scramble to find another API provider that meets your technical needs and financial requirements.

And if you think you're safe integrating with the big players such as Google APIs, Twitter, and Amazon - guess what? You're not. While it's not likely that they'll experience a catastrophic collapse,11 api myths 3 these companies do change their public API schemas regularly. If you're not paying attention, your integration with large providers might break due to these changes. It's also important to consider that you hold far less authority as one of countless other API consumers to a popular API, so your vote on how these APIs change (if you even get a vote) may count far less than if you were to integrate with an API provider that really depends on your subscription to their services.

Myth #8: Our API can't be hacked
Just because you haven't been hacked yet, or you have taken what youbelieve are adequate measures to protect misuse of your API, rest assured your API will be the target of hacking attempts from malicious users and bad actors.

It happens all the time in the news - just consider the Moonpig breach and constant attacks on companies like Uber and Tinder, as a clear sign that public APIs constitute just as much of a security problem as any other web or mobile app. Certainly the folks at Uber thought about security before releasing their API publically, but through elbow grease and malicious intent, hackers still found a way to misuse their APIs. If you are publishing a public API, it's important to bake in time to review your API for conformance to guidelines like the Top 10 OWASP scans for REST or SOAP web services.11 api myths 4

Myth #7: Their API can't be hacked
Each of the points above applies when you think about integrating with 3rd party APIs as well. If they don't have a zero-day response policy, you may want to reconsider trusting your data with their web service. Also be wary of API providers that present compliance at a point in time, but aren't willing to go into detail with you about their continuous security process. If they're not constantly ensuring the conformance they tout, then they might not even know they've been breached.

Trust no one. Be vigilant. Demand the same from others.

Myth #6: SSL + OAuth is enough
Thorough security is never locked to one layer, so it's important to have multiple layers of security considerations in place in order to deter hacking attempts and reduce single-point vulnerabilities. Relying too heavily on a single 11 api myths 5layer such as SSL as a transport security mechanism or OAuth as an authorization pattern, without considering network-level or data-level vulnerabilities, will make it very easy for hackers to play along with the few mechanisms you've established until they find an unprotected aspect of your system to exploit.

Just consider the bearer token exploit, in that without SSL the entire authentication process is bogus. There are other common vulnerabilities too, but the overarching theme is that your approach to securing your APIs must be multi-layered. Using OAuth + SSL might be a major step in the right direction, especially if you use something as arcane as Basic authentication, but it's just one step. Make sure you take the next one soon as part of your deployment or maintenance plans.

Myth #5: Metadata is bad
Put simply, the idea that Metadata is bad is patently false. Metadata is just ‘other information' than the primary data of purpose. Common programs such as Microsoft Office, for instance, produce lots of metadata; the primary data is the content that you include in your document or spreadsheet, whereas the metadata is author and origin information, credentials to underlying data sources, and other information that becomes associated 11 api myths 6with a document throughout its creation, but is usually not exposed within the document itself.

API metadata can be considered critical to the primary function of the API but this data is exposed in non-standard methods to the way that primary data is delivered. Metadata can exist in the form of custom headers to abate the process of baking new functionality into the existing HTTP body schema or specification.  So long as everyone using the API understands why ‘metadata' exists separate from traditional ‘data,' all metadata is data. Use it wisely.

Myth #4: You need to adhere to REST principals
One of the most constraining business practices is to follow strict adherence to some form of guidelines even when they don't make sense for a given situation. REST11 api myths 7 principals are great and all, but REST lacks pretty important things like a built-in formal schema definition and bolt-on standards for doing security (WS-Security, WS-Trust), distributed transactions, and asynchronous processing (JAX-WS).

Regardless of whether you have SOAP or REST services, you should be willing to consider the context by which you apply architectural principals. Using REST as a canon on how to build APIs misses the point of REST: build what is appropriate based on thoughtful consideration of the domain.

Myth #3: Top-down creation of APIs is only for elaborate architectures
Not so! APIs come in all shapes and sizes, especially in the enterprise. Rewriting small portions of infrastructure one at a time is often the only way teams can make headway in migrating from a monolithic web service approach to a more scalable, maintainable model like Microservices.

11 api myths 7If you're trying to partition a class of problems that are thematic throughout your infrastructure, then yes, a top-down approach is often a good thing to try...on the whiteboard...with the rest of your team. The most effective APIs are designed with the consumer in mind, which is great news for people who like to think about their designs before getting lost in implementation details. Even the smallest API should be well thought through, and taking a top-down approach to API design at each opportunity can help to improve the consumer experience and the overall landscape of your API infrastructure, one endpoint at a time.

Myth #2: Nobody uses SOAP
This could be one of the most prevalent API misconceptions that exist today, but it grossly misrepresents the current API economy. Plenty of organizations have existed well before the existence of REST APIs and have been through programming era after era. 11 api myths 9SOAP was the only option in the early SOA days, obtaining both mass adoption in the enterprise as well as years of ecosystem support and tooling. Now, of course, there is a shift away from SOAP for applications and devices that are designed to trade formality for agility. But much of our world is built on XML, no matter how hard we want to move on.

Most notably are organizations that employ a formal back-end, an enterprise service bus (ESB), where many ESB vendors have standardized on XML documents as a native structured input and output format. Building APIs that use SOAP naturally fits in to this kind of ecosystem, and makes sense for teams where the informalities of REST/JSON aren't feasible due to compliance or regulatory concerns.

Myth #1: Our API works!
How do you know this? Do you have proof such as proper test coverage, both positive and negative condition checks in your tests, and are you monitoring your APIs to see exactly what the uptime percentage really is?

The fact is, most API development teams build and ship without proper testing or monitoring practices to ensure that the API being delivered does exactly what it's supposed to do, reliably and safely. Maybe another project takes priority, the "quality analysis" problem is offloaded to another group, or the problems in production are a known quantity solved by a workaround.

The only way you don't fall into the hazards of thinking your API works when it really doesn't is to proactively test to prove that your API stands up to the challenge.

Read the original blog entry...

More Stories By SmartBear Blog

As the leader in software quality tools for the connected world, SmartBear supports more than two million software professionals and over 25,000 organizations in 90 countries that use its products to build and deliver the world’s greatest applications. With today’s applications deploying on mobile, Web, desktop, Internet of Things (IoT) or even embedded computing platforms, the connected nature of these applications through public and private APIs presents a unique set of challenges for developers, testers and operations teams. SmartBear's software quality tools assist with code review, functional and load testing, API readiness as well as performance monitoring of these modern applications.

@DevOpsSummit Stories
SYS-CON Events announced today that Elastifile will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Elastifile Cloud File System (ECFS) is software-defined data infrastructure designed for seamless and efficient management of dynamic workloads across heterogeneous environments. Elastifile provides the architecture needed to optimize your hybrid cloud environment, by facilitating efficient data access across cloud and on-premises boundaries - with all the advantages of public IaaS everywhere.
As DevOps methodologies expand their reach across the enterprise, organizations face the daunting challenge of adapting related cloud strategies to ensure optimal alignment, from managing complexity to ensuring proper governance. How can culture, automation, legacy apps and even budget be reexamined to enable this ongoing shift within the modern software factory?
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Launched in 2016, Cloudistics helps anyone bring the power of the cloud to the data center in an easy-to-use, on- premises cloud platform that automatically provides high performance resources for all types of applications: Docker, Splunk, Hadoop, Citrix® VDI, and many other high performance workloads. With no onsite controllers to install or maintain, it’s easy to scale across a large site or multiple locations – all from a single, centralized dashboard.
With Cloud Foundry you can easily deploy and use apps utilizing websocket technology, but not everybody realizes that scaling them out is not that trivial. In his session at 21st Cloud Expo, Roman Swoszowski, CTO and VP, Cloud Foundry Services, at Grape Up, will show you an example of how to deal with this issue. He will demonstrate a cloud-native Spring Boot app running in Cloud Foundry and communicating with clients over websocket protocol that can be easily scaled horizontally and coordinate communication between multiple instances by using an additional message broker.
@DevOpsSummit at Cloud Expo taking place Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center, Santa Clara, CA, is co-located with the 21st International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.
SYS-CON Events announced today that Golden Gate University will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Since 1901, non-profit Golden Gate University (GGU) has been helping adults achieve their professional goals by providing high quality, practice-based undergraduate and graduate educational programs in law, taxation, business and related professions. Many of its courses are taught by faculty actively working in their field of expertise, providing students with skills that can be applied immediately. The new MS in Business Analytics, like most of its programs, is available fully online or in-person in downtown SF.
SYS-CON Events announced today that Golden Gate University will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Since 1901, non-profit Golden Gate University (GGU) has been helping adults achieve their professional goals by providing high quality, practice-based undergraduate and graduate educational programs in law, taxation, business and related professions. Many of its courses are taught by faculty actively working in their field of expertise, providing students with skills that can be applied immediately. The new MS in Business Analytics, like most of its programs, is available fully online or in-person in downtown SF.
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.
SYS-CON Events announced today that Secure Channels, a cybersecurity firm, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Secure Channels, Inc. offers several products and solutions to its many clients, helping them protect critical data from being compromised and access to computer networks from the unauthorized. The company develops comprehensive data encryption security strategies that are tailored for the unique needs of each client; the team builds in an intuitive user experience to boost efficiency and effectiveness of its cyber security solutions.
Vulnerability management is vital for large companies that need to secure containers across thousands of hosts, but many struggle to understand how exposed they are when they discover a new high security vulnerability. In his session at 21st Cloud Expo, John Morello, CTO of Twistlock, will address this pressing concern by introducing the concept of the “Vulnerability Risk Tree API,” which brings all the data together in a simple REST endpoint, allowing companies to easily grasp the severity of the vulnerability. He will provide attendees with actionable advice related to understanding and acting on exposure due to new high severity vulnerabilities.
SYS-CON Events announced today that SkyScale will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. SkyScale is a world-class provider of cloud-based, ultra-fast multi-GPU hardware platforms for lease to customers desiring the fastest performance available as a service anywhere in the world. SkyScale builds, configures, and manages dedicated systems strategically located in maximum-security facilities, allowing customers to focus on results while minimizing capital equipment investment.
SYS-CON Events announced today that Datera will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Datera offers a radically new approach to data management, where innovative software makes data infrastructure invisible, elastic and able to perform at the highest level. It eliminates hardware lock-in and gives IT organizations the choice to source x86 server nodes, with business model options that best align to their goals.
DevOps at Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 21st Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The widespread success of cloud computing is driving the DevOps revolution in enterprise IT. Now as never before, development teams must communicate and collaborate in a dynamic, 24/7/365 environment. There is no time to wait for long development cycles that produce software that is obsolete at launch. DevOps may be disruptive, but it is essential.
SYS-CON Events announced today that DXWorldExpo has been named “Global Sponsor” of SYS-CON's 21st International Cloud Expo, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Digital Transformation is the key issue driving the global enterprise IT business. Digital Transformation is most prominent among Global 2000 enterprises and government institutions.
21st International Cloud Expo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy. Meanwhile, 94% of enterprises are using some form of XaaS – software, platform, and infrastructure as a service.
SYS-CON Events announced today that Massive Networks will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Massive Networks mission is simple. To help your business operate seamlessly with fast, reliable, and secure internet and network solutions. Improve your customer's experience with outstanding connections to your cloud.
SYS-CON Events announced today that Akvelon will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Akvelon is a business and technology consulting firm that specializes in applying cutting-edge technology to problems in fields as diverse as mobile technology, sports technology, finance, and healthcare.
In his session at 20th Cloud Expo, Scott Davis, CTO of Embotics, discussed how automation can provide the dynamic management required to cost-effectively deliver microservices and container solutions at scale. He also discussed how flexible automation is the key to effectively bridging and seamlessly coordinating both IT and developer needs for component orchestration across disparate clouds – an increasingly important requirement at today’s multi-cloud enterprise.
Docker containers have brought great opportunities to shorten the deployment process through continuous integration and the delivery of applications and microservices. This applies equally to enterprise data centers as well as the cloud. In his session at 20th Cloud Expo, Jari Kolehmainen, founder and CTO of Kontena, discussed solutions and benefits of a deeply integrated deployment pipeline using technologies such as container management platforms, Docker containers, and the drone.io Cl tool. He also demonstrated deployment of a CI/CD pipeline using container management, as well as show how to deploy a containerized application through a continuous delivery pipeline.
As more and more companies are making the shift from on-premises to public cloud, the standard approach to DevOps is evolving. From encryption, compliance and regulations like GDPR, security in the cloud has become a hot topic. Many DevOps-focused companies have hired dedicated staff to fulfill these requirements, often creating further siloes, complexity and cost. This session aims to highlight existing DevOps cultural approaches, tooling and how security can be wrapped in every facet of the build and release cycle and how to get sales and customer facing resources wrapped in.
SYS-CON Events announced today that Secure Channels, a cybersecurity firm, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Secure Channels, Inc. offers several products and solutions to its many clients, helping them protect critical data from being compromised and access to computer networks from the unauthorized. The company develops comprehensive data encryption security strategies that are tailored for the unique needs of each client; the team builds in an intuitive user experience to boost efficiency and effectiveness of its cyber security solutions.
"With Digital Experience Monitoring what used to be a simple visit to a web page has exploded into app on phones, data from social media feeds, competitive benchmarking - these are all components that are only available because of some type of digital asset," explained Leo Vasiliou, Director of Web Performance Engineering at Catchpoint Systems, in this SYS-CON.tv interview at DevOps Summit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
SYS-CON Events announced today that WineSOFT will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Based in Seoul and Irvine, WineSOFT is an innovative software house focusing on internet infrastructure solutions. The venture started as a bootstrap start-up in 2010 by focusing on making the internet faster and more powerful. WineSOFT’s knowledge is based on the expertise of TCP/IP, VPN, SSL, peer-to-peer, mobile browser, and live streaming solutions.
SYS-CON Events announced today that App2Cloud will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct. 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. App2Cloud is an online Platform, specializing in migrating legacy applications to any Cloud Providers (AWS, Azure, Google Cloud).
The goal of Continuous Testing is to shift testing left to find defects earlier and release software faster. This can be achieved by integrating a set of open source functional and performance testing tools in the early stages of your software delivery lifecycle. There is one process that binds all application delivery stages together into one well-orchestrated machine: Continuous Testing. Continuous Testing is the conveyer belt between the Software Factory and production stages. Artifacts are moved from one stage to the next only after they have been tested and approved to continue. New code submitted to the repository is tested upon commit. When tests fail, the code is rejected. Subsystems are approved as part of periodic builds on their way to the delivery stage, where the system is being tested as production ready. The release process stops when tests fail. The key is to shift test c...