<div dir="ltr">On Wed, Oct 12, 2016 at 2:54 AM, Aristotle Pagaltzis <span dir="ltr"><<a href="mailto:pagaltzis@gmx.de" target="_blank">pagaltzis@gmx.de</a>></span> wrote:<br><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The position of a czar is reactive and disempowered. They can only fire-<br>
fight individual issues as the project hurtles forward headlong.<br>
<br>
If you want real security or actual good design, it must be part of the<br>
culture: it must pervade every choice, every judgement call. Otherwise<br>
you get zilch, or maybe a veneer. Just the same is true of stability, or<br>
any other similar value.<br>
<br></blockquote><div><br></div><div>Speaking personally again, I beg to differ. During the 2008 financial crisis, when most banks were losing money, Goldman Sachs made money. Why?<br><br></div><div>One major reason was that the bank's risk management function was listened to and heeded. All traders constantly *think about* risk, but they do so in the context of tradeoffs in local decisions. Is the reward worth the risk for this investment? Only the risk management function looked at the aggregate risk of the bank as a whole and judged whether there was "too much" risk. When risk management said "cut down those positions" or "hedge that exposure", GS traders did what they said. Other banks treated risk management like Cassandra in the myths. As the CEO of Citibank put it "as long as the music is playing, you've got to dance."<br><br></div><div>The same could be true of a software project. Developers could be assessing risk vs reward tradeoffs locally. Is *this* PR worth it? Will *this* refactoring break too much stuff? There could well be a role for stability oversight that looks at the aggregate whole and says "STOP". But it only works if heeded by the rest – if the group trusts the oversight enough to delegate the power to decide when it's too much.<br><br></div><div>Does it need to be a single person? Could it be a team responsibility like a Toyota-style "Stop the Line" button? I think a community can decide how it wants to mechanically run a stop process.<br><br></div><div>The important thing – if stability is truly important – is making sure that people with the right perspectives on aggregate stability are known, involved, and heeded.<br><br></div><div>David<br></div><div><br>-- <br></div></div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div>David Golden <<a href="mailto:xdg@xdg.me" target="_blank">xdg@xdg.me</a>> Twitter/IRC/GitHub: @xdg</div></div></div></div></div>
</div></div>