TECHNOLOGY

RADAR APRIL ‘16

Our thoughts on the

technology and trends that

are shaping the future

thoughtworks.com/radar

WHAT’S NEW?

Here are the themes highlighted in this edition:

OPEN SOURCE AS A VIRTUOUS BY-PRODUCT

Some of the most influential software appearing on our radar comes from companies whose first mandate isn’t to create software tools. Several of our radar entries come from Facebook, not considered a traditional software development toolmaker. Unlike in the past, today many companies open source their important software assets—to attract new recruits and credentialize themselves. This creates a virtuous feedback loop: Innovative open source attracts good developers who are in turn more likely to innovate. As a side effect, these companies’ frameworks and libraries are some of the most influential in the industry. This represents a big shift in the software development ecosystem and is further proof of the efficacy of open source software … in the right context (our advice about Web Scale Envy still stands).

PARSING THE PAAS PUZZLE

Many large organizations see the Cloud and Platform as a Service (PaaS) as an obvious way to standardize infrastructure, ease deployment and operations, and make developers more productive. But it’s still early days, the definition of PaaS remains nebulous, and many PaaS approaches are incomplete or suffer from the immaturity of supporting frameworks and tools. Some PaaS solutions make it harder to do things more easily done with plain Infrastructure as a Service (IaaS), such as using a custom Service Locator or complex network topology, and the jury is still out on whether a “Containers as a Service” approach will provide similar value with more flexibility. We see many companies implementing an off-the-shelf PaaS or gradually building their own, with varying degrees of success.

We suspect that any PaaS built today will not be an end state but rather part of an evolutionary path. Enterprise migration to Cloud and PaaS, while bringing many benefits, has difficulties and challenges, particularly around overall pipeline design and tooling. Consumers of these technologies should seek the inflection point that indicates “ready for prime time” for their context and should avoid coupling too tightly to the implementation details of their PaaS.

DOCKER, DOCKER, DOCKER!

Containerization, and Docker in particular, has proven hugely beneficial as an application-management technique, rationalizing deployment between environments and simplifying the “it works here but not there” class of problems.

We see a significant amount of energy focused on using Docker—and, particularly, the ecosystem surrounding it—

beyond dev/test and all the way into production. Docker containers are used as the “unit of scaling” for many PaaS

and “data center OS” platforms, giving Docker even more momentum. As it matures as both a development and production environment, people are paying more attention to containerization, its side effects and its implications.

OVER-REACTIVE?

Reactive programming—where components react to changes in data that are propagated to them rather than use imperative wiring—has become extremely popular, with reactive extensions available in almost all programming languages. User interfaces, in particular, are commonly written in a reactive style, and many ecosystems are settling on this paradigm. While we like the pattern, overuse of event-based systems complicates program logic, making it difficult to understand; developers should use this style of programming judiciously. It is certainly popular: We added a significant number of reactive frameworks and supporting tools on this Radar.

CONTRIBUTORS

The Technology Radar is prepared by the ThoughtWorks Technology Advisory Board, comprised of:

Rebecca Parsons (CTO)

Dave Elliman

Ian Cartwright

Rachel Laycock

Martin Fowler(Chief Scientist)

Erik Doernenburg

James Lewis

Sam Newman

Anne J Simmons

Evan Bottcher

Jonny LeRoy

Scott Shaw

Badri Janakiraman

Fausto de la Torre

Mike Mason

Srihari Srinivasan

Brain Leke

Hao Xu

Neal Ford

Thiyagu Palanisamy

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 1

27

ABOUT THE TECHNOLOGY RADAR

ThoughtWorkers are passionate about technology. We build it, research it, test it, open source it, write about it,

67

22

and constantly aim to improve it – for everyone. Our mission is to champion software excellence and revolutionize

26

68

IT. We create and share the ThoughtWorks Technology Radar in support of that mission. The ThoughtWorks

69

21

Technology Advisory Board, a group of senior technology leaders in ThoughtWorks, creates the radar. They meet regularly to discuss the global technology strategy for ThoughtWorks and the technology trends that significantly impact our industry.

70

25

20

The radar captures the output of the Technology Advisory Board’s discussions in a format that provides value to a

81

wide range of stakeholders, from CIOs to developers.

71

The content is intended as a concise summary. We encourage

you to explore these technologies for more detail. The radar is graphical in nature, grouping items into techniques, tools, platforms, and languages & frameworks. When radar items could appear in multiple quadrants, we chose the

56

one that seemed most appropriate. We further group these items

55

72

in four rings to reflect our current position on

19

them. The rings are:

57

59

73

13

18

74

58

75

24

10

14

12

61

76

11

17

60

8

9

77

62

78

23

16

7

63

6

2

64

79

3

15

5

65

54

80

1

4

66

HOLD

ASSESS

TRIAL

ADOPT

ADOPT

TRIAL

ASSESS

HOLD

85

We feel strongly that the industry should be

Worth pursuing. It is important to

Worth exploring

Proceed with

38

adopting these items. We use them when

95

30

understand how to build up this

with the goal of

caution.

appropriate on our projects.

capability. Enterprises should try

understanding how

this technology on a project that can

105

it will affect your

handle the risk.

enterprise.

39

28

83

84

29

31

94

93

Items that are new or have had significant changes since the last radar are represented as triangles, while items that

104

have not moved are represented as circles. We are interested in far more items than we can reasonably fit into a

40

document this size, so we fade many items from the last radar to make room for the new items. Fading an item does

92

not mean that we no longer care about it.

32

33

82

For more background on the radar, see thoughtworks.com/radar/faq

103

41

51

35

89

91

42

102

34

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 2

43

90

36

88

101

87

44

45

37

46

86

100

52

99

106

97

47

48

98

49

50

96

53

THE RADAR

27

TECHNIQUES

67

22

ADOPT

26

68

69

1. Decoupling deployment from release

21

2. Products over projects

3. Threat Modeling

70

25

TRIAL

20

81

71

4. BFF - Backend for frontends

5. Bug bounties

6. Data Lake

55

56

72

7. Event Storming

19

57

8. Flux

59

73

13

9. Idempotency filter

18

74

10. iFrames for sandboxing

58

75

11. NPM for all the things

24

12. Phoenix Environments

10

14

13. QA in production

12

14. Reactive architectures

61

76

11

17

ASSESS

60

15. Content Security Policies

new

8

9

77

16. Hosted IDE’s

new

62

17. Hosting PII data in the EU

78

23

16

7

63

18. Monitoring of invariants

19. OWASP ASVS

new

20. Serverless architecture

new

6

2

64

79

21. Unikernels

new

3

15

22. VR beyond gaming

new

5

65

54

80

HOLD

1

4

66

23. A single CI instance for all teams

new

24. Big Data envy

new

HOLD

ASSESS

TRIAL

ADOPT

ADOPT

TRIAL

ASSESS

HOLD

25. Gitflow

26. High performance envy/web scale envy

85

27. SAFe™

38

95

30

105

PLATFORMS

39

28

83

84

29

31

94

93

ADOPT

104

28. Docker

40

92

29. TOTP Two-Factor Authentication

32

33

82

TRIAL

103

30. Apache Mesos

41

51

31. AWS Lambda

35

89

91

32. H2O

42

102

33. HSTS

34

34. Kubernetes

35. Linux security modules

43

90

36. Pivotal Cloud Foundry

new

37. Rancher

36

88

101

87

ASSESS

new

44

38. Amazon API Gateway

39. AWS ECS

45

37

46

86

100

40. Bluetooth Mesh

new

52

41. Ceph

99

106

42. Deflect

new

97

new

47

48

98

43. ESP8266

49

44. MemSQL

new

45. Mesosphere DCOS

46. Nomad

new

50

96

47. Presto

48. Realm

new

New or moved

53

49. Sandstorm

new

No change

50. TensorFlow

new

HOLD

51. Application Servers

52. Over-ambitious API Gateways

53. Superficial private cloud

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 3

THE RADAR

27

TOOLS

67

22

26

68

69

ADOPT

21

54. Consul

70

TRIAL

25

55. Apache Kafka

20

81

71

56. Browsersync

57. Carthage

58. Gauge

55

56

72

59. GitUp

19

57

60. Let’s Encrypt

59

73

13

61. Load Impact

new

18

74

62. OWASP Dependency-Check

new

58

75

63. Serverspec

new

24

64. SysDig

10

14

65. Webpack

new

12

66. Zipkin

61

76

11

17

ASSESS

60

67. Apache Flink

new

8

9

77

68. Concourse CI

62

69. Gitrob

78

23

16

7

63

70. Grasp

new

71. HashiCorp Vault

new

72. ievms

6

2

64

79

73. Jepsen

new

3

15

new

5

65

74. LambdaCD

75. Pinpoint

new

54

80

76. Pitest

new

1

4

66

77. Prometheus

78. RAML

HOLD

ASSESS

TRIAL

ADOPT

ADOPT

TRIAL

ASSESS

HOLD

79. Repsheet

new

80. Sleepy Puppy

85

38

95

30

HOLD

105

81. Jenkins as a deployment pipeline

new

39

28

83

84

29

31

94

93

LANGUAGES & FRAMEWORKS

104

40

92

ADOPT

82. ES6

32

33

82

83. React.js

103

84. Spring Boot

41

51

85. Swift

35

89

91

42

102

TRIAL

34

86. Butterknife new

87. Dagger

new

43

90

88. Dapper

new

89. Ember.js

36

88

101

90. Enlive

87

91. Fetch

new

44

92. React Native

93. Redux

new

45

37

46

86

100

94. Robolectric

new

52

95. SignalR

99

106

97

47

48

98

ASSESS

49

96. Alamofire

new

97. AngularJS

98. Aurelia

new

50

96

99. Cylon.js

new

100. Elixir

53

New or moved

101. Elm

No change

102. GraphQL

new

103. Immutable.js new

104. OkHttp

105. Recharts

new

HOLD

106. JSPatch

new

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 4

TECHNIQUES

With the number of high-profile security breaches in the

encourages participants to identify potentially

past months, software development teams no longer

damaging vulnerabilities in return for reward or

need convincing that they must place an emphasis on

recognition. Companies like HackerOne and Bugcrowd

writing secure software and dealing with their users’

offer services to help organizations manage this

data in a responsible way. The teams face a steep

process more easily, and we’re seeing these services

learning curve, though, and the vast number of potential

gather adoption.

threats—ranging from organized crime and government

spying to teenagers who attack systems “for the lulz”—

A Data Lake is an immutable data store of largely

can be overwhelming. Threat Modeling provides a unprocessed “raw” data, acting as a source for data

set of techniques that help you identify and classify

analytics. While the technique can clearly be misused,

potential threats early in the development process. It is

we have used it successfully at clients, hence motivating

important to understand that it is only part of a strategy

its move to trial. We continue to recommend other

to stay ahead of threats. When used in conjunction

approaches for operational collaborations, limiting the

with techniques such as establishing cross-functional

use of the data lake to reporting, analytics and feeding

security requirements to address common risks in the

data into data marts.

technologies a project uses and using automated security

scanners, threat modeling can be a powerful asset.

We see continued adoption and success of reactive

architectures, with reactive language extensions and

The use of bug bounties continues to grow in

reactive frameworks being very popular (we added

popularity for many organizations, including enterprises

several such blips in this edition of the Radar). User

and notable government bodies. A bug-bounty program

interfaces, in particular, benefit greatly from a reactive

style of programming. Our caveats last time still hold

true: Architectures based on asynchronous message

27

passing introduce complexity and make the overall

system harder to understand—it’s no longer possible to

22

simply read the program code and understand what the

67

26

68

69

21

system does. We recommend assessing the performance

and scalability needs of your system before committing

70

25

20

to this architectural style.

81

71

55

56

19

We are finding

57

Content Security Policies

72

to be a

59

73

13

helpful addition to our security toolkit when dealing with

18

74

24

websites that pull assets from mixed contexts. The policy

58

75

10

14

defines a set of rules about where assets can come from

12

11

17

(and whether to allow inline script tags). The browser

61

76

8

9

then refuses to load or execute JavaScript, CSS or images

60

77

23

16

7

that violate those rules. When used in conjunction with

62

78

63

good practices, such as output encoding, it provides

6

2

3

good mitigation for XSS attacks. Interestingly, the

64

79

15

5

65

optional endpoint for posting JSON reports of violations

54

80

1

4

is how Twitter discovered that ISPs were injecting HTML

66

HOLD

ASSESS

TRIAL

ADOPT

or JavaScript into their pages.

ADOPT

TRIAL

ASSESS

HOLD

85

38

95

30

105

39

28

83

84

29

ADOPT

31

94

TRIAL

ASSESS

93

HOLD 104

1. Decoupling deployment from release

4. BFF - Backend for frontends

15. Content Security Policies

23. A single CI instance for all teams

40

92

2. Products over projects

5. Bug bounties

16. Hosted IDE’s

24. Big Data envy

3. Threat Modeling

32

6.

33

Data Lake

82

17. Hosting PII data in the EU

25. Gitflow

7. Event Storming

18. Monitoring of invariants

103

41

26. High performance envy/web scale envy

51

8. Flux

19. OWASP ASVS

27. SAFe™

35

89

91

42

9. Idempotency filter

20. Serverless architecture

102

10.

34

iFrames for sandboxing

21. Unikernels

11. NPM for all the things

22. VR beyond gaming

43

90

12. Phoenix Environments

13. QA in production 36

88

101

14. Reactive architectures

87

44

45

37

46

86

100

52

99

106

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

97

48

98

TECHNOLOGY RADAR APRIL 2016 | 5

47

49

50

96

53

TECHNIQUES continued

In a number of countries around the world, we see

With the continued rise to domination of the container

government agencies seeking broad access to private,

model led by Docker adoption, we think it’s worth calling

personally identifiable information (PII). In the EU,

attention to the continued rapid development in the

the highest court has invalidated the Safe Harbor

Unikernel space. Unikernels are single-purpose library

framework, and Privacy Shield, its successor, is expected

operating systems that can be compiled down from high-

to be challenged too. At the same time, the use of

level languages to run directly on the hypervisors used by

cloud computing is increasing, and all the major cloud

commodity cloud platforms. They promise a number of

providers—Amazon, Google and Microsoft—offer multiple advantages over containers, not least their superfast startup data centers and regions within the European Union.

time and very small attack surface area. Many are still at

Therefore, we recommend that companies, especially

the research-project phase—Drawbridge from Microsoft those with a global user base, assess the feasibility of a

Research, MirageOS and HaLVM amongst others—but we

safe haven for their users’ data, protected by the most

think the ideas are very interesting and combine nicely with

progressive privacy laws, by Hosting PII in the EU.

the technique of serverless architecture.

As more development teams incorporate security earlier

The idea of virtual reality has been around for more than

in the development life cycle, figuring out requirements

50 years, and with successive improvements of computing

to limit security risks can seem like a daunting task. Few

technology many ideas have been hyped and explored.

people have the extensive technical knowledge needed

We believe that we’re reaching a tipping point now.

to identify all the risks that an application might face,

Modern graphics cards provide sufficient compute power

and teams might struggle just trying to decide where to

to render detailed, realistic scenes in high resolutions,

begin. Relying on frameworks such as OWASP’s ASVS

and at the same time at least two consumer-oriented

(Application Security Verification Standard) can help

VR headsets (the HTC Vive and Facebook’s Oculus Rift)

make this easier. Although somewhat lengthy, it contains

are coming to market. These headsets are affordable,

a thorough list of requirements categorized by functions

they have high-resolution displays, and they eliminate

such as authentication, access control, and error

perceivable motion-tracking lag, which was causing issues

handling and logging, which can be reviewed as needed.

such as headaches and nausea before. The headsets are

It is also helpful as a resource for testers when it comes

mainly targeted at enthusiast video gaming, but we are

time to verify software.

convinced that they will open many possibilities for VR

beyond gaming, particularly as the low-fi approaches,

Serverless architecture replaces long-running

such as Google Cardboard, are driving greater awareness.

virtual machines with ephemeral compute power

that comes into existence on request and disappears

There might be the impression that it’s easier to manage

immediately after use. Examples include Firebase and

a single CI (Continuous Integration) instance for

AWS Lambda. Use of this architecture can mitigate all teams because it gives them a single configuration

some security concerns such as security patching and

and monitoring point. But a bloated instance that is

SSH access control, and can make much more efficient

shared by every team in an organization can cause a

use of compute resources. These systems cost very

lot of damage. We have found that problems like build

little to operate and can have inbuilt scaling features

timeouts, configuration conflicts and gigantic build

(this is especially true for AWS Lambda). An example

queues appear more frequently. Having this single point

architecture could be a JavaScript app with static assets

of failure can interrupt the work of many teams. Carefully

served by a CDN or S3 coupled with AJAX calls served

consider the trade-off between these pitfalls and having

by the API Gateway and Lambda. While serverless

a single point of configuration. In organizations with

architectures have significant benefits, there are

multiple teams, we recommend having CI instances

drawbacks too: Deploying, managing and sharing code

distributed by teams, with enterprise decisions based not

across services is more complex, and local or offline

on the single CI installation but on defining guidelines

testing is more difficult if not impossible.

about the instances’ selection and configuration.

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 6

TECHNIQUES continued

While we’ve long understood the value of Big Data

node relational or graph database. Even if you do have

to better understand how people interact with

more data than that, usually the best thing to do is

us, we’ve noticed an alarming trend of Big Data

to first pick out the data you need, which can often

envy: organizations using complex tools to handle

then be processed on such a single node. So we urge

“not-really-that-big” Data. Distributed map-reduce

that before you spin up your clusters, take a realistic

algorithms are a handy technique for large data sets,

assessment of what you need to process, and if it

but many data sets we see could easily fit in a single-

fits—maybe in RAM—use the simple option.

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 7

PLATFORMS

We remain excited about Docker as it evolves from a would not recommend using Docker as a secure process-

27

tool to a complex platform of technologies. Development

isolation mechanism, though we are paying attention

teams love Docker, as the Docker image format makes

to the introduction of user namespaces and seccomp

it easier to achieve parity between development and

22

26

67

68

69

profiles in version 1.10 in this regard.

21

production, making for reliable deployments. It is a

natural fit in a microservices-style application as a

70

Our teams continue to enjoy using AWS Lambda and

25

packaging mechanism for self-contained services. On the

20

81

71

are beginning to use it to experiment with Serverless

operational front, Docker support in monitoring tools

architectures, combining Lambda with the API Gateway

55

56

72

(Sensu, Prometheus, cAdvisor, etc.), orchestration tools

19

to produce highly scalable systems with invisible

13

57

59

73

(Kubernetes, Marathon,

18 etc.) and deployment-automation

74

infrastructure. We have run into significant problems

58

75

tools reflect the growing maturity of the platform and its

24

using Java for Lambda functions, with erratic latencies

10

14

readiness for production use. A word of caution, though:

12

up to several seconds as the Lambda container is

61

76

11

There is a prevalent view of Docker and Linux containers

17

started. We recommend sticking with JavaScript or

60

in general as being “lightweight virtualization,” but we

8

9

77

Python for the time being.

62

78

23

16

7

63

Kubernetes is Google’s answer to the problem of

6

2

64

79

3

15

deploying containers into a cluster of machines, which

5

65

54

80

is becoming an increasingly common scenario. It is

1

4

66

not the solution used by Google internally but an

HOLD

ASSESS

TRIAL

ADOPT

ADOPT

TRIAL

ASSESS

HOLD

open source project that originated at Google and has

85

38

95

30

seen a fair number of external contributions. Since

105

we mentioned Kubernetes on the previous Radar,

39

28

83

84

29

31

94

93

our initial positive impressions have been confirmed,

104

and we are seeing successful use of Kubernetes in

40

92

production at our clients.

32

33

82

103

41

51

35

89

91

In earlier versions of the Radar, we have highlighted the

42

102

34

value of Linux security modules, talking about how

43

90

they enable people to think about server hardening as a

36

88

101

part of their development workflow. More recently, with

87

LXC and Docker containers now shipping with default

44

45

37

46

86

100

AppArmor profiles on certain Linux distributions, it has

52

forced the hand 99

of many

106

teams to understand how these

97

47

48

98

49

tools work. In the event that teams use container images

to run any process that they did not themselves create,

50

96

these tools help them assess questions about who has

53

access to what resources on the shared host and the

capabilities that these contained services have, and be

conservative in managing levels of access.

ADOPT

TRIAL

ASSESS

HOLD

28. Docker

30. Apache Mesos

38. Amazon API Gateway

51. Application Servers

29. TOTP Two-Factor Authentication

31. AWS Lambda

39. AWS ECS

52. Over-ambitious API Gateways

32. H2O

40. Bluetooth Mesh

53. Superficial private cloud

33. HSTS

41. Ceph

34. Kubernetes

42. Deflect

35. Linux security modules

43. ESP8266

36. Pivotal Cloud Foundry

44. MemSQL

37. Rancher

45. Mesosphere DCOS

46. Nomad

47. Presto

48. Realm

49. Sandstorm

50. TensorFlow

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 8

PLATFORMS continued

The PaaS space has seen a lot of movement since we

Deflect is an open source service protecting NGOs,

last mentioned Cloud Foundry in 2012. While there

activist and independent media companies from DDoS

are various distributions of the open source core, we

attacks. Similar to a commercial CDN, it uses distributed

have been impressed by the offering and ecosystem

reverse-proxy caching and also hides your server IP

assembled as Pivotal Cloud Foundry. While we expect addresses and blocks public access to admin URLs.

continued convergence between the unstructured

Particular effort is put in to combat the botnets typically

approach (Docker, Mesos, Kubernetes, etc.) and the used for extrajudicial censoring of independent voices.

more structured and opinionated buildpack style offered

by Cloud Foundry and others, we see real benefit for

Our growing ranks of hardware hackers have been

organizations that are willing to accept the constraints

excited by the ESP8266 Wi-Fi microcontroller.

and rate of evolution to adopt a PaaS. Of particular

Rather than a specific technology innovation, it is

interest is the speed of development that comes from

the combination of low price point and small form

the simplification and standardization of the interaction

factor that has sparked an inflection point in people’s

between development teams and platform operations.

thinking about what is now feasible to achieve with

custom hardware devices. Its main characteristics are:

The emerging Containers as a Service (CaaS) space is

Wi-Fi capabilities (it can act as station, access point or

seeing a lot of movement and provides a useful option

a combination of both), low power, open hardware,

between basic IaaS (Infrastructure as a Service) and more

Arduino SDK programmability, Lua programmability,

opinionated PaaS (Platform as a Service). While Rancher

huge community support and low cost compared with

creates less noise than some other players, we have

other IoT modules.

enjoyed the simplicity that it brings to running Docker

containers in production. It can run stand-alone as a full

As Moore’s Law predicts, we continue to increase the

solution or in conjunction with tools like Kubernetes.

capacity of computer systems and reduce their cost, and

so new processing techniques become possible that only

Amazon API Gateway is Amazon’s offering enabling a few years ago would have seemed out of reach. One

developers to expose API services to Internet clients,

of these techniques is the in-memory database: Instead

offering the usual API gateway features like traffic

of using slow disks or relatively slow SSDs to store data,

management, monitoring, authentication and

we can keep it in memory for high performance. One

authorization. Our teams have been using this service to

such in-memory database, MemSQL, is making waves

front other AWS capabilities like AWS Lambda as part of

because it is horizontally scalable across a cluster and

serverless architectures. We continue to monitor for the

provides a familiar SQL-based query language. MemSQL

challenges presented by over-ambitious API gateways,

also connects to Spark for analytics against real-time

but at this stage Amazon’s offering appears to be

data, rather than stale data in a warehouse.

lightweight enough to avoid those problems.

HashiCorp continues to turn out interesting software.

While many deployments of smart devices rely on

The latest to catch our attention is Nomad, which is

Wi-Fi connectivity, we have been seeing success with

competing in the ever-more-populated scheduler arena.

Bluetooth Mesh networks that don’t necessitate a hub

Major selling points include not just being limited to

or gateway. With better energy usage than Wi-Fi and

containerized workloads, and operating in multi–data

better smartphone adoption than ZigBee, Bluetooth LE

center / multiregion deployments.

deployed as a self-healing mesh provides interesting new

approaches for connecting local device-area networks.

Realm is a database designed for use on mobile We are still waiting for the formal approach to emerge

devices, with its own persistence engine to achieve high

from the Bluetooth SIG but have already had successful

performance. Realm is marketed as a replacement for

deployments. We particularly like the lack of infrastructure SQLite and Core Data, and our teams have enjoyed using required to stand up a decentralized network but still

it. Note that migrations are not quite as straightforward

retain the option to “progressively enhance” the system

as the Realm documentation would have you believe. Still,

with the addition of a gateway and cloud services.

Realm has us excited, and we suggest you take a look.

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 9

PLATFORMS continued

For people who want the benefit of cloud-based

hardware from a mobile CPU all the way to a large GPU

collaboration tools but don’t want to inadvertently

compute cluster. It’s an important platform because

“become the product” of a major cloud provider,

it makes implementing deep-learning algorithms

Sandstorm provides an interesting open source much more accessible and convenient. Despite the

alternative with the potential for self-hosting. Of

hype, though, TensorFlow isn’t really anything new

particular interest is the isolation approach, whereby

algorithmically: All of these techniques have been

containerization is applied per document rather than

available in the public domain via academia for some

per application, and syscall whitelisting is added to

time. It’s also important to realize that most businesses

further secure the sandbox.

are not yet doing even basic predictive analytics and that

jumping to deep learning likely won’t help make sense of

Google’s TensorFlow is an open source machine-most data sets. For those who do have the right problem

learning platform that can be used for everything

and data set, however, TensorFlow is a useful toolkit.

from research through to production and will run on

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 10

TOOLS

We have moved Consul, the service-discovery tool supporting both DNS- and HTTP-based discovery

27

mechanisms, into Adopt. It goes beyond other discovery

tools by providing customizable health checks for

67

22

registered services, ensuring that unhealthy instances

26

21

68

69

are marked accordingly. More tools have emerged to

70

work with Consul to make it even more powerful.

25

20

Consul

81

71

Template enables configuration files to be populated with information from Consul, making things like client-side

55

56

72

19

57

load balancing using mod_proxy much easier. In the world

13

59

73

18

74

of Docker, registrator can automatically register Docker

58

75

24

containers as they appear with Consul with extremely

10

14

12

little effort, making it much easier to manage container-

61

76

11

17

based setups. You should still think long and hard about

60

8

9

77

whether you need a tool like this or whether something

62

78

23

16

7

simpler will do, but if you decide you need service

63

discovery, you won’t go far wrong with Consul.

6

2

64

79

3

15

5

65

54

Many organizations are now looking closely at new data

80

1

4

66

architectures that capture information as immutable

HOLD

ASSESS

TRIAL

ADOPT

ADOPT

TRIAL

ASSESS

HOLD

sequences of events at scale. Apache Kafka continues

85

95

to build momentum as an open source messaging

38

30

105

framework that provides a solution for publishing ordered

beta status from private to public, meaning users will no

39

28

29

83

84

94

event feeds to large numbers of independent, lightweight

31

93

longer be required to have an invitation in order to try

104

consumers. Configuring Kafka is nontrivial, but our teams

40

92

it. Let’s Encrypt grants access to a simpler mechanism

are reporting positive experiences with the framework.

32

33

82

to obtain and manage certificates for a larger set of

103

41

51

users who are seeking a way to secure their websites.

35

Gauge is a lightweight cross-platform test-automation

89

91

42

102

It also promotes a big step forward in terms of security

tool. Specifications are written in free-form Markdown

34

and privacy. This trend has already begun within

90

so test cases can be written in the business language,

43

ThoughtWorks, and many of our projects now have

36

88

101

as opposed to using the more common but restrictive

87

certificates verified by Let’s Encrypt.

“given-when-then” format. Language and IDE

44

45

37

86

100

support are implemented as plugins to a single core

46

Load Impact is a SaaS load-testing tool that can

52

99

106

implementation, allowing testers to use the same IDEs as

97

generate highly realistic loads of up to 1.2 million

47

48

98

the rest of the team, with powerful capabilities such as

49

concurrent users. Record and playback web

autocompletion and refactoring. This tool, open sourced

interactions using a Chrome plugin simulate network

50

96

by ThoughtWorks, also supports parallel execution out of connections for mobile or desktop users and generate

53

the box for all supported platforms.

load from up to 10 different locations around the

world. While not the only on-demand load-testing tool

Let’s Encrypt first appeared on the Radar last edition,

we’ve used—we also like BlazeMeter—our teams were and since December 2015 this project has moved its

very enthusiastic about Load Impact.

ADOPT

TRIAL

ASSESS

HOLD

54. Consul

55. Apache Kafka

67. Apache Flink

81. Jenkins as a deployment pipeline

56. Browsersync

68. Concourse CI

57. Carthage

69. Gitrob

58. Gauge

70. Grasp

59. GitUp

71. HashiCorp Vault

60. Let’s Encrypt

72. ievms

61. Load Impact

73. Jepsen

62. OWASP Dependency-Check

74. LambdaCD

63. Serverspec

75. Pinpoint

64. SysDig

76. Pitest

65. Webpack

77. Prometheus

66. Zipkin

78. RAML

79. Repsheet

80. Sleepy Puppy

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 11

TOOLS continued

In a world full of libraries and tools that simplify the

operations. Apache Flink stands out with feature-rich

life of many software developers, deficiencies in their

capabilities for stream processing: event time, rich

security have become visible and have increased the

streaming window operations, fault tolerance and

vulnerability surface in the applications that use them.

exactly-once semantics. While it hasn’t reached version

OWASP Dependency-Check automatically identifies 1.0, it has raised significant community interest due to

potential security problems in the code, checking if

innovations in stream processing, memory handling,

there are any known publicly disclosed vulnerabilities,

state management and simplicity of configuration.

then using methods to constantly update the database

of public vulnerabilities. Dependency-Check has some

Attackers continue to use automated software to crawl

interfaces and plugins to automate this verification in

public GitHub repositories to find AWS credentials and

Java and .NET (which we have used successfully) as well

spin up EC2 instances to mine Bitcoins or for other

as Ruby, Node.js and Python.

nefarious purposes. Although adoption of tools like

git-crypt and Blackbox to safely store secrets such as In the past we have included automated Provisioning

passwords and access tokens in code repositories is

Testing as a recommended technique, and in this issue we

increasing, it is still all too common that secrets are

highlight Serverspec as a popular tool for implementing stored unprotected. It is also not uncommon to see

those tests. Although this tool is not new, we are seeing

project secrets accidentally checked in to developers’

its use become more common as more cross-functional

personal repositories. Gitrob can help minimize the delivery teams take on responsibility for infrastructure

damage of exposing secrets. It scans an organization’s

provisioning. Serverspec is built on the Ruby library RSpec

GitHub repositories, flagging all files that might contain

and comes with a comprehensive set of helpers for

sensitive information that shouldn’t have been pushed to

asserting that server configuration is correct.

the repository. The current release of the tool has some

limitations: It can only be used to scan public GitHub

Webpack has solidified itself as our go-to JavaScript

organizations and their members, it doesn’t inspect the

module bundler. With its ever-growing list of loaders,

contents of files, it doesn’t review the entire commit

it provides a single dependency tree for all your static

history, and it fully scans all repositories each time it is

assets, allowing flexible manipulation of JavaScript,

run. Despite these limitations, it can be a helpful reactive

CSS, etc. and minimizing what needs to be sent to the

tool to help alert teams before it is too late. It should be

browser and when. Of particular relevance is the smooth

considered a complementary approach to a proactive

integration among AMD, CommonJS and ES6 modules and tool such as Talisman.

how it has enabled teams to work in ES6 and seamlessly

transpile (using Babel) to earlier versions for browser

We had our collective minds blown by a little JavaScript

compatibility. Many of our teams also value Browserify,

command-line refactoring tool called Grasp. Providing a

which covers a similar space but is more focused on

rich set of selectors and operating against the abstract

making Node.js modules available for client-side use.

syntax tree, it is leagues ahead of fiddling with sed and

grep. A useful addition to the toolkit in our ongoing

Development on Zipkin has continued apace, and since quest to treat JavaScript as a first-class language.

the middle of 2015 it has moved to the openzipkin/

zipkin organization at GitHub. There are now bindings

Having a way to securely manage secrets is increasingly

for Python, Go, Java, Ruby, Scala and C#; and there

becoming a huge project issue. The old idea of just

are Docker images available for those wanting to

having a file with secrets or environment variables is

get started quickly. We still like this tool. There is an

becoming hard to manage, especially in environments

active and growing community around usage of it, and

with multiple applications like microservices or

implementation is getting easier. If you need a way

microcontainer environments, where the applications

of measuring the end-to-end latency of many logical

need to access a multitude of secrets. HashiCorp Vault

requests, Zipkin continues to be a strong choice.

is a promising tool that tries to solve the problem by

providing mechanisms for securely accessing secrets

Apache Flink is a new-generation platform for scalable through an unified interface. It has some features that

distributed batch and stream processing. At its core is

make life easier, such as encryption and automatically

a streaming data-flow engine. It also supports tabular

generating secrets for known tools, among others.

(SQL-like), graph-processing and machine-learning

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 12

TOOLS continued

With the growth in usage of NoSQL data stores, and

lines that are executed by your tests. It is therefore

the growth in popularity of polyglot approaches to

only able to identify code that is definitely not tested.

persistence, teams now have many choices when it

Mutation testing, on the other hand, tries to test the

comes to storing their data. While this has brought

quality of those lines that are executed by your test

many advantages, product behavior with flaky networks

code and yet might contain general errors. Several

can introduce subtle (and not so subtle) issues that

problems can be spotted this way, helping the team to

are often not well understood, even in some cases

measure and grow a healthy test suite. Most of such

by the product developers themselves. The Jepsen

tools tend to be slow and difficult to use, but Pitest

toolkit and accompanying blog have become the de-

has proven to have better performance, is easy to set

facto reference for anyone looking to understand how

up, and is actively supported.

different database and queuing technologies react

under adverse conditions. Crucially, the approach

Attacks on web properties using bots are becoming

to testing, which includes clients in the transactions,

more sophisticated. Identifying these bad actors and

shines a spotlight on possible failure modes for many

their behaviors is the goal of the Repsheet project.

teams building microservices.

It’s a plugin for either Apache or NGINX that records

user activity, fingerprints actors using predefined

LambdaCD provides teams with a way to define

and user-defined rules, and then allows action to be

Continuous Delivery pipelines in Clojure. This brings the

taken, including the ability to block offensive actors. It

benefits of Infrastructure as code to the configuration

includes a utility that visualizes current actors; this puts

of CD servers: source-control management, unit testing,

the ability to manage bot-based threats in the hands

refactoring and code reuse. In the “pipelines as code” space, of team members, increasing security awareness LambdaCD stands out for being lightweight, self-contained

for teams. We like this since it’s a good example of

and fully programmable, allowing teams to work with their

a simple tool solving a very real but often invisible

pipelines in the same way that they do with their code.

problem—bot-based attacks.

Teams using the Phoenix Server or Phoenix Environment

We know we’re in perilous territory here, since

techniques have found little in the way of support

we build a competing tool, but we feel we have to

from Application Performance Management (APM)

address a persistent problem. Continuous Integration

tools. Their licensing models, based on long-running,

tools like CruiseControl and Jenkins are valuable for

limited amounts of tin, and their difficulty in dealing

software development, but as your build process

with ephemeral hardware, have meant that they are

gets more complex it requires something beyond

often more trouble than they are worth. However,

just Continuous Integration: It requires a deployment

distributed systems need monitoring, and at some

pipeline. We frequently see people trying to use point many teams recognize the need for an APM

Jenkins as a Deployment Pipeline with the aid of

tool. We think Pinpoint, an open source tool in this plugins, but our experience is that these quickly

space, is worth investigating as an alternative to

become a tangle. Jenkins 2.0 introduces “Pipeline

AppDynamics and Dynatrace. Pinpoint is written in Java,

as Code” but continues to model pipelines using

with plugins available for many servers, databases and

plugins and fails to change the core Jenkins product

frameworks. While we think you can go a long way using

to model pipelines directly. In our experience, tools

a combination of other lightweight open source tools—

that are built around a first-class representation of

Zipkin, for example—if you are in the market for an APM, deployment pipelines are much more suitable, and

Pinpoint is worth considering.

this is what drove us to replace CruiseControl with

GoCD. Today we see several products that embrace

Pitest is a test coverage analysis tool for Java that

deployment pipelines, including ConcourseCI, uses a mutation-testing technique. Traditional test

LambdaCD, Spinnaker, Drone and GoCD.

coverage analysis tends to measure the number of

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 13

27

67

22

26

68

69

21

70

25

20

81

71

55

56

72

19

57

59

73

13

18

74

58

75

24

10

14

12

61

76

11

17

60

8

9

77

62

78

23

16

7

63

LANGUAGES & FRAMEWORKS

6

2

64

79

3

15

5

65

54

80

1

4

66

In the avalanche of front-end JavaScript frameworks,

HOLD

ASSESS

TRIAL

ADOPT

ADOPT

TRIAL

ASSESS

HOLD

React.js stands out due to its design around a reactive

85

38

95

30

data flow. Allowing only one-way data binding greatly

105

simplifies the rendering logic and avoids many of the

39

28

83

84

29

31

94

issues that commonly plague applications written with

93

104

other frameworks. We’re seeing the benefits of React.js

40

92

on a growing number of projects, large and small, while

32

33

82

103

41

at the same time we continue to be concerned about

51

35

89

91

the state and the future of other popular frameworks

42

102

34

like AngularJS. This has led to React.js becoming our

43

90

default choice for JavaScript frameworks.

36

88

101

87

A lot of work has gone into Spring Boot

44

45

to reduce

37

46

86

100

complexity and dependencies, which largely alleviates

52

99

106

our previous reservations. If you live in a Spring

97

47

48

98

49

ecosystem and are moving to microservices, Spring Boot

is now the obvious choice. For those not in Springland, 50

96

Dropwizard is also worthy of serious consideration.

53

Swift is now our default choice for development in the

Apple ecosystem. With the release of Swift 2, the language

approached a level of maturity that provides the stability

and performance required for most projects. A good

solutions addresses many of the performance and

number of libraries that support iOS development—

development issues, thereby making it suitable for

SwiftyJSON, Quick, etc.—are now migrated over to Swift,

Android development. With Dagger, there is full

which is where the rest of the applications should follow.

traceability with easy debugging because the entire call

Swift has now been open sourced, and we are seeing

stack for provision and creation is made available.

a community of developers dedicated to continuously

improving development in iOS.

Dapper is a minimal, lightweight ORM of sorts for .NET.

Rather than trying to write the SQL queries for you,

Butterknife is a field and method binding view-

Dapper maps SQL queries to dynamic objects. Though it’s

injection library. It allows the injection of arbitrary

not brand new, Dapper has steadily gained acceptance

objects, views and listeners, thereby ensuring cleaner

from ThoughtWorks teams working in .NET. For the

code with reduced glue code for Android development.

C# programmer, it removes some of the drudgery of

With Butterknife, multiple views can be grouped into

mapping relational queries to objects while still allowing

a list or array with common actions applied to the

complete control over the SQL or stored procedures.

views simultaneously, without heavy reliance on XML

configurations. Our project teams have used this library

Ember.js has developed further support based on

and benefited from its simplicity and ease of use.

project experiences and is clearly a strong contender in

the field of JavaScript application frameworks. Ember

With the increased need for Android-based applications,

is praised for its developer experience, with far fewer

Dagger offers a fully static, compile-time dependency-

surprises than other frameworks such as AngularJS. The injection framework. Dagger’s strictly generated

Ember CLI build tooling, convention-over-configuration

implementation and nonreliance on reflection-based

approach and ES6 support also gain positive feedback.

ADOPT

TRIAL

ASSESS

HOLD

82. ES6

86. Butterknife

96. Alamofire

106. JSPatch

83. React.js

87. Dagger

97. AngularJS

84. Spring Boot

88. Dapper

98. Aurelia

85. Swift

89. Ember.js

99. Cylon.js

90. Enlive

100. Elixir

91. Fetch

101. Elm

92. React Native

102. GraphQL

93. Redux

103. Immutable.js

94. Robolectric

104. OkHttp

95. SignalR

105. Recharts

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 14

LANGUAGES & FRAMEWORKS continued

Our teams are moving away from JQuery or raw XHR

Angular back to Assess on this edition of the Radar.

for remote JavaScript calls and instead are using the

This move is intended as a note of caution: React.

new Fetch API and the Fetch polyfill in particular. The

js and Ember offer strong alternatives; the migration

semantics remain similar but have cleaner support for

path from Angular version 1 to version 2 is causing

promises and CORS support. We are seeing this as the

uncertainty; and we see some organizations adopting

new de-facto approach.

the framework without really thinking through whether

a single-page application fits their needs. We have

We are seeing continued success with React Native

passionate internal debates about this topic but have

for rapid cross-platform mobile development. Despite

certainly seen codebases become overly complex from

some churn as it undergoes continuing development,

a combination of two-way binding and inconsistent

the advantages of trivial integration between native and

state-management patterns. We believe that rather

nonnative code and views, the rapid development cycle

than requiring that a solid framework be jettisoned,

(instant reload, chrome debugging, Flexbox layout) and

these issues can be solved through careful design and

general growth of the React style is winning us over. As

use of Redux or Flux from the outset.

with many frameworks, care needs to be taken to keep

your code well structured, but diligent use of a tool like

Aurelia is considered the next-generation JavaScript

Redux really helps here.

client framework and was written using a modern

version of JavaScript: ECMAScript 2016. Aurelia was

Redux is a great, mature tool that has helped created by Rob Eisenberg, the creator of Durandal. He many of our teams reframe how they think about

left the Angular 2.0 core team to dedicate his time to managing state in client-side apps. Using a Flux-style

this project. The great thing about Aurelia is that it’s

approach, it enables a loosely coupled state-machine

highly modular, contains simple small libraries and is

architecture that’s easy to reason about. We’ve found

designed to be customized easily. Aurelia follows the

it a good companion to some of our favored JavaScript

pattern of convention over configuration, which enables

frameworks, such as Ember and React.

easier production and consumption of modules, but

there are no strong conventions that you have to adhere

In the Android application-development world,

to. Aurelia has a large community, and in the project

Robolectric is a unit-testing framework that has been

website you can learn more by using the tutorials.

used by multiple teams within our technical community.

It offers the best option among those available for

The intersection between IoT devices and the JavaScript

writing real unit tests that extend or interact directly

ecosystem offers interesting possibilities. Cylon.js is a

with Android components and support JUnit tests. We

JavaScript library for building interfaces for robotics and

caution, though, that because it is an implementation of

the Internet of Things, which has excited our technical

the Android SDK, there might be device-specific issues

community. It offers support for 50+ platform devices,

for some tests that pass in Robolectric. To manually

as well as general-purpose input/output support with

mock all the Android dependencies, ensuring only test of

a shared set of drivers provided by the cylon-gpio

the system-in-test will require a lot of complex code, and

module. Control of the devices is then possible through

this framework addresses this effectively.

a web browser interface.

Networking and decoding in iOS applications have

We continue to see a lot of excitement from people using

been a difficult endeavor for many years. There

the Elixir programming language. Elixir, which is built on

have been many libraries and attempts to solve this

top of the Erlang virtual machine, is showing promise for

ongoing problem. It looks as though Alamofire is the creating highly concurrent and fault-tolerant systems.

most robust and developer-friendly library to handle

Elixir has distinctive features such as the Pipe operator,

decoding JSON. It was written by the same creator as its

which allows developers to build a pipeline of functions

Objective-C counterpart (AFNetworking), which was used

as you would in the UNIX command shell. The shared

at great length during the Objective-C days.

byte code allows Elixir to interoperate with Erlang and

leverage existing libraries while supporting tools such as

While we have delivered many successful projects using

the Mix build tool, the Iex interactive shell and the ExUnit

AngularJS and are seeing an acceleration of adoption

unit testing framework.

in corporate settings, we have decided to move

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 15

We have been prompted to reconsider Elm because

Immutability is often emphasized in the functional

of the rapid adoption of Redux framework. Elm—

programming paradigm, and most languages have the

the original inspiration for Redux—offers the view

ability to create immutable objects, which cannot be

componentization and reactiveness of React.js along

changed once created. Immutable.js is a library for with the predictable state of Redux in a compiled,

JavaScript that provides many persistent immutable data

strongly typed functional language. Elm is written in

structures, which are highly efficient on modern JavaScript

Haskell and has a Haskell-like syntax but compiles

virtual machines. Immutable.js objects are, however, not

down to HTML, CSS and JavaScript for the browser.

normal JavaScript objects, so references to JavaScript

JavaScript programmers rushing to embrace React.js and

objects from immutable objects should be avoided.

Redux might want to also consider Elm as a type-safe

Our teams have had value using this library for tracking

alternative for some applications.

mutation and maintaining state, and it is a library we

encourage developers to investigate, especially when it’s

When we look at REST implementations in the wild, we combined with the rest of the Facebook stack.

frequently see REST misused to naively retrieve object

graphs through chatty interactions between client

We’ve been enjoying how Recharts integrates D3 charts

and server. Facebook’s GraphQL is an interesting

into React.js in a clean and declarative manner.

alternative to REST that might be a better approach

for this very common use case. As a protocol for

Many iOS developers are using JSPatch to dynamically remotely retrieving object graphs, GraphQL has

patch their apps. When a JSPatch-enabled app runs, it

received enormous attention recently. One of

loads a chunk of JavaScript (potentially via an insecure

GraphQL’s most interesting features is its consumer-

HTTP connection) and then bridges to the main Objective-C

oriented nature: The structure of a response is driven

application code to change behavior, fix bugs, and so on.

entirely by the client, not the server. This decouples

While convenient, we think monkey-patching live apps is a

the consumer and forces the server to obey Postel’s

bad idea and should be avoided. When doing any amount

law. Client implementations are now available in

of incremental patching, it’s very important that your

many programming languages, but we have seen a

testing process matches what end users will experience,

flurry of interest of Facebook’s Relay, a JavaScript in order to properly validate functionality. An alternative

framework that was designed to support the React.js

approach is to use React Native for the app and AppHub

stateless component model.

and CodePush to push small updates and new features.

ThoughtWorks is a software company and community

critical needs. Founded over 20 years ago, ThoughtWorks

of passionate, purpose-led individuals that specialize

has grown from a small group in Chicago to a company

in software consulting, delivery and products. We think

of over 3500 people spread across 35 offices in 12

disruptively to deliver technology to address our clients’

countries: Australia, Brazil, Canada, China, Ecuador,

toughest challenges, all while seeking to revolutionize

Germany, India, Singapore, South Africa,Turkey, the

the IT industry and create positive social change. We

United Kingdom, and the United States.

make pioneering tools for software teams who aspire to

be great. Our products help organizations continuously

improve and deliver quality software for their most

© April 2016, ThoughtWorks, Inc. All Rights Reserved.

TECHNOLOGY RADAR APRIL 2016 | 16