Polyglot is Killing Your Enterprise
Overcoming the Challenges of a Polyglot Environment
October 30, 2018

Bart Copeland
ActiveState

As organizations have embraced open source, they have become polyglot — using multiple programming languages and technology stacks to accomplish software and hardware related tasks. These polyglot enterprises are using multiple programming languages to develop and support both legacy and modern software applications.

In real life, being a polyglot enables a person to communicate with millions more people than if he or she only spoke their native tongue. In software environments, people introduce new languages not to communicate differently but to achieve specific ends. Some languages are great for one task but not another, so working with multiple programming languages enables developers to use the right tool for the job. In this way, all development is polyglot; it's just the nature of the beast.

The addition of new programming languages can be incidental and incremental, as well. For example, when an enterprise acquires a company, it takes on the company's technology stacks — including its programming languages. And as tech leadership changes within the organization, those leaders often bring new technologies into the fold. Technologies fall in and out of fashion, as well, expanding the number of programming languages and technologies an organization has to maintain over time.

Enterprises are caught between the benefits provided by a polyglot environment and the complexities and challenges these environments bring. Ultimately, if the situation remains unchecked, polyglot will kill your enterprise.

The Dangers of a Polyglot Environment

Complexity abounds in organizations with disparate technologies like polyglot environments, polyglot programming languages along with managing legacy along with up-and-coming technology stacks. Engineering wrestles more and more with retrofitting licenses, security and dependency management for the programming languages they use for multiple software applications. At the same time, management lacks oversight on code compliance and they can't gauge risk.

Enterprises end up with high variability in tooling support and varying degrees of programming language quality. It's hard to become an expert in one language when you're required to work with a dozen. There's a big difference in skill level between a person who speaks French and Italian fluently and a person who can string a few sentences together in eight languages.

These problems multiply exponentially as an enterprise adds more languages, creating a digital Tower of Babel.

However, you don't want to hamstring your developers. You want them to have the freedom to use the best tool for the job, innovate, learn and create elegant solutions. Adding new programming languages builds their skill base and empowers them with the right equipment to fulfill their craft. So, you want to say "yes" to your developers, but as more and more languages are added to the enterprise, they impose a drag on your software development lifecycle (SDLC). At scale, all these languages and tools can kill the enterprise.

Enterprises should closely monitor these three primary issues:

1. Coding vs. Fixing: Updating and fixing tools instead of coding new features: Some enterprises centralize this function in a single team. Others require that each "pizza team" manage their own development tools. In either case, there's an opportunity cost the engineering team and management pay: rather than coding new features, these teams are constantly updating and fixing libraries in their open source tools since they move so quickly.

2. Wasted Development Cycles: Because library versions and code dependencies are constantly being updated, the artifacts associated with the original build of an application may no longer be available when a vulnerability is found. As a result, many development cycles are wasted trying to re-create an environment in which the vulnerability can be fixed.

3. Risk and Application Transparency: Applications are released and then never updated — why fix what's not broken? Teams come together for a project and then disband. As a result, when a critical vulnerability is discovered, the enterprise may not have visibility into which applications are affected, which libraries those applications contain, or even what languages they were built with. This can result in costly "exploration projects" in order to ensure the vulnerability is properly addressed.

Now, multiply these three challenges by each programming language in your organization, and what started out as a molehill suddenly looks like scaling Mount Everest. And just like a mountain climber, you won't survive without the proper equipment/tools.

Thriving in a Polyglot Environment

What's needed is a holistic solution that works for both the enterprise and the individual stakeholders in the SDLC. Enterprises can create this solution using these best practices:

1. Get regular updates to keep code current and bug-free.

2. Enable consistent environments across teams and manage dependencies by standardizing on specific programming language builds across your enterprise.

3. Get smaller build distributions with only the packages you need, based on your specific criteria.

4. Take advantage of commercial open source support to get help with programming language versions and platforms that are near end-of-life and not supported by a community.

5. Monitor code running in production and respond based on risk of flagged components (e.g. CVE components) used in your applications.

6. Create a single source of truth for your package management; this may require the assistance of a knowledgeable technology provider.

7. Set thresholds for when to trigger an update, alarm or other kinds of events based on application dependencies.

By implementing these tactics, developers will be able to put time toward delivering value, not tooling or build engineering grunt work. There will be consistency for code in all environments in the software development life cycle. Even the bottom line will improve with the time savings and decreased cost of resources dedicated solely to maintaining programming languages and package distributions internally.

Following these practices will solve the pain points of engineering teams, management, individual developers and every coder in the SDLC, regardless of their role.

Bart Copeland is CEO and President of ActiveState
Share this

Industry News

June 01, 2020

IT Revolution announced a full conference agenda for DevOps Enterprise Summit London, June 23-25, 2020.

June 01, 2020

Caltech CTME announced that Simplilearn, a global provider of digital skills training, will collaborate with CTME (Caltech's Center for Technology and Management Education) to offer a specialized Post Graduate Program in DevOps software engineering.

June 01, 2020

DevOps Institute, a global member-based association for advancing the human elements of DevOps, announced the introduction of its SKILup Playbook Library, a dynamic collective body of knowledge (cBok) that aligns thought leadership from industry experts with a set of dynamic, orchestrated artifacts, research and assets.

May 28, 2020

Docker has extended its strategic collaboration with Microsoft to simplify code to cloud application development for developers and development teams by more closely integrating with Azure Container Instances (ACI).

May 28, 2020

Eggplant announced updates to its Digital Automation Intelligence (DAI) platform.

May 28, 2020

Aptum launched its Managed DevOps Service in partnership with CloudOps, a cloud consulting and professional services company specializing in DevOps.

May 27, 2020

Red Hat announced an expansion of its application services portfolio with the addition of Quarkus as a fully supported framework in Red Hat Runtimes.

May 27, 2020

Couchbase has completed a $105 million all-equity Series G round of fundraising.

May 27, 2020

Aqua Security closed a Series D round of $30M led by Greenspring Associates.

May 26, 2020

GitLab is releasing 13.0 of its DevSecOps platform to enable organizations to efficiently adapt and respond to new and dynamic business challenges.

May 26, 2020

Solo.io announced the availability of the Istio Developer Portal to streamline the developer onboarding process for improved developer experience and increased productivity with added security features.

May 26, 2020

WhiteHat Security will offer free application scanning services to any education institution to support secure online learning.

May 21, 2020

Exadel announced the Grand Prize winner of the “Appery.io COVID-19 Virtual Hackathon.”

May 21, 2020

CloudBees announced significant advances for its Software Delivery Management (SDM) platform – integrations with additional continuous integration and continuous delivery (CI/CD) engines, including Google Cloud Build and Tekton, and extension of the availability of CloudBees’ SDM Preview Program.

May 21, 2020

OutSystems is announcing over 70 development accelerators that ensure web and mobile applications created on the OutSystems low-code development platform can comply with the highest accessibility standards and regulations.