Polyglot is Killing Your Enterprise
Overcoming the Challenges of a Polyglot Environment
October 30, 2018

Bart Copeland
ActiveState

As organizations have embraced open source, they have become polyglot — using multiple programming languages and technology stacks to accomplish software and hardware related tasks. These polyglot enterprises are using multiple programming languages to develop and support both legacy and modern software applications.

In real life, being a polyglot enables a person to communicate with millions more people than if he or she only spoke their native tongue. In software environments, people introduce new languages not to communicate differently but to achieve specific ends. Some languages are great for one task but not another, so working with multiple programming languages enables developers to use the right tool for the job. In this way, all development is polyglot; it's just the nature of the beast.

The addition of new programming languages can be incidental and incremental, as well. For example, when an enterprise acquires a company, it takes on the company's technology stacks — including its programming languages. And as tech leadership changes within the organization, those leaders often bring new technologies into the fold. Technologies fall in and out of fashion, as well, expanding the number of programming languages and technologies an organization has to maintain over time.

Enterprises are caught between the benefits provided by a polyglot environment and the complexities and challenges these environments bring. Ultimately, if the situation remains unchecked, polyglot will kill your enterprise.

The Dangers of a Polyglot Environment

Complexity abounds in organizations with disparate technologies like polyglot environments, polyglot programming languages along with managing legacy along with up-and-coming technology stacks. Engineering wrestles more and more with retrofitting licenses, security and dependency management for the programming languages they use for multiple software applications. At the same time, management lacks oversight on code compliance and they can't gauge risk.

Enterprises end up with high variability in tooling support and varying degrees of programming language quality. It's hard to become an expert in one language when you're required to work with a dozen. There's a big difference in skill level between a person who speaks French and Italian fluently and a person who can string a few sentences together in eight languages.

These problems multiply exponentially as an enterprise adds more languages, creating a digital Tower of Babel.

However, you don't want to hamstring your developers. You want them to have the freedom to use the best tool for the job, innovate, learn and create elegant solutions. Adding new programming languages builds their skill base and empowers them with the right equipment to fulfill their craft. So, you want to say "yes" to your developers, but as more and more languages are added to the enterprise, they impose a drag on your software development lifecycle (SDLC). At scale, all these languages and tools can kill the enterprise.

Enterprises should closely monitor these three primary issues:

1. Coding vs. Fixing: Updating and fixing tools instead of coding new features: Some enterprises centralize this function in a single team. Others require that each "pizza team" manage their own development tools. In either case, there's an opportunity cost the engineering team and management pay: rather than coding new features, these teams are constantly updating and fixing libraries in their open source tools since they move so quickly.

2. Wasted Development Cycles: Because library versions and code dependencies are constantly being updated, the artifacts associated with the original build of an application may no longer be available when a vulnerability is found. As a result, many development cycles are wasted trying to re-create an environment in which the vulnerability can be fixed.

3. Risk and Application Transparency: Applications are released and then never updated — why fix what's not broken? Teams come together for a project and then disband. As a result, when a critical vulnerability is discovered, the enterprise may not have visibility into which applications are affected, which libraries those applications contain, or even what languages they were built with. This can result in costly "exploration projects" in order to ensure the vulnerability is properly addressed.

Now, multiply these three challenges by each programming language in your organization, and what started out as a molehill suddenly looks like scaling Mount Everest. And just like a mountain climber, you won't survive without the proper equipment/tools.

Thriving in a Polyglot Environment

What's needed is a holistic solution that works for both the enterprise and the individual stakeholders in the SDLC. Enterprises can create this solution using these best practices:

1. Get regular updates to keep code current and bug-free.

2. Enable consistent environments across teams and manage dependencies by standardizing on specific programming language builds across your enterprise.

3. Get smaller build distributions with only the packages you need, based on your specific criteria.

4. Take advantage of commercial open source support to get help with programming language versions and platforms that are near end-of-life and not supported by a community.

5. Monitor code running in production and respond based on risk of flagged components (e.g. CVE components) used in your applications.

6. Create a single source of truth for your package management; this may require the assistance of a knowledgeable technology provider.

7. Set thresholds for when to trigger an update, alarm or other kinds of events based on application dependencies.

By implementing these tactics, developers will be able to put time toward delivering value, not tooling or build engineering grunt work. There will be consistency for code in all environments in the software development life cycle. Even the bottom line will improve with the time savings and decreased cost of resources dedicated solely to maintaining programming languages and package distributions internally.

Following these practices will solve the pain points of engineering teams, management, individual developers and every coder in the SDLC, regardless of their role.

Bart Copeland is CEO and President of ActiveState
Share this

Industry News

February 29, 2024

ManageEngine, the enterprise IT management division of Zoho Corporation, announced the integration between Endpoint Central, its flagship unified endpoint management solution, and Check Point's Harmony Mobile, a leading mobile threat defense solution, to help IT security teams automate the remediation of mobile threats.

February 29, 2024

Stack Overflow and Google Cloud announced a strategic partnership that will deliver new gen AI-powered capabilities to developers through the Stack Overflow platform, Google Cloud Console, and Gemini for Google Cloud.

February 29, 2024

The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, announced the graduation of Falco, a cloud native security tool designed for Linux systems and the de facto Kubernetes threat detection engine.

February 28, 2024

JFrog announced a new technology integration with Qwak, a fully managed ML Platform, that brings machine learning models alongside traditional software development processes to streamline, accelerate, and scale the secure delivery of ML applications.

February 28, 2024

ServiceNow, Hugging Face, and NVIDIA, announced the release of StarCoder2, a family of open‑access large language models (LLMs) for code generation that sets new standards for performance, transparency, and cost‑effectiveness.

February 28, 2024

GMO GlobalSign announced the availability of an Issuer for Kubernetes cert-manager.

February 27, 2024

MacStadium announced the launch of its online community to deepen the connections of application developers through knowledge sharing and collaboration.

February 27, 2024

Octopus Deploy announced the acquisition of Codefresh Inc.

February 26, 2024

Intel announced its new Edge Platform, a modular, open software platform enabling enterprises to develop, deploy, run, secure, and manage edge and AI applications at scale with cloud-like simplicity.

February 26, 2024

Tray.io announced AI-augmented API Management, a new Tray Universal Automation Cloud capability that turns any new or existing workflow into a reusable API, significantly decreasing the technical debt associated with the operational effort and costs of traditional API management (APIM).

February 26, 2024

Bitwarden Secrets Manager is now integrated with Ansible Playbook.

February 22, 2024

Check Point® Software Technologies Ltd. introduces Check Point Quantum Force series: an innovative lineup of ten high-performance firewalls designed to meet and exceed the stringent security demands of enterprise data centers, network perimeters, campuses, and businesses of all dimensions.

February 22, 2024

Tabnine announced that Tabnine Chat — the enterprise-grade, code-centric chat application that allows developers to interact with Tabnine AI models using natural language — is now available to all users.

February 22, 2024

Avaamo released Avaamo LLaMB™, a new low-code framework for building generative AI applications in the enterprise safely, securely, and fast.

February 21, 2024

CAST announced the winter release of CAST Imaging, an imaging system for software applications, with significant user experience (UX) enhancements and new features designed to simplify and accelerate processes for engineers who develop, maintain, modernize, complex software applications.