In almost all the companies that I have worked at, I have used technology innovation to create additional value. The process always involved getting on board colleagues and making them part of the change and incorporating their input to be advocates of the change rather than opponents.
For me what I did was just common sense and the pure result of proactiveness after observing and listening to colleagues. Still though today it has been coined digital transformation.
For me it was just using technology to help the company be more productive and efficient and make our work easier and provide better service to all stakeholders customers included.
Technology Innovation = Digital Transformation
Technology Innovation=Digital Transformation
Digital transformation is essentially a form of internal wide scale innovation using technology. Today’s companies in their ever-growing complexity depend more and more on data. To properly use data and find new ways to exploit it has become essential to survival and growth.
Data technology in whichever form it comes usually helps to improve information supply. With goof information and creativity, the limit is the sky. Companies can optimize and expand their horizon of possibilities.
I find it very much common sense:
The better our information, the better decisions we can take.
The timelier we get it, the faster we can plan toward taking advantage of it.
With better use of information the more competitive we become.
The more efficien and faster we become the better service we can give to all stakeholders including customers.
It cannot be denied that through human creativity, good information, and supporting systems companies can strife to realize new opportunities and prevent missing out on necessary changes.
Some beliefs about innovation and company-wide changes
Today company-wide changes such as digital transformation are often thought of as something requiring a top-down leadership mandate, but I believe that’s only part of the story. In my experience, digital transformation is something that can be driven from the ground up by individual employees who see an opportunity to use technology to create additional value for their company.
The fact is that I find this book a good read for anyone involved in business today. I would also recommend reading the books by Ichak Adizes on corporate lifecycles since they will bring great insights into organizational change management. Nevertheless, both authors coincide in the element of leadership and its importance. Something with which I completely agree.
For real change, leadership is required. Sometimes of one style and others of another. It is not easy and thus different approaches need to be taken depending on the underlying situation. If this is not done, no lasting change can be established. Ichak Adizes in my version of the book which is already quite old has a set of very clarifying examples. I truly recommend reading any of his books here is a link to those on Amazon.com.
Innovation change is hard
It is no walk in the park. Anyone who has tried to do it, knows it. The larger the corporation, usually the more complex its systems, the more people work in it, and the longer it has been operating. Due to this, such organizations require a systemic approach aiming at different variables within the company. Otherwise, no effective change is achieved. I would compare it, to creating a new habit at a large scale. It is not easy, takes longer than expected and requires discipline, perseverance and losts of two way communication.
Top-Down or Bottom-Up
When it comes to managing change within companies one often speaks of Top-Down versus Bottom-up. With digital transformation, it can be particularly challenging. Such transformation often changes many established processes, and with processes, it directly affects people at many layers within an organization.
Digital transformation within large corporations is like addressing a systemic complex problem. It requires changes at de institutions different levels, installing a new way of thinking, incorporating new skills, and creating new knowledge. It is in a way like creating a new habit for many people on a grand scale.
Evidently, if you have ever tried to change anything, you know it takes time, discipline and perseverance, and lots of communication. How do people react? Often with fear and reticence. This is very normal. Why? We all are animals of habit and do not like stepping out of our comfort zones, and large institutions are nothing but a very large group of people.
Given this fact one encounters some common beliefs:
Changes in large institutions require top-down approaches.
Such changes result from a crisis or trends which top management needs to be dealt with.
From my experience, I can state that this is partially true since I have also done it the other way round. In his book, Tendayi Viki describes it as guerrilla tactics. I would have never thought of it in this way but he is right. He is also right in that it is harder, much harder since it often fails. I vouch from my own experience that it is harder. Bottom-up requires a lot of maneuvering to get things done and convince people to join the movement to then slowly but steadily establish such changes.
Conclusion
Innovation and digital transformation are essentially implementing change within an established organization. It is difficult because you change processes, and the way people have worked within their established routines. Therefore it is hard, and requires a lot of leadership, diplomacy, communication, and perseverance to get people involved to make it happen.
It is complex and I will try to explain in future posts how I went about it so maybe it serves anyone in the same or similar situation.
A couple of weeks ago a friend and current colleague of mine called me a geek. My friend is a developer and he considers himself a geek. His name is Jose. I did not take this comment negatively, even though usually the term geek has some negative connotations.
Jose made me ponder my geekiness. Out of curiosity I did some research on the word and this is the definition of Merriam Webster’s online dictionary.
Geek
As you can see out of the three listed definitions two are related to an intellectual interest, and technology.
Some background information
To give you some background information on this conversation and what my professional occupation is. The conversation was about the mission, vision goals and strategy of a company group that the two of us work for.
Jose is a senior developer. He used to be the General Manager of a company that the two of worked for. This company belonged to a German company innovation group called HYVE. The two of us ran the group’s digital innovation daughter company together.
I was hired at that time to assist Jose and become the second local General Manager after a year. I have over 20 years of experience with companies of all types. My experience is cross-functional and I have worked as a management consultant for many years. The two of us complemented each other very well, he as the technical expert and myself as the business expert.
Our conversations and experience
The two of us worked through the challenges of the pandemic together especially the downturn in project volume. Over a period of two years we had many conversations about the nature of software development, team culture, strategy in software, etc.
We did many thinks together. He gave me the freedom to implement changes in operations, team communication and improve things wherever I saw fit. Together with our small team we decoupled us and changed how we worked. We changed processes such as time management, staffing and reporting, and then later our changes triggered interest from the headquarters and led to further changes there.
In addition to this, contrary to what had been done before we started acquiring customers on our own instead of waiting for projects to come from Germany. Jose and I foresaw a reduction in projects from Germany, and a growing competition for developers. Given this, we wanted to keep our team busy, working on interesting projects. We found that boredom was the worst for morale and especially developers need sources of intellectual challenge and growth.
Given this need for personal growth of our team and the analysis we did on our technology stack we focused on building a plan B. Consequently, we started looking for interesting new projects in different fields with new relevant technologies as a form of investment with spare capacity to meet three goals:
Keeping our team busy
Grow our teams technology stack with diverse projects
Cover cost with a small margin
The current project
Later, when Jose was asked to join another project that was to create several technology companies around Blockchain and AI. He recommended me as the business expert within the group. He wanted to exclusively focus on coding or programming , his true passion.
Nowadays Jose and I belong to the core team and the two of us have continued with our conversations. We discuss different topics of our mutual interest and throw ideas and thoughts at each other.
Now after a year we are considering changing project focus. Given that I found a possible change not aligned with the initial direction I voiced my concern. I asked for clearly defining the groups mission, vision, goals and general strategy to align all core members perceptions and actions.
We are talking at the moment much about this topic and I asked Jose about what he thought that we all had in common. He said we were all geeks in a way or another.
Interests, passion and “geekiness”
Till then I had never considered myself really a “geek”. I have always felt comfortable working with people from IT, engineers, developers, etc. since I understood how they thought and approached problems, but I never had thought of myself as a “geek”.
Now, after thinking about it for some time I think of “geekiness” as a result of passion. Passion to me is a stronger expression of your of inner interests that lead to a fascination with one or more topics that you decide to dedicate your time to.
Business challenges
Business Geek Puzzles
I come from a third generation entrepreneur family. To some extent due to this I have always had interest in companies. I think though that my interest stems from more than just growing up in an entrepreneur family. In my case it has more to do with the intellectual challenge and the opportunities for creativity that they represent for me.
I still remember the first book about companies that I read, a book by Ichak Adizes, about company lifecycles and the challenges for leadership at each stage. All the things that had to be considered seemed to me like a large and fascinating puzzle to solve.
Technology as a means to an end
As you can imagine I studied business. College was great for me. My friends considered me a little bit of a nerd but I did not care. I enjoyed each lessson and was fascinated by company challenges and how people solved them and especially how they managed to do so with technology.
I learned the usefulness of technology to solve problems and how it made things more efficient. This realization made deep dive into software programs like Excel etc. which I considered a useful tool. Excel in fact for me has prevailed as one of the most useful investments of my time since it has been a great companion for almost 30 years now and helped me solve many riddles.
After Excel I developed a growing fascination with technology. In general and how it is used within companies for greater efficiency, productivity, etc. Not surprisingly, I continued learning many new tools and exploring programming through courses to implement automation and solving many challenges.
For me technology has always been a means to make life easier, more efficient and productive which has made me passionate about it.
People, culture and leadership
Still though the years prove to me again and again that the greatest puzzle are people, culture and leadership. I do not separate the three since for me they go hand in hand.
If leadership does not set the right direction and listens and empowers its people, you set the base for a specific culture. With direction I mean, defining a coherent mission, vision, goals and strategy. By listening, I mean asking employees and customers to get involved in the discussion.
People like to be taken notice off. To be asked for their input since they are spending their time at work. It is a way to show respect to the value that they are generating, and their experience. Especially, from experience I can say that this is important. Specifically, when you want to implement changes or are looking for support.
I am the first who values his own contribution. I appreciate when my input is asked for. Fact is, the golden rule has shaped always my behavior:
“Treat others the way you would like to be treated.”
Common sense to me.
Definitely a “Business Geek”
Physical Bookshelf
Well, when I look at my small physical library in addition to my ebooks and take into account the time a spend on reading, thinking and learning about companies and technology outside work, Jose is definitely right. I am a “business geek” with an always growing interest in learning how to use technology to solve problems and add more value.
On the other hand though if you look at my books in this picture on the right you will find a number of other interests too, but business challenges are definitely one of my intellectual passions.
I do not think that being “geeky” is bad at all. I actually feel lucky that what I do for work is also one of the things that excite me and tickle my intellect daily. More so because the more experienced I am, the more creative I can be. Making connections and finding solutions for possible challenges is just like a big puzzle. Fun indeed.
So who cares if others think that you are geek, it just means that you are truly passionate and experienced about a topic. Good for you.
Here is another of my hobbies where one could say that I am a little geeky, check it out if you are curious.
It’s no secret that Open Source projects have a difficult time being financially sustainable and search for sources of income. Fact is many projects struggle just to keep the lights on. This is often because project maintainers have to look for stable sources of income, which can be difficult to find. Sadly, this often leads to project abandonment.
The way I see it Open Source projects face similar problems to startups, and often end up becoming startups. However, there are ways to keep your open source project financially sustainable, or at least try to do so.
In this article I will try to give you an overview of the methods that I have researched.
Different Financing Methods
You will find different approaches to financing. From common to less common and from commercial to non-commercial. Here is a simple list of these:
In open-source, the three most common financing methods are donations, sponsoring, and support contracts. Let’s take a look at each of them in more detail.
Donations
Donations are perhaps the most obvious way to try to keep your project afloat. You can set up a donation page on your website or use a service like Patreon. The problem with donations is that they’re often not very reliable. You might get a big influx of donations one month and then nothing the next month. This can make it difficult to budget and plan for the future of your project.
Sponsorship and Subscriptions
Sponsoring is another common method of open source financing. In this model, companies or organizations pay you to work on your project. This is usually done in exchange for some kind of recognition, such as a link on your website or mentions in your project’s documentation. The advantage of this model is that it can provide a steady stream of income. The downside is that it can be difficult to find sponsors, and you may have to give up some control over your project in order to get them onboard.
Support Contracts
Another option is to offer support contracts for your project. In this model, companies or individuals pay you for help using or developing your software. This can be a great way to generate income, but it requires quite a bit of work on your part. You need to be able to provide timely support and have a good understanding of your project’s code base.
Other forms of financing
Licensing (Dual, Commercial, etc.)
Some open-source projects choose to release their software under a dual license. This means that you can use the software for free, but if you want to use it commercially, you need to pay a fee. This model can work well if your project is popular and has a lot of users. The downside is that it can be difficult to enforce.
Specialized Hosting Services
Another option is to set up a specialized hosting service for your project. This can be a great way to generate income, but it requires quite a bit of work on your part. You need to be able to provide timely support and have a good understanding of your project’s code base.
Bounties for Bugs and Features
You might also give rewards for bugs and features. Companies or individuals may pay you to fix defects or develop new features on your project in this manner. This can be a lucrative business, but it comes with a lot of responsibilities on your side. You must be able to offer timely assistance and have a thorough knowledge of the source code base.
Saas: Software as a Service
This approach offers the option to use the Open Source project as a hosted online service. This approach pays a fee for its use without having to deal with any IT infrastructure or maintenance costs. This is a good way to generate income, but it requires quite a bit of work on your part. You need to be able to provide timely support, and have the necessary people and IT infrastructure setup. This service usually brings with it legal responsibilities.
Affiliation
In this approach, open-source projects can have an affiliation with the organization. The project gets some financial support, but not full funding. This model is a good way to get started, but it’s said to not be sustainable in the long run, though companies like Mozilla, affiliated to Google, having established it as their default search engine is a clear example of its potential for income.
Conferences
Conferences are another great way to generate income for open source projects. You can either organize your own conference or participate in someone else’s. This is a great way to get exposure for your project and meet other like-minded people. The downside is that it can be expensive and time-consuming to organize a conference.
Brand Licensing and or Certifications
This is the process of licensing your project’s name and logo to other companies. This can be a great way to generate income, but it comes with a lot of responsibility. You need to make sure that the companies you license to are reputable and will use your project’s name and logo in a positive light.
This approach can be done once a project has a large user base and requires for example specialist consultants who could be certified as for example “Linux” Specialists, etc.
Selling Merchandise and other products
You can also sell merchandise and other products related to your project. This is a great way to generate income. You need to be able to promote your products and have a good understanding of your target market. Examples of this are for example companies who sell T-shirts, mugs, etc. and others which supply ready to use specialized products with their software installed.
Tokenization
This is a process of funding open source projects with the help of cryptocurrency. In this approach, people can contribute to your project by buying tokens and or becoming a part of it in some instances.
Crowdfunding
Crowdfunding is a great way to generate income for open source projects. You can use platforms like Kickstarter or Indiegogo to raise funds for your project.
The downside of this approach is that it can be difficult to reach your funding goal unless you already have a follower group or community of users that can be interested in it.
Things that are often funded are for example games, technological gadgets, art, etc. Check out Kickstarter.com for some insight.
Foundation Grants
These are usually donations from foundations of government institutions. There tends to be some formality involved in addition paperwork. Examples of such are:
When one receives money either through a sale or through a donation one usually has to declare it and pay taxes on it. It is unfortunate but this is usually expected.
Here is a screenshot to show you what I mean from the sponsoring tool by GitHub:
Screenshot from GitHub Sponsor
Some countries have more tax and others have less, still the paperwork a project owner or contributors who receive funds have to be considered but in essence they are these four:
Taxation of received funds
Necessary legal implications
Surrounding administrative complexity, paperwork and cost
Book keeping of fund allocations for payments etc.
In essence, once you receive money you will have to pay one way or the other part of it.
Open Source Project Owner and Contributor Types
In Open Source projects you can find mostly these different types of owners and contributors which can be divided into legally ready for receiving funds and others which are not:
Legally prepared to receive funds:
For-profit companies
Not-for-profit companies and institutions
Individuals who are set up as freelancers
Legally not prepared to receive funds:
Individuals who are not set up as freelancers
Individuals who are under age
The first group is usually able to open a bank account, have a PayPal account and can receive official direct payments. The second group has some limitations in this area but there are solutions that can help them do so. Nevertheless, they will have to become freelancers, create a company, another form of legal institution or channel the funds in case of minors through their legal tutors.
Simplifying Receiving Funds
In order to simplify receiving funds nowadays you have various digital options, some are solutions, services or software add ons for your repositories. I will go through a few marked in pink below just to give you an idea. The others require also talking about business models and are beyond the scope of this post.
In addition below these examples you will find the link to the entire list that I have collected from different internet sources. The list is organized by the categories I have mentioned above. This list is one I will be exploring more in detail myself with my team of colleagues for our projects.
Available Online Tools and Solutions to Simplify Receiving Funds
Donations and Sponsoring
The tools come in different flavors so to say. In a way you could say that there are two main approaches and then there are some innovative and different ones.
The more common are recurrent donation and subscription platforms and one time small amount donation platforms.
Then you find a full service solution run by OpenCollective.com in the (USA) where they will deal with all the necessary paperwork, legal setup etc. and you can function through them.
Then there is GitHub’s solution that they are rolling out right now:
It is basically an online platform for social project funding which includes all types of Open Source as well as other public goods and non-profit social projects. The platform is about giving in crypto currencies such as Ethereum.
Another slightly different approach is the one of Gitcoin.co. They come in the form of Grants so to say. You create a project and description where you include links etc and people can fund you with money which then gets replicated via a fund through a quadratic funding formula.
Essentially the more people fund you with amounts, no matter the size, the more funds you receive from a pool of grants for open source projects on the platform. These grants have different rounds during the year. Here is a link to this product: https://gitcoin.co/grants/
Screenshot GitCoin Grants page
There are quite a few more so check out my compilation of resources.
Is a platform where freelancers essentially offer specific services or “gigs” as they are referred to which are paid for using Ethereum. The Bounties are specific jobs that those freelancers do custom to the customer who hires their services. More than a Bounties platform it looks like a Freelancer hiring platform.
Was an easy and approachable platform. You signed up with your GitHub account, added your repositories and could install an app on your repository. This then allows you to be paid for issues which were requested to be solved. Unfortunately this platform seems to be inactive though one can log in and check it out as to how it functions. Their video tutorials also give you an idea, but they seem outdated.
Is an interesting platform with different options in addition to their Bounties, such as Grants, Kudos, Quests, Hackathons, etc. The Bounties can be set up by anyone who can create an issue in a repository, though that person is the one funding it. It can be thus used for users for example who want a specific feature, or bug resolved which they then fund if the issue gets done. If one were to make use of this site one can indicate this on the Readme and then advertise it from there.
“ SourceCred (in the most basic sense) is a technology that makes the labor of individuals more visible and rewardable as they work together in a project or community. The goal of SourceCred is to use this technology to make rewarding labor as nuanced as human contribution often is. We hope to be one piece in the puzzle of a healthier future where systems serve community members, where financial maximization isn’t the end-all be-all goal, and where wealth actually flows to those who are creating the value in our world.”
They essentially have developed a software which you run as an instance on your repository and which then assigns Credits or “Cred” as they call them, based on an algorithm that analyzes contributions interlinkages of generated “value”.
This “Cred” is then rewarded through their own project specific Crypto Currency “Grain” to which funds can be assigned.
Then later external parties can purchase Grain and fund issues of their interest, etc.
In a way it is like creating your own project economy with its own currency.
“Decentralized funding where creators and backers work together to drive project growth and are equally rewarded.”
Their vision statement is:
“Empowering all creators for sustainable challenges. Decentralized funding, Social tokens, DAOs and everything you need for a sustainable creator economy is here.”
They attempt to provide the necessary infrastructure tools for a fair creator, backer ecosystem. The way I interpret it, it does not exclude closed source projects. Their focus is to speed up creating a system where creators and backers work together and get both rewarded.
The Commons Stack stands for an organization whose vision states:
“We want to create a world where public goods are valued fairly for the benefits they deliver. Our current economic system frequently exploits the environment, and undervalues open-source software, open research, and other altruistic efforts addressing the collective needs of our society. We aim to change this.”
Their intent being also mentioned as:
“To advance the design of commons-based economies, we need an open-source ecosystem of token engineering tools and a robust token engineering methodology.”
Their Commons that they are working on is a library of Open Source components whose aim is to help project owners incentivize work towards common goals, providing accountability, help with governance and communication through feedback on what they call one’s Commons.
Commons standing for your Open Source project and the common good for the community that it represents. The idea from what I have understood is that of creating DAO (Decentralized Autonomous Organization) for each Open Source project.S
Screenshot CommonsStack Landing Page
Crowdfunding
Under this category you find the usual suspects and some specific to Open Source projects in addition some additional which you can find in my list.
As you can see there are many options to simplify generating income. It is a matter of what you need. I would take some time to check them out and study them since depending on your situation they may be appropriate or not. Still you never know what that extra knowledge can bring you in the future.
Nevertheless, these are just a part of making your Open Source project sustainable through contributors, users, etc. which still remains the most difficult and keystone for becoming sustainable and able to grow long term.
In the next weeks I will test some of these or our projects and then write about for anyone who can use this information. The company group for which I work expects all its members to write about their experience while working on our projects. Anything useful that we learn we are to share it either through blog posts or repository documentation. I think it is great and a way of supporting the development of the Open Source ecosystem by adding value to the community.
If you are interested in the Open Source Guide repository we are creating here is the link and if you are interested in what projects we are currently working on, here.
I have been dabbling with bonsai since I was 15 years old. I say “dabbling” intentionally since I do not consider myself a professional nor an expert. As a fan and lover of this form of art which goes back in time almost 1400 years I will tell you a little about:
What bonsai are
How you create a bonsai
Why I like this hobby so much
The ways I benefit personally
How I think it helps develop relevant skills
What are bonsai?
Bonsai are trees or shrubs that are planted in shallow pots and trained to remain small. The word bonsai is Japanese and is pronounced “bone-sigh”. It actually has two parts: “bon”, meaning tray or shallow pot; and “sai”, meaning plant. So, bonsai means tray planting.
Bonsai are not a particular species of plant; any tree or shrub can be trained to grow in this way. The art of bonsai lies in the training and shaping of the plant to create an aesthetically pleasing miniature tree.
If you want to read more about bonsai in Wikipedia here is a link:
The basic principle of bonsai is to mimic the shape of a full-sized tree in a small form. There are different ways to achieve this, but the most common is through pruning of branches.
Pruning is the main way that bonsai are shaped. It involves carefully trimming and shaping the branches and leaves of the plant to create the desired effect. For example through pruning of the larger leaves or even defoliating (trimming all the leaves) you achieve smaller leave size and greater branching.
Also when you want to give a specific shape to branches or the trunk you can also apply wires. Once wired you bend the wood into the shape that you want.
In addition the root system is “pruned” every so often. Depending on the variety. and the age of the tree this can be every 1 to 2 years or longer. The goal of pruning the roots is to obtain the most roots in a small area so as to have it survive and obtain all its nutrients from the soil within the pot. This process is as important as all the other.
Each of these techniques and some others which you also resort to when needed require practice. If you are curious here you can find a little more information on these:
Here is also a pretty good video on the quick process but which gives you a good idea as to all the techniques that are applied: https://www.youtube.com/watch?v=lR15GyBEFZM
Why I like this hobby so much
I really enjoy the creative aspect of bonsai. It is very satisfying to take a plant and carefully shape it into something beautiful. It is also very calming and relaxing, which is a nice contrast to the hustle and bustle of everyday life.
The personal benefits I have experienced from this hobby are numerous. First of all, it has helped me to develop a greater appreciation for nature. Working with plants and trees has given me a greater respect for the natural world.
Another benefit is that it has helped me to develop patience and perseverance. Bonsai take a long time to grow and shape, so it requires a lot of patience. It has also helped me to develop a greater attention to detail.
How I think it helps develop relevant skills
Also looking back I think this hobby has helped me to develop some important life skills. For example, it has helped me to learn how to plan and visualize. When shaping a bonsai, you need to have a clear vision of what you want the end result to look like. This requires planning and visualization skills.
I have also had to learn to improvise. At times, things do not go as expected, a branch breaks, part of the tree dies, etc. You have to adapt to whatever happens.
It has also helped me to develop perseverance. Bonsai require a lot of care and attention, and it can be easy to get discouraged when things are not going as planned. However, persevere you must if you want to create a beautiful bonsai.
I think that anyone who is looking for a hobby that is creative, calming, and challenging should consider bonsai. It is a great way to connect with nature and develop some important life skills.
Conclusion
Bonsai is a great hobby for many reasons. It helps you connect with living art and teaches you different skills like visualization, planning, and perseverance. If you are looking for a new hobby that can help you grow as a person, I encourage you to check out bonsai.
Like any art it takes time to develop the necessary expertise and skill and it is now just about buying one. If you want to
Now if you want to explore this world a little more go to your closest bonsai center do not just buy one in the flower shop these are usually going to die on you since the soil quality is not the right one or the pots have defects that make them accumulate water.
If you want to read about the techniques I recommend you John Yoshio Nakas books. He is an eminence in the realm of Bonsai. Here is a link to his books at Amazon.com.
Next week, I will be representing Nautilus Cyberneering at a developer event in the island of Tenerife. Nautilus is a startup company developing open-source software and is currently growing its team. The fact that I am attending to network and recruit potential contributors and team members has made me think about my career and ask me the question: should you choose to work for a startup?
Looking back at my career
I remember that my parents always wanted me to start out working for a large corporation.
My parents’ belief mirrored what many people still think: Larger companies are safer, stabler, and offer greater opportunities for personal and financial growth.
Today though, looking back at my career, I must say that I never tread along this path. My parent’s ideas though well-intended and reasoned did not materialize. On the other hand, though, I must say that I gave it a shot. During my last year of college, I interviewed with several of them, but in the end I chose to work for a start-up.
In this post, I will share my experience during my career working for startups, why I chose to become part of their team, and why I have always preferred working for startups or small companies.
At the end of the post, I will also share my view on why I think that large corporations are not necessarily the right choice at times depending on what you seek or how your personality is.
The first time working for a Startup
I remember that I went through several interviews with Unilever, Intel, Bain Consulting company, etc. but in the end, life showed me another option that I found more interesting, working for a tech startup. The startup I chose to work for was called Inflow. I consider myself very lucky for having had this opportunity and have been part of it.
Reasons why I joined Inflow
At the time I joined the company for various reasons:
First, I liked the people who represented the company and whom I met.
Second, during the visit to the company, I saw pulsing energy and a proactive positive attitude combined with a down-to-earth practical mindset where everyone helped everyone.
Thirdly, even though the company was growing rapidly and it had already over 100 employees when I joined, it did not feel bureaucratic in any way.
Fourth, it was the year 2000 and they were in an interesting industry, data hosting, and expanding into Europe.
Fifth, they gave an undergrad who had slipped into a presentation to master students an opportunity.
I will never forget that presentation, it was very enjoyable and interesting and I enjoyed the energy from the presenter. The presenter’s name was Dan Rojas, and later on Dan happened to become my superior in Ireland where we opened the company’s first European Data Center.
My experience at Inflow
While at Inflow in the USA I spent several months training and got to know the internal organization and operations. The company was not likely the standard startup since it had a lot of structure with established processes. In hindsight I factor that this was due to founders and responsible managers common military background.
Also another thing that I came to appreciate was the internal management style. Our managers were always leading by example. Their main goal was to serve their team by constantly getting rocks out of the way. If you needed something you could just go ask for help and the would act. Additionally you were also expected to be proactive, which I loved and thrived on.
My first project
To give you an example, in Ireland, my first project was to set up the data center’s networking cable infrastructure. Initially it appeared to me as an overwhelming task. The reason for this was my ignorance about the topic. I was a recent business major with no technical knowledge in this area.
I proactively contacted my technical colleagues in the USA and discussed everything with them. By the end I effectively set up the company’s most modern cabling infrastructure. We installed Cat 6E cabling which at that time was the latest in Ethernet cabling.
However there was one small detail that I had been unaware of. The cabling was not the standard within Inflow. This small detail made me receive a reprimand from Dan. He was right in giving it and I learned from this mistake, but he also said that I had done a good job since we now we had the most modern cabling infrastructure possible.
All in all, I spent a year at the company to later go help get my family’s business out of bankruptcy. I learned a lot about leadership, respect, process, documentation, and teamwork. In a way, I can say that this one year set the base how I work, collaborate, and perceive my role when managing others.
Later work at startups and small-sized companies
Hereafter I spent several years fixing and working in my family’s business. We got it out of bankruptcy, improved all its IT infrastructure and internal processes, and made it profitable again. It was a major feat. The first challenge I encountered was that many employees had given up on the company and its management, so I had to focus on building trust again in management and especially in me, a rookie and youngster in the eyes of almost all my 50 colleagues.
It took me some time but through leading by example as I had seen at Inflow I succeeded in doing so. Overall I must say, though the situation was dire and it took a lot of sacrifices. Nevertheless. I liked the experience since it gave me a lot of chance to try out ideas and implement changes quickly, and learn new things by doing.
This characteristic of small companies is what I have always appreciated. Their small size has usually not created the bureaucratic layers and processes yet so that it can move and implement change quickly. Besides this since there are not many employees, it is likely that you end up doing many different things, thanks to which you will get tremendous opportunities for growth and learning.
My experience working at larger companies
Now, on the other hand, even though I cannot say that I have ever worked for a large international corporation, with thousands of employees, the largest company group that I have worked for had over 150 employees and invoiced around 30 Million €.
Company culture and management style
The company was hierarchical, with department managers who were not very approachable and open to discussion and suggestions. Each department was measured and goals were set by higher management and the owner of the group.
Given this, each department had its own goals and agendas, not necessarily aligned and optimized. Information was not shared openly nor collaboration between departments was incentivized. There was no mutual trust and people were always blaming each other.
In addition, the leadership style was completely different. Managers did not solve problems for their team. They expected their team to solve problems and do as they were told. It was more management through commandment rather than actual leadership. Not very pleasant as you might imagine. I stayed there for two years and learned to maneuver this political departmental game as purchasing manager.
Observations from this period
During my time at this company and also when working with other companies such as suppliers etc. I came to appreciate the difficulties that bureaucratic structures bring with them and which elements originate it.
Leadership
The single most important and relevant factor for me is leadership. Over the years I have learned that leadership defines how a company evolves on many fronts, since it sets the tone for:
Processes
Reporting
Goal setting
Resource allocation
These directly define the work environment an sets a template for as how people interact and behave inside the company and which agendas they develop.
People and culture
As a result of the previous the culture is shaped and it affects organization’s agility and internal degree of collaboration and sentiment. Elements that are crucial for long term development of the company as a living institution, but especially for the work environment that you will encounter if you join it.
As a matter of fact a company’s culture has proven always to be the most important factor when I was to choose to work for a startup or any other company.
Now, should you choose to work for a startup or a large corporation?
As usual, it depends. There are many things you need to consider.
From my experience startups always have these traits:
Can move faster
Are more flexible in their processes
Offer opportunities for employees to learn and grow quickly
Have less resources
Can make you resilient to working under stress
On the other hand, large corporations:
Are more bureaucratic and political
Have strict formal processes
Are often inflexible and slow to implement change
Have more resources
Do provide internal training and mentor programs
Have often an international setup
These two lists can be endless and here is a list of some additional articles on this topic that may interest you:
First and most important, give some thought to what you are looking for in your next job. It essentially depends your preferences. For instance, if you are proactive and like learning new things quickly and being able to try out new ideas, then working for a startup might be a good choice. However, if you prefer stability and a more formal work environment, then working for a large corporation might be a better fit.
Then on the other hand if you do not like political games etc. then a large corporation may not be the place for you and so on.
The all important company culture
A company is defined by their people, and in a startup even more so. It is a small growing company which is establishing itself and defining it operations. Given this, try to meet some members of the team, they will be a good indicator of whether you would like working with them, since you will likely see and work with them. Ask them for example about their day to day.
This is important so you get a good feeling of where you are getting into. You will be one of a few and people are more open and less hierarchical more like a group of friends or family. Usually everyone is expected to get things done so that everybody can make progress. Progress for which, from time to time you will end up doing all sort of things, sometimes not exactly related to your job, but things which need to be done. Also since things need to get done you will likely at times work with the CEO and other managers or departments.
This however, is not likely to happen in larger, and more mature companies such as corporations. Here, there is a good chance that the culture is already very developed and layers of processes exist which make it much more formal. Also, you will be one of many, so competition for positions will be fierce, and politics will be part of your career. In addition you will likely not meet anyone outside your department until you climb or work on cross-functional projects.
For me after 22 years out of college I think that the most important in choosing a company is its culture. People and culture are the core, and key to know if you will thrive in its environment. In fact, I think a lot about it and even another post on it here.
Final thoughts on whether to choose to work for a startup
These are just a few things that I would advise anyone to consider beforehand but some things you can only fully experience once you are inside a company. To give you an idea I will try to give some insight into this in another post in the future regarding Nautilus in my next post.
Now, do you have any experience working for startups or large corporations? What are your thoughts on the pros and cons of each? Let me know in the comments below!
Most of the times when you read about AI you find lots of technical explanations, so that finding a non-technical AI explanation in simple words is rare.
End of last month I presented for Nautilus Cyberneering, at a webinar where we got invited to collaborate. I talked about AI. The other presenter talked about the Meta-verse. Both presentations aimed to clarify terms and concepts for non-technical business people. The goal was to create a good base understanding, simplify these topics, give examples, and share some advice on where to start.
This is a link to the webinar in case that you are interested. In case that you want to get a copy of the slides here they are.
In this post I intend to do the same but I will also give the example of how we are approaching the development of our AI. This insight will give you a better understanding of what you need to consider.
So, if you are looking for technical knowledge this article is not for you. Nevertheless, if you want to learn the basics and get a non technical explanation to know what is possible and where to start, keep reading.
How did I end up knowing a little about AI?
To start, I am not technical expert but I am interested in technology. I have worked in different roles in business for the last 20 years and have often used technology to overcome challenges wherever I worked.
As for AI, I started dabbling with it about 2 years ago. My first contact was a course by Udacity on AI product management. This course taught me its potential, its training methods, challenges, costs, etc. as well as how to look at it from a business point of view. It was a good entry point.
Hereafter, I continued reading on the topic, and by coincidence I ended up in a team developing an AI product, where I am now working as a business developer.
It is an ambitious Open-Source project, where we create the necessary base product, infrastructure and community around a concept of a simple and expandable command line AI assistant. Evidently, you can imagine that AI is a constant discussion topic and I am learning something new every day.
What we do in this project explained visually is this:
Nautilus Cyberneering AI Assistant Conceptual Project
AI in our daily lives
AI is already everywhere in our daily life. It has become a seamless integration in your day-to-day when you use your desktop computer, tablet, or mobile. You may be using it when you take a picture, search online searching, buy at your favorite online store, watch a movie or use your bank account.
Companies are using it all over the place. Netflix, Amazon, Google, your bank, etc. are just a few of them.
AI necessary basic understanding, conceptual differentiation, and types
To understand how you can use and how AI works, you first have to have a basic understanding of what AI is. It is also important to understand the difference between AI and the human mind.
What is AI? – In simple words
AI is a computer system that can learn and work on its own. It does this by using artificial intelligence algorithms, optimized or “taught”, so to say, to the machine.
However, what is an algorithm? An algorithm in the case of AI is a set of rules that have been created to solve a problem or accomplish some end. In the context of AI, these algorithm sets are what enable the computer system to learn and work on its own, be it for example image recognition, or any other task.
These algorithms are what make AI special and different from traditional computer systems. For example, the tasks an AI algorithm can perform are many, though it is often specialized to accomplish these in specific contexts or domains.
Conceptual AI – Strong vs Weak
There are two different types of AI: Strong AI and Weak AI.
Strong AI, named also general intelligence (AGI). This type of AI can solve any problem that a human mind can solve. It can think creatively, reason, and learn on its own. Strong AI does not exist yet, but scientists are working on it.
Weak AI, on the other hand, also called artificial narrow intelligence (ANI). An AI focused on solving specific tasks. Weak AI is the kind of AI that we have today. Most of the AI applications that we use today fall into this category. They describe it as “weak” but it can be very powerful.
Machine learning versus Deep learning – The differences
Now that we have a basic understanding of AI, let’s take a closer look at the two most popular types of AI: machine learning and deep learning.
As mentioned before, both deep learning and machine learning are sub-fields of artificial intelligence. And as you might have guessed, deep learning is a sub-field of machine learning.
So, what is the difference between machine learning and deep learning?
The main differences between machine learning and deep learning can be simplified as two:
Machine Learning is more dependent on human supervision to learn through prepared structured data, and Deep Learning is capable of doing this unsupervised and even with unstructured data.
The complexity of the layers of interrelated algorithms known as nodes, usually more than three layers of hidden nodes.
Here is an example setup of the layers in a Deep Learning Neural Network Algorithm:
Example set up of a Neural Network Layer setup (from left to right: Input layer, multiple hidden layers, and the output layer)
Rather complicated, if you know that there are hundreds and thousands or even millions of such layers.
Difference between the Human Mind and AI
AI vs Human Brain
Now, if we consider the previous discussion we can say that AI is good at processing data from specific preset contexts, it runs data through its algorithms which it adjusts to improve its accuracy and outcome.
The human mind, on the other hand, though not as fast in processing data, can learn and adapt itself to new contexts, for which it uses abstraction and creativity. Thanks to this ability we have survived over the millennia and evolved till today.
To better understand this difference, let’s take a look at an example.
Say you want to buy a new car. You would go online, research the different models, their prices, features, etc. This is all data processable by an AI system.
Now, let’s say you want to buy a new house. The research part would be the same, but you would also need to consider the location, the schools in the area, commute, etc. You possibly would imagine life in that area, how it would be, how convenient, etc. this is where abstraction and creativity come into play.
The human mind can take all this data and more, process it, and come up with a decision. The AI system, on the other hand, would need to be “taught” how to do this.
So, while AI is good at processing lots of data, the human mind is better at making decisions based on available data, and possibly better with little data, if it is in a completely new setting or context. And this is just one example of the difference between the human mind and AI.
Business use cases for AI in different industries
There are many different real-world applications of artificial intelligence today as I already mentioned before. The most common also in business are:
Fraud detection, discovering unusual bank transactions, etc.
Predicting consumer behavior, based on historic consumption and personal information
Speech recognition is used in many different industries such as healthcare, law, and customer service.
Image recognition is used in business for tasks such as product identification, facial recognition, security, document automation, etc.
Customer service is an industry that is using AI more and more to provide better service to customers.
This is just a small list of examples, but there are many other possible applications for AI in business today, and in the future, there will be even more.
AI is rapidly evolving and the potential uses for it are endless. I am convinced that shortly we will see more and more businesses using AI to automate tasks, improve efficiency, and make better decisions.
How much can it cost and how complex is it
Well according to an article which I read, it can cost as little as 0 € to about 300 k € to implement AI in your company.
The most complex is usually creating a custom AI model. For instance, GPT-3 a Natural Language Processing model which is currently “on fire” is said to have cost almost 5 million USD $. Do you need to do this though? NO!! There are cheaper and even free Models out there.
Now, here is a little overview of a cost chart.
In the image above you may have wondered about Open – Source. Open-Source stands for publicly available software, data sets, models which are frequently used in developments since they are either free or cost much less than so-called closed source equivalents. Also, for your information very often closed source software makes heavy use of open-source components for their development.
Recommendations on how to start using AI in your business or organization
Now when talking about the companies which are already using it heavily they have some common characteristics. They usually:
Produce lots of data
Have complex processes
Operate in variable settings or industries
Are large companies
So, if you are a small business or startup it is likely harder for you to start using AI. But that doesn’t mean it’s impossible.
There are many different ways to start using AI in your business today. My advice here is to be practical and go for an incremental approach, not running off to look for “experts” right away. I would not do so now but later.
First, I would recommend the following to do in-house:
Assign a person or a team to the task of getting familiar with the AI.
Invest into training them on the basics
Have them look at what data you are producing.
Review your internal processes in search of complexity and large required time efforts.
Have them research simple AI-empowered tools in the different areas.
Check to which processes you can apply such tools.
Implement these tools.
Second, now that you have an internal person or team with some practice, knowledge, and understanding of what can be achieved I would suggest to:
Review the data and processes which require a custom approach due to the nature of your business.
Contact external AI consultants and have them analyze your case and make a proposal and cost estimate of the required investment.
Important for this second phase is that when you approach them you have them consider Open-Source and not only consider large AI models, since according to several benchmarks smaller specialized models beat larger general models in predetermined contexts.
Conclusion
So there you have it. I hope that I could explain AI to you in simple words and give you some insight into the use cases. If so, you are now a little more knowledgeable about AI, how you can start using it in your business, and the ways it is impacting our lives.
To me it’s important to understand the basics so that one can conceptualize what is happening around us and differentiate between hype and potential. With the topic of AI there is always going to be people who over-hype things and make claims that AI will take over the world or do away with certain jobs.
I am sure that there are changes coming, but remember, as humans, we have an incredible ability to learn and adapt – something that artificial intelligence still has a lot of catching up to do o, but it is evident from the examples that AI used as a complementary tool lets people be much more productive.
Now, with all of this in mind, go forth and experiment with some AI tools! There are many great ones out there waiting to help you do your work. I leave you a list here of some that I am trying out right now.
Also if you want to read a little more on AI these are some links to articles that I wrote or re-shared:
Natural Language Processing AI Technology a Quick and Brief Intro with Examples
The company that I currently work for, Nautilus Cyberneering, has a 5 year project for which the so called Natural Language Processing AI is key. We essentially want to create a virtual artificial intelligence assistant that you can run from your own local computer and communicate with you through a command line interface. This assistant […]
Good read: AI – Summarizing Books with Human Feedback
“Summarizing Books with Human Feedback” was published on OpenAI.com. It is a quick read, very clear and well written. They share some examples from on how they had AI summarizing books. In the article they give the example of the classic “Alice’s Adventures in Wonderland”, by Lewis Carroll which they used to test it. […]
Good Read: AI Adoption Skyrocketed Over the Last 18 Months
This is a brief and interesting article by Joe McKendrick an independent researcher and speaker exploring innovation, information technology trends and markets, published on HBR online on the 27th of September, 2021. If you are interested in, how AI may affect your business, or how it can help you , this article offers a broad […]
The company that I currently work for, Nautilus Cyberneering, has a 5 year project for which the so called Natural Language Processing AI is key. We essentially want to create a virtual artificial intelligence assistant that you can run from your own local computer and communicate with you through a command line interface.
This assistant we envision, will do all sorts of things that a private user may consider of value. The user will basically interact with the “machine” indicating what he wants to achieve or do, and the “machine” will respond to his input.
As you can imagine such an application will require a good understanding of human language and it could look like this:
Clearly not exactly like in the picture but you get the point. : )
Human communication and understanding is rather complex, as you well know. Hence to achieve this we will employ “Natural Language Processing” artificial intelligence models also abbreviated as NLP.
Starting My Research
Given this I wanted to begin forming my opinion and test a few and ask around if anyone in my network had used any Natural Language Processing AI so far. It happened to be the case.
Some good friends of mine were currently using GPT-3. They told me that to them it was another employee in their company. Knowing them I knew it was no overstatement, when they told me that they used it for code review and research. Especially since their business also happens to be in machine learning, AI and automation solution consulting. Consequently, I became even more interested.
However, if you keep on reading please let me first start by saying that I do not consider myself an expert in this field, so please forgive any mistakes I may make during this post. Still you may find it interestint if you are also new to the topic.
In this post I will do the following:
Briefly explain what NLP is
How do NLPs work
NLP Creation Techniques
Known NLP Models
Share some links to the ones I found most interesting
Give you some examples of their replies to my input
Share some already usable tools
What is Natural Language Processing (NLP)
These are two definitions from different sources:
Wikipedia
“Natural language processing (NLP) is a subfield of linguistics, computer science, and artificial intelligence concerned with the interactions between computers and human language, in particular how to program computers to process and analyze large amounts of natural language data. The goal is a computer capable of “understanding” the contents of documents, including the contextual nuances of the language within them.”
“Natural language processing strives to build machines that understand and respond to text or voice data—and respond with text or speech of their own—in much the same way humans do.”
NLP is an artificial intelligence technology meant to power machines. It processes human language inputs written or spoken, understanding and responding to them.
How do NLPs Work
The before mentioned summary sounds very simple, but it is not. An NLP system needs to:
Recognize speech, which is convert voice data into text data, no matter how they speak, where they come from or what accents or mistakes they make.
Tag words, be they nouns, verbs, articles, etc.
Decide on the intended meaning of a word given many possible meanings based on the context.
Differentiate between block elements such as sentences.
Establish relevant words, for example names of a person, state, etc.
Make contextual cross references, from pronouns or descriptive words, etc.
Infer the emotional load within a text, such as subjectivity, objectivity, sarcasm, etc.
Generate “human” responses from structured information.
I do not know you, but I think that this is even difficult for a human. Recall for instance when you learn a language. All the different accents, double meanings, the different sense of humor, etc. Complex indeed.
Natural Language Processing AI Model Creation Techniques
Creating a single working NLP model is difficult. Evidently, it takes a lot of effort. For many years different approaches came into existence to optimize and test this process. Research in this field has been going on for over half a century. You can get a brief overview of the past models in Wikipedia.
The currently used machine learning methods are two. The two require extensive use of computational power and can be used in combination.
One could write a book on each of them but this is not my intent so that I will try to briefly describe how I have understood them and include a link to more information.
Feature or Representation Learning
A system is set up to automatically discover and learn through prepared sets of labeled or unlabeled data. It essentially learns to recognize and associate features, common patterns, within a context and make associations of meaning. For more information here.
Deep Neural Network Learning
Is an approach in which there are different layers of inter connected nodes. Nodes are computational sets of rules that get adjusted in the form of weights during the training phase. The nodes pass information through them. The data that you input into the system proceeds through this network of decision rules and progresses through the different layers like a decision tree. For more information here.
Neural Network
Known Natural Language Processing AI Models
There currently exist many NLP models. It would seem that there is a race to develop the most powerful one. You will find WU DAO, GPT-3, GPT-J, Meta AI, Bert, etc.
One of the challenges researchers are facing with such models is whether the models have learned reasoning or simply memorize training examples.
Clearly as you can image, some are Open-Source and others not. Through the use and access to these available models many solutions are being. I will briefly highlight some facts about the ones that I have looked at most and which I found demo implementations for or solutions developed on them which you can try.
GPT Group
GPT stands for “Generative Pre-trained Transformer”. These are models trained to predict the next token in a sequence of tokens autonomously. A token being a set of characters when it comes to text characters.
GPT-3
This is the model that has recently created a lot of buzz since 2020 when it came out. In 2020 it was the largest model ever trained. It has been already used to implement marketed solutions by different companies.
The model was developed by OPENAI. It started out as an open source project; however, nowadays its code base has been licensed out exclusively to Microsoft.
It has been trained to perform generalist and niche tasks such as writing code in different programming languages such as Python.
These three models have been developed by EleutherAI. It is an Open-Source project. It is a grassroots collective of researchers working on open-source AI research. The models can from what I read be considered generalist models good for most of the purposes.
GPT-Neo
GPT-J
GPT-NeoX
Date
2021-03
2021-06
2022-02
Parameters
1,3 to 2,7 Billion
6 Billion
20 Billion
Model Progression EleutherAI
Interesting Responses from GPT-J
Below you will find several screenshots of the responses that I got from their online test interface so that judge for yourself.
AI responding to “Who is the greatest musician of all times?”
AI responding to “which is the best beginner programming language in your opinion?”
AI responding to “what is more important to work or to live?”
Here is the link to the online test instance where I got the responses from if you are interested: https://6b.eleuther.ai/
On the other hand you also can get paid access at goose.ai and test the different EleutherAI models at very reasonable prices.
Wu Dao 2.0 – China’s Monster Natural Language Processing AI
This Natural Language Processing AI model is considered the “monster” and largest NLP model ever. It was generated by the Beijing Academy in june 2021. Its code base is open-source based on PyTorch and it is “multi-modal” being able to process images and text at the same time and being capable to learn from it. Something that the others are not capable of.
It was trained on:
1.2TB Chinese text data in Wu Dao Corpora.
2.5TB Chinese graphic data.
1.2TB English text data in the Pile dataset.
It is supposedly capable of doing all the standard translation etc. but also composing poetry, drawing, singing, etc…
Wu Dao 2.0
Date
2021-06
Parameters
1,75 Trillion
Training Data
4,9 TB
Model Specs Wu Dao 2.0
Some Implemented Solutions
Here you will find some interesting implementations that you can start using today if you want.
Jasper
This is a tool that I think many digital copy writers will find handy to ease their work.
Jasper (Formerly Jarvis) – #1 AI Writing Assistant
Create content 5x faster with artificial intelligence. Jasper is the highest quality AI copywriting tool with over 3,000 5-star reviews. Best for writing blog posts, social media content, and marketing copy.
Thoughts
Same applies to this solution which helps you speed up your tweets in your own style.
Thoughts – Create intelligent Thoughts
Thoughts leverages state-of-the-art language model GPT-3 to create human-like Thoughts in your writing style
DeepGenX
This is a solution for developers to write code faster and easier.
DeepGenX
We are thrilled to announce CodeGenX! A Code Generation system powered by Artificial Intelligence!
Nevertheless, this is just three from many more. Here is a more extensive list of such solutions.
Final Reflections
Like with the examples above, technology never seizes to amaze me. Evidently, there is great potential in their use. Yet, what are its resulting disadvantages?
OpenAi, for instance decided when they developed their GPT-2 model to not make it fully available due to its potential to create fake news with it. In addition, later OpenAi went one step further and called out to create a general collaboration on AI safety in this post.
I agree with this line of thought. We have to weigh AI’s possibilities and dangers and check them against our values and beliefs. Technology in the end is nothing but tool, powerful though. Reason for which this old adage from before Christ rings true again:
“With great power comes great responsibility.”
Not from Marvel Comics : )
AI has only started and we are still to see much more of it in the coming years. If you want to read another interesting example of Natural Language Processing AI at work, here is another post of mine.
Assuring the authenticity of work submitted to GitHub has become increasingly important. One of the common policies that organizations have used to secure the commits made by developers has been to require the use of GPG Keys to sign Git commits.
Both GitHub and Git have long natively supported cryptography signed comments:
When commits are signed by each of their respective authors it is much harder for an attacker to successfully pull-off an impersonation attack.
My Experience
When I was asked to follow Nautilus policy of having GPG signatures for commits, I followed the GitHub and Git guidelines blind without putting much thought into it. Later after some internal discussion from my colleagues, it became evident that there are some additional aspects to be considered when using GPG for Git, GitHub or any other use.
In this post I will walk you through:
How the default GPG keys are set up when you create the
Why this practice can be improved
Recommended Best practices
How to do this
How to use them with Git or GitHub
Some other recommendations (expiration date, key rotation, etc.)
GPG Keys
Like all asymmetric cryptographic keys, GPG keys are made in two parts: “Private Key”, and the “Public Key” (that is derived from the Private Key).
With GPG, the common practice is to generate a set of keys that are grouped together with an extensive set of meta-data into a so-called OpenPGP key.
An OpenPGP key typically consists of:
Keys
Primary Key (Certify, and optionally other capabilities)
Key Capabilities, signed metadata that is included in the public key, are listed in the brackets.
All Keys can be set with expiry dates.
Sub-Keys and User-ID can be independently revoked or retired
If the primary key is Revoked, then entire OpenPGP Key is considered compromised.
GPG Defaults
There are many arrangement and possible combinations of keys, sub-keys, user-id’s and so on. When you use GPG to generate your keys, by default it generates your keys following a standard template:
Keys
Primary Key (Certify and Signing)
Supplementary Key (Encrypting)
User-ID
Primary ID (Name, Email, and Comment)
You can notice that the primary key has been set with the dual-capabilities of Certifying (to make new supplementary keys) and Signing (such as signing a Git commit).
This basis structure was chosen upon the thought that the keys used for Encryption need to be (or at least should be) rotated regularly, however Signing can remain constant over the lifetime of the OpenPGP Key.
However, in many cases this is not what the user would want if given the choice.
Why is this not optimal?
The default set-up leaves still some space for improvement. This is because it does not take advantage of the possibility to create individual sub-keys for each capability.
The idea is that you essentially disconnect all the rights of your choice from your primary key and just use your sub-keys to avoid using your primary key. The only times you then use your primary is to cancel (revoke) existing sub-keys or to generate new sub-keys.
It is very advanced to separate the primary key from the supplementary keys.
The advantage of this approach is that if any of these sub-keys gets compromised, you can revoke individually and generate a new key, all while keeping your primary key valid.
If you do not do this, you probably will end up someday with your primary key compromised and will have to regenerate a new primary key, etc.
Recommended Best Practices
How to Create Further Sub-Keys
In order to create additional sub-keys, you need to use the GPG command-line interface.
A colleague of mine, Jose Celano wrote a very clear step-by-step guide for internal use in one of our company’s repositories, here.
I base the following summary of steps in the command line interface on his work.
In the list you get an overview of all the primary key and its existing sub-keys. You will copy the second line of your public key made up of 10 pairs of 4 numbers and or letters.
Using the noted public key type: gpg --edit-key <public key 40 digits without spaces>
You will get a display of their associated private key and a new prompt so type: addkey
Select your applicable key, most likely option (4) RSA (sign only)
It will ask you to specify the keysize duration, I recommend 4096 and “0” for does not expire.
Confirm the creation.
You get a new overview of the new secret keys, seeing the newly generated sub-key and the changed rights of the primary key.
To see the equivalent public keys for export type: gpg --list-keys --fingerprint --with-keygrip --with-subkey-fingerprints<public key 40 digits without spaces>
You should now see the new sub-key and the changed primary key rights.
Removing Primary Key Rights
The last step to finish this is to remove all capabilities except the “certify” capability from the primary key. For this, you will continue using the command line but using the “expert” mode.
Type: gpg --expert --edit-key <public key 40 digits without spaces>
You will get an overview of the primary key’s rights.
Type: change-usage
Use the toggle option taking away the rights for which you already have created the new sub-key.
Once you are done you get a new overview of the primary key’s rights.
Type save and you are all set working on the keys.
You will see the new public key rights where you should only see the “c” option for certify at the “pub” key.
Configuring Git with Your New Key
In order to set up your new key for signing your commits you have to follow these steps:
In the command prompt type: git config --global --edit
This will open the git config file in your default editor. In my case it opens it in Visual Code.
Once here look for the following entry of the signing-key and update it with the last 16 digits of your new signing sub-key.
Save it.
If you are using GitHub you will need to export your new public key and import it into it, following the necessary steps as shown in their GitHub Documentation – Signing commits.
Always use a Passphrase
When creating the set of keys you are asked for a passphrase. Set it and remember it or even better write it down somewhere. This is another safety measure but it is essential.
Backing up Your Revocation Certificate
Make sure that you keep a backup of your revocation certificate or that you print it out and store it somewhere safe in case that you were to have to use it.
Rotating Your Encryption Keys
This being one of the most used capabilities. It is recommended that you rotate these keys to prevent anyone to have access to any of your encrypted information, creating for example new keys in events such as computer change, etc. It is important though to back these up in the event that you were to have files encrypted with these.
Setting an Expiration Date
Another good idea is to set an expiration date not too far in the future in case that you were to not be able to revoke your certificate due to having lost your revocation certificate.
Some After Thoughts
In a way using GPG is good for security, but if you work yourself through all these steps to do things properly, I am convinced that you may agree with me that it could be more user friendly.
Things could be made easier especially with the default key setup which could already have all keys separate, and avoid the need to have to do all this.
If this is too advance you can just go back to the basic as in my previous post.
The company I currently work with, our team decided to use OpenGPG keys. OpenPGP keys are also known GPG keys.
The intent is to avoid any security issues from impersonation attacks to the Nautilus Cyberneering code repositories. We host our repositories on the well known GitHub repository platform where this is one of the two options for increasing security through commit signing.
I wrote this post to explain what GPG is and how to use it since there are likely also other users who do not know it, nor have never used it before. The post was published on Nautilus Cyberneering’s corporate website today.
It is a quick read and simple overview of OpenPGP keys functioning, benefits and use.
Anyone interested in more digital security can benefit from reading it. Learning about OpenPGP keys easy and there many user friendly applications out there.
What is GPG? Why and how to use it? – Open-Source – Nautilus Cyberneering GmbH
I did not have a clue about what is meant by GPG when I heard it.As it turned out to be it has to do with security. Our team strives to have good security practices. I am no developer but I am contributing to our open-source project where any contribution needs to be signed and… Continue reading Wha…
If you want to learn more
It is always good to learn more about them since OpenPGP keys can be used to encrypt, certify, authenticate and sign.
If you are more interested about how to use it check out our GPG – Bootcamp repository on GitHub that I was asked to create. If you see any errors or mistakes please feel free to comment on GitHub.
I hope this is information is useful for you and makes your online and digital life more secure
In my opinion it is an impressive task that has been achieved so far. Though there is still lots to improve from briefly looking at the summaries, to have AI summarizing books is still impressive.
It is a remarkable work that I think can have great application especially for technical texts in my opinion, though for fiction texts I think it will not be as applicable. I wish I had had this tool when I was studying to double check my summaries.
I believe that the summaries lack some human touch but this is logic. However this is very subjective though from my side.
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept All”, you consent to the use of ALL the cookies. However, you may visit "Cookie Settings" to provide a controlled consent.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
