The year that was, 2023

Well, it's the end of another year and it has been a strange one. It hasn't been a terrible year, like some recently. But I also don't seem to have done anything except work. In review at the end of the year, I feel I've learned a lot and I feel very tired. So let's see whether I've achieved anything at all - there has to be a bit more then Hell Let Loose and Roboquest.

• 14 posts on this blog (15 including this one) - ninth consecutive year of a post per month
• Started posting my blog posts on LinkedIn - small thing, but a big deal for me
• Another year of the Year in Pictures - ninth year and we're up to 40 photographers
• 224 Github contributions - well down on last year
• Rebuilt my email setup so email actually arrives
• Finished replatforming all my apps
• Started playing D&D again
• Started writing a D&D setting too
• Some reading
• Managed to see a few friends for the first time in years
• Foraging cookery course
• Completed another escape room
• Stripped down and repaired the taps in my kitchen
• Finally sorted out the signatories on the house bank account (2+ years!!)
• Another year of exercise with a personal trainer
• Established a good physiotherapy regime
• Another year of the Saturday morning exercise class
• Won an award for CIO potential
• Spoke at a conference about the future of tech
• Yet more instagramming
• More photos on my Flickr stream

Resolution count - 3/10. Utterly awful.

This time last year I wrote this:

"Looking forward to 2023, I'm going to write the same thing I write every year. I need to spend less time working and more time living."

It really has been a strange year. I seem to have been constantly busy and yet outside of work achieved very little. I feel like I've spent so much of the year on the back foot - whether that's because I've been worn out, or because I've spent time doing things for other people and not moving forward with things I want to do. My resolution count shows this - lowest in years. For various reasons, I've not been able to prioritise much for myself. I've learned very little, and not completed many projects leaving an overall sense of emptiness.

It has been a sub-optimal year for physical health. I've had a year of blood tests for chronic fatigue (fortunately nothing) and all manner of problems with my hips which have blown apart my fitness. I've been nursing injuries since May and while training and physio has helped, I feel like I've moved backwards (and outwards) this year. This is something I really want to turn around in 2024 if I can avoid damaging myself any more.

Also, while I don't feel too bad as I write this, I think my mental health has taken a battering this year. My work / life balance is completely off - the worst it has been in years. However, unlike previous years when this has been the case at least I'm enjoying the challenge this time around. But that doesn't change that work has been full on, which has led to much exhaustion and doing less of my own things while I hid and recovered.

All that said, while my real-life has been less than ideal my work-life has been doing ok. I have achieved a lot in my current role and even won an industry award which was rather surprising. I don't write about work much during this year-end post but this year it's worth calling out the success to contrast ... well ... everything else.

So some words for 2024...

Looking forward to 2024, I'm going to write the same thing I write every year. I need to spend less time working and more time living.

Sigh.

More seriously, I want to focus on my health - physical and mental. I need to increase the quality of my time across the board. The time I spend at work needs to be better spent. Outside of work, I need to make better use of the time I have - doing more, and resting better. I definitely need to do more myself instead of chasing round after other people. This year - quality over quantity.

Time for 2024. Tally-ho.

Professional new year resolutions

It's my favourite time of the year - the null zone between Christmas and New Year where nobody is doing anything, the weather is awful and hiding away is socially acceptable. I can sit with a laptop, learning about things I never find time to touch during the year and slowly become one with a chair. All without any guilt that I should be doing something else.

Every year I write new year resolutions and then do an end of year summary however this always focuses on my personal life. This year has been VERY work-heavy so I thought I'd also write some extra new year resolutions for my professional life and why I think they are important. It's the holidays so don't expect anything enormously insightful - there is a huge list of things I should be doing, and this is more about where I should refocus myself for the new year. Here we go.

More engagement

Anyone who has read Future Engage Deliver knows that you can have a vision (Future) and set everything up for output (Deliver), but if you don't bring people along (Engage) your success is going to be limited at best. This ranges from simple visibility through to detailed talking about strategy to everyone, both in the team and wider. When physically in the office some of this happens just by not hiding behind a closed door, but when working remote those corridor conversations don't happen - there is the need for more deliberate mapping of communications and touchpoints.

My area is now essentially a remote working group and that creates a need for more deliberate communication. We're also in a time of change - a very exciting time, but change is always unsettling. This is going to make engagement even more important.

I don't think I'm too bad at engagement - but only when I prioritise it. There has been a LOT going on, and good engagement takes time and energy - two things that have been especially in short supply in Q4 2023. So for 2024 I'm going to look to make two changes. First, make sure my engagement is of a higher quality. Second, and more important at the moment, I'm going to prioritise engagement which means finding or making more time for it.

Give back more

The Tech industry can be a pretty bleak place at times, and the only way that will improve is by all of us doing what we can to make it better. Over the years I've tutored, coached, mentored and set up groups. These days I'm still mentoring people across several different organisations - particularly people who are leading software engineers, and software people who want to progress into senior management. I also sit on the London Data Board, I've done some consulting with groups looking to restructure (both paid and pro bono) and I've spoken at conferences about technical leadership.

I get a lot out of these kind of things and I am going to assume it's helpful! I'd like to find ways to do more. If you'd like a chat do reach out. Otherwise, I need to explore some ideas around this - ways to share / cooperate / mentor and so on. I'm not very clear what I can do beyond more mentoring (I'll post about that in the new year) but I'd like to find something.

Do less

Both of the above will take time and while we insist on saying "make time" this is actually impossible. Time is a fixed resource and needs to be spent effectively. What I want to do in 2024 is to make sure the time I have is spent on quality activities. For 2024, that is going to mean two things. First, a renewed focus on delivery - getting things out the door rather than spinning wheels and sustaining. This will also help with the good feels - everyone likes achieving things. 

Second, I'm going to ensure the various meetings and governance processes I attend are providing proper value. As mentioned earlier, we are in a time of change and that can easily mean overlapping or redundant org processes. This only costs us time and energy, so finding and stopping them helps not just me but everyone. I'm going to push back hard where it seems appropriate to do so to protect my time.

Work / life balance

Actually, there IS a way to "make time" - work more hours. That has been my default in 2023 and to everyone's surprise it has proven unsustainable. In 2024, I need to balance work and life better. This doesn't just mean looking at working hours - I need to put things in my off-time and have the energy to do them. I know there are problems when I'm not doing anything in my free time because I'm too tired so this is a move to protect my mental health.

So that's it. In 2024 I'm going to work on how I engage with people, I'm going to find ways to give more back to the industry, I'm going to focus my time at work and I'm going to improve my work / life balance. Any guesses how I'm going to get on? Happy new year!

Sending email in 2023

"Your email keeps going into my junk box" - everyone.

I use a vanity domain to front my email address. I used to run a simple setup where the domain was basically masking my Gmail account. Incoming was handled by a wildcard forward in the domain host. Outgoing, I simply rewrote the email envelope with my desired email address. Essentially I was spoofing the outgoing email.

Gmail used to let me do this, but clamped down years ago requiring proper authentication with an SMTP host however the old setup still worked, as long as I didn't change anything.

Then the big email providers started clamping down on this kind of thing. In an effort to combat spam, email is increasingly complicated and the wider ecosystem is getting more locked down. There is a big rumble about the big providers essentially pushing smaller email providers out by blanket not trusting them, making it increasingly difficult to run your own email setup. This post is not about that, rather it's how I stopped my email started going into junk boxes. I was forging my own sender address, which is exactly the kind of behaviour you see from various types of spam. Nice.

So, on the assumption I wanted my email to arrive I needed to revisit my configuration and set this up properly. I did a bit of work, so I thought I'd write up here so I can repair it in future if needs be, and it's in one place on the offchance it helps anyone else.

Incoming email - you're emailing me

Not many changes here - although I use a combination of Cloudflare and Ionos DNS these days, but a blanket forwarding rule in the Ionos config from the whole domain still works.

Outgoing email - I'm emailing you

Ok, this is where it gets interesting. I can still send email, setting the domain to whatever I want, but my emails are being flagged as spam. This is because the receiving hosts are trying to protect the account owners from spam and my setup was being flagged as spam. Obvious note - I set up a test Gmail account for receiving email so I could test the effects of my settings.

Outgoing SMTP server

First thing was properly configuring an outgoing mail server. In theory, this can be done with the Gmail SMTP service but while I could authenticate properly I found my email still ended up flagged as spam. I'm sure there is a way to do this properly but for the moment I instead turned to SendGrid and this documentation was useful.

A free account allows 100 emails per day - plenty for me. Nobody wants to hear more of me than that. In the SendGrid interface it is easy to create a API key (Settings -> API keys) with appropriate emailing sending permission then when adding the server details, just select smtp.sendgrid.net / apikey / $YourKey. Only slight gotcha is making sure you get the port right (SSL over port 465). This should authenticate properly and email can be sent - although it'll probably be going to junk again.

Next up, setting up DKIM. This stands for DomainKeys Identified Mail - an email authentication method designed which allows the recipient to check that an email came from the domain it claims, and was allowed by the domain owner. The setup is found in Settings -> Sender Authentication. You might be able to get away with Single Sender Verification, but I did the full Domain Authentication. You need to be able to modify your domain's DNS settings for this to work properly.

If the setup doesn't seem to be working properly you can test the individual additions on the command line with a tool like dig.

dig foo8908.tomnatt.com should give a NOERROR response. If it's not, the setting isn't right or it hasn't refreshed yet.

Finally, assuming this is for personal email you'll want to disable link tracking. This rewrites links in your email for marketing purposes and likely break any links you send unless you configure it properly. Turn it off with Settings -> Tracking -> Click tracking -> disable and links will work again.

Other DNS setup

There are two other DNS entries that can help with proving email provenance - SPF and DMARC. I'm not sure whether I needed all these for a minimal setup, but they do work best when all three are present. I did configure them, so I'm capturing what I did. 

SPF (Sender Policy Framework) is another way to ensure the mail server sending an email is allowed to send via this domain. It works by defining which servers can send email, so the client can check, rather than directly encrypting the connection (the DKIM approach). The setup is fairly simple, and can be checked with tools like this.

An SPF policy which allows sending from Gmail and SendGrid servers might look like this:

v=spf1 include:sendgrid.net include:gmail.com ~all

DMARC (Domain-based Message Authentication, Reporting & Conformance) helps receiving mail systems decide what to do with incoming mail that fails validation via SPF or DKIM. So this is worthless without at least one of the other two.

A rule which tells the receiver to mark failing email as spam and send reports to the given email address would look like this:

v=DMARC1;p=quarantine;pct=100;rua=mailto:postmaster@tomnatt.com

Done

And lo, email appears to be flowing again. I hope something here helps. To finish, I want to note that I'm not an email expert - not even close. If you are, and you're seeing somewhere I've written something stupid please reach out and I'll correct and attribute.

A few words for World Mental Health Day

Earlier in the week (Tuesday 10th October) was World Mental Health Day. As part of normalising mental health through openly talking about it, at work I posted something of my own experiences on our internal chat board. The reception was extremely positive - people pleased someone spoke out, feeling seen and so on. So - since mental health isn't just about last Tuesday - I'm reproducing a version of that below, albeit with the work-specifics removed.

For World Mental Health Day I wanted to share something personal. Mental health still has a social stigma attached, and while this is improving rapidly even from five years ago there is a long way to go. So, to make my small contribution, I'm going to tell you a little about myself.

I have suffered from depression throughout my adult life. I'm fortunate enough that this has very rarely reached the more intense levels where I can't get out of bed or worse, but I've certainly had ongoing difficulties with anxiety and feelings of emptiness, loss of interest in life in general and feelings of hopelessness, guilt, worthlessness, helplessness and others. Even writing this makes me feel like a fraud, since it's not "proper" depression etc etc...

I know that these feelings go in cycles and I've spent a lot of time identifying my own triggers so I know when I need to take a step back and protect myself before I get into a worse state. I also know that it sometimes sneaks up, and I suddenly find myself in a bad way. It's hard and deeply unpleasant at times.

I'm sharing this mostly because I don't think people talk about mental health openly enough, and World Mental Health Day seems like a good day to put something out there. For some people, I hope to show some solidarity. For others, this will be some small insight into a world that is totally alien to you.

On this blog, sometimes I post about mental health. If you'd like to see what I wrote after taking about a month off you can see that here, and you can see all my posts about mental health here. Obvious disclaimer - I am not a medical professional.

Most important - if you're in a similar position, know you're not alone. There are people who share your experiences and are willing to talk. If anyone would like to talk to me, please feel free to reach out. I'm also quite happy for the "but what's it like" conversation if you'd like to ask that.

At work, I suggested a discussion group and it occurs to me that that might be a useful thought in other contexts - either for people who have different experiences they want to share, or for a wider group to talk. If people think that is a good idea do shout and if enough people are interested I'll see if I can get something set up.

Take care everyone.

Some thoughts about the future of the Tech industry

Last week I was given the opportunity to sit on a panel of technical leaders and talk about the future of technology. I had a few notes about about how we're going to need to change our thinking about building capability and I thought I may as well capture and flesh out a touch the results of my crystal ball gazing here.

I spoke briefly about three areas:

• The people we hire
• The expectations of our users, and our expectations of them
• Where I think we’re going to need to invest and build capability

The people

Fairly obviously, Technology is getting more important to daily operations. But it's getting harder to hire people all the time. As we all keep hunting for talent, those who aren't offering the top end salaries will increasingly have to look nationally or even globally to recruit. I don't think moving the organisation to another city is a sustainable approach - at best, it will simply move the problem. Instead, I think we will increasingly see a more distributed workforce, and therefore more remote working. As staff turnover is identified as a major organisational cost, we’ll also see more emphasis staff retention - succession, training, individual growth and so on.

Whoever nails building a strong remote working culture and environment which encourages loyalty and celebrates and develops the individual is going to do very well. I think the secret to this is going to be building very strong communities of practice, and if I’m right we’ll see more “Head of Community” style work and roles growing up. 

I also think we’ll see more Tech decisions based not on the best technical or product solution for the org, but the best fit for the skills we can grow or hire. This would suggest a lean towards the big names (the Microsofts, Googles and Amazons) who are heavily investing in training the Tech industry through free access to courses, sponsoring hackathons, and so on.

I believe this will be more acute as Automation is used to deliver more while avoiding the continual growth of IT departments. We will need to retain the skillsets to maintain that automation layer or we'll be seeing yet another wave of technical debt.

Expectations from and on users changing

In times of yore, users used to have to know something about operating a computer to install and use software. These days, users on a smart device can just touch an icon and get everything they need. This is a victory for accessibility and digital inclusion but it also means the gap between “technical” and “non-technical” user is widening. Our helpdesks and other support points will need to work with an increasingly broad ranges of questions, especially as tech like AI gains traction, and expectations for what it can do are all over the place. 

We’ve also been seeing for years the expectations from users increasing as they use more SaaS products at home and demand the same sort of tools at work. To satisfy these needs, the cost of development is going to go up and cover a wider range of skillsets - and of course this links back to the earlier points about skill availability. Out of the box services are also going to be affected - vanilla deployment is going to be less palatable in the office, requiring more work for a good result especially with the current state of many internal systems user interfaces with respect to accessibility and usability. 

This is particularly true regarding what have often been considered secondary requirements - accessibility and environmental sustainability for example. Users are (quite rightly!) far more vocal about accessibility needs, and we need to not just respond but get ahead of their requirements.

Other places we’re going to need to build capability

Technology is obviously an increasingly essential part of everything. I mentioned the effect on helpdesks above. We're also already seeing increasing amounts of security threats and the wider reaching impact of a successful attack. This will take us into an ever more expensive arms race in the Security field, which will mean building Security capability. This is going to need to be approached very carefully as it will be very expensive - everything I’ve said about skills shortages are far more acute in the world of InfoSec. Part of the Security picture is a renewed emphasis on good, basic engineering practice (such as patching) - but again, this places a challenge on building skills in our organisations.

We’re also generating and handling more data all the time, so inevitably we’ll see more human error leading to data loss. In fact, for any organisation a major security incident or data breach is only a matter of time now. If we are assuming that it is going to happen, there is a need for much more robust organisational responses to these scenarios which means building appropriate incident response and Business Continuity capabilities. Of course, just responding isn't enough so there will also need to be stronger data ownership throughout our organisations, with more people with data owner and controller roles. Organisations will need to fully grip their end to end processes and user journeys in ways that perhaps hasn’t been happening before.

Obviously there is a lot more that can be said about everything here!

Looking to the future

One of the symptoms of seniority that I still struggle to process is this idea that people want to hear what I have to say and understand how they can (professionally at least) be me. It's a weird feeling, both humbling and frightening, and has only grown in the last few months. I'm being asked to speak at conferences, and in a few weeks I'm on a panel discussing the future of the Tech industry. Why? Surely there is someone better for this?

Honestly, this is a question I've been asking myself since my time in the Civil Service, where I found myself in a meeting discussing how to spend five million pounds of public money. I should write a post about getting over myself and getting on with it. This, however, is not that post.

I moved away from development into management so I could make a difference to the industry. How do people get into Tech? How do people move to more senior technical roles? Showing the importance of senior leadership with technical backgrounds, and helping people get the right experience to be credible candidates. These are core to my motivation and it seems I have the beginning of a platform. This is a responsibility I want to take seriously. What can I offer to the wider industry?

I've got a few ideas and since there seems to be a few people reading this blog from LinkedIn, I suppose I can offer them up. First and foremost, I'm thinking of creating a set of interviews with people in my position telling their story, talking about how they got to where they are today. I don't kid myself that I'm some kind of Steve Jobs or Bill Gates, but then neither are the overwhelming majority of people. I am, however, fairly successful in the industry. I'm in a position that someone getting into Tech can reasonably aspire to attain. Not inspirational perhaps, but practical. There are lots of people like me, and the stories don't get told often enough so I like the idea of creating some kind of resource showing the different paths people can take. At the moment I'm thinking a podcast, but format to be decided. If you're reading this and think it's an interesting or useful idea, please do reach out.

In addition, I sit on the London Data Board, and I'm happy to offer some time to support other initiatives if they come up. Again, do reach out - especially if they are something to do with nature or animals. On top of this, I already do some mentoring, and I've got a whole post about that coming up soon.

I opened saying that people asking about my career and how to "be me" is weird. Actually, on reflection, it's a weirder feeling that I'm in a position to be feeling a sense of responsibility to the industry and asking any of the above questions. It's a great privilege to be working somewhere where I can spend some time looking outwards and hopefully make a difference. That's my intention anyway - so I've written it down in public so I can hold myself to account.

A break in the routine

When I started as Director of Engineering at Macmillan, one of my objectives was to build a department which functioned without me. I wanted to be able to pull myself out of the operational day to day, empowering others to own those problems, while I focused on overall direction and wider concerns. This was always an aim rather than a hard goal - similar to the sysadmin end game of a fully automated system, it's something I would like to chase and I think I can get close, but I don't believe I will ever truly achieve.

Over the last year and a bit I've set things up to work this way. I've created core areas of my division, and put someone in charge of each of those spaces. I've empowered them to make decisions and own their successes, and I've carefully worked with each of these leaders to identify and remove weaknesses. There is still a long way to go, but I think we've made a strong start.

Why write about this? Well, I took last week off as leave (booked some time ago) and at the end of the week:

The Boss: How are you doing?

Me: Starting to feel better! After about four days asleep, I finally started to feel human again.

The Boss: Want another week off?

Me: Is this some kind of trap?

It wasn't a trap, so after a quick conversation I decided against looking that gift horse in the mouth and spent half an hour with my assistant going through my diary. The first week off was all planned, so that hadn't been a problem but this second week was a spur-of-the-moment thing. Surely it was going to cause all kinds of problems if I wasn't around?

Nope.

Of the week, there was an hour which absolutely required me and needed rescheduling. Which means ... what? This is the question I've been pondering for a few days. On the one hand, my ground-in desire to be needed and adored took a massive hit. Being basically superfluous is not good for the ego. On the other hand, this is exactly what I've been building towards. The department can survive without me. It can make decisions, move forward, solve problems, etc etc...

We've got a way to go. The wheels most certainly will not stay on the wagon indefinitely and the more forward-planning functions haven't been tested in this short term. Plus, of course, people are covering  some bits of my role and I shouldn't underplay their help. There is still plenty of need for someone in my position to keep things steady and move things forward - I don't think they can make me redundant just yet. However, I'm pretty pleased with the results of this (accidental) test and what it means for changing my day to day when I'm back.

To be clear - I'm not wasting my time. The bits that didn't need rescheduling were parts of the job where I'm providing support or oversight, and direct support for individuals. All this should be done, but I can certainly ask some questions about what happens if I dial it back a bit. That means less oversight, but perhaps we're ready for that? Then I can focus more on the work I'd be doing myself which isn't getting done. However, the nature of the job is such that my work is (supposed to be) much more strategic which naturally has a longer burn. If it's delayed a week, that doesn't create the same kind of problem as operational work stopping. Fortunately, this also means focusing in on the part of the job I particularly enjoy.

So, in summary I am very deliberately in the process of making myself operationally irrelevant and it's time to reboot my focus list. Is this ... is this what success looks like?