How Dow Jones uses GitHub

Dow Jones delivers the day's headlines with a secure and news-ready platform developers and readers can rely on: GitHub Enterprise.

Company Overview

Location: New York, US
Company Size: 5,000+
Number of Developers: 500

Dow Jones produces leading publications and products including The Wall Street Journal, Factiva, Barron's, MarketWatch, Mansion Global, Financial News, Dow Jones Risk & Compliance, and Dow Jones Newswires. With 500 full-time tech employees worldwide and hubs across New York, Barcelona, London, and Hong Kong, the company is committed to delivering news readers need to know as quickly as possible.

The Challenge

Dow Jones wanted the privacy and security afforded by on-premises servers while enabling everyone—from developers to journalists—to use code to do their jobs better. Ensuring that breaking news gets to readers as quickly as possible depends on code that doesn't break. The company needed "news-solid" software that could help their developers and journalists deliver top stories faster.

The Solution

Developers at Dow Jones get the best of both worlds with GitHub on-premises and in the cloud. This hybrid deployment helps developers bring open source standards like collaboration and transparency into every project.

Reliability and Deployment

Engineering Director Lee Cookson was among the first to use GitHub Enterprise at Dow Jones and quickly noticed GitHub's reliability. "GitHub has done a fantastic job at deploying a highly-available enterprise server. It's products are very dependable," Cookson said. "It's up and running nearly one hundred percent of the time."

Originally deployed in their data center, GitHub is now used by teams across Dow Jones, powering everything from consumer products to detailed reporting. "GitHub rapidly expanded to other functions. It also was an integral part of building out our DevOps pipeline."

Security and Governance

After Dow Jones' DevOps transformation, everyone is encouraged to collaborate and write code. Security is crucial—journalists write their own Python scripts to access data sets stored in GitHub repositories and used in digital and print publication.

"We want to make sure that we have our security controls baked into our pipelines," Chief Information Security Officer Miguel El Lakkis said, "all the way from the first line of code you're writing."

Lead Cyber Security Engineer Sydney Sweeney explains how the team manages security at scale. By self-containing apps within GitHub repositories on their own servers and in the cloud, teams are able to collaborate and work better together while governing systems from a single place. "GitHub has been amazing for us because we've actually built our own governance bots using GitHub Apps in our public or GitHub.com organizations to help govern our repositories," explained Sweeney. "These apps are able to check if there are owners assigned to repositories to make sure that they don't get orphaned."

GitHub ensures a reliable digital trail for security and compliance. Using governance bots, Sweeney's team can check if the right topics are assigned to the right repositories and trace which business units and products each project belongs to. GitHub also allows individual teams to enforce their own custom security controls.

"Having apps that help automate security within GitHub has been huge for us," Sweeney confirmed. "The repo secrets have made security much easier to manage. It helps prevent passwords from being pushed into the code by providing a similar developer experience from local development through deployment."

When a security vulnerability is discovered, product teams can act quickly. GitHub Enterprise's built-in security alerts notify developers when a vulnerable dependency is found, and then automatically open pull requests with suggested fixes.

Automation and CI/CD

Along with GitHub Apps, developers use GitHub Actions to build and deploy on one platform. Their entire workflows are automated and managed from GitHub repositories—so what used to take multiple steps can now be done in a click or with a single Slack command. "We're actually building out a whole app for our employees in Slack to request a CI/CD pipeline in our GitHub organizations and get a fully operational AWS deployment through a Slack bot," said Sweeney.

Sweeney also appreciates the operational efficiency. Instead of hosting and managing their CI/CD pipeline on top of managing their cloud infrastructure, GitHub Actions picks up the load. "In some cases, we've replaced three servers using a single GitHub Action."

Security is critical, but reliability is important too. We depend on GitHub to deploy our products quickly and safely.

Building faster doesn't mean shortcutting security. Since Dow Jones hosts GitHub Enterprise both on their own servers and on GitHub.com, the team has reinforced their security best practices for users inside and outside their firewall. "You move away from enabling flat network designs and into more sophisticated zero-trust models by having your pipeline hosted on a SaaS," Sweeney said, "and it forces you to maintain security best practices and real authentication." El Lakkis agreed: "We're able to show best practices with examples of tools that we wrote ourselves in security."

Open Source and Community

Dow Jones developers aren't the only ones building more securely. As they've built new internal tools, they've also used GitHub to share them with the world. Tokendito, which generates temporary AWS credentials via Okta, is key to securely authenticating Code to Cloud practices for the entire organization, and any user on GitHub can download it from Dow Jones's public repository for free.

For Dow Jones engineers, "giving away" internal code as open source isn't counterproductive. It's common sense. Senior Security Engineer Pranavkumar Patel sees it as returning the favor. "Every product of ours has been heavily dependent on open source," Patel said. "That's why community development has been huge for us and we wanted to give back to the community."

With GitHub, developers at Dow Jones get the best of both worlds: hosting GitHub Enterprise Server on-premises for source code and securely engaging in open source with GitHub-hosted Enterprise Cloud. Enterprise Server and Cloud include access to features like GitHub Actions along with GitHub Packages. This means Dow Jones developers can create private package registries to use internally while also exploring and downloading public packages from GitHub.com. "GitHub Packages is the perfect fit for the tools we use like Reapsaw, a Docker image that you build and execute as part of your pipeline," explained Patel.

Tokendito, Reapsaw, and other open source projects have transformed Dow Jones into a company known for big ideas—and for attracting top talent. "It's just been two or three years since we joined the open source community. We still have a lot of learning to do, but GitHub has helped us get our tech and our team out in the open," said Patel. Both Sweeney and Cookson confirmed that GitHub has opened the door to new projects and new talent, too. "Open source helps us be part of that community," Cookson said, "not a traditional media company, but a modern and adaptable technology company."

Innersourcing and Code Quality

Engaging in the open source community has transformed how Dow Jones builds software, internally and externally. Teams don't just release new applications to customers faster. According to El Lakkis, they also write better code. "The scrutiny that an open source project is exposed to definitely benefits the project itself. When it's a private project or closed source project, it's more about the business than about solving the difficult tech challenges that we have."

Known as "innersourcing," GitHub has helped Dow Jones' developers bring open source standards like collaboration and transparency into every project. Now developers build on each other's ideas, spend less time on manual tasks, and catch bugs earlier in the development lifecycle.

Conclusion

From supporting the company's DevOps transformation to hosting its cloud infrastructure, Dow Jones can always depend on GitHub's platform and its people. El Lakkis noted, "I'm impressed with the technical knowledge that the representatives have at GitHub compared to other organizations," while Cookson explained, "Security is critical, but reliability is important too. We depend on GitHub to deploy our products quickly and safely."

When Dow Jones breaks news, the company wants to make sure it's delivered in a fast and reliable way so that everybody can know what's going on. GitHub is a key part of that process.