2018 in Review: Spectre, GDPR, and a Humbled Tech Industry

It’s Christmas Eve, and I’m trying to make sense of the last twelve months. 2018 felt like the year tech finally had to grow up, because of consequences rather than a breakthrough product launch.

I spent most of this year at a fintech startup. We went through a startup accelerator earlier in the year, and it was an intense, compressed experience: pitching, mentoring sessions, and late-night rethinks of how we position ourselves in new markets. But even while we were in the accelerator, I kept coming back to the same thought: the ground was shifting underneath everyone in tech, not just us.

Spectre, Meltdown, and the end of hardware innocence

The year opened with the Spectre and Meltdown disclosures : speculative execution bugs in most modern CPUs. Vendors scrambled to patch. Performance took hits that nobody wanted to talk about publicly, but everyone measured privately.

What mattered was the realization more than the patches. We had all been building on top of hardware we assumed was correct, and that assumption was wrong. After January 2018, “trust but verify” applied all the way down the stack.

At the fintech startup, we patched fast and moved on. But I noticed a shift in how I thought about infrastructure after that. Less “this is probably fine” and more “what else are we assuming?”

GDPR hit us. Hard.

May 25: GDPR day. If you were running any kind of service that touched EU user data, you felt it.

We had been preparing for months. Data inventories. Consent flows. Reworking how we handled deletion requests. Figuring out what “legitimate interest” meant for a financial data platform. It was spreadsheets, legal calls, and rewriting data pipelines.

I’m glad we did it. Forcing ourselves to map where user data lived, how it flowed, and who could access it made our systems better, not just compliant. We found data we were storing for no reason, permissions that were too broad, and retention policies that didn’t exist. The first week was rough, but GDPR turned out to be one of the most useful engineering exercises we ran all year.

California passed its own privacy law in June: the CCPA. Different mechanics, similar direction. By December it was obvious that privacy regulation wasn’t a European quirk.

Kubernetes won

I don’t think this is controversial anymore. Kubernetes won the container orchestration fight in 2018. Docker Swarm faded. Mesos hung on in some shops. And with Amazon’s EKS and Azure’s AKS both going GA in June, all three big clouds now sell managed Kubernetes, which removed enough operational pain that adoption snowballed.

We ran our own Kubernetes clusters at the fintech startup. Day 1 was great. Day 2 (upgrades, RBAC policies, monitoring, cost management) was where the real work lived, as I wrote back in January . I think a lot of teams learned this the hard way in 2018. Getting your app onto Kubernetes is a weekend project. Keeping it healthy is a full-time job.

The ecosystem grew fast, though. Helm charts, operators, custom resources. It felt like every month there was a new tool promising to solve the last problem you ran into.

Infrastructure as code stopped being optional

Terraform became the default, if not the only option. Git-driven workflows, plan-and-apply pipelines, policy as code. If you were still clicking around cloud consoles to provision things, 2018 was the year you started feeling behind.

Multi-cloud went from conference-talk fodder to something people did. Not always elegantly. But the reasons were real: risk mitigation, regulatory requirements, pricing leverage. We used it pragmatically at the fintech startup: some workloads on one provider, some on another, tied together with Terraform and a lot of glue.

Serverless found its lane

Serverless stopped being “the future of everything” and became “really good for these specific use cases.” Event-driven workloads, spiky traffic, glue code between services. Cold starts were still annoying. Observability was still rough. But for the right patterns, the economics were hard to argue with.

I think 2018 was the year serverless and containers stopped competing and started coexisting. That was healthy.

Go, Rust, TypeScript

Three language trends that mattered to me personally.

Go kept eating infrastructure tooling. Go 1.11 shipped modules as an experiment in August, and for the first time dependency management looks like it will be bearable. I wrote a lot of Go this year, and it felt like the language was settling into maturity.

Rust went from “interesting but niche” to “seriously consider this for systems work.” The ecosystem was still smaller than Go’s, but the safety guarantees were real. I started paying closer attention.

TypeScript crossed a threshold. It went from “nice to have” to “why would you start a serious JavaScript project without it?” Strong typing, great IDE support, first-class framework adoption. This was the year TypeScript became the default for frontend in a lot of shops.

DevOps just became how we work

Nobody called it a “transformation” anymore. CI/CD pipelines, infrastructure as code, observability, on-call rotations. It was just how engineering teams operated. SRE ideas spread beyond Google. Platform teams became a thing. Internal developer experience started getting real attention.

The accelerator

I keep coming back to this. The accelerator was a highlight of my year, less for the mentorship or pitch practice than for the perspective shift. Being surrounded by founders building for markets I hadn’t deeply considered forced me to think differently about what we were building at the fintech startup and who we were building it for.

I came out of it with a longer list of ideas than I went in with. Some of those ideas are shaping our roadmap for 2019.

What I’m watching for 2019

A few things I expect to matter next year:

• The first big GDPR fines will land and set the tone for enforcement. Everyone is waiting to see how aggressive regulators get.
• CCPA preparation will consume US-focused teams the way GDPR consumed European ones.
• Kubernetes operations will mature. Better tooling for upgrades, security, and cost. The “day-2 problem” is too widespread to ignore.
• Supply chain security will get more attention after this year’s compromised packages, most recently the backdoored event-stream npm package in November.
• Edge computing will move from theory to early production pilots.

Wrapping up

Hardware wasn’t as trustworthy as we thought. Privacy wasn’t optional. Running containers at scale was harder than the demos suggested. The teams that did well treated these realities as engineering problems.

It was a good year. A hard one. I learned more from the constraints than from the wins. I suspect 2019 will be the same.