War story: shared DB credentials danger

This interview was recorded for the GOTO Book Club.
http://gotopia.tech/bookclub

Lukasz Dynowski - Independent Consultant & Co-Author of "Learning API Styles"
Sam Newman - Author of "Building Microservices" & "Monolith to Microservices"

Check out more here:
https://gotopia.tech/episodes/436

RESOURCES
Lukasz
https://github.com/ludyn-leo
https://www.linkedin.com/in/ldynia
https://learningapistyles.com

Sam
https://twitter.com/samnewman
https://github.com/snewman
https://www.linkedin.com/in/samnewman
http://samnewman.io
http://samnewman.io/blog

Links
https://www.youtube.com/@ldynia1
https://www.youtube.com/playlist?list=PLRkB-vSK4koOHYIhpKXuXpipVpByEKuPu
https://learningapistyles.com
https://github.com/ldynia/learning-api-styles
https://nordicapis.com/the-bezos-api-mandate-amazons-manifesto-for-externalization
https://dl.acm.org/doi/10.1145/1176617.1176622

DESCRIPTION
In this GOTO Book Club episode, Sam Newman — author of "Building Microservices" — sits down with Lukasz Dynowski, co-author of "Learning API Styles", for a refreshingly low-level deep dive into a subject most developers think they already understand. The book deliberately starts from the network layer up — transmission modes, TCP, protocol stacks — rather than jumping straight to REST and GraphQL, because, as Lukasz explains, most API problems only become visible when you understand the substrate beneath them. The conversation covers the full spectrum: public vs internal APIs, the Bezos API Mandate moment, why treating your API as a product is non-negotiable, and why the choice between binary and textual protocols is never as obvious as performance benchmarks suggest.

The real gold comes in two moments. First, Lukasz lays out a crisp checklist for what makes a good API — audience-awareness, maintainability, efficiency, intuitiveness, resilience, security, testability, and documentation that actually matches behavior. Second, Sam shares a war story about a credit derivative system where the only way to figure out who was accessing the database was to turn off the credentials and wait for angry phone calls.
The lesson: context shapes every trade-off, there's no universal right answer between REST, gRPC, WebSockets, or messaging, and the best API decision is the one that fits your situation — not the one that fits the conference talk.

RECOMMENDED BOOKS
Lukasz Dynowski • Learning API Styles • https://amzn.to/3PFembK
Sam Newman • Building Resilient Distributed Systems • https://www.oreilly.com/library/view/building-resilient-distributed/9781098163532
Sam Newman • Monolith to Microservices • https://amzn.to/2Nml96E
Sam Newman • Building Microservices • https://amzn.to/3dMPbOs
Ronnie Mitra & Irakli Nadareishvili • Microservices: Up and Running• https://amzn.to/3c4HmmL

Bluesky
Instagram
LinkedIn
Facebook

CHANNEL MEMBERSHIP BONUS
Join this channel to get early access to videos & other perks:
https://www.youtube.com/channel/UCs_tLP3AiwYKwdUHpltJPuA/join

Looking for a unique learning experience?
Attend the next GOTO conference near you! Get your ticket: gotopia.tech

SUBSCRIBE TO OUR YOUTUBE CHANNEL - new videos posted daily!