Showing posts with label architecture. Show all posts
Showing posts with label architecture. Show all posts

Monday, May 20, 2024

NewCrafts Paris 2024 - A Memorable Conference to Rave About

There are some conferences out there that you hear people speak highly of. NewCrafts is one of them, and I've waited for years for my opportunity to experience it. It finally happened! Thank you Maxime Sanglan-Charlier for having me this year. NewCrafts celebrated their tenth edition, and I celebrated my first. It was a blast.

 

The Day Before

Travels went well and I had planned to use some of my time before evening activities to go sightseeing. After all, it's Paris! I quickly realized, however, that I just didn't have energy for it, so opted for preparing myself for the conference and taking a break instead. Sightseeing will have to wait for the next opportunity to get there.

The evening before the conference, the organizers invited all speakers to a dinner. They treated us to a fabulous place at Radio France - quite an experience! Great place, great food, even better company.

It's such an awesome feeling to see more and more amazing people come together for these occasions. There are usually some folks that I know already from past conferences which ends up in lots of hellos and how have you been and what have you been up to. There are always speakers I haven't met or not really talked with yet, which allows forming initial bonds. Very exiting, somewhat overwhelming, and still much appreciated.

This time was my chance to re-connect and connect with folks like Romeu Moura, Thierry de Pauw, Elizabeth Zagroba, Marit van Dijk, Zsófia Herendi, Sofia Katsaouni, Aki Salmi, Kenny Baas-Schwegler and Alberto Brandolini. Thanks for making this evening a great start into the conference!


Conference Day 1

It's quite a sight when you walk from the hotel to the conference venue and you're walking straight up to the Eiffel Tower. The venue itself turned out to be really nice, coffee and breakfast treats were served on arrival, and organizers provided a separate speaker room to get prepared. All ready to get started! The first day's program made our choice very difficult, all the sessions were intriguing - I'm glad I'll have a second chance for the talks I missed as all of them were recorded. Even though watching videos usually doesn't really work well for me, I have lots of incentive to do so this time.

  • Keynote: From Pilot to Transformation: Embracing the Reality of GenAI at Scale by Patrick Debois. I did not come with expectations for this talk and was pleasantly surprised that it provided more information about generative AI that I have not come across before, especially around the actual implementation, respective tooling and experience.
  • Team Transformation Tactics for Holistic Testing and Quality by me. I've done this talk a few times by now, and it constantly evolved further. According to people's feedback, this edition seemed to have resonated, and I'm glad it was recorded.
  • Human-centred system design by Trond Hjorteland. It was insightful to learn about the history of the Open Systems Theory, which experiments were run and how concepts evolved. The talk was packed full of insights and conclusions, there's a lot more to go deeper into.
  • Workshop: Architecture Modernization: Understanding your System's Current State using Service Blueprints by Indu Alagarsamy. I wanted to learn a new approach for my toolbox and see if it would help me with my challenges that often involve getting people across roles and teams on a shared page. And this workshop did just that! Service blueprints are diagrams that visualize the relationships between different components like people, systems, or processes that are directly tied to touchpoints in a specific customer journey. It's an approach originating from service design. It brings people together across roles as everyone can benefit from the shared understanding, and helps everyone making better decisions. Indu created a great space to try out creating a service blueprint hands-on, and reflect on the different variants we could use to adapt it to our needs.
  • Effective software design: The role of men in debugging patriarchy in IT by Kenny Baas-Schwegler. I loved seeing this session on such a crucial topic on the program and am really happy I could join it live. I very much appreciate that Kenny used his privilege to lead by example and address these difficult topics and convey very important messages that more people need to hear.
  •  Keynote: Don't Hit the Iceberg by Diana Montalion. I really appreciated the points made, along with the encouragement to do better and participate in creating a better environment together. The iceberg model helped convey the message of how things are connected and how systems drive different behaviors. A great reminder for all of us to look out for the invisible parts of the icebergs we encounter, every day.

A conference is not only the sessions you attend. All the informal times before, in between and after the program are invaluable to learn more. Lunch allowed insightful conversations, this time including Michael Plöd, Susanne Kaiser, Anja Kunkel, and Krisztina Hirth. Right after the conference, there were drinks and pizza served, and a meetup took place at the same venue. It sounded very interesting, yet I didn't make it there as I got caught up in lots of interesting conversations. Finally, as it usually happens at conferences, a dinner group formed for the evening. We all enjoyed some lovely quality time together along with nice food. For me a great chance to catch up with Joep Schuurkes, Kostas Stroggylos, and Markus Tacker. 

 

Conference Day 2

Time is flying if so many things are happening. The second and final conference day started, and had once again lots of good stuff prepared for us.

  • Keynote: Power Structures and their Impact on Software by Andrew Harmel-Law. I had high hopes for this keynote as I've seen the speaker with a brilliant talk before. This keynote even exceeded my hopes! Andrew not only presented what I've experienced myself in such poignant ways, they also used their privilege to call out systemic issues that we all must continue fighting to build a better world. My sincere, heartfelt thanks to Andrew for this absolutely wonderful keynote - it's been resonating with me more than I can express and I believe way more folks need to hear it! And on top of this, representation matters and we need to see more neurospicy folks on stage. Andrew included meta talk about themselves, and thus not only provided a role model but also helped normalize talking about the whole topic.
  • Workshop: Leveraging Team Topologies for software evolution by João Rosa. I hoped to learn more about team topologies, potentially uncover mismatches with my mental model about it, and also gain more practice to apply these concepts back at work. The workshop did all this and provided lots of hands-on opportunities to engage with the material. A few things really stuck with me. The core idea to reduce cognitive load and making it the base for our decision making. Shifting our thinking from problem solving to puzzle solving when it comes to designing teams and their interactions, and using the "yes, and" approach to find the next piece. Strategizing against the environment to change it, and intentionally re-shaping towards the future to have the organization aligned in business and tech. Really well structured, explained and facilitated workshop, with an impressive workbook to go with.
  • Shades of Conway's Law by Thierry de Pauw. I'm in awe of Thierry going through all this material on such a complex topic and condense the findings in such a concise manner. There's a lot to digest and think about, and this talk triggered just that. I'll need to keep on thinking about this and matching what I've heard and learned in the talk to what I experience at work, and then to see how I can apply the gained knowledge to help my organization (or at least a sub-part of it) to a better place. Really, so much food for thought in here.
  • My Team Is High Performing But Everyone Hates Us by Stephen Janaway. I hoped for an insightful story from the trenches - and I got one! Could relate with a lot of what had been shared, and loved the condensed playbook with sage advice for our own contexts. Really engaging presentation and great storytelling as well!
  • Bring meaning back to your retrospectives (no matter your role) by Sofia Katsaouni. At first, I didn't plan to come to this talk as I felt I had already engaged with the topic so much in the past, so what's there still to learn right now. After getting to know Sofia better, I decided to join nonetheless and give it a try, allowing myself to find serendipitous new insights. I was not disappointed! I really liked how the talk encouraged everyone to reflect on our own experiences and gain a deeper understanding on what likely happened in certain situations, and how we could approach similar ones differently in the future. Although nothing of what had been shared was completely new, the arrangement was unique and did inspire to take further steps and go deeper into the respective topics, once again.
  • Keynote: Technical Neglect by Kevlin Henney. I've heard Kevlin speak at a conference many years ago and had high hopes for this keynote, especially on the given topic of technical "debt" as it's often called. No disappointment here! It was an amazing and very insightful spotlight on what's so often happening, and also gave tangible advice on how to turn our ships around and get them back on course. This will be a talk I'll refer people to a lot in the future.

What about the rest of the day? During lunch time, I really enjoyed conversations with Vitaly Sharovatov, Minh-Tâm Tran, Elizabeth Zagroba and Joep Schuurkes.

When the conference was over, lots of people had to leave right away. Some people joined for another drink, and we once again found a wonderful dinner group to enjoy the rest of the evening with. Many thanks go out to Marit van Dijk, Mathias Verraes, Alberto Brandolini, Kevlin Henney, Michel Grootjans, and Stéfanie Loiseleur.

That not being enough, of course we ended up in the hotel bar before it was really over. So here's my shout-out to Indu Alagarsamy and Javiera Laso - thanks for the perfect closure of a memorable conference!

 

Conclusion

Would I recommend people to join NewCrafts? Yes, absolutely. Especially if you want to grow beyond your current position, role and expertise - if you are eager to learn more about the world and the socio-technical systems we're working in. You will not only hear about tech and culture topics that are relevant right now for your work, but also about all kinds of horizon-broadening topics to help you grow further as a human. Add to that a really smooth conference experience, and an inspiring crowd to learn with. People raved about this conference, hence I really wanted to go. Now I'm part of those people, and I really want to come back!

Posted by at No comments:
Labels: , , , , , ,

Tuesday, September 12, 2023

AskAppSec - Input Validation

Input validation is a topic that's been following me around for years. I've came across countless resources speaking about the importance of input validation, or input filtering as it's called at times. What stuck with me is the recommendation to validate any input coming from any source, no matter if we're speaking about third parties, public interfaces we offer ourselves, internal services behind a firewall or accessible only from inside a private cluster. No matter if the input comes via clients, APIs, messages, data sources, or anything else. Based on my experience of working in testing and quality focused roles for over 14 years, I couldn't agree more. All that makes a lot of sense to me. Not only from a security point of view, yet also from a holistic quality perspective as input validation can help prevent errors, improve usability, increase observability, and more.

Here are a few interesting resources speaking about input validation from a security standpoint.

Well. Seems convincing people to validate input is also a common challenge in AppSec; it definitely is in my bubble advocating for better quality outcomes. Most frequently I've seen these discussions when working with backend for frontend (BFF) services. This architectural pattern is often applied when you develop mobile applications, yet not limited to it. It is usually found along with having a bunch of downstream services that are all tasked with different duties. The BFF acts as the main entry point or proxy for a single client (e.g., the mobile app), hence only this API is public to the outside world. Any requests are routed through the BFF to the respective downstream backend services (which are usually protected further). Doing so, the BFF orchestrates incoming requests to different services; it can take care of authentication and authorization, as well as filter and aggregate data in order to respond with the needed information.

If you'd like to learn more about BFFs and see visual or code examples, I found the following resources useful.

What about input validation for BFFs now? What I've heard frequently from colleagues can be summarized in the following statements.

  • "The BFF is just an API gateway."
  • "The BFF should not contain any logic, just pass through anything it receives to the backend services and vice versa."
  • "Only the downstream backend service behind the BFF should validate input as it's their responsibility, otherwise we replicate the same logic everywhere."
  • "Well, it's okay for the BFF to do sanitization, yet not validation."

Here's my viewpoint, and I'm very curious to hear further opinions.

Any modular component of our system needs to sanitize and validate input coming from outside in order to prevent falling into an unknown state. This is both causing poor user experience as well as presents an attractive situation for malicious actors looking for further insights that can be used for exploits. Components include frontend clients in favor of usability, even though malicious actors can easily circumvent them. As long as there is an interface accepting data from another source, there should be validation. Under that premise, I do think that also BFFs should validate incoming data, especially from the public facing side, yet also from internal backend services or other data sources. The BFF is one of the first layers of defense we have, hence if input is validated, we leave the door less wide open. We cannot rely on underlying backend services having foreseen anything that could enter the system from the outside and having sufficient mitigations in place; especially if they are developed by other teams in other contexts who might not even realize the impact of their local decisions. Also, lots of people tend to underestimate threats coming from within the company, like malicious insiders or mere human mistakes. I do understand that it's not always pragmatic or feasible to validate input on all boundaries. Yet if we have to decide, I choose validation at trust boundaries, like between the BFF as public interface and the outside world, as a minimum.

That being said: context is crucial, as always. Maybe the policy to only validate on the most downstream service works well in your situation. Maybe this is considered way too dangerous as you might be aware that specific services are not in good shape. Or maybe your product domain's nature means you're dealing with lots of confidential, sensitive data and you are more invested in keeping people out right at the door (aka the BFF API) without letting them any farther in. As usual, it depends on the risk appetite of the company, combined with your own ethics of what potential impact and harm you deem acceptable or not.

One thing I learned over and over again in my career is that arguments might convince rationally, yet they often don't reach people in a way that they change their behavior. They usually need to experience it, and usually a few times (and I'm not excluding myself in this equation). The trouble with security and similar quality aspects: I want to prevent the experience of harmful impact as much as possible. Speaking of the topic of whether it makes sense to validate input also for BFFs. I could of course invest in exploiting lack of validation, or showcasing a close to real situation, yet it's effort that still does not easily change the narrative and then behavior. If you have any further idea or tactic for these kinds of situations, your input is appreciated.

All in all, I do have a strong opinion on this topic, yet I hold it loosely enough to allow myself to be convinced by better ones. I did find posts that support my standpoint, like "Web App Security: Understanding The Meaning Of The BFF Pattern" by Syed Wahaj - yet that might be pure confirmation bias. So, I'd sincerely love to hear your thoughts and experience about this and learn more: should BFFs validate input?


UPDATE: I've shared this question with the wider community and received some validating feedback. My appreciation to everyone who offered their thoughts!

What I found especially insightful was the following input from a We Hack Purple Community member, hence sharing it further with their permission so it can help more folks besides me. I think they nailed it, so I mostly maintained the original take with slight format editing from my side.

I think the answer to "Should BFFs validate input?" really depends on what it does with the data. The BFF will need to validate some input, but not necessarily all of it.

Generally, anything that looks at the data, parses it or interprets the data in any way will have to validate input.

A BFF will likely look at the HTTP request headers, so it has to validate those. It cannot assume that the request headers will be sensible, or not malicious. It may also have to decide how to deal with duplicate request headers, etc.

But maybe the BFF does not look at the request bodies, and just passes them through to the backend.

It probably would not make sense to duplicate lots of application logic in the BFF to perform application specific input validation on data the BFF itself does not process. Unless, maybe there are very common things that may make sense for a BFF to filter out before bothering the backend with it. But that would then be a bit more like a WAF that may do some general input validation, like looking for common SQL injection patterns. And this still does not absolve the backend from its input validation responsibilities.

The backend services will always have to validate the input they are handling, but even backend services may pass some data through to other downstream backend services. The important thing is that everything that looks at the data and processes it performs validation, whether that is a web server, an API gateway, a web API, or a BFF.

My deepest thanks go out to the person who took the time and energy to elaborate on this. They made the distinction I was looking for (without knowing I was): what exactly makes sense to validate where and why, given the specific context at hand. I think this is what I struggled with myself and hence struggled to convey more clearly to colleagues. Taking this explicit distinction, I feel enabled to map it to our context to make better informed decisions, and I also feel equipped to bring more clarity to the next conversation on input validation!

As a bonus, here's one more thoughtful response allowing us to weigh further aspects against each other.

Posted by at No comments:
Labels: , , ,

Friday, September 1, 2023

SoCraTes 2023 - A Place Where I Belong

I nearly didn't go to SoCraTes this year, the "International Conference for Software Craft and Testing". My speaking budget was already strained, my schedule overbooked, and it would have meant going on vacation time. But then the organizers reached out and offered me yet another slot on the training day this year. They were even fine with me giving a workshop I already had prepared, and I changed my mind. I seized the opportunity and went to SoCraTes on vacation. What can I say, I don't regret it one bit! Granted, I'm super tired, and at the same time I'm super happy. It was so much worth it and convinced me to reserve this time of the year for 2024 as well!


Coming Back

It's always super exciting to join a conference for the first time. The second time around, a few things are already clear - you know the venue, more people, the procedures and other things that reduce your cognitive load. Still, the second time is curious as well - how will they welcome me this time? How easily can I reconnect to where we left things last year?

The first moments are awkward for me, at any conference. At SoCraTes, this very quickly vanished into a feeling of belonging. I felt welcomed, I was included, I had a right to be there. This is the foundation for everything coming afterwards.

My first contact after seeing familiar faces at registration was a person being there for the first time, Lydia Leifels - such a pleasure right from the start! At dinner, I met dear people I already know for a while, like Tobias Göschel, Thierry de Pauw (along with their daughter), Juke Trabold, and Woody Zuill. There were so many awesome folks I got to know or meet again over the course of the conference! Like Janina Nemec, Marc Kalmes, Stefan Scheidt, Claudius Link, Lea Rosema, Waldemar Tomme, Martin Schmidt, Markus Tacker - well, the list could go on and on.


Training Day

The second edition of the training day was even better than the first one. Trainers were amazing both times, yet for this year organizers listened well to the feedback and crafted a schedule of three tracks with each session having enough time to dive into the topic and generous breaks in between. Just awesome. Here's the choice of sessions I made.

  • "Enforcing Architecture Using Tests" by Javiera Laso. This was the first time I heard about ArchUnit, a library to check for conventions like file names, structure, dependencies and more.  Writing tests was quite straightforward, and I can see how these could support maintainability and reduce friction by codifying agreements.
  • "Modernize CI/CD Session" by Raimo Radczewski & Chris Neuroth. Very interesting talk sharing fundamental principles for a pipeline optimized for quick feedback while going small, safe steps. They demonstrated live how fast a change can be on production. A few statements I really related to were these: "minimize the time from code written to code on mainline, deployed to real users, running in a real environment, ready to be evaluated - there is no other way to develop software sustainably", "influence the loops you can", "the moment we stop slicing we deliver slower", "skip the review, pair with someone".
  • "Ensemble Exploratory Testing" by me. Fun fact, I've given this workshop now for the 10th time so it became my most repeated conference session ever so far. Good thing is, it seems it doesn't get old! This time again, people were eager to join and seemed to enjoy the learning experience (which hopefully convinced them to try new approaches back at work). Well, I had fun observing people having lots of aha moments together.
  • "Take a mess, make a mess, fix the mess" by Aki Salmi. A very interesting session on refactoring code that's untestable and contains hidden domain concepts, code that's still valuable yet needs to be modified. How? Together, we tried an approach many of us had not seen before: not even trying to understand the code in the first place. Instead, using the IDE's automated refactoring tools to slice it up first, turning hard to test code into easy to test code. Then we can document its behavior in tests, and hence gain our safety net to make the required changes. Check it out, you can follow every small commit Aki made. Nicolas Carlo also wrote a great post on this where you can follow an example: "Another way of refactoring untested code" (by the way, his newsletter is super insightful and a clear recommendation).

After the training day ended, the main part of the conference was opened with a world café. Find a group of people you don't know, take a question as starting point, see where the conversation leads you and doodle your insights on a shared canvas. After a given time box is over, everyone find themselves new groups besides one person staying at the table and getting the newcomers on the same page. Repeat until you finished three rounds. Really nice exercise, perfect to get to know first people ahead of the main conference part and have interesting conversations emerge. One main theme we had was on people, community, culture and how that's foundational. In case you're wondering where to start, I have a resource collection on inclusion that really helped me.

That's not the end of the day, of course - SoCraTes goes all in! Everyone is at the same place, we're together the whole time, so of course there's an evening / anytime during the night / morning schedule with bonus activities suggested by anyone. Such a good thing our hotel rooms are right there to retreat and rest any time. I love how Juke as facilitator and also organizers continuously emphasized the importance of caring for your needs and taking breaks.

Having learned from last year that joining all sessions can be quickly very exhausting, I decided to use the evening time for conversations and enjoying both atmosphere and company of wonderful people.


Open Space Day 1

Days start early at SoCraTes for me being a night owl, yet it's worth it. In its core it's an unconference offering an open space for everyone to bring their topics. Things they want to share, conversations they'd like to have, apps they want to build, tools to try out, skills to practice - and also challenges they'd like to get help on. With so many different people, there's a whole range of topics offered, covering a spectrum of deep dive tech topics to humans and culture as foundation for everything. No matter if it's very personal, related with our professions, challenges in society, or all combined, everything is represented. There are also sessions like doodling together, painting your nails, talking about sheep, whatever is most valuable to people right now. Be prepared to be surprised! This format of building your own schedule together on the fly works amazingly well. It definitely worked out well for me again this year.

  • "Web accessibility - building beautiful web sites that don't make you puke" by njan Völker and Lina Sievering. I had hoped to learn more about accessibility at the conference, and already the first session was right on spot! Awesome workshop focused all around motion sickness induced by websites and apps. A topic close to my heart as I'm affected myself. Njan and Lina provided mindful and enlightening exercises to convey the problem and think of more accessible options together. Thanks to them, I also learned about the European Accessibility Act becoming effective as of 28 June 2025 - which means accessibility will be enforceable in Europe which hopefully gives us more leverage for accessible solutions when making product decisions.
  • "Capture the flag together" by me. As part of my personal AskAppSec challenge, I recently tried out further services offering hacking labs like TryHackMe and Hack The Box to practice penetration testing. The first challenges were good fun to me, so I thought why not offer a session and do it together during the open space. I was positively surprised how many people came and joined me! I opted for Hack The Box and their starting point machines. It worked super well, people were engaged, shared lots of knowledge and we captured a flag together (the second we missed only due to my VPN interfering). A very insightful experience, validating my assumption that there's interest and these could be great sessions for more people to learn about security in a fun way.
  • "Security for devs (& everyone)" by Claudius Link and me. The more security sessions the better, right? So why not host another one, together with Claudius who had the same idea. We had a great conversation with people bringing up all kinds of insights and common challenges. Nothing was immediately new for me, and yet it was validating to hear experienced people share similar views.
  • "Documentation as Code" by Markus Decke. We work together at the same company, and we are transitioning to having more and more documentation as code, so I was curious about other people's ideas, struggles and in general experiences. We talked about benefits and use cases, shared tooling options and their limitations. One of the main themes was around what problem we're trying to solve and then aim for tackling exactly that, nothing else not to document only for the sake of documentation.

What about the evening? Well, after open space is before open space! As mentioned, there's always an evening schedule people are building up. Once more, I opted for dinner, conversations and more fun time! Last year I discovered that Janina Nemec is an absolutely pro in playing Set, a card deck game I've learned to love through the testing community. At first we didn't spot any deck so decided to opt for a round of Exploding Kittens (so much fun) - and finally discovered a Set deck in the end. Well, next year we're prepared to bring our own decks. Such a good way to close the day.


Open Space Day 2

New day, new schedule. Every day starts a tiny bit later, which is still early for me. And yet it was awesome again and worth the early start.

  • "Stop being a superhero!" by Janina Nemec. She did an early dry run of her upcoming talk to be presented at Agile Testing Days this year - which is your chance to catch this talk, you'll be in for a treat! Janina has vast experience of working in an ensemble full time for many years. In her talk she describes (superhero) behavioral patterns she's observed (like the architecture wise or the coding wizard - way too relatable) and the pain points that result from them (like lots of work in progress without things getting done, or the behavior not helping the team grow and work sustainably). There's a solution for this: working together as an ensemble, or team programming as she calls it - saving the world together.
  • "Build a minimal showcase app" by me. I have a recurring argument around a security topic and wanted to finally start building a minimal app to demonstrate good security practices. So what could be better than get this started together right at the conference? Nonetheless, I nearly didn't dare to suggest the session. And then I thought no one shows up (I didn't realize it was break time). Until people did show up and we formed a wonderful little ensemble helping me get started on a good way. Everyone else enjoyed setting things up and realizing that we all struggle in certain areas. When doing it together, however, we usually have the missing piece of knowledge in the round to avoid friction, solve problems without frustration, learn with fun, and get to value fast. A pleasant experience, would have loved to continue together.
  • "Security scanning in pipeline" by Raimo Radczewski & Chris Neuroth. Both wanted to try out security scanning tools like Trivy, Syft and Grype on a real case example and see how they work and what value they bring. A really interesting session that then also sparked a serendipitous hallway conversation on why attack trees might work better compared to threat models in order to get people to think like malicious actors and consider risk.
  • "Security games" by Claudius Link. He brought a whole bunch of games to teach security in a safe space with fun. We could try out a few of them and gain experience how they could be used for educational purposes. Games like Elevation of privilege and OWASP Cornucopia, yet also [d0x3d!] and a lot more I can't remember. Now I know there are a lot more out there to try out!

This was the last day for the main part of the conference, so we closed it with a retrospective. The best part here was that it didn't merely gather feedback for organizers and Juke as facilitator, it also was  intended to provide feedback for each other as participants. Over half of my group were here for the first time, and I just loved hearing their feedback and also input to make it even better for each other.

A gratitude round followed. The challenge was to thank five people we have not thanked yet. Honestly, this experience was a bit overwhelming, in all the best ways - and more than one feedback took me by surprise. I haven't mentioned yet, this conference goes big on hand-written kudos cards you can hand out any time for anything you appreciated the other person doing. The ones I received I will keep with me for long, they present such a dear memory.

Dinner followed with more great conversations. Then further sessions were hosted (remember, the evening schedule). I had a great time joining a code kata ensemble. We did the "Vending Machine Kata" which was an insightful exercise itself, yet my main takeaways were on the collaboration part. It was fascinating to see an ensemble start off quite free style and converge to more structure like having a dedicated navigator, using a timer for rotations, having the navigator stand up to be more prominent, etc. It just worked better with folks who have never worked with each other in this way. Also, we used the fish-bowl approach to ensembling, having outside observers and always open spots to join the ensemble. This exercise made me realize once again that this approach is simply not for me, despite having super kind and safe people around me it felt exclusive. I'm very sure it's actually more inclusive for other people to opt in. For me I much prefer the "all together just one ensemble without observers" format.

Last but not least, a retro gaming session! We played the old adventure game "Zak McKracken and the Alien Mindbenders" all together on a C64 system provided by Tobias Göschel - how awesome was that?


Workshop Day

Have I said the conference is over? There's still the additional workshop day! And what better format to have than asking people to bring their topics for hands-on sessions also on this day. It's also the time of the traditional code retreat, practicing the whole day solving the same kata in various ways. Originally, I was adamant to join the code retreat again, it was simply an amazing experience last year. And then Claudius Link came and suggested the only thing that could possibly lure me away: co-facilitating a security workshop. Well, what shall I say? I couldn't resist, this fit way too perfectly to my personal AskAppSec challenge this year.

We aligned on our main thoughts of what to aim for, pitched it to a fellow participant, incorporated the feedback, and came up with a workshop on "Painless Security". We crafted the agenda shortly before and went ahead with it, playing it by ear and experience in giving workshops. Having co-hosted a session the other day helped, too. Co-facilitation worked super well together, we often thought along the same lines and built on each others ideas. People shared many painful experiences and we gathered potential things to try out and what we related with most to bring back to work. I took a lot with me myself.

During lunch time, the security theme continued for me. First thinking about security conferences and ideas to contribute to the space together with Claudius Link and Susanne Neunes. Heading back towards the conference rooms, I noticed another table where Martin Schmidt and Philipp Zug, who also both participated in our security workshop, were scheming on a new security card deck. I loved the idea and they were so kind to invite me in. Well, it seems I got myself involved in two new topics - and yet I feel these are very much worth it.

I decided to check out what other sessions might still run that I could join. First, coffee though - and that's when Matthias Klass approached me and asked whether we might have another capture the flag session together, as a couple of people expressed their interest. Well, I didn't need to check the schedule anymore, security theme it was for the whole day! Of course I'll host another capture the flag session. What can I say, it was awesome! We spent the whole time until we officially had to leave the room and head for dinner. Nearly instantly, the idea popped up whether we could ask the hotel for opening the room once more during the evening. Asking was worth it, we got the keys and went all in after dinner. Many more rounds of capturing flags followed until everyone was so tired we couldn't think anymore - while being just super happy. Some of the challenges tackled were very familiar to us and hence solved a lot faster, others required us to piece together knowledge we usually don't need. All of them were very insightful and fun. So much fun. I loved that we all worked together so effectively as a big ensemble again. I really want to do more of this.

There's a traditional count of code katas done at SoCraTes, counting each exercise by everyone. I was really moved seeing so many people join me on practicing penetration testing, staying with me for so long and sharing my enthusiasm. It felt we just established a new counter at SoCraTes next to the code kata counter: the captured flags counter, aka the number of security secrets discovered. We collectively increased it to 8 overall! 


Why again next year?

Heading home, my heart was full, my brain energized, my body tired, and me super happy. I was certain that if I have any chance to be back next year I will take it.

Besides the obvious reasons of self-selected, very insightful content and just amazingly kind and inspiring people, there's a reason that is even more important. This conference is the best I've seen so far in intentionally designing welcoming and inclusive spaces. They continue to reduce friction and make it more accessible and safer to more and more people. Literally every year. There are lots of aspects of this to be found everywhere. Not only in the code of conduct that's actually being lived and enforced, or offering all gender toilets, or giving away tickets based on a lottery to level the playing field. It's in every little detail. Less noisy applause by waving hands. Exact food labelling and plenty of options for everyone. Child care service so lots of parents could join this year. Sharing Covid tests upfront for every day and encouraging masks.

The level of diversity already achieved has a huge positive impact on the quality of conversations and insights gained. A lot to learn and take with me to do better myself.

Posted by at No comments:
Labels: , , , , , , ,

Sunday, February 16, 2020

DDD Europe 2020 - About Close Collaboration, Shared Language and Visual Models

Last week it was my first time at DDD Europe, and it was great. Although it was a pity to miss the fifth and final edition of European Testing Conference which took place at the exact same dates and even the same city, I was still very happy about this opportunity to explore a new community and gain a foundation in domain-driven design. I heard lots of great things about DDD Europe from different people, one of them being my colleague Thomas Ploch, who also got accepted as speaker this year.

In the beginning I didn't know what to expect of this conference and the DDD community that was new to me. I've seen the program with lots of big names, I've seen the sessions offered on topics I've merely heard about, and I wasn't sure whether my sessions on the mob approach would be a fit for this new audience. Quite intimidating, and yet also very exciting - a great learning opportunity.

Brace yourself - it was a long conference week, this is going to be a long post. It was worth it for me, though!

Arriving in Amsterdam

Sunday evening before the conference I've arrived at the hotel where most of speakers and attendees alike had been accommodated. I had some time to prepare myself for the week and practice my upcoming talk.

No one else from the conference was to be seen yet - or at least I couldn't make them out, as once more I entered a new community here. My colleague Thomas arrived the same evening as well so we had a good time over dinner and then made it to bed early. We knew it was going to be a long week; and it was indeed. A week where I learned once more about the importance of close collaboration with all parties, of evolving a shared language with everyone, of visualizing mental models to help us think, of experimentation and continuous learning. Lots of familiar topics, looked at from a different angle that was new to me.

Training Days

Both Thomas and I decided to participate in Nick Tune's and Kacper Gunia's two day training "Strategic DDD using bounded context canvas". I knew Nick from SwanseaCon and I hoped this workshop would provide me a quick hands-on introduction to all things DDD. I was not disappointed. We discovered our example domain using the business model canvas, did event storming and rule storming. We learned about bounded contexts, message flows, strategic classifications, and more. We used Nick's bounded context canvas, discussed ubiquitous language and policies, model traits, context interfaces, and sociotechnical architecture. We discovered lots of valuable heuristics along our way, too!

By joining this workshop I gained lots of new insights and pieces of knowledge which triggered lots of new thoughts. What a great entry into all things DDD, learning about concepts while applying them. I loved that we did lots of hands-on interactive exercises and mixed formats that we can take home to improve collaboration and architecture. I felt this training helped me right away to have better conversations about architectural topics. The long term impact? It made me curious to learn more, especially to see how we can bring people from different areas of expertise together and discuss a holistic view on everything.
The first day ended with very nice dinner conversations with Thomas Ploch, Maxime Sanglan-Charlier, Jennifer Carlston, and Thomas Bøgh Fangel. What a great group! The second day? Well, it also ended with a nice dinner - one of my favorite parts of every conference. This time I had the pleasure to get to know Zsofia Herendi, Roman Sachse and Marcello Duarte. What a nice crowd already, thank you all for the warm welcome into the DDD community!

DDD Foundations and Speakers Dinner

The main conference was preceded by a day of two smaller conferences taking place at the same time: DDD Foundations (curated by Nick Tune) and EventSourcing. People signed up for one conference could join sessions of the other one as well. In the end, however, I decided to stay with the foundations conference as one of my goals was to gain a fundamental understanding of DDD - so this sounded like the perfect opportunity. Check out my sketchnotes for the talks to learn more yourself.
A word of warning regarding my sketchnote for Alberto Brandolini's keynote: it really does not do it justice. This keynote was amazing and I could only put down a fraction of all the ideas shared. I so much related to this keynote, Alberto shared lots of wisdom on all things collaboration, experimentation and learning together. I'm very much looking forward to watching the recording when it's published, and I can only recommend it to you as well.

In the evening the speakers dinner took place. Once more I got to know more people, once again had fantastic food and even better conversations. Thank you all so much!

DDD Main Conference and Further Networking

The main conference days arrived, and with them also my own sessions. First of all, here are the sessions I joined including my sketchnotes of them.
It was a real pleasure finally listening to Kent Beck and seeing him perform on stage. What mastery. He derived the keynote content from conversations he had with conference participants. He drew his slides live in front of us. He lectured us in a unique entertaining way while still conveying important messages. What really resonated with me was to "insist on feedback before we make another decision based on risky assumptions", and that "waterfall is back, it stopped apologizing and it needs to be killed with fire."

During these main conference days, it was also up to me to perform. When first seeing the venue I couldn't resist and peek into the hall where I was supposed to speak - and I was in awe. My respect raised immediately. This theater hall accommodates up to 800 people! In the end it wasn't filled with 800, but still it was the largest stage I've ever put my foot on so far; and also the largest audience besides TestBash Brighton.

So here I gave my talk "A Story of Mob Programming, Testing and Everything". It happened to be in the last slot of the first day, with only lightening talks taking place at the same time. Therefore people thought it would be a keynote! It wasn't scheduled as such though, and yet people told me it didn't matter to them as they still think it was a keynote. I decided to stop correcting them and taking this as a compliment! :) I'm really happy it got recorded, too.

When hearing great feedback about my talk I was very relieved. It seems the topic resonated very well with the DDD community. One of my highlights here was that also Kent Beck listened to my talk, and afterwards I finally could speak with him for the first time. Now, there's a story to it. In the beginning of 2017, when my public speaking challenge started, Kent suddenly followed me back on Twitter (I assumed Lisa Crispin retweeting my stuff made this happen, so thanks to Lisa!). I couldn't believe it, so I wrote Kent a direct message telling him how honored I felt - and he said he liked my blog posts. This resulted in a written conversation over the next weeks that left quite an impact on me, encouraging me to go further on my journey. That was it back then, we never met. Now was the first time I had the chance to speak with him in person, so I grabbed it and contacted him again. And then, right after my talk, it happened. He found me and said he had been listening to me. He asked whether I would like to get feedback (absolutely!) and he shared very valuable thoughts with me how I could further level up as a speaker. Seeing him keynote the next day and having a longer conversation with him afterwards was truly inspiring! Lots of food for thought for me.
Following up on my talk closing the first day, I had a hands-on lab session on the second day on the topic of "Mob Exploratory Testing". I had given this workshop a few times already, and always revised the concept to improve it further. Just like this time, and it worked out very well. The audience was great! All of them wanted to be part of a mob, so we split into several mobs, mostly small ones around laptop screens, and two larger mobs working on bigger screens. Huge shout-out to Tobias Göschel who volunteered facilitating one of the big mobs! Great help and he said he learned a lot in this role, too. Overall, the two hours went very fast, people had fun and learned lots of things in short time. That's exactly what I like to set up the environment for! Mission accomplished.

The main conference was great, and there were even a few people I already knew. I had the pleasure to meet Kostas Stroggylos again who I knew from Agile Greece Summit, Gojko Adzic whom I met at several conferences already, and Romeu Moura whom I first met at European Testing Conference.

The conference evenings were great as well. On day one we had a huge dinner group where I finally met Tobias Göschel for the first time, on day two some of us joined lots of European Testing Conference speakers for dinner, bringing two great communities together and enjoying lots of insightful conversations. So good to meet many wonderful people from the testing community there! Among them my power learning group mate João Proença - although time was short I thoroughly enjoyed speaking with him in person again.

Sightseeing and a Long Way Home

Saturday arrived, the day I planned for sightseeing; so that's what I did. In case you'd like to see these parts of my conference speaking journey as well, feel free to follow me on Instagram. In the evening I joined Romeu Moura and met Felienne Hermans for the first time - what a pleasure! We had a great time together.

That should be it. I was supposed to leave Amsterdam the day after, yet life had different plans. Due to the heavy storm going across Europe, I got stranded. Instead of returning home and resting the next day, I had to wait at the hotel, the Amsterdam airport, Frankfurt, again a hotel, the Frankfurt airport, until I finally arrived home on Tuesday noon. Nothing but tired.

Still, I was happy about my time at DDD Europe and getting to know many great people. Thanks to everyone for welcoming me and sharing experiences with each other. The conference was very inclusive, and made an active effort to be so by offering gender-inclusive toilets, food for everyone, making the Pacman rule really work, and more. I loved the variety of super interesting topics. So many great speakers, no matter whether they were renowned already or not. All that combined with a very smooth organization - everything worked perfectly. Thanks so much to the fantastic organizers, you did an amazing job here and treated people very well. Looking forward to another DDD Europe!
Posted by at No comments:
Labels: , , , , , , , , , , , , , , , , , ,
Subscribe to: Posts (Atom)