DevSecOps

Maintaining and developing SDKs for a multiple of languages and platforms can be time consuming and laborious. While there are many ways to tackle such a feat, using open api spec, the biggest issue I've come across is generating SDKs that consume your service in a way that developers can use them. In this talk we are going to look at some ways to create your own customisable SDK generation service, Utilising openapi generator tools and ways to test against multiple language types.

Improve application resilience with chaos testing by deliberately introducing faults that simulate real-world outages. Azure Chaos Studio Preview / AWS Fault Injection Simulator is a fully managed chaos engineering experimentation platform for accelerating discovery of hard-to-find problems, from late-stage development through production. Disrupt your apps intentionally to identify gaps and plan mitigations before your customers are impacted by a problem.

The delta between Kubernetes and a developer friendly PaaS is where the next layer of value is being created today. Many products are racing to fill the void that is called Kubernetes developer experience. This is also the place where things get opinionated, a requirement for reliable end to end workflows. In this talk you will learn about Gimlet.io's approach on how Kubernetes UIs can be quick to use, and safe at the same time. In this talk you will see how you can create a developer platform - with the usual components Cert-Manager, Nginx Ingress etc - and deploy on it with only clicking on a dashboard. You will also see that behind the curtains, all Gimlet does is writing yamls into a git repository. ClickOps.. over GitOps.

Discovering passwords in our codebase is probably one of our worst fears as a developer. But, what if you didn't need passwords at all? Join Chris, as he explores how you can use OpenID Connect to trust your cloud provider, enabling you to deploy easily, securely and safely.

Many of you may be familiar with GitHub for your own Open Source (OSS) projects. But, did you know that you can run your end-to-end development within your organization using GitHub Enterprise? Join Chris for a whistle-stop tour in the day-in-the-life of a developer with GitHub Codespaces, GitHub Copilot, GitHub Actions and GitHub Advanced Security, showing how you can bring Open Source best practices into your day-to-day work (also known as InnerSource)!

A new phenomenon stand out in recent years: security must pervade the entire software development lifecycle. Except it isn't. Current generation of processes and tools is lacking crucial features to properly manage modern security risks. Think of the Log4J event. Were you able to identify all affected components? Were they internally developed, or you need a vendor support? How fast you were able to deliver a fix? In this talk we'll explore the challenges, what you can do with current tools, and which gaps should be addressed by communities through better practices and new tools.

In this session, Chris is joined by DeveloperSteve Coochin, a Developer Advocate at Snyk. In this episode, Chris and Steve talk about vulns in the wild for a bit (well and to geek out in general), especially on the back of some research that Steve did recently on the likes of PHP. Steve has recently been looking into the security vulns that get let in without developers even knowing (Teaser: He was really surprised at some of them!)