In day one, you'll see and work with a practical example of going from no code to a deployed feature.

In day two, you'll learn various techniques for keeping an existing code base clean.

This workshop is an in-person, hands-on companion to the book 

Tools and techniques for writing and maintaining a code base that fits in your head.

Developers who have suffered through a few bad projects.

C# code examples are written in a style friendly to developers working in C#, Java, TypeScript, C++, etc. Hands-on exercises are in C# on .NET Core 3.1. You don’t have to be a professional C# developer, but you should at least feel comfortable trying your hand with C#. You can get assistance during exercises, but we will not have time to cover basics of installation, compilation, syntax, and such.

You'll need a development environment that enables you to work with C# on .NET Core 3.1, a Git client, and (for some exercises) SQL Server Express. If on Windows, Visual Studio Community Edition is a great fit. In general, free versions of those application will be sufficient.

2 Days

Code That Fits in Your Head

.NET

Architecture

"Hack Yourself First" is all about building up defensive skills in developers. It looks at security from the attacker's perspective and takes them through the steps necessary to exploit vulnerable software on the web so that they can experience hacking first hand. Workshop participants are set specific goals they must complete that involve probing for risks and then exploiting discrete vulnerabilities in a specially built vulnerable application. The interactive nature of the workshop means that multiple attack vectors are usually identified across the spectrum of participants and each person contributes their own unique perspective as to how specific risks are exploited.

The objective of the workshop is that each person walks away with demonstrated experience across a broad spectrum of specific risks. They not only learn about but also demonstrate practical experience across a range of different vulnerabilities targeted to the specific needs of the group.

Courses run for two days on the following schedule:

The first day build fundamental security skills that all technology professionals delivering applications on the web should posses:

- Discovering Risks via the Browser
- Using an HTTP proxy
- XSS
- SQL Injection
- CSRF
- HTTPS
- Framework Disclosure

The second day delves deeper into online risks, covering more advanced topics in greater depth:

- Password Cracking
- Account Enumeration
- FiddlerScript
- Content Security Policy
- Session Hijacking
- Subresource integrity
- Brute Force Attacks
- Automating Attacks and Review

Attendees will get taught the mechanics of each of these risks and of course the defensive patterns required to defend against them. But more than that, they get exposed to how to think about security; how to apply it in depth via multiple defences, how to choose appropriate controls based on the specific risk of the feature and how to have the discussion about what makes sense in different circumstances.

Above all though, security is just one factor in delivering working software and it has to be applied appropriately. Sometimes it comes with a trade-off against usability or cost and decisions have to be made about not what's just most secure, but what's in the overall best interests of the product being built. This workshop helps those who attend have the right discussions about when and where to invest in security.

- Software Developers
- System Administrators
- Testers

This workshop is aimed at any software developer, system admin or tester who wants to get a better understanding what is going on in cyber space if it comes to hacking and cracking of systems. This workshop enables you to take a pro-active approach and you learn how hackers will try to break your system. This workshop will be an eye opener for most attendees and it is the starting point of becoming a better developer. It all starts with awareness and improving your own habits. So start hacking yourself first, to become a better developer!

Attendees will need to use their own computer with one of following software options installed: Fiddler: 

https://portswigger.net/burp/communitydownload

If possible please also bring your smartphone.

Hack Yourself First: How to go on the Cyber-Offence

Security

Venue: Rebel

This will be a hands-on workshop designed for beginners in functional programming. We'll do lots of domain modeling exercises starting with some simple models and then enhancing them with constraints, state machines, error handling, commands and events, and so on.

The core concepts of functional programming and how they can be applied to Domain Driven Design

How to represent the nouns and verbs of a domain (e.g. the ubiquitous language) using types.

Why representing the domain model using types is better than UML or other documentation (hint: it can never get out of sync)

How to capture constraints and business rules in the domain model itself instead of being buried in the implementation

How to treat errors as a part of the domain

How to build a complete business workflow from smaller components using composition

How to design a functional architecture with bounded contexts, validation, I/O and on.

At the end of the workshop you'll know how to accurately represent a rich domain using some simple code which can then be used as the starting point for an implementation.

Domain Modeling Made Functional

Functional Programming

Once upon a time, software was simple. You built a website, connected it to a database, and you were done. Then customers started asking for APIs, mobile apps, notification emails, realtime chat… Today, cloud hosting lets us build “elastic” systems – websites that automatically scale up to handle demand; message queues and publish/subscribe patterns to handle spikes in traffic and workload without impacting your end users.

If you’re just starting out with distributed systems design, the possibilities can be overwhelming. APIs, message queueing, REST, GraphQL, gRPC… what should you choose, how does it work, how do you get started?

This workshop gives you a hands-on introduction to the most important messaging patterns used in modern application development. Using C# and .NET, we’ll build a series of small example apps and services, wire them together using these patterns, and discuss how – and when – you’d apply the same patterns in your own applications.

HTTP architectural patterns – XMLRPC, REST, GraphQL

HTTP frameworks: WebAPI, NancyFX, ServiceStack

Working with HTTP APIs: testing and tooling

Exercise: building an HTTP API client and server

Message queueing in .NET – Redis, MSMQ, EasyNetQ

Advanced architectural patterns: CQRS, event sourcing

Exercise: building a pub/sub system using .NET

History of RPC on .NET – SOAP, DISCO, WSDL, WCF

Exercise: high-performance architecture using gRPC

Integrating browsers with distributed systems

Exercise: real-time browser notifications using SignalR

This workshop is aimed at developers with some experience writing applications using C# and Microsoft .NET.

Attendees will be writing and running .NET code during the workshop, so will need a computer running Windows, macOS or Linux, and ideally install the Microsoft .NET SDK from https://dotnet.microsoft.com/download.

Exercises can be done in .NET Framework 4.6+ or .NET Core 2.0+

Introduction to Distributed Systems with C# and .NET

There are a lot of questions that come up when you start looking at adopting IaC. And some of them are quite important to answer correctly the first time around, as changing the answer is likely to be both costly and time consuming. The goal of this workshop is to create a way for people who are interested in adopting IaC to get more information about the choices that are involved, and the pros and cons of each option. And not just from a theoretical point of view, but also by being able to get practical experience by trying it out on their own.
We start off with an introduction to the subject in theoretical form. This covers the pros and cons of IaC, and the pre-requisites before you can start adopting it, as well as what to look at when selecting the right tool for the job. Once the theoretical part has been covered, we move into the practical section. Here you get to see some of the tools available and how they compare to each other. We will go through the most popular tools for deploying to Azure. Currently that means Azure CLI, ARM templates, Bicep, Terraform and Pulumi. For each tool, we’ll discuss the pros and cons.
After having seen the comparison between them, it’s up to you to decide which of the tools that seem best suited for your scenario (team, solution etc.). Once you have found your favorite, there are labs for each one of them that allows you to get a better feel for what it is like to work with them. This makes it much easier to make an informed decision about the path you want to choose for your future IaC journey. And a truly informed decision is the best way to set yourself up for success!

Exploring Infrastructure as Code

DevOps

ASP.NET Core 6, gRPC, Protobuf, Visual Studio, .NET CLI, Docker, Kubernetes, services meshes, monitoring, distributed tracing

Day 1: Building gRPC applications in ASP.NET Core

Day 2: Security, Deployment and Observability

Service mesh (using Linkerd as an example)

Attendees will be expected to be familiar with .NET and C#.

Bring a laptop with the following installed:

Visual Studio 2022 or JetBrains Rider EAP or VS Code

Modern distributed systems with gRPC in ASP.NET Core 6

Venue: Oslo Kongressenter

The class is a combination of lectures, security testing demonstrations, code review, and interactive threat modeling discussions. Students will learn the most common threats against applications. More importantly, students will learn how to code secure software via a variety of techniques such as secure design practices, defense-based coding, the use of security libraries and services, and the use of a variety of web security standards.

As part of this course, we will explore the use of third-party security libraries and frameworks to speed and standardize secure development. We will highlight production quality and scalable controls from various languages and frameworks including Java, PHP, Python, Javascript, and .NET, but any developer building web applications and webservices will benefit from this class.

Familiarity with the technical details of building web applications and webservices from a software engineering point of view.

Any laptop that can run an updated web browser and "Burp Community Edition".

Day 1 of the course will focus on web application basics.

Introduction to Security Goals and Threats

Day 2 of the course will focus on API secure coding, Identity, and other advanced topics.

Webservice, Microservice, and REST Security

The course will include several hacking and secure coding labs!

Building Secure API's and Web Applications

Multi-platform, multi-client, and highly-mobile users bring a new set of challenges, so the approaches of the past are no longer appropriate for modern applications. This two-day workshop is your chance to dive into all things security related to these new technologies. Learn how to securely connect native and browser-based applications to your back-ends and integrate them with enterprise identity management systems as well as social identity providers and services.


.NET Core, ASP.NET Core, MVC, Web APIs, Claims, OpenID Connect, OAuth 2.0, WS-Federation, SAML, JSON Web Tokens, Single Sign-on and off, Federation, Delegation, Home Realm, Discovery, CORS

Social Logins (e.g. Google, Facebook, Twitter, etc.)


Attendees will need to bring a computer with the latest .NET Core SDK and the IDE of your choice (e.g. Visual Studio) installed.

Identity & Access Control for modern Applications and APIs using ASP.NET Core 6

This 2-day workshop will quickly progress you from Blazor fundamentals through to creating rich interactive UI experiences using the more advanced framework features. The objective of this workshop is that attendees walk away with a solid understanding of the Blazor framework as well as practical experience of building a real application with it.

Leveraging browser APIs and existing JavaScript libraries

This course assumes attendees are familiar with .NET, C# and web technologies such as HTML, CSS and JavaScript. Attendees will also need to bring a laptop with the following:

An IDE such as Visual Studio 2019, Visual Studio for Mac or JetBrains Rider. VS Code can also be used.

Blazor Workshop

What you will learn: We will start by taking an existing sample repository and get that building locally in Visual Studio. We will then take the application and get it building and testing on Azure DevOps, then configure the Release and lastly pass the artifact through to Octopus Deploy ready for deployment.

You will get hands-on access to provisioning infrastructure on Azure, building an Azure DevOps pipeline & creating an Octopus Cloud instance. You will use all of these tools to configure and prepare a build, test it, create the release and deployment pipeline of a sample application and get you deploying from Dev, through to test and lastly to Production.

Creating Build in Azure Pipelines & Test plans in Azure Test Plans.

Integrating Azure DevOps & Octopus Deploy

Creating the Deployment process in Octopus Deploy.

Multi-Tenancy, Channels, Lifecycles & Spaces

Common Deployment patterns such as Canary, Blue/Green & Red/Black


This workshop is for Developers, Ops and DevOp Engineers starting on their CI/CD journey or for engineers looking for some fresh ideas. Additionally, if you are using an older version of Octopus and want a refresher, then come along.

Free Azure/MSDN Subscription with access to create an Azure Service Principal. A Corporate Subscription is best to be avoided.

Email address to spin up free Azure DevOps & Octopus instances


Attendees will need a laptop with Windows with the following software:

Turbocharging your Azure DevOps experience with Octopus Deploy

If this sounds familiar, then this workshop is for you. We cover both the theory and patterns of Domain-Driven Design, and connect it to code with hands-on examples in .NET 6.

Where DDD fits in to software delivery and what business problems it addresses

How to craft and enforce a ubiquitous language

The role of refactoring in shaping and reshaping our model

How to define bounded contexts and microservices

Realizing a pragmatic implementation with ASP.NET Core 6 and EF Core 6

We spend day 1 on the theory and concepts of DDD and day 2 applying it to a real-world, complex example with hands-on code exercises.

Domain-Driven Design: Theory and Practice

Microservices

In this tutorial, we will look at why asynchronous messaging is often the preferred solution to the problems of integrating and distributed solution, and look at the implementation of common messaging patterns.

If you have ever been put off moving from RPC-based solutions to messaging because of the need to learn how to implement messaging based solutions, this workshop will get you started. if you have been using messaging but want to gain a firmer understanding

The session will be a hands-on introduction and take you from simple messaging scenarios like "Hello World" through to more complex ideas like routing, brokers, and publish-subscribe.

Day 1: Messaging Architectures and Simple Patterns

Day 2: Distributed Systems Advanced Patterns

There will be hands on coding exercises in C#, JavaScript, Python and Go enabling you to implement simple and more complex messaging scenarios.


We will use Rabbit MQ for examples. You need not have the latter installed on your machine, but you should have Docker installed on your machine, as exercises will use Docker Compose.This is a Bring Your Own Device (BYOD) course. At BYOD courses delegates are required to bring their own laptop with the necessary software installed

NDC { London }

Workshops

09:00 - 17:00 (UTC±00)

Code That Fits in Your Head

Mark Seemann

Modern distributed systems with gRPC in ASP.NET Core 6

Mark Rendle

Practical Messaging Workshop

Ian Cooper

Blazor Workshop

Chris Sainty

Identity & Access Control for modern Applications and APIs using ASP.NET Core 6

Dominick Baier

Introduction to Distributed Systems with C# and .NET

Dylan Beattie

Domain Modeling Made Functional

Scott Wlaschin

Hack Yourself First: How to go on the Cyber-Offence

Scott Helme

Building Secure API's and Web Applications

Jim Manico

Turbocharging your Azure DevOps experience with Octopus Deploy

Derek Campbell

Exploring Infrastructure as Code

Chris Klug

Jakob Ehn

Domain-Driven Design: Theory and Practice

Jimmy Bogard