In this 2-day workshop, Paul will help you understand the different infrastructures required to deploy your applications in each of these services.

Deploying an application to Azure Static Web Apps

Deploying an application to Azure AppService

Best practices for infrastructure management around testing, architecture and secrets management

All examples are based on Pulumi but will be available in Go / TypeScript / Python and DotNet!

2 Days

Just Let Me Run My Application... Azure edition

Venue: Oslo Kongressenter

Cloud

Mod(C++) Fundamentals should ideally be taken before Mod(C++) Intermediate, another two day course which expands on the topics in Mod(C++) Fundamentals. Taken together these two courses will give a good foundation for a modern C++ programmer.
Course Description

The Fundamentals course gives the students an understanding of how one should think and program in “Modern C++” (C++11/14/17/20). The exercises will all be based around a 2D graphics game inspired by PacMan. Topics covered in the course include:

Variable and function use, including auto, const, overloading and function templates
Namespaces, classes and structs, when and how to use them
Standard library containers and algorithms usage
How to efficiently use values and references
Memory theory, including understanding allocation on the heap and stack
RAII and lifetime management, including Rule of Zero
Lambda functions and using them with standard algorithms
An introduction to the C++ compilation model and advice to make the best use of compilers and build systems




Students are assumed to be proficient in anObject Oriented Programming language like Java or C#. They should be working in (or looking to work in) a C++ project.




The exercises will be done in a CMake based project. The students will need a development environment, a rich IDE is recommended, for example Jetbrains CLion, QtCreator or Visual Studio. A GitHub account will be useful.

Mod(C++) Fundamentals: Introduction to C++

Venue: Rebel

"Hack Yourself First" is all about building up defensive skills in developers. It looks at security from the attacker's perspective and takes them through the steps necessary to exploit vulnerable software on the web so that they can experience hacking first hand. Workshop participants are set specific goals they must complete that involve probing for risks and then exploiting discrete vulnerabilities in a specially built vulnerable application. The interactive nature of the workshop means that multiple attack vectors are usually identified across the spectrum of participants and each person contributes their own unique perspective as to how specific risks are exploited.

The objective of the workshop is that each person walks away with demonstrated experience across a broad spectrum of specific risks. They not only learn about but also demonstrate practical experience across a range of different vulnerabilities targeted to the specific needs of the group.

Courses run for two days on the following schedule:

The first day build fundamental security skills that all technology professionals delivering applications on the web should posses:

- Discovering Risks via the Browser
- Using an HTTP proxy
- XSS
- SQL Injection
- CSRF
- HTTPS
- Framework Disclosure

The second day delves deeper into online risks, covering more advanced topics in greater depth:

- Password Cracking
- Account Enumeration
- FiddlerScript
- Content Security Policy
- Session Hijacking
- Subresource integrity
- Brute Force Attacks
- Automating Attacks and Review

Attendees will get taught the mechanics of each of these risks and of course the defensive patterns required to defend against them. But more than that, they get exposed to how to think about security; how to apply it in depth via multiple defences, how to choose appropriate controls based on the specific risk of the feature and how to have the discussion about what makes sense in different circumstances.

Above all though, security is just one factor in delivering working software and it has to be applied appropriately. Sometimes it comes with a trade-off against usability or cost and decisions have to be made about not what's just most secure, but what's in the overall best interests of the product being built. This workshop helps those who attend have the right discussions about when and where to invest in security.

- Software Developers
- System Administrators
- Testers

This workshop is aimed at any software developer, system admin or tester who wants to get a better understanding what is going on in cyber space if it comes to hacking and cracking of systems. This workshop enables you to take a pro-active approach and you learn how hackers will try to break your system. This workshop will be an eye opener for most attendees and it is the starting point of becoming a better developer. It all starts with awareness and improving your own habits. So start hacking yourself first, to become a better developer!

Attendees will need to use their own computer with one of following software options installed: Fiddler: 

https://portswigger.net/burp/communitydownload

If possible please also bring your smartphone.

Hack Yourself First: How to go on the Cyber-Offence

Security

Once upon a time, software was simple. You built a website, connected it to a database, and you were done. Then customers started asking for APIs, mobile apps, notification emails, realtime chat… Today, cloud hosting lets us build “elastic” systems – websites that automatically scale up to handle demand; message queues and publish/subscribe patterns to handle spikes in traffic and workload without impacting your end users.

If you’re just starting out with distributed systems design, the possibilities can be overwhelming. APIs, message queueing, REST, GraphQL, gRPC… what should you choose, how does it work, how do you get started?

This workshop gives you a hands-on introduction to the most important messaging patterns used in modern application development. Using C# and .NET, we’ll build a series of small example apps and services, wire them together using these patterns, and discuss how – and when – you’d apply the same patterns in your own applications.

HTTP architectural patterns – XMLRPC, REST, GraphQL

HTTP frameworks: WebAPI, NancyFX, ServiceStack

Working with HTTP APIs: testing and tooling

Exercise: building an HTTP API client and server

Message queueing in .NET – Redis, MSMQ, EasyNetQ

Advanced architectural patterns: CQRS, event sourcing

Exercise: building a pub/sub system using .NET

History of RPC on .NET – SOAP, DISCO, WSDL, WCF

Exercise: high-performance architecture using gRPC

Integrating browsers with distributed systems

Exercise: real-time browser notifications using SignalR

This workshop is aimed at developers with some experience writing applications using C# and Microsoft .NET.

Attendees will be writing and running .NET code during the workshop, so will need a computer running Windows, macOS or Linux, and ideally install the Microsoft .NET SDK from https://dotnet.microsoft.com/download.

Exercises can be done in .NET Framework 4.6+ or .NET Core 2.0+

Introduction to Distributed Systems with C# and .NET

.NET

Architecture

In this 2 day workshop we will take a practical approach to adding cryptographic security to your applications.

Cryptography is generally regarded as being very hard to implement, but in this workshop we will show you that it is in fact very easy to do when you are given the right direction.

Generating cryptographically secure random numbers

Storing passwords with Password Based Key Derivation Functions

Using RSA and AES together to create a powerful and flexible encryption scheme

Hybrid Encryption with Authenticated Hashing for Integrity

Look at secure key management using Azure Key Vault

Look at some reference examples that use the principles from Day 1

This is a practical workshop where you will be playing around with all the techniques discussed. We aim to demystify the complexity around using robust encryption and you will leave this workshop with all the knowledge and skills to robustly secure your organisations data.

You will need to be a competent C# developer. You don't need to be an expert, but you need to be familiar with the basic C# constructs.

You will need to supply your own laptop that has:

Visual studio 2019 installed. Community edition is fine or Visual Studio for MAC

You can use JetBrains Rider if you wish on Windows / Linux

Secure Programming for the Enterprise in .NET,  .NET Core and Future

In this workshop, you discover best practices for building secure frontend applications. We investigate how to use and configure security mechanisms available in modern browsers. We explore what security measures are built into Angular and React, along with common mistakes that circumvent these protections. Additionally, we discuss scenarios that address frequent questions, including secure data storage in the browser and the use of OAuth 2.0 and OpenID Connect.


This course offers practical and immediately applicable security advice for architects and developers. Throughout the course, Philippe is available to answer any questions, including concrete scenarios applying to your own applications.
Concretely, we will cover the following topics:

Countering advanced XSS with Trusted Types

Using OAuth 2.0 and OpenID Connect in SPAs

Securing OAuth 2.0 tokens in JS frontends


This workshop consists of a mixture of lectures, demos, interactive quizzes, and hands-on labs. The lectures provide in-depth knowledge of attacks and defenses. The hands-on labs are conducted in a custom-built competitive training environment, allowing participants to gain hands-on experience with offensive and defensive technologies.



This security training specifically targets modern web developers. Anyone involved in building single-page applications (e.g., Angular, React) or managing development teams should be here. This training course is not just any training course. It is packed with in-depth and up-to-date content. We do not merely brush over a threat and defense but focus on the underlying cause and consequences. Why do we have this problem? Which mitigations are often used? Why are some ineffective? Which one is the current best practice? These are the questions that will be answered throughout the training.

To participate in this training, you should have development experience with single-page applications and the underlying APIs. Familiarity with the basics of security (e.g., simple XSS attacks) is helpful, but not required. The training will talk about Angular and React specifically, but also applies to other frameworks, such as EmberJS or Vue.js.

To participate in the lab sessions, participants need an internet-accessible laptop with a modern browser installed (E.g., Chrome, Firefox).

A builder’s guide to Single Page Application security

ASP.NET Core 6, gRPC, Protobuf, Visual Studio, .NET CLI, Docker, Kubernetes, services meshes, monitoring, distributed tracing

Day 1: Building gRPC applications in ASP.NET Core

Day 2: Security, Deployment and Observability

Service mesh (using Linkerd as an example)

Attendees will be expected to be familiar with .NET and C#.

Bring a laptop with the following installed:

Visual Studio 2022 or JetBrains Rider EAP or VS Code

Modern distributed systems with gRPC in ASP.NET Core 6

Today, many of us already heard about Event Sourcing and its benefits. However, when it comes to writing code, it could be quite challenging to start from an empty screen in the IDE. Using one of the Event Sourcing frameworks that promise to deliver everything out-of-the-box might be helpful at the beginning but also bring a great deal of "magic" to the system and hides a lot of important implementation details.

During this day we will model and build an application using tactical patterns of DDD with CQRS and polyglot persistence. We will start with a quick modeling session to find out how the new system can be represented in a loop of commands, events and read-models. Then, during the course of the implementation exercise, we will create a set of useful abstractions and tools that you could continue to develop further and use in your projects.

A whiteboard that compiles - convert sticky notes to code

Commands, events and consistency boundaries

Integration inside and outside, using events

Production readiness - metrics and traces

Practical examples with use Eventuous, a compact Event Sourcing library for .NET. The workshop will be most beneficial for .NET developers as most of the building blocks are ready-made. 

Participants will need a laptop with .NET installed, preferably .NET 5 or .NET 6.

Real-life DDD, CQRS and Event Sourcing

Here are a few of the topics and techniques covered in this workshop:

Record types – What are they? How do you use them? Why?

Nullable reference types – Moving towards immutability and avoiding null reference exceptions

Asynchronous Programming – Working with Streams and best practices

Pattern matching – Writing more beautiful and understandable code

Using Span<T> - Writing fast and memory efficient code

Each topic will be thoroughly covered, followed by exercises that allow you to understand and incorporate these language features in your projects. We will talk about how the application changes, benefits and drawbacks of applying the language features.

We’ll be discussing application design, leveraging new language features and try to answer any of the questions you might have!

This is a workshop you really don’t want to miss if you’re a C# developer in 2021!


Developing with C# in 2021

Programming Languages

In this workshop, you will learn how to simulate latency and failures in your web application and how to add strategies to deal with this. We will learn how changing the different parameters change the behavior of our application under load, and what trade-offs we ultimately must make. Because we build on HTTP and TCP/IP, we will also have fun sessions where we dig deeper into details in hands-on sessions to get a better understanding of the foundations on which we build.

We will start with introducing Polly, a resiliency and transient-fault-handling  library for .NET applications.

We will then move on to using k6 for load testing a .NET Core web API. For resiliency strategies, we will use Polly  and we will use Simmy for fault injection. This is red-green testing, but for performance and resiliency. As you work through the challenges, you will learn about service level indicators, service level objectives, and how to formulate and test such requirements. We will also work on some .NET specifics that we need to master regarding asynchronous programming to make sure the mechanisms work as intended.

In the last part of the workshop, we will focus on writing high-level tests in k6. We will share some of our experiences with such tests, and a simple process to help ensure system-level reliability and organizational coordination. You will gain a better understanding of k6, and reflect about some of the non-technical challenges of building reliable systems.

There are no prerequisites for the workshop, but you should have some experience building web applications to get the most out of the workshop. The workshop should be valuable to developers, testers and architects working with or with an interest in robustness and scalability. We will visit high-level concepts, such as talking to the business about SLOs, and nitty-gritty details of HTTP headers.

Roger is a full-stack test developer with a varied background and a strong passion for building quality software solutions. In recent years, he has specialized in software testing. He started his career 15 years ago as a R&D engineer in signal processing, developing solutions for underwater communications. He has also worked with jet plane modems, gas detection systems, signal systems for railway, wireless condition monitoring systems and streaming services.

Bjørn Einar is a .NET developer and architect working at 4Subsea. He has a background from automation systems in the energy sector and has for the last 6 years worked for NRK TV as a backend developer and architect in the streaming service. His main topics of interest are domain driven design and functional programming.  Keeping NRK TVs services up and running has been the main driver for his interest in resilient architecture. In the search for robustness, he has also learned to love HTTP.

Building and testing resilient services over HTTP

Multi-platform, multi-client, and highly-mobile users bring a new set of challenges, so the approaches of the past are no longer appropriate for modern applications. This two-day workshop is your chance to dive into all things security related to these new technologies. Learn how to securely connect native and browser-based applications to your back-ends and integrate them with enterprise identity management systems as well as social identity providers and services.


.NET Core, ASP.NET Core, MVC, Web APIs, Claims, OpenID Connect, OAuth 2.0, WS-Federation, SAML, JSON Web Tokens, Single Sign-on and off, Federation, Delegation, Home Realm, Discovery, CORS

Social Logins (e.g. Google, Facebook, Twitter, etc.)


Attendees will need to bring a computer with the latest .NET Core SDK and the IDE of your choice (e.g. Visual Studio) installed.

Identity & Access Control for modern Applications and APIs using ASP.NET Core 6

This 2-day workshop will quickly progress you from Blazor fundamentals through to creating rich interactive UI experiences using the more advanced framework features. The objective of this workshop is that attendees walk away with a solid understanding of the Blazor framework as well as practical experience of building a real application with it.

Leveraging browser APIs and existing JavaScript libraries

This course assumes attendees are familiar with .NET, C# and web technologies such as HTML, CSS and JavaScript. Attendees will also need to bring a laptop with the following:

An IDE such as Visual Studio 2019, Visual Studio for Mac or JetBrains Rider. VS Code can also be used.

Blazor Workshop

In this tutorial, we will look at why asynchronous messaging is often the preferred solution to the problems of integrating and distributed solution, and look at the implementation of common messaging patterns.

If you have ever been put off moving from RPC-based solutions to messaging because of the need to learn how to implement messaging based solutions, this workshop will get you started. if you have been using messaging but want to gain a firmer understanding

The session will be a hands-on introduction and take you from simple messaging scenarios like "Hello World" through to more complex ideas like routing, brokers, and publish-subscribe.

Day 1: Messaging Architectures and Simple Patterns

Day 2: Distributed Systems Advanced Patterns

There will be hands on coding exercises in C#, JavaScript, Python and Go enabling you to implement simple and more complex messaging scenarios.


We will use Rabbit MQ for examples. You need not have the latter installed on your machine, but you should have Docker installed on your machine, as exercises will use Docker Compose.This is a Bring Your Own Device (BYOD) course. At BYOD courses delegates are required to bring their own laptop with the necessary software installed

Practical Messaging Workshop

DevOps

Python

Then, we’ll dive into a series of hands-on exercises designed to get you up and running on building APIs using ASP.NET Core and C#. Finally, we’ll review essential tools within the API development ecosystem that are designed to help you test, maintain, deploy, and document your API - all in just a couple of days!

From the developer who’s never worked with an API (or an API of that kind for any matter!) to a seasoned API developer, this workshop will have something for everyone! Come prepared to learn and practice implementing an API that can be used to back systems of all kinds.

API Design best practices and important considerations

Designing responses back to the client and implementing them

Using CQRS to create a testable, scalable API development experience

Versioning your API - exploring the API life cycle and building your project for versioning success

Securing your API - considerations and techniques

Testing your API using Postman’s test platform and ASP.NET Core’s integration testing framework

Documenting your API using OpenAPI/Swagger tooling

Comparing/contrasting popular API paradigms (REST/gRPC/GraphQL)

From developers who want to learn how to build APIs to seasoned API developers looking for a better way to build and maintain their ASP.NET Core projects, this workshop will have something for everyone! At a minimum, you must have a working knowledge of HTTP and C#.

Any machine with Postman, Docker, and the .NET 5 SDK installed as well as Visual Studio, Visual Studio Code, or JetBrains Rider.

NDC { Oslo }

Workshops

09:00 - 17:00 (UTC+01)

Modern distributed systems with gRPC in ASP.NET Core 6

Mark Rendle

Identity & Access Control for modern Applications and APIs using ASP.NET Core 6

Dominick Baier

Secure Programming for the Enterprise in .NET, .NET Core and Future

Stephen Haunts

Practical Messaging Workshop

Ian Cooper

Hack Yourself First: How to go on the Cyber-Offence

Scott Helme

Building and testing resilient services over HTTP

Bjørn Einar Bjartnes

Roger Hoem-Martinsen

Blazor Workshop

Chris Sainty

A builder’s guide to Single Page Application security

Philippe De Ryck

Building Scalable and Maintainable APIs with ASP.NET Core Workshop

Spencer Schneidenbach

Mod(C++) Fundamentals: Introduction to C++

Patricia Aas

Just Let Me Run My Application... Azure edition

Paul Stack

Developing with C# in 2021

Filip Ekberg

Real-life DDD, CQRS and Event Sourcing

Alexey Zimarev

Marcin Budny

Introduction to Distributed Systems with C# and .NET

Dylan Beattie