We’ll consider simplicity from a number of viewpoints, including essential versus accidental complexity, value demand versus failure demand, simple versus simplistic.

We’ll also look at typical sources of complexity in our coding habits, along with code examples in various languages.

We'll see that many practices and approaches can be used both to simplify and to complicate. It's all in knowing how and when versus how not to and when not to use them. For example, we can encourage reuse through code libraries, platforms and services, but we can also make an architecture needlessly complex and draw in unnecessary dependencies, with implications for maintainability and security. Similarly, AI assistance can be employed to make code simpler and easier to work with but, without attention and guidance, it can make things more complicated and harder in the long run, becoming a new source of legacy.

We’ll explore verbose and convoluted code, the effect of programming paradigm and how we can turn down the imperative noise of many languages and styles with declarative techniques.

We'll talk about what we might (or might not) mean by clean code, and whether that's a helpful approach.

We'll learn it’s not just in our programming and languages where we find complexity: our development processes, tools, architectures and organisational cultures can often encourage unnecessary complexity, costing us time, effort and opportunity where simplicity would have had the opposite effect. Suffering from heavy Agile™ ceremony? Too much certification and not enough action? That.

We’ll look at how we can work with incomplete knowledge without adding speculative complexity of so-called future proofing.

We’ll acknowledge technical debt and neglect for what they are and understand why legacy is so often the opposite of simple, no matter what its backstory or business value. We want to make sure that as well as recognising unnecessary complexity in the small and the large, that we also have an idea of the practices that can help with simplification.


As well as presenting concepts, examining themes and considering code, this masterclass will also offer plenty of opportunity for questions and discussion, plus some hands-on refactoring exercises (options will be available in different programming languages).

What kinds of complexity do we find in software systems?

What are the costs of accidental complexity in code and architecture?

Where does complexity appear in our organisations and processes?

The technical debt consequences of long-term technical neglect

Refactoring as an act of simplification, discovery and evolution

The role of testing in keeping code, architecture, delivery and life simple

How to be the human in the loop when working with AI code generation

Programming paradigms and their effect on complexity

Declarative programming versus imperative programming

Keeping code, architecture and development process lean

2 Days

14-15 Sept

Keeping It Simple

.NET

Agile

Architecture

Functional Programming

JavaScript

Testing

Work skills

This workshop is here to give you the skills you need to make your APIs secure. We're going to think like an attacker to test APIs and like a defender to figure out the best ways to protect them. With deep-dive talks, real-world demos, fun quizzes, and hands-on labs, you'll learn how to lock down your APIs.
During this hands-on training, we'll explore:

The security model of API-based web applications

Recognizing and addressing authorization failures

Understanding Broken Object Property Level Authorization (BOPLA)

Fixing Broken Object Level Authorization (BOLA)

Testing the security of APIs that use JWTs

Best practices for making JWTs secure in modern APIs

Identifying, exploiting, and fixing Server-Side Request Forgery (SSRF) issues

Understanding Cross-Origin Resource Sharing (CORS)

Configuring secure CORS policies for various use cases

Tracking user authentication securely with sessions or tokens

Relying on OAuth 2.0/2.1 for securing APIs

Q & A throughout the workshop to clear up any doubts


This workshop is about more than theory. We're all about giving you practical security tips you can use right away as an API developer. We dig into the root causes of API threats and how to handle them. We don't just skim the surface of problems and solutions - we get into the why's and how's, looking at common fixes, why some fall short, and which ones are currently the best way to go.
By the end of this workshop, you'll be up-to-speed on the best practices for API security. You'll also leave with a handy list of steps to check and boost the security of your applications.




This training is perfect for developers and architects who work a lot with APIs. If your role involves building, testing, or designing modern apps, this workshop will give you a thorough, up-to-date understanding of the best ways to keep things secure. We'll often use NodeJS, Flask, and Spring Boot in our code examples and demos, but you'll easily be able to apply what you learn to other languages and frameworks.




These testimonials from previous workshops give you a good idea of what to expect:

Trainer is great and an expert in the domain. All of the topics are very relevant. Practical examples for most of the topics. Excellent communication and addressing of questions.

Even though the topic is broad, there was no single moment where my focus went astray. Philippe talks in a way to keep you interested to listen to him.

I liked the the pleasant and relaxed way of speaking and the fresh style of presentation of this kind of dry stuff :)

Philippe is a friendly and knowledgable trainer and delivered an interesting course that was well presented. Questions were answered promptly and in a detailed way.


To participate in this training, you should have some experience with building API-based applications. Knowledge of application security can be helpful, but is not required.




To participate in the lab sessions, participants need a computer with a full-featured modern browser installed (preferably Chrome).


Bulletproof APIs: Hands-On API Security

Security

Most software starts out pretty simple: front end, back end, maybe a database, and you’re done. Then the client wants an API, a mobile app, notification emails, realtime chat; cloud gives you elastic hosting, apps that dynamically scale based on workload and traffic, and if you’re just starting out with distributed systems design, the possibilities can be overwhelming. APIs, message queueing, REST, GraphQL, gRPC… what should you choose, how does it work, how do you get started?

This workshop gives you a hands-on introduction to the most important messaging patterns used in modern application development. Using C# and .NET, we’ll build a series of small example apps and services, wire them together using these patterns, and discuss how - and why - you’d apply the same patterns in your own applications.


Working with HTTP APIs: testing and tooling

Interactive documentation with OpenAPI and Swagger

Distributed queues with RabbitMQ and EasyNetQ

Contract-first development using protocol definitions

Integrating browsers with distributed systems

Adding instrumentation to your distributed apps

Principles of observability: spans, traces, metrics and logs


This workshop is aimed at developers with some experience writing applications using C# and Microsoft .NET. The workshop can be run in person or online. Attendees will be writing and running .NET code during the workshop, so will need a computer running Windows, macOS or Linux, and the Microsoft .NET 10 SDK from 

. The sample application and examples used during the workshop all run on .NET 10, and are tested on Linux, macOS and Windows.

Building Distributed Systems with .NET 10

To be fair, the people who abuse this term are also the people who probably fall under this category. I prefer “Agentic Programming” instead. I have pushed thousands of lines of code in production using agentic programming. Code that would have taken me months to write myself now takes merely days.

In this workshop, we’ll explore agentic programming as a disciplined engineering practice, not a toy.
Using Claude Code, I’ll show how to collaborate with AI agents to produce maintainable, reviewable, and production-ready code, without surrendering architectural control, correctness, or performance.

What Claude Code, Codex and Cursor are, how they work, and how you should use them

Designing clear agent boundaries and responsibilities.

How to turn vague intent into explicit, testable instructions.

Create plans that can run for hours on end, generating and testing code as they go.- Securing your agentic code

Much more (workshop contents are constantly updated as new models and tools are released)

This is not a “let the AI take the wheel” session. It’s about teaching the AI to work like a senior engineer, while you stay firmly in charge. If you believe AI coding tools are dangerous, flaky, or fundamentally incompatible with serious software engineering, then this workshop is for you.



A laptop with your favourite IDE installed

Vibe Coding for Production

In this workshop, we will dive deep into how .NET implements asynchronous programming under the hood to become experts using async/await!

Join me as we uncover the ways that the .NET compiler modifies each of our async methods. We'll learn how to build a custom implementation of `Task` from scratch and use it with the built-in async/await keywords. Then we'll dive deep into the .NET source code to understand the importance of internal framework tools like SynchronizationContext, ExecutionContext, Principal, ThreadStatic and more!


C# Developers who have used async/await but don’t yet know how it works under the hood

Become an Expert with Async/Await in C#

Concurrency

Programming Languages

Day 1: Build an Enemy with Real Game AI
Day 2: Build a Physics-Driven Weapon System

Most developers use game engines.
In this workshop, we crack one open and start hacking the systems that make it work.

Over two creative days, we extend a custom-built .NET 3D engine powering The Omega Strain — not by importing packages, but by writing real game systems ourselves.

No Unity.
No Unreal.
No physics middleware.

Just vectors, delta time, collision boxes, gravity, and code.




We design and implement a new enemy from scratch. Using state machines, distance checks, spatial awareness, and real-time updates, we build AI that reacts inside a running engine.



 
We build a weapon system with real 3D trajectory physics — velocity vectors, normalization, ballistic motion, gravity, collision detection, and impact handling.

This workshop is not about building a AAA game.
It’s about understanding what game engines actually do — by building the moving parts yourself.

If you love games, this workshop will show you what really happens under the hood — and even if you build APIs for a living, it will sharpen your understanding of real-time systems, architecture under constraints, and how physics, state, and performance interact in complex software.



C# developers curious about game engine internals, real-time systems, and performance-driven architecture.




Basic C# knowledge recommended. No prior game development experience required.

Build a 3D Game System from Scratch (No Engine Required)

Gaming

3D Modeling

Two-day training session on AI agents, MCP, and Skills facilitated by Aleksander Stensby from GritAI. This training gives you the foundation to build MCP servers and MCP Apps, reusable agent skills, and wire everything into capable autonomous agents that actually work.

This hands-on workshop will equip you with practical skills to build your own MCP servers, CLI tool wrappers, and interactive MCP Apps — and then go further by creating reusable skills that turn simple tool-calling agents into capable, autonomous systems. You'll leave with a working agent powered by tools and skills you built yourself.

Day 1: Context & Connectivity — MCP Servers, Apps & Tools

Introduction to the AI agent stack: LLMs in a loop with tools and why context is king

Core MCP concepts: Host/client/server architecture, tools, resources, and prompts

Building a working local MCP server (Python or TypeScript)

MCP Apps: Adding interactive UI components to your MCP Server

CLI tools with direct API access as an alternative and complement to MCP

Hands-on exercises: Build an MCP server, extend it with an MCP App

What skills are and why they're the missing layer in most agent setups

Skills vs. tools vs. prompts: Understanding the capability stack

The skill creator pattern: Using AI to capture and formalise skills from workflows

Workflow capture: Turning expert knowledge into reusable agent skills

Agentic loop architecture: How LLMs, tools, and skills combine across frameworks

Provider-agnostic patterns: Claude, OpenAI, Gemini and beyond

Final exercise: Building a capable agent combining MCP tools and custom skills

Basic Python or JavaScript programming knowledge

Familiarity with AI/ML concepts (helpful but not required)

Laptop with necessary development environment

This training is targeted at developers and people with a medium+ technical skill level and interest for AI.



Bring your laptop with your preferred IDE and either Python or Node installed. We recommend an AI coding agent like Claude Code, Cursor, or GitHub Copilot.
Bring your favorite sauce! You need access to an LLM provider like Anthropic, OpenAI or Azure Foundry, but you can also use Ollama if you would like to run everything locally and free. Claude Code is highly recommended and will be used for a lot of the demonstrations during the workshop.

Context and Skills Are All Your Agent Needs

This two-day deep-dive workshop is for developers, architects, and technical leaders who want to understand how enterprise AI systems are actually designed, delivered, and scaled in production.

You’ll learn how real-world solutions emerge from the combination of data platforms, agents, integration layers and governance—and why most teams fail by treating AI as an isolated application instead of a connected system.



We’ll walk through the full lifecycle of enterprise AI delivery:

selecting use cases that deliver real ROI (and avoiding “UAT purgatory”)

designing architectures across data, agents, integration, and experience layers

choosing between pro-code, low-code, and data-platform approaches

applying retrieval, knowledge, and semantic patterns effectively

embedding governance, evaluation, and safety from day one

Through architecture deep dives and live demos of emerging capabilities, you’ll gain a clear understanding of what to use, when, and why.

A key theme throughout the workshop is the shift in the developer role itself. Modern AI engineers are no longer just writing code—they are orchestrating intelligence across copilots, agents, data platforms, and enterprise systems.

By the end, you’ll leave with practical frameworks, architectures, and an opinionated view of how to build AI systems that are scalable, governed, and production-ready.

Designing Enterprise AI Systems: From Use Cases to Production Reality

Cloud

If you have ever been put off moving from HTTP or RPC-based solutions to messaging because of the need to learn how to implement messaging-based solutions, this workshop will get you started.

If you have been using messaging but want to gain a firmer understanding of how to build event driven architectures, this workshop will help you understand how to succeed with reactive approaches.

The material is presented in two parts: an introduction to using messaging middle-ware (including hands-on exercises in RabbitMQ and Kafka) and the fundamentals of how we construct event driven architectures.

Hands-on exercises are offered in C#, Java, JavaScript, Python and Go.

Topics covered will include:




- Distribution
- Integration Styles
- Messaging Patterns
- Queues and Streams
- Managing Asynchronous Architectures




- Flow
- Process Automation
- Control Flow
- Activities


We will use Rabbit MQ for examples. You need not have the latter installed on your machine, but you should have Docker installed on your machine, as exercises will use Docker Compose.

This is a Bring Your Own Device (BYOD) course. At BYOD courses delegates are required to bring their own laptop with the necessary software installed.

The exercises are self-paced and you will find it helpful to have headphones to listen to the material that accompanies each exercise (though scripts are provided for those who cannot use headphones).

Practical Messaging

DevOps

Microservices

What are the different architectures? Why should we choose one over the other? Or should we choose a combination of them for some applications? How do we make such decisions? What should be the process or the approach that will lead us towards selecting a more suitable or appropriate architecture, one that comes from proper analysis rather than infatuation or desire to build something because that's seems to be the current trend.


In this workshop, we will take a very systemic approach to going from requirements to choosing suitable architectures. We will cover the following topics, not by simple talking about these, but by way of hands-on exercises and interactive and collaborative sessions:

- Challenges with selecting Architectures
-  Functional and non-functional requirements
- Evaluating trade offs
- Methodical Mapping from requirements to patterns
- Architectural Patterns
- Underpinnings of monoliths and distributed architectures
- Hands-on exercises to analyze application requirements
- Groups labs to evaluate the architectural patterns for different application characteristics
- Using AI to assist with requirements analysis
- Cautiously Using AI to guide along the selection process
- Next steps beyond choosing architecture




- Senior programmers
- Team leads*Architects
- Technical managers and directors



Dr. Venkat Subramaniam is an award-winning author, founder of Agile Developer, Inc., an instructional professor at the University of Houston, and creator of the dev2next and Arc of AI conferences.
He has trained and mentored thousands of software developers in the US, Canada, Europe, Asia, and Africa, and is a regularly-invited speaker at several international conferences. Venkat helps his clients effectively apply and succeed with sustainable agile practices on their software projects.
Venkat is a (co)author of multiple technical books, including the 2007 Jolt Productivity award winning book Practices of an Agile Developer. You can find a list of his books at <

Architectural Patterns: Common Solutions for Building Large Scale Systems

Creating new apps with Aspire is an easy process, but adding Aspire to existing apps can be overwhelming - especially if you want to take advantage of all of Aspire's features. Maddy, Aspire PM, has Aspirified hundreds of apps, and is bringing a slightly-more-structured version of the process to a workshop format.


This workshop will be interactive and adapt to the attendees - bring any codebase you want, and work through Aspirification in your real usecase. We will cover the basics of Aspire, how to Aspireify apps for both local dev and deployment, and deep dive into customizations based on the attendees requests. Both days will also include some unstructured exploration time where you can work on your Aspirification with Maddy and the Aspire team's guidance.

Aspireify your Stack

Tools

Modern application design is more complex than it was a decade or two ago. A modern application is expected to be mobile-first and cloud-based. Microsoft’s answer to these demands was to create ASP.NET Core. A decade later, ASP.NET Core has matured into a trusted development platform covering all components needed in a modern application architecture.

Multi-platform, microservices, multi-client, and highly-mobile users bring a set of challenges that were not present a decade ago. A modern application cannot be secured just by handling access control in the single UI of the application, because there is no longer any single UI. There are web applications, mobile apps and APIs that are exposed to partners and third-party developers. Internally, an application often consists of multiple microservices calling each other. These services are also frequently reused between different applications and externally visible APIs.

To properly secure this landscape, a zero-trust approach is required. There should be a verifiable proof of the end user (or end machine) identity for any user session established or API.

This workshop is your chance to dive into all these security-related technologies. Learn how to securely connect native and browser-based applications to your back-ends and integrate them with enterprise identity management systems as well as social identity providers and services.

After attending this workshop you will have a good understanding of the concepts and will be ready to start implementing a modern identity and access management solution tailored to your organization’s needs.

The ASP.NET Core Authentication and Authorization System Design Principles.

How to use external authentication and offer single sign-on and single logout.

How to securely call APIs on behalf of the authenticated user.

The principles of the OpenID Connect and OAuth 2.0 Protocols.

An overview on how to configure, customize, and deploy Duende IdentityServer.

Day 2: OpenID Connect (OIDC) & OAuth 2.0

Token Lifetime Management & Refresh Tokens


Attendees will need to bring a computer with the latest .NET Core SDK and the IDE of their choice (e.g. Visual Studio) installed.

Identity & Access Control for modern Applications and APIs using ASP.NET 10

Root, UID transitions, and capabilities (*)

Creating a child process in a new namespace: clone()

Combining user namespaces with other namespaces

What does it mean to be superuser in a namespace?

The BPF virtual machine and BPF instructions


The primary audience comprises designers and programmers building privileged applications, container applications, and sandboxing applications. Systems administrators and DevOps engineers who are managing such applications are also likely to find the workshop of benefit.


The workshop consists of a mixture of presentations coupled with practical exercises that allow participants to apply the knowledge learned in the presentations.


Participants should be familiar with fundamental system programming topics such as file I/O using system calls, signals, and the system calls that define the lifecycle of a process (

). For a refresher on these topics, you can download the course materials available at 

. In addition, participants should have a reading knowledge of the C programming language. (Note, however, that the practical sessions do not require writing C programs.)


You'll need a laptop with Linux installed - either as a native install or inside a virtual machine (VM). You should ensure that you have a fairly recent Linux distribution.

NDC { Oslo }

Workshops

09:00 - 17:00 (UTC+02)

Vibe Coding for Production

Nick Chapsas

Context and Skills Are All Your Agent Needs

Aleksander Stensby

Bulletproof APIs: Hands-On API Security

Philippe De Ryck

Architectural Patterns: Common Solutions for Building Large Scale Systems

Venkat Subramaniam

Practical Messaging

Ian Cooper

Building Distributed Systems with .NET 10

Dylan Beattie

Become an Expert with Async/Await in C#

Brandon Minnick

Build a 3D Game System from Scratch (No Engine Required)

Jarle Adolfsen

Designing Enterprise AI Systems: From Use Cases to Production Reality

Adam Stephensen

Linux Security and Isolation APIs Fundamentals

Michael Kerrisk

Aspireify your Stack

Maddy Montaquila

Keeping It Simple

Kevlin Henney

Identity & Access Control for modern Applications and APIs using ASP.NET 10

Anders Abel