CodeMash 2018
2018-01-09..2018-01-12
Sandusky, United States
[CodeMash 2018, CodeMash 2020, CodeMash 2023, CodeMash 2025, CodeMash 2026]
who it's for
security engineers, devops engineers, backend developers, qa engineers, frontend developers, cloud architects, engineering managers
topics
Kubernetes on Raspberry Pi clusters; AWS security checklists (KMS, STS, VPC); OWTF automated web pentesting; Angular with Socket.io and rxjs; GraphQL flexible client APIs; problems with JSON Web Tokens; .NET Core cross-platform publishing; browser security headers and CSP rollout; NoSQL (MongoDB) exposure and fixes; threat modeling for secure design; advanced automated UI testing patterns; domain driven design fundamentals
| title | author | length |
|---|---|---|
| Avoiding Microservice Megadisasters | Jimmy Bogard | 51m |
A rewrite of a monolith into many tiny services takes 18 months and hundreds of engineers and yields a site that takes 9.5 minutes to load because every page… | ||
| AWS Security Essentials | Aaron Bedra | 51m |
Gives a checklist: enforce automation (Terraform/CloudFormation/Ansible) so humans stop clicking console buttons, restrict console logins and root use with… | ||
| Zero to DevOps in Under an Hour with Kubernetes | Dale Alleshouse | 59m |
Claims a full Kubernetes devops pipeline from zero to running in under an hour and actually builds it: a four Raspberry Pi nodes cluster (bought for under… | ||
| Automating Security Testing with the OWTF | Jerod Brennen | 55m |
OWTF automates web pen testing by wiring together command-line scanners and a web UI running on Python/Postgres so a QA pipeline can run OWTF against targets… | ||
| Event-Driven UX in the Real World with Angular and Socket.io | Michael Meadows | 46m |
Demonstrates concrete patterns and working demos: real-time notifications, streaming support requests, record locks and field-level “soft” locks, and a chat… | ||
| Matt Smith | Matt Smith | 56m |
Claims that moving security into the dev cycle finds issues earlier, saves money, and frees pen testers for harder work. Demonstrates OWASP ZAP (proxy, spider… | ||
| A Game of Theories: why languages do what they do | Rae Krantz | 47m |
Compares six languages by concrete tradeoffs: Ruby’s monkey patching enables flexibility but breaks gems; Python’s Zen and adoption of numpy drove Python’s… | ||
| Evolution of a RESTful Testing Framework | Kevin Shomper | 35m |
A custom REST test framework evolves from single-line Ruby hashes into readable YAML scenarios and relational test references that let one call capture values… | ||
| Designing Cross Platform Applications on .NET Core | Kevin Griffin | 56m |
Claims that .NET Core enables true cross‑platform apps are tested with concrete details: target dotnet standard 2.0, sockets are now available, JSON.NET… | ||
| Enhancing Application Security: Understanding and Utilizing Browser Security Features | Kevin Cody | 50m |
Lists exact headers to add, where to add them, and what they actually stop: X-XSS-Protection: 1; mode=block blocks many reflected XSS cases… | ||
| How Do I Secure My Micro-Services? | John Melton | 57m |
Argues for concrete practices not theory: run dependency-check in CI for third‑party vulnerabilities, centralize secrets in HashiCorp Vault, automate TLS… | ||
| NoSQL Shouldn’t Mean NoSecurity | Matthew Groves | 54m |
Demonstrates that unsecured document stores really get compromised: spins up an unsecured MongoDB on Azure, imports fake credit‑card JSON, leaves a honeypot… | ||
| Threat Modeling for Secure Software Design | Robert Hurlbut | 01h 00m |
Concrete takeaways and tools not platitudes: threat modeling identifies specific flaws (Jeep Cherokee remote takeover, about 500,000 pacemakers with… | ||
| GraphQL -- Flexible APIs for Adaptive Clients | Brian Genisio | 58m |
Claims that GraphQL lets clients ask one endpoint for exactly the fields they need and that a typed schema enables linting and introspection. Shows tooling… | ||
| 10 Insane Tips You Can Use Today to JavaScript Effectively; #8 Will Shock You! | Brian Genisio | 56m |
Claims twelve practical ES2015–2017 patterns not ten, with #8 admitted as linkbait; Khan Academy runs a transpile pipeline for two years and serves 10 million… | ||
| Becoming a Servant Leader, Leading from the Trenches | Sarah Dutkiewicz | 52m |
Claims that servant leadership means doing the work alongside the team and carrying their voices forward, with concrete tactics: document misconduct to remove… | ||
| JSON Web Tokens Suck | Randall Degges | 54m |
Claims that JWTs are great for web auth turn out to be wrong: most JWTs are not encrypted and stateless JWTs embed full user records so they balloon (example… | ||
| Public Speaking without Barfing on Your Shoes | David Neal | 40m |
First talk was in 2011 and lessons include concrete tactics: use hand-drawn illustrations (start with stick figures), practice until transitions are smooth… | ||
| Crypto for Developers: Making Sane Choices | Adam Caudill | 55m |
Recommendation focuses on concrete choices and failures: use Argon2 for password hashing (PBKDF2 only as a minimum), prefer AES-256 (or Salsa20) with… | ||
| Secure Applications, By Design | Craig Stuntz | 51m |
Claims a repeatable process: threat modeling + partitioning + defense in depth with concrete outcomes. Shows a hotel card-authorization system on AWS that… | ||
| Unbreakable. Perfect: The Craft of Code | Joe Morgan | 43m |
Argues for craftsmanship over “it works” with concrete practices: use linters and writing for testability to expose hidden complexity, refactor long parameter… | ||
| How Not to Destroy Data | Michael Perry | 55m |
Argues for a data model that records immutable facts so state changes become inserts: only inserts no updates no deletes, identities come from natural keys or… | ||
| Advanced Patterns for Automated UI Testing | Seth Petry-Johnson | 53m |
Estimated manual regression takes 7–8 days so the team automates browsers with Canopy and Selenium and focuses UI tests only where lower‑cost tests can’t prove… | ||
| How to get started with robotics and IoT at home | Carla Siler-Maddalena | 43m |
Starts from kid-friendly Lego kits and moves to concrete projects: a garage-door sensor (magnetic sensor + Raspberry Pi, wired to GPIO 14/16; hardware-only LED… | ||
| Domain Driven Design: The Good Parts | Jimmy Bogard | 01h 04m |
A greenfield DDD effort starts as a huge monolith with 195 controllers ~650 actions, 121 roles and an enormous repository of ad‑hoc queries that still ships to… | ||
| 299,792,458 Meters per Second | Anthony Eden | 49m |
Network latency shapes design decisions: ~14.8 million meters gives a 50 milliseconds theoretical round trip, but observed pings hit 250 ms measured ping… | ||
| How to embed security into your process | Timothy DeBlock | 58m |
Claims concrete steps to embed security: inventory components, run threat modeling with STRIDE and rate risks with DREAD, add code review and patching to… | ||
| nothing matches | ||