class: middle, title-slide # Tech choices ## Baking risk reduction in --- class: center, middle ### All the buzzwords! * Agile/Iterative development * User/Human-centered Design * Devops * Continuous Delivery But there is a common thread that runs through them... --- class: center, middle ## User/Human-centered Design ><strong>Evaluating designs with users</strong> and improving them based on their feedback <strong>provides an effective means of minimizing the risk</strong> of a system not meeting user or organizational needs <cite>ISO 9241-210:2010</cite> --- class: center, middle ## Agile/Iterative development ><strong>Iteration should be used to progressively eliminate uncertainty</strong> during the development of interactive systems. Iteration implies that descriptions, specifications and prototypes are revised and refined when new information is obtained <strong>in order to minimize the risk</strong> of the system under development failing to meet user requirements. <cite>ISO 9241-210:2010</cite> --- class: center, middle ## Continuous Delivery .fourty[] --- class: center, middle ## Devops ><strong>Lowering risk of change</strong> with tools and culture<cite>John Allspaw</cite> --- class: center, middle ### Process tools to reduce project risk * User/Human-centered Design * Agile/Iterative development * Devops * Continuous Delivery ### Technological tools to reduce risk * React * GraphQL * Kubernetes/Docker/Istio * ... --- class: middle, center ## We want risk reduction baked in .thirty[] --- <div id="graph"></div> --- class: middle, center background-image: url(images/react-values.png) # .ten[] --- class: middle, center ## Why React? * Lets us build highly interactive _applications_ on the "Open Web Platform" * New model for safely generating web User Interface (UI) --- class: middle, center, codebg background-image: url(images/react-vs-xss-jsx.png) --- class: middle, center, codebg background-image: url(images/xss-output.png) --- class: center, middle ### We changed the tools so that they safely handle inputs by default --- class: middle, center background-image: url(images/graphql-values.png) # .ten[] --- class: center, middle # GraphQL * Mobile first for API development * Single round trip data fetching * Best of breed input validation * Supports automation and observability * Implementations in C#/.NET, Java, JavaScript, PHP, Python, Ruby... --- class: middle, center, codebg background-image: url(images/rest-vs-graphql.png) --- class: middle, center, codebg background-image: url(images/rest-vs-graphql-output.png) --- class: middle, center background-image: url(images/npm-values.png) # .ten[] --- class: center, middle ### npm package manager * main package manager for the JavaScript ecosystem * vulnerability scanning by default every time a dependency is installed, worldwide --- class: middle, left ```bash $ npm install graphql + graphql@14.1.1 added 2 packages from 1 contributor and audited 402 packages in 3.521s found 0 vulnerabilities ``` --- class: middle, center background-image: url(images/javascript-values.png) # .ten[] --- class: center, middle # JavaScript * One language across the stack: APIs, desktop apps, mobile apps * Injection protection is part of the language --- class: center, middle .eighty[] --- class: middle, center, codebg background-image: url(images/injection-protection.png) --- class: left ### Tagged Template literals in the wild: node-mssql ```javascript const sql = require('mssql') async () => { await sql.connect('mssql://username:password@localhost/database') const result = await sql.query`select * from mytable where id = ${value}` console.dir(result) } ``` --- class: left ### Tagged Template literals in the wild: arangojs ```javascript import { Database, aql } from "arangojs" const db = new Database() (async () => { const now = Date.now() const cursor = await db.query(aql`RETURN ${now}`) const result = await cursor.next() console.log(result) })() ``` --- class: middle, center background-image: url(images/kubernetes-values.png) # .ten[] --- class: middle, center # Why Kubernetes? * A single skillset across monoliths, microservices, VM's, serverless & containers * Minimize cloud vendor lock-in * Combines with Istio and Docker to create robust, scalable, observable systems --- class: middle, center .seventy[] --- class: middle, center ## Final thoughts * No silver bullets: If this wasn't hard it would be fixed already. * There are new tools that have learned from the past. Find them! Use them! * When risk reduction is built into both tools & process, safety and speed are not in opposition.