Ken Sipe

Scaling and Fault Tolerance Workshop

Tue 9:00 AM

There was a day when it was common to see the twitter fail whale! This imagine, extinct today, was the sign that scaling at twitter was broken in some way. What did Twitter do in order to increase their ability to scale, be more fault tolerant all while growing significantly. The answer is a move to Apache Mesos and leveraging container technology.

Google in 2009 had a top secret project we now know as the Google Borg project. That technology was reincarnated in an open source project out of UC Berkley known as Apache Mesos. Mesos has grown up significantly while at Twitter providing production tested solution for scaling applications and containers. In addition Solomon himself stated at DockerCon EU in December 2014 that Mesos is the only reliable way to scale docker in a production environment today.

This session is a hands on workshop. It is broken into 3 separate but related parts.

The first part is an 1.5 hour lecture of the challenges of the datacenter today. It will provide an overview of

* containers, 
* static vs. elastic partitions 
* schedulers.

The second part is a dive into docker with time for hands on labs. You will need access to docker for 1/2 of this session. We will have some discussion on the issues of running Java in a container with a focus on needs of production.

The third part will be on Apache Mesos and several different schedulers. We will discuss:

* different types of containers
* stateful service solution
* service discovery
* typical failures at twitter and how to avoid them

This also has a hands on component. You will need either:

* A Google Compute Engine account
* A AWS account
* Software local on your laptop to run vagrant

The last shorter part will include an overview of technologies on the horizon in this fast paced micro-services space.

Fault Tolerance to a Fault

Wed 8:30 AM

If there is a safe bet, it is that everything fails. From hard drives to power supplies, from routers to software, everything fails. Frankly a planned upgrade of a production service is planned down time, or a failure to continue services for a planned period of time.

This session will look at planning for failure by deploying into an Apache Mesos cluster.

This session will delve into how Apache Mesos identifies failures and how it protects from them. It will also look at how to upgrade infrastructure without down time.

Continuous Delivery into a production cloud

Wed 1:30 PM

Continuous Delivery into a production cloud

Continuous Delivery into a production cloud

Building a PaaS Workshop

Wed 3:15 PM

Platform as a Service (Paas) is all the buzz today…. but why? What’s the value proposition? Once you have decided that it is for you… what are your options?

This 2 session presentation is broken down in to 3 parts. The first is understanding why organizations on moving to PaaS and what to expects. The second and third part includes a walk through of PaaS options with part 2 being traditional PaaS and part 3 highlighting container based PaaS solutions.

We will conclude with a short discussion on getting PaaS like experiences without a PaaS and what that might look like.

Building a PaaS Workshop

Wed 5:00 PM

Platform as a Service (Paas) is all the buzz today…. but why? What’s the value proposition? Once you have decided that it is for you… what are your options?

This 2 session presentation is broken down in to 3 parts. The first is understanding why organizations on moving to PaaS and what to expects. The second and third part includes a walk through of PaaS options with part 2 being traditional PaaS and part 3 highlighting container based PaaS solutions.

We will conclude with a short discussion on getting PaaS like experiences without a PaaS and what that might look like.

Networks for Programmers

Wed 8:00 PM

In the words of John Gage, “The network is the computer”. At the heart of everything we do is a complex system of infrastructure from which we are often abstracted. For general application development this abstraction provides the convenience of simplifying our efforts. With a growing number of mobil applications with intermittent connectivity and higher latency, and with increased hostility on the network from a security standpoint, there is great value in pulling back the curtain and understanding the details of this computer.

This session will start with the underlying understanding of networking at a low level. At this level we will discuss, IP, MAC, ARP, DNS and DHCP. As we walk up an abstraction level, we discuss sockets, NAT, gateways and firewalls along with the use of TCP and UDP. Spending some time at this layer can make network developers more productive, as we look at tools which help us answer the question, “who owns this port?“, “where is this packet going?” and “What is my latency and why?“.

The session will end with a little fun looking at wifi, where will we sniff, snort, crack:) From a security stand point we will look at the challenges of wifi and how it has become the weakest component on the net.

This session is extremely fast-pace. The attendees will come away with a more enhanced understanding of the this thing we call the internet. It will include through discussion or demonstration tools such as tcproute, tcpdump, nemesis, nmap, tcpmon and wireshark.

Hacking Workshop

Thu 9:00 AM

The net has cracks and crackers are among us. With all the news of security failures, it can be a challenge to know what is FUD and what is really at risk and to what extent. This session isn’t about hacking an application together nor is it about coding a solution. It is about looking at the network and network infrastructure and understanding some of its weaknesses. This workshop is a 50% mix of lecture / discussion and hands on attacking in order to best understand the challenges.

The labs will require the use of:

• a virtual machine with BackTrack 5
• a wifi adaptor
• and a laptop.

We will have ISO installations of BackTrack 5 for you to install on your VM. It is best if you have this pre-installed, it can be downloaded at http://www.backtrack-linux.org/ . In order to run backtrack, you will want to install this to a virtual machine, if this is new to you, pick up virtualbox or vmware.

The wifi adaptor needed is an Alfa AWUS036H or Alfa AWUS036NHA. You will need 1 of these external adaptors. There are ~ $30 at amazon.

Through the labs we will:

• Disassociate wireless traffic
• Crack a WEP key
• Learn to break through a WPA device
• Scan for open ports

Hacking Workshop

Thu 11:00 AM

The net has cracks and crackers are among us. With all the news of security failures, it can be a challenge to know what is FUD and what is really at risk and to what extent. This session isn’t about hacking an application together nor is it about coding a solution. It is about looking at the network and network infrastructure and understanding some of its weaknesses. This workshop is a 50% mix of lecture / discussion and hands on attacking in order to best understand the challenges.

The labs will require the use of:

• a virtual machine with BackTrack 5
• a wifi adaptor
• and a laptop.

We will have ISO installations of BackTrack 5 for you to install on your VM. It is best if you have this pre-installed, it can be downloaded at http://www.backtrack-linux.org/ . In order to run backtrack, you will want to install this to a virtual machine, if this is new to you, pick up virtualbox or vmware.

The wifi adaptor needed is an Alfa AWUS036H or Alfa AWUS036NHA. You will need 1 of these external adaptors. There are ~ $30 at amazon.

Through the labs we will:

• Disassociate wireless traffic
• Crack a WEP key
• Learn to break through a WPA device
• Scan for open ports

Scaling up on the web

Thu 1:30 PM

The drive to continuous delivery, micro services and PaaS includes the need to auto scale and potentially auto provision services. This session will identify the legacy thinking of a statically partitioned world and drive to the scalable world of Apache Mesos.

This session will look at the failings of the many of today’s cloud technology, identify the goals we have and look into the tooling of how to get there. In this session we will look at:

• static vs elastic partitioning
• vm vs containers
• separating cluster capacity from application scale
• load balancing with HAProxy

This session will be packed with demonstrations.

Next Generation Web Applications Workshop

Fri 9:00 AM

The next generation of web applications using a cluster of resources instead of running on a single instances of a node in a cluster. To build this capability from scratch would be a costly proposition. Fortunately there is Apache Mesos. It abstracts the cloud and the data center and allows you to focus on your application needs. This is a workshop which will get into writing your first application which leverages a cluster of nodes.

To participate in this session you will need a computer with Java on it and for the best experience you will need a google account for Google Cloud Platform. An alternative is to use Vagrant with Virtualbox.

This will be a code focused workshop with focus on:

• Apache Mesos
• Protocol Buffers
• Java

Next Generation Web Applications Workshop

Fri 10:45 AM

The next generation of web applications using a cluster of resources instead of running on a single instances of a node in a cluster. To build this capability from scratch would be a costly proposition. Fortunately there is Apache Mesos. It abstracts the cloud and the data center and allows you to focus on your application needs. This is a workshop which will get into writing your first application which leverages a cluster of nodes.

To participate in this session you will need a computer with Java on it and for the best experience you will need a google account for Google Cloud Platform. An alternative is to use Vagrant with Virtualbox.

This will be a code focused workshop with focus on:

• Apache Mesos
• Protocol Buffers
• Java

Web Application Security Workshop

Fri 1:30 PM

As a web application developer, most of the focus is on the user stories and producing business value for your company or clients. Increasingly however the world wide web is more like the wild wild web which is an increasingly hostile environment for web applications. It is absolutely necessary for web application teams to have security knowledge, a security model and to leverage proper security tools.

This training workshop on security will provide an overview of the security landscape starting with the OWASP top ten security concerns with current real world examples of each of these attack vectors. The first session will consist of a demonstration and labs using hacker tools to get an understanding of how a hacker thinks. It will include a walk through of the ESAPI toolkit as an example of how to solve a number of these security concerns including hands-on labs using the OWASP example swingset.

The workshop will include several hands on labs from the webgoat project in order to better understand the threats that are ever so common today.

Attendees will come away with the following skills / capabilities:

• threat modeling
• security audit plan
• introduction to Pen testing
• key / certificate management
• fixing web application security issues

Don’t be the weakest link on the web!

Web Application Security Workshop

Fri 3:15 PM

As a web application developer, most of the focus is on the user stories and producing business value for your company or clients. Increasingly however the world wide web is more like the wild wild web which is an increasingly hostile environment for web applications. It is absolutely necessary for web application teams to have security knowledge, a security model and to leverage proper security tools.

This training workshop on security will provide an overview of the security landscape starting with the OWASP top ten security concerns with current real world examples of each of these attack vectors. The first session will consist of a demonstration and labs using hacker tools to get an understanding of how a hacker thinks. It will include a walk through of the ESAPI toolkit as an example of how to solve a number of these security concerns including hands-on labs using the OWASP example swingset.

The workshop will include several hands on labs from the webgoat project in order to better understand the threats that are ever so common today.

Attendees will come away with the following skills / capabilities:

• threat modeling
• security audit plan
• introduction to Pen testing
• key / certificate management
• fixing web application security issues

Don’t be the weakest link on the web!