Based on the example of the XWiki Open Source project (http://xwiki.org) this session will describe a number of practices to improve the quality of a Java project. Also, it will show how to implement these practices so that they are automatically checked and enforced. Some examples include: *How to make sure your project does not break binary compatibility unintentionally and, more generally, how to successfully evolve an API without breaking your users; *How to manage the JAR hell and avoid duplication of classes in your application at runtime; *How to automatically control the test coverage and the associated policies; *How to automate functional testing of web applications and how to avoid false-positives that plague any project..
This document introduces behavior driven development (BDD) and the TestBox testing framework for ColdFusion. It discusses how BDD builds upon test-driven development (TDD) principles by focusing on user stories and scenarios over isolated functions. TestBox allows writing BDD-style tests with expectations and supports different styles like xUnit. It provides features for parallel testing, mocking, reporting and integrating with build tools.
Hacking Java - Enhancing Java Code at Build or RuntimeSean P. Floyd
In this talk I'll explore different techniques in and around Java that extend or complement the existing language features at compile or runtime.
Examples are Source and Byte Code generation, Annotation Processing and compile-time defect analysis. The talk is not specific to any Java version. Code sample will use Java 8, but could be easily adapted to previous versions (1.6+).
As the talk is called "Hacking Java", the focus will not only be on established best practices, but also on techniques of a more experimental nature. The talk is accompanied by a GitHub project with code samples and unit tests for every single technique.
Test it! Unit, mocking and in-container Meet Arquillian!Ivan Ivanov
A gentle introduction into testing in Java. Begin with testing a single unit, continue with mocking dependency and end up with a full incontainer test capabilities.
Surviving the Java Deserialization Apocalypse // OWASP AppSecEU 2016Christian Schneider
The hidden danger of Java deserialization vulnerabilities – which often lead to remote code execution – has gained extended visibility in the past year. The issue has been known for years; however, it seems that the majority of developers were unaware of it until recent media coverage around commonly used libraries and major products. This talk aims to shed some light about how this vulnerability can be abused, how to detect it from a static and dynamic point of view, and -- most importantly -- how to effectively protect against it. The scope of this talk is not limited to the Java serialization protocol but also other popular Java libraries used for object serialization.
The ever-increasing number of new vulnerable endpoints and attacker-usable gadgets has resulted in a lot of different recommendations on how to protect your applications, including look-ahead deserialization and runtime agents to monitor and protect the deserialization process. Coming at the problem from a developer’s perspective and triaging the recommendations for you, this talk will review existing protection techniques and demonstrate their effectiveness on real applications. It will also review existing techniques and present new gadgets that demonstrates how attackers can actually abuse your application code and classpath to craft a chain of gadgets that will allow them to compromise your servers.
This talk will also present the typical architectural decisions and code patterns that lead to an increased risk of exposing deserialization vulnerabilities. Mapping the typical anti-patterns that must be avoided, through the use of real code examples we present an overview of hardening techniques and their effectiveness. The talk will also show attendees what to search the code for in order to find potential code gadgets the attackers can leverage to compromise their applications. We’ll conclude with action items and recommendations developers should consider to mitigate this threat.
--
This talk was presented by Alvaro Muñoz & Christian Schneider at the OWASP AppSecEU 2016 conference in Rome.
The document discusses techniques for enhancing Java code at build time or runtime, including patching third party libraries. It presents AspectJ as a way to patch byte code by defining pointcuts and advice that modify the behavior of methods. The document includes an example of using AspectJ to patch methods in a class with known bugs, replacing the implementation to fix the bugs while ensuring the patches worked correctly through test cases.
C++ Testing Techniques Tips and Tricks - C++ LondonClare Macrae
Links from the talk are available at:
https://github.com/claremacrae/talks/blob/master/Cpp_Testing_Techniques_Tips_and_Tricks.md#top
Presented at C++ London Meetup, on Thursday, November 21, 2019.
Abstract:
An assortment of practical techniques to make it easier to write effective automated tests of C++ code, both old and new.
I share some approaches for easier handling of commonly troublesome testing scenarios. This is a brand new talk, that is independent of test frameworks, and even covers a little for those creating Qt desktop applications.
This document introduces Arquillian, a testing platform that allows tests to run against deployed applications. It enables testing Java EE components with real instances rather than mocks. Arquillian uses the Java EE container to deploy and manage test dependencies, eliminating the need for manual transaction management or persistence context handling. Tests are written like normal unit tests and interact with real objects instead of mocks. Arquillian makes testing components close to their production environment.
(COSCUP 2015) A Beginner's Journey to Mozilla SpiderMonkey JS EngineZongXian Shen
This is my slides of COSCUP 2015 at Taipei, Taiwan.
The material is about the engine implementation overview from a 3 month experienced mentor bug contributor.
Security DevOps - Wie Sie in agilen Projekten trotzdem sicher bleiben // DevO...Christian Schneider
Diese Session zeigt Ihnen, welche Automatisierungsoptionen zur Überwachung bestimmter Sicherheitsaspekte in der agilen Softwareentwicklung bestehen. Ausgehend von dem etablierten DevOps-Konzept, mit dem im Übergang von Entwicklung zu Betrieb Prozesse automatisiert und verzahnt werden, wird mit „Security-DevOps“ dieser Antrieb aufgegriffen und auf die Absicherung von Anwendungen gegen Hackerangriffe übertragen. Durch frühe Rückkopplung sicherheitstechnischer Findings an die Entwicklung im Rahmen der Automatisierung haben Ihre Pentester die Möglichkeit, sich auf die kniffligeren Sicherheitschecks zu konzentrieren – trotz geforderter kurzer Releasezyklen.
This document discusses setting up a Selenium project with Maven and Jenkins for continuous integration. It describes installing and configuring Maven, creating a Maven project structure for Selenium, and setting up Jenkins to automatically run test cases and generate XSLT reports on the test results. Key steps include downloading and configuring Maven, creating a Maven project with dependencies in the pom.xml, and configuring Jenkins with the project details to enable continuous integration and reporting.
Quality assurance and testing are very important in a life cycle of any application. Although, by far not all developers understand the significance of tests.
In this presentation, we cover the basic testing practices for developers. The following tools are discussed: JUnit, Mockito, Hamcrest, JsTestDriver, DBUnit, Arquillian, SoapUI, Selenium.
The document discusses using the Flow library for MVP architecture in Android apps. It describes using Flow to define screens (paths) and navigate between them. Each screen has a custom view, layout, and presenter. The presenter is responsible for the view's logic and isolates it from changes in the model. Sample code is provided to demonstrate how to implement screens like login and home using this architecture.
Quickly Testing Legacy C++ Code with Approval TestsClare Macrae
Presented at CppCon 2019 on 16th September 2019.
You've inherited some legacy code: it's valuable, but it doesn't have tests, and it wasn't designed to be testable, so you need to start refactoring. But you can't refactor safely until the code has tests, and you can't add tests without refactoring! How can you ever break out of this loop?
Whether Legacy code for you means "old code", "code without tests", or "code you wish to redesign for new features or unit-tests", this talk will enable you to become productive and work safely, quickly.
The simplicity, convenience, ease-of-use, power and flexibility of Llewellyn Falco's "Approval Tests" approach has long been proven in a dozen programming languages. And now all this is now available to C++ developers too!
Clare will present a small but surprisingly effective C++11 library for applying "Approval Tests" to cross-platform C++ code - for both legacy and green-field systems, and with a range of testing frameworks.
She will describe its use in some real-world situations, including how to quickly lock down the behaviour of legacy code. She will show how to quickly achieve good test coverage, even for very large sets of inputs. Finally, she will describe some general techniques she learned along the way.
Attendees will discover some quick, practical techniques to use for common challenges, such as testing outputs containing dates and times, that can be applied very easily using Approval Tests.
Introductory slides on what is OpenJDK and why and how we should contribute to it. Given to the Bulgarian JUG before the first real adopt OpenJDK hackathon
Quickly and Effectively Testing Legacy C++ Code with Approval TestsClare Macrae
Presented at C++ on Sea 2020, 15 July 2020
Links from this talk are at: https://github.com/claremacrae/talks/blob/main/Quickly_and_Effectively_Testing_Legacy_C++_Code_with_Approval_Tests.md#top
Abstract:
You've inherited some legacy code: it's valuable, but it doesn't have tests, and it wasn't designed to be testable, so you need to start refactoring. But you can't refactor safely until the code has tests, and you can't add tests without refactoring! How can you ever break out of this loop?
Whether Legacy code for you means "old code", "code without tests", or "code you wish to redesign for new features or unit-tests", this talk will enable you to become productive and work safely, quickly.
The simplicity, convenience, ease-of-use, power and flexibility of Llewellyn Falco's "Approval Tests" approach has long been proven in a dozen programming languages. And now all this is now available to C++ developers too!
Clare will present a small but surprisingly effective C++11 library for applying "Approval Tests" to cross-platform C++ code - for both legacy and green-field systems, and with a range of testing frameworks.
She will demonstrate its use in some real-world situations, including how to quickly lock down the behaviour of legacy code. She will show how to quickly achieve good test coverage, even for very large sets of inputs.
She will also show recent work applying Approval Tests to testing Graphical User Interfaces
Finally, she will describe some powerful techniques used in the implementation, that are useful beyond the field
Attendees will discover some quick, practical techniques to use for common challenges, such as testing GUI systems, and outputs containing dates and times, that can be applied very easily using Approval Tests.
This document summarizes Louis Nyffenegger's talk on code review and capture-the-flag exercises for finding security vulnerabilities. The talk discusses different approaches to code review like grepping for bugs, following user inputs, reviewing functionality, and reading all code. It also provides tips for getting started with capture-the-flag exercises by focusing on weaknesses rather than vulnerabilities and combining issues. An example application is provided for attendees to practice on, and common weaknesses are listed that could lead to vulnerabilities like hardcoded credentials, cross-site scripting, and remote code execution.
San Francisco Java User Group presents Chris Bedford who talks about:
- How to write functional tests with Selenium (including explaining its IDE, architecture, RC, and alternatives like Canoo WebTest)
- How to set up Selenium testing for web apps in continuous integration using Maven, Ant, Cargo, etc.
- How to use Hudson for build server (brief overview)
January 12, 2010 in San Francisco, CA
http://www.sfjava.org/calendar/11982857/
Hosted by SUPINFO International University
Sponsored by TEKsystems, Guidewire Software, Sun, O'Reilly, JetBrains, and Marakana.
Video by Max Walker
Organized by Marakana
Serial Killer - Silently Pwning your Java Endpoints // OWASP BeNeLux Day 2016Christian Schneider
In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees:
The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application.
The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start.
Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.
--
This talk was presented by Christian Schneider & Alvaro Muñoz at the OWASP BeNeLux Day 2016.
First Name: Stephane
Last Name: Ducasse
Video: https://youtu.be/OGkGgx4iymM
Title: A Taste for Pharo 70
In this talk I will present the roadmap for Pharo 70.
- support for Undefined Classes
- Class Parser
- new class definition
- support for namespace (not namespace) modules.
- ...
Bio:
Stéphane is directeur de recherche at Inria. He leads the RMoD
(http://rmod.lille.inria.fr) team. He is expert in two domains:
object-oriented language design and reengineering. He worked on
traits, composable groups of methods. Traits have been introduced in Pharo, Perl, PHP and under a variant into Scala and Fortress. He is also expert on software quality, program understanding, program
visualisations, reengineering and metamodeling. He is one of the
developer of Moose, an open-source software analysis platform
http://www.moosetechnology.org/. He created http://www.synectique.eu/
a company building dedicated tools for advanced software analyses. He
is one of the leader of Pharo (http://www.pharo.org/) a dynamic
reflective object-oriented language supporting live programming. The
objective of Pharo is to create an ecosystem where innovation and
business bloom. He wrote several books such as Functional Programming
in Scheme, Pharo by Example, Deep into Pharo, Object-oriented
Reengineering Patterns, Dynamic web development with Seaside.
According to google his h-index is 51 for more than 11000
citations. He would like to thanks all the researchers making
reference to his work!
This document discusses various tools used for automated testing including Bugzilla, Testopia, and Jenkins. It provides overviews of each tool's features and how they integrate together in an automated testing environment. Key steps are outlined for setting up projects in each tool and configuring them to work together. Specifically, it describes how test cases can be retrieved from Testopia, executed via scripts on Jenkins, and results reported back to Testopia.
This document discusses monitoring software repositories to detect security issues. It introduces a tool called SANZARU that analyzes commits to repositories to identify potential bugs and vulnerabilities. SANZARU works by extracting vectors from commit data, training a classifier on past issues, and then classifying new commits. Its goals are to detect security fixes, new vulnerabilities, and interesting new features. The document provides examples of issues SANZARU has found and discusses challenges in commit classification.
Testing JSF with Arquillian and SeleniumLukáš Fryč
Testing of web applications is significant part of development cycle from perspective of both, application development and quality assurance.
JSF concepts makes testing of applications simple by separation of concerns, but enforces employing of specific tools for testing business logic and user interface.
Lukas covers testing pitas and introduce frameworks which make testing of JSF application a breeze and motivate developers to follow concepts of test-driven development.
Real Java EE Testing with Arquillian and ShrinkWrapDan Allen
Dan Allen presents on Arquillian and ShrinkWrap, tools for integration testing Java EE applications. Arquillian manages the lifecycle of containers to make integration testing easier. ShrinkWrap provides a simple API for programmatically assembling archives like JARs and WARs. Together they allow tests to run inside containers with the application code, avoiding lengthy builds. The talk demonstrates how to write tests using Arquillian and ShrinkWrap that inject resources and run application code directly in the same JVM for fast, isolated testing of Java EE components.
Arquillian - Integration Testing Made EasyJBUG London
Slides by Davide D'Alto presented at JBUG London event on the 24th of October 2012.
You can watch the presentation video here http://youtu.be/MuqAx9SuIOk
Abstract 2: "Advanced testing in action on a Java project"
In 2019 we're all used to writing automated tests in Java projects. It's now time to move up the chain and learn how to implement more complex type of testing.
This talk will demonstrate advanced testing practices used by the XWiki open source project (http://xwiki.org), and using Java, Maven, Docker and Jenkins and more:
* Testing for backward compatibility with Revapi and an associated strategy
* Testing for coverage with Jacoco and defining a viable strategy for slowing improving the situation
* Testing the quality of your tests with Descartes Mutation testing
* Automatically enriching your test suite with DSpot
* Testing various configurations with Docker containers and Jenkins
(COSCUP 2015) A Beginner's Journey to Mozilla SpiderMonkey JS EngineZongXian Shen
This is my slides of COSCUP 2015 at Taipei, Taiwan.
The material is about the engine implementation overview from a 3 month experienced mentor bug contributor.
Security DevOps - Wie Sie in agilen Projekten trotzdem sicher bleiben // DevO...Christian Schneider
Diese Session zeigt Ihnen, welche Automatisierungsoptionen zur Überwachung bestimmter Sicherheitsaspekte in der agilen Softwareentwicklung bestehen. Ausgehend von dem etablierten DevOps-Konzept, mit dem im Übergang von Entwicklung zu Betrieb Prozesse automatisiert und verzahnt werden, wird mit „Security-DevOps“ dieser Antrieb aufgegriffen und auf die Absicherung von Anwendungen gegen Hackerangriffe übertragen. Durch frühe Rückkopplung sicherheitstechnischer Findings an die Entwicklung im Rahmen der Automatisierung haben Ihre Pentester die Möglichkeit, sich auf die kniffligeren Sicherheitschecks zu konzentrieren – trotz geforderter kurzer Releasezyklen.
This document discusses setting up a Selenium project with Maven and Jenkins for continuous integration. It describes installing and configuring Maven, creating a Maven project structure for Selenium, and setting up Jenkins to automatically run test cases and generate XSLT reports on the test results. Key steps include downloading and configuring Maven, creating a Maven project with dependencies in the pom.xml, and configuring Jenkins with the project details to enable continuous integration and reporting.
Quality assurance and testing are very important in a life cycle of any application. Although, by far not all developers understand the significance of tests.
In this presentation, we cover the basic testing practices for developers. The following tools are discussed: JUnit, Mockito, Hamcrest, JsTestDriver, DBUnit, Arquillian, SoapUI, Selenium.
The document discusses using the Flow library for MVP architecture in Android apps. It describes using Flow to define screens (paths) and navigate between them. Each screen has a custom view, layout, and presenter. The presenter is responsible for the view's logic and isolates it from changes in the model. Sample code is provided to demonstrate how to implement screens like login and home using this architecture.
Quickly Testing Legacy C++ Code with Approval TestsClare Macrae
Presented at CppCon 2019 on 16th September 2019.
You've inherited some legacy code: it's valuable, but it doesn't have tests, and it wasn't designed to be testable, so you need to start refactoring. But you can't refactor safely until the code has tests, and you can't add tests without refactoring! How can you ever break out of this loop?
Whether Legacy code for you means "old code", "code without tests", or "code you wish to redesign for new features or unit-tests", this talk will enable you to become productive and work safely, quickly.
The simplicity, convenience, ease-of-use, power and flexibility of Llewellyn Falco's "Approval Tests" approach has long been proven in a dozen programming languages. And now all this is now available to C++ developers too!
Clare will present a small but surprisingly effective C++11 library for applying "Approval Tests" to cross-platform C++ code - for both legacy and green-field systems, and with a range of testing frameworks.
She will describe its use in some real-world situations, including how to quickly lock down the behaviour of legacy code. She will show how to quickly achieve good test coverage, even for very large sets of inputs. Finally, she will describe some general techniques she learned along the way.
Attendees will discover some quick, practical techniques to use for common challenges, such as testing outputs containing dates and times, that can be applied very easily using Approval Tests.
Introductory slides on what is OpenJDK and why and how we should contribute to it. Given to the Bulgarian JUG before the first real adopt OpenJDK hackathon
Quickly and Effectively Testing Legacy C++ Code with Approval TestsClare Macrae
Presented at C++ on Sea 2020, 15 July 2020
Links from this talk are at: https://github.com/claremacrae/talks/blob/main/Quickly_and_Effectively_Testing_Legacy_C++_Code_with_Approval_Tests.md#top
Abstract:
You've inherited some legacy code: it's valuable, but it doesn't have tests, and it wasn't designed to be testable, so you need to start refactoring. But you can't refactor safely until the code has tests, and you can't add tests without refactoring! How can you ever break out of this loop?
Whether Legacy code for you means "old code", "code without tests", or "code you wish to redesign for new features or unit-tests", this talk will enable you to become productive and work safely, quickly.
The simplicity, convenience, ease-of-use, power and flexibility of Llewellyn Falco's "Approval Tests" approach has long been proven in a dozen programming languages. And now all this is now available to C++ developers too!
Clare will present a small but surprisingly effective C++11 library for applying "Approval Tests" to cross-platform C++ code - for both legacy and green-field systems, and with a range of testing frameworks.
She will demonstrate its use in some real-world situations, including how to quickly lock down the behaviour of legacy code. She will show how to quickly achieve good test coverage, even for very large sets of inputs.
She will also show recent work applying Approval Tests to testing Graphical User Interfaces
Finally, she will describe some powerful techniques used in the implementation, that are useful beyond the field
Attendees will discover some quick, practical techniques to use for common challenges, such as testing GUI systems, and outputs containing dates and times, that can be applied very easily using Approval Tests.
This document summarizes Louis Nyffenegger's talk on code review and capture-the-flag exercises for finding security vulnerabilities. The talk discusses different approaches to code review like grepping for bugs, following user inputs, reviewing functionality, and reading all code. It also provides tips for getting started with capture-the-flag exercises by focusing on weaknesses rather than vulnerabilities and combining issues. An example application is provided for attendees to practice on, and common weaknesses are listed that could lead to vulnerabilities like hardcoded credentials, cross-site scripting, and remote code execution.
San Francisco Java User Group presents Chris Bedford who talks about:
- How to write functional tests with Selenium (including explaining its IDE, architecture, RC, and alternatives like Canoo WebTest)
- How to set up Selenium testing for web apps in continuous integration using Maven, Ant, Cargo, etc.
- How to use Hudson for build server (brief overview)
January 12, 2010 in San Francisco, CA
http://www.sfjava.org/calendar/11982857/
Hosted by SUPINFO International University
Sponsored by TEKsystems, Guidewire Software, Sun, O'Reilly, JetBrains, and Marakana.
Video by Max Walker
Organized by Marakana
Serial Killer - Silently Pwning your Java Endpoints // OWASP BeNeLux Day 2016Christian Schneider
In this session we begin with modelling the attack surface of Java deserialization, which often leads to remote code execution (RCE), by showcasing vulnerabilities we found in modern and widely used applications and frameworks. We extend existing research about risks of deserialization broadening the attack surface. After a live demo of getting a Meterpreter shell in a modern Java endpoint setup we delve into the exploitation styles for this vulnerability to lay the foundation of the first of three key takeaways for the attendees:
The first key takeaway is identification of test types that should be executed during a dynamic assessment of an application in order to find this kind of vulnerability. This includes analyzing the deserialization interface and using blackbox tests to create payloads with gadgets matching the application’s classpath to verify the RCE. Discussion extends to cover indirect deserialization interfaces that use non-binary data formats, such as XML-based interfaces, which can also act as a driver for deserialization within the application.
The next key takeaway covers the realm of static code analysis (SAST). We present code patterns security reviewers should look for when doing whitebox assessments of applications or frameworks. This is especially interesting for code offering dynamic functionality including AOP, generic mappings, reflection, interceptors, etc. - all of which have a high probability of including code that can facilitate as deserialization gadgets and thus help the attackers in exploiting deserialization vulnerabilities. In this section we present the techniques used to find the vulnerabilities within the popular frameworks showcased during the live demo at the session’s start.
Finally we conclude with tips on implementing different techniques of hardening measures for applications offering deserialisation interfaces (either direct binary deserialization interfaces or indirect XML-based ones) to give the attendees the third key takeaway: protecting applications properly. This includes ways to verify data integrity prior to deserialization and ways to properly inspect the data before it’s handled by the Java deserialization process.
--
This talk was presented by Christian Schneider & Alvaro Muñoz at the OWASP BeNeLux Day 2016.
First Name: Stephane
Last Name: Ducasse
Video: https://youtu.be/OGkGgx4iymM
Title: A Taste for Pharo 70
In this talk I will present the roadmap for Pharo 70.
- support for Undefined Classes
- Class Parser
- new class definition
- support for namespace (not namespace) modules.
- ...
Bio:
Stéphane is directeur de recherche at Inria. He leads the RMoD
(http://rmod.lille.inria.fr) team. He is expert in two domains:
object-oriented language design and reengineering. He worked on
traits, composable groups of methods. Traits have been introduced in Pharo, Perl, PHP and under a variant into Scala and Fortress. He is also expert on software quality, program understanding, program
visualisations, reengineering and metamodeling. He is one of the
developer of Moose, an open-source software analysis platform
http://www.moosetechnology.org/. He created http://www.synectique.eu/
a company building dedicated tools for advanced software analyses. He
is one of the leader of Pharo (http://www.pharo.org/) a dynamic
reflective object-oriented language supporting live programming. The
objective of Pharo is to create an ecosystem where innovation and
business bloom. He wrote several books such as Functional Programming
in Scheme, Pharo by Example, Deep into Pharo, Object-oriented
Reengineering Patterns, Dynamic web development with Seaside.
According to google his h-index is 51 for more than 11000
citations. He would like to thanks all the researchers making
reference to his work!
This document discusses various tools used for automated testing including Bugzilla, Testopia, and Jenkins. It provides overviews of each tool's features and how they integrate together in an automated testing environment. Key steps are outlined for setting up projects in each tool and configuring them to work together. Specifically, it describes how test cases can be retrieved from Testopia, executed via scripts on Jenkins, and results reported back to Testopia.
This document discusses monitoring software repositories to detect security issues. It introduces a tool called SANZARU that analyzes commits to repositories to identify potential bugs and vulnerabilities. SANZARU works by extracting vectors from commit data, training a classifier on past issues, and then classifying new commits. Its goals are to detect security fixes, new vulnerabilities, and interesting new features. The document provides examples of issues SANZARU has found and discusses challenges in commit classification.
Testing JSF with Arquillian and SeleniumLukáš Fryč
Testing of web applications is significant part of development cycle from perspective of both, application development and quality assurance.
JSF concepts makes testing of applications simple by separation of concerns, but enforces employing of specific tools for testing business logic and user interface.
Lukas covers testing pitas and introduce frameworks which make testing of JSF application a breeze and motivate developers to follow concepts of test-driven development.
Real Java EE Testing with Arquillian and ShrinkWrapDan Allen
Dan Allen presents on Arquillian and ShrinkWrap, tools for integration testing Java EE applications. Arquillian manages the lifecycle of containers to make integration testing easier. ShrinkWrap provides a simple API for programmatically assembling archives like JARs and WARs. Together they allow tests to run inside containers with the application code, avoiding lengthy builds. The talk demonstrates how to write tests using Arquillian and ShrinkWrap that inject resources and run application code directly in the same JVM for fast, isolated testing of Java EE components.
Arquillian - Integration Testing Made EasyJBUG London
Slides by Davide D'Alto presented at JBUG London event on the 24th of October 2012.
You can watch the presentation video here http://youtu.be/MuqAx9SuIOk
Abstract 2: "Advanced testing in action on a Java project"
In 2019 we're all used to writing automated tests in Java projects. It's now time to move up the chain and learn how to implement more complex type of testing.
This talk will demonstrate advanced testing practices used by the XWiki open source project (http://xwiki.org), and using Java, Maven, Docker and Jenkins and more:
* Testing for backward compatibility with Revapi and an associated strategy
* Testing for coverage with Jacoco and defining a viable strategy for slowing improving the situation
* Testing the quality of your tests with Descartes Mutation testing
* Automatically enriching your test suite with DSpot
* Testing various configurations with Docker containers and Jenkins
Vincent Massol presented on developing the open source XWiki project. Key points include:
- XWiki is an open source structured wiki and content platform. It has over 73% test coverage and aims for monthly releases.
- Governance follows Apache Foundation rules. Development uses test-driven practices like continuous integration, automated testing, and code reviews.
- Communication occurs via mailing lists, IRC, and commit emails. Developers work on specifications in JIRA and document code.
- Future goals include separating the open source project from the company, running CI tests in Docker, reducing flaky tests, and automating performance testing.
This talk demonstrates advanced testing practices coming from the STAMP research project and applied to the XWiki open source project:
- Testing for coverage with Jacoco and defining a viable strategy for slowly improving the situation
- Testing the quality of your tests with Descartes Mutation testing
- Automatically enriching your test suite with DSpot
- Testing various configurations with Docker containers and Jenkins
- Generating tests automatically from production stack traces
The document discusses best practices for building top-notch Android SDKs. It recommends making SDKs open source to improve quality through community contributions. It provides guidance on project structure, ensuring SDKs are available, easy to use, flexible, testable, performant, reliable and lightweight. Specific tips include using README files, continuous integration, static analysis, documentation generation, testing, and distributing through package managers. The goal is to create SDKs that minimize requirements and permissions while supporting different Android versions and contexts.
Internal training at [[XWiki SAS>>http://xwiki.com]] about the Development Practices used by the XWiki SAS product team in charge of developing the XWiki open source project (among other projects). Most of the practices detailed are those from the XWiki open source project, defined on the [[dev subwiki>>dev:Main.WebHome]]. However the slides also provide a glimpse of other development practices that are used to complement the open source practices, such as Roadmap preparation and Stakeholder meetings.
More details at http://www.xwiki.org/xwiki/bin/view/Blog/DevPracticesByXWikiSAS
QtTest is a unit testing framework that comes with Qt. It provides classes and methods for building test fixtures to test units of code. QtTest allows testing signals without needing to write slots using QSignalSpy. It can also simulate user events like mouse clicks and key presses. While QtTest is useful for unit testing, it does not provide isolation of dependencies between units. Tests using QtTest should focus on testing one thing at a time and creating new objects for each test to isolate the code being tested.
- Testing JavaScript code helps ensure quality and allows for refactoring and code handovers. Unit, integration, and functional testing methodologies were discussed.
- Siesta was introduced as a JavaScript testing tool that supports unit and functional testing for Ext JS and Sencha Touch. It allows simulating user interactions and verifying results.
- Writing testable code through separation of concerns, avoiding direct DOM manipulation, and supporting dependency injection were recommended to facilitate automated testing. Continuous integration was also recommended for running tests regularly.
Mock what? What Mock?Learn What is Mocking, and how to use Mocking with ColdFusion testing, development, and continuous integration. Look at Mocking and Stubbing with a touch of Theory and a lot of Examples, including what you could test, and what you should test… and what you shouldn't test (but might be fun).
Infinum Android Talks #13 - Developing Android Apps Like Navy Seals by Ivan KuštInfinum
In this talk, we’ll show you our development process at Infinum. We'll talk about Continuous integration, MVP, Git flow, static code analysis, Unit tests, multi-environment support and a few more.
The document discusses challenges faced with automated testing at scale for a large codebase with many dependencies, technologies, and test types. It describes how the large number of tests led to slow build times, failures blocking changes, and reduced developer productivity. Specific issues mentioned include monolithic test organization, slow unit/functional tests, non-deterministic races/timeouts, and re-running all tests on every commit. The document advocates for strategies like separating test types, running in parallel, and using page objects to isolate tests from UI changes.
Whether you are building a mobile app or a web app, Apache Usergrid (incubating) can provide you with a complete backend that supports authentication, persistence and social features like activities and followers all via a comprehensive REST API — and backed by Cassandra, giving you linear scalability. This session will tell you what you need to know to be a Usergrid contributor, starting with the basics of building and running Usergrid from source code. You’ll learn how to find your way around the Usergrid code base, how the code for the Stack, Portal and SDKs and how to use the test infrastructure to test your changes to Usergrid. You’ll learn the Usergrid contributor workflow, how the project uses JIRA and Github to manage change and how to contribute your changes to the project. The session will also cover the Usergrid roadmap and what the community is currently working on.
Presented at STPCon 2016. With the extensive amount of testing performed nightly on large software projects, test and verification teams often experience lengthy wait times for the availability of test results of the latest build. As we strive to identify and resolve issues as fast as possible, alternative methods of test execution have to be found. Learn how to use Jenkins to launch tests in parallel across a number of Virtual Machines, monitor execution health, and process results. Learn about various Jenkins plugins and how they contributed to the solution. Learn how to trigger downstream jobs, even if they are on separate Jenkins instances.
This document summarizes a talk on unit testing in JavaScript. It introduces the speaker and their company Third Wave Technology. It then defines unit testing as writing code to test individual units in isolation. The benefits of unit testing are discussed such as speeding up development, providing documentation, and helping write better code. Popular JavaScript unit testing frameworks like QUnit and Jasmine are presented. The document concludes by suggesting factors to consider when choosing a unit testing framework.
MyHeritage - QA Automations in a Continuous Deployment environmentMatanGoren
In this presentation we explain the CD mindset of the MyHeritage QA and how we use Watir, Appium, Ruby, Cumcumber and other supporting technologies to allow end to end testing.
These are the link mentioned in the presentation:
Continuous Deployment Applied at MyHeritage - http://www.slideshare.net/RanLevy/continuous-deployment-applied-at-myheritage
Appium - http://appium.io/
Ruby - https://www.ruby-lang.org/en/
Watir - http://watirwebdriver.com/
page-object - https://github.com/cheezy/page-object
Selenium Grid - https://github.com/SeleniumHQ/selenium/wiki/Grid2
Selenium-Grid-Extras - https://github.com/groupon/Selenium-Grid-Extras
Jenkins - https://jenkins-ci.org/
This document provides an overview of Behavior Driven Development (BDD). It begins by introducing the speaker, Luis Majano, and his background. It then discusses the testing landscape, including the costs of fixing bugs at different stages of development. It provides an introduction to test-driven development (TDD) and how it differs from BDD. BDD combines TDD with domain-driven design and object-oriented principles to promote collaboration between developers, business analysts, and stakeholders. It focuses on user stories and scenarios rather than just functions. The remainder of the document discusses how to implement BDD using TestBox, a BDD testing framework for ColdFusion, including writing tests using describe(), it(), expectations, matchers, and
This talk was give at the South Shore .NET Users Group.
Unit Testing is now considered a required skill for developers. There are a ton of tools out there. However, there's nothing that shows you how to tie them all together to make your software fast, testable, and flexible. This talk will go over my toolset:
• MSTest
• Moq - Mocking framework
• NCover - for coverage
• MSBuild - for automation
• Dotcover - coverage from VS
• Unity - for dependency injection
This talk has a very long demo
Video at https://www.youtube.com/watch?v=nD1eFbql8jg
This talk will demonstrate advanced testing practices used by the XWiki open source project, and using Java, Maven, Docker and Jenkins:
* Testing for backward compatibility with Revapi and an associated strategy
* Testing for coverage with Jacoco and defining a viable strategy for slowing improving the situation
* Testing the quality of your tests with Descartes Mutation testing
Automatically enriching your test suite with DSpot
* Testing various configurations with Docker containers and Jenkins
En tant que développeur, qu'il est bon d'être capable de débugguer sur sa machine un problème survenant en production, dans une configuration spécifique ! C'est ce que permet le framework TestContainers. Il permet de piloter Docker directement depuis ses tests JUnit et donc d'avoir un mécanisme extrêmement efficace pour déployer ses tests fonctionnels dans un environnement donné.
Cette session présentera TestContainers, appliqué à un cas réel avec une démonstration de comment l'utiliser pour effectuer des tests impliquant une base de données, un moteur de Servlet et plus. Au programme: Intégration JUnit5, création d'images Docker custom, enregistrement automatique de vidéos des tests, intégration avec un job Jenkins pipeline pour itérer sur les différentes configurations à tester.
XWiki is an open source enterprise wiki platform that can be used to build content-based web applications. It allows users to create custom metadata and store it in wiki pages, includes strong scripting capabilities in pages, and enables skinning, theming and injection of CSS/JavaScript. XWiki is aimed at collaborative authoring of content and provides capabilities for storing data locally for performance and analytics purposes. It also includes features for scheduling tasks and visualizing data through graphs. XWiki takes a model of "application morphing" where applications are dynamically built using the wiki capabilities rather than using a traditional development approach.
Configuration Testing with Docker & TestContainersVincent Massol
Testing different configuration of your software on the developer machine, directly from your IDE.
Presented at Devoxx FR 2019
Video at https://youtu.be/0TvWv4L_IJM
This document discusses recent and upcoming changes in versions 9.x and 10.x of the XWiki collaboration platform. Key updates in 10.x include replacing the watchlist and activity stream with a new notifications system, adding filters to the live table feature, and reorganizing the administration interface. Version 9.x introduced features like blame viewing, syntax highlighting, and batch restoring of deleted pages. The document encourages sharing future ideas to continue improving XWiki.
This document proposes the QDashboard project, which aims to develop a quality and health dashboard to monitor software projects. It would extract metrics from source code, issue trackers, and other project outputs to track quality and health over time. The dashboard would display metrics, rank projects, and suggest recommendations. It would reuse existing open source tools and provide views for various roles. The proposed architecture includes a web app, plugins/portlets for views, and an API for extracting metrics from data sources.
Creating your own project's Quality DashboardVincent Massol
This document discusses creating a quality dashboard to monitor various metrics for a software project. It describes integrating data from Jenkins, SonarQube, JIRA, and GitHub to track the number of tests, code bugs, open blocker issues, and committer stats. The dashboard will be created in XWiki using scripts, the graph macro, dashboard macro, and cache macro. Data will be stored locally in XWiki objects for performance and visualization. A scheduler job will regularly update the data. Notifications may be sent if certain conditions are met like exceeding a bug threshold.
XWiki: wiki collaboration as an alternative to Confluence and SharepointVincent Massol
This document compares the wiki collaboration platform XWiki to Confluence and Sharepoint. It outlines XWiki's main differentiators as being open source and community-based development, high configurability directly in the wiki, and structured data as a built-in feature. It discusses XWiki's open source nature, extensive customizability options through UI extensions and configurations, built-in structured data capabilities, and ability for non-developers to create simple applications. Feedback from users praises XWiki's functionality, extensive extensions, flexibility, active community, and quality over other wiki systems like Confluence.
Creating your own project's Quality DashboardVincent Massol
Presentation held at Softshake 2017.
Shows how to use the XWiki open source project (http://xwiki.org) to develop a quality portal web site for your development projects. We'll start from a clean XWiki instance and configure it and write scripts to have the following features:
* Documentation for your project
* Display JIRA issues
* Display Sonar metrics
* Display Jenkins statuses
* Display Git statistics of your project
* Have an application to perform releases (checklist, release notes)
* Send alerts (mail, IRC, etc) when quality metric thresholds are reached
And more!
Presentation held at Softshake 2017.
When developing a web application, the traditional way is to develop the application from scratch using a general purpose language such as PHP, Grails, Play, Java/JSP, etc.
This presentation shows that a next generation wiki (examples based on XWiki: http://xwiki.org) can be used as a web development platform to develop applications on top of it, providing a strong infrastructure scaffolding to building web applications.
The advantages are similar to those of using an application sever. However whereas an application server offers technical services only, a wiki platform offers higher level services such as content management, rendering, storage, WYSIWYGeditor, user management, and a lot more.
Not only are these services offered, you can develop using them in your traditional IDE or in the runtime, directly in wiki pages. This allows developing web applications extremely quickly, collaboratively and with a fast turnaround time, which is perfect for adhoc web application development.
Leading a Community-Driven Open Source ProjectVincent Massol
Talk presented at Voxxed Luxembourg 2017.
This talk is a return of experience of 20 years developing open source software at the Apache Software Foundation (Jakarta Cactus, Apache Maven), at Codehaus (Cargo) and on the XWiki open source project (last 10 years).
Through the example of the XWiki open source project, the talk will tackle best practices and governance rules for running community-driven open source projects and it'll also tackle the difficult topic of how to run such a project when there are companies making money from the open source project behind the scene.
Examples of topics that will be covered:
* Committership
* Development best practices
* Roadmap definitions
* Fully automating software releases
* Handling companies
* Tracking who's using your project
- XWiki downloads have increased steadily to over 30,000 per month since 2014. Active installs have also grown by around 9% per month.
- While mailing list activity has decreased and commit activity has remained stable, issues filed and pull requests have increased in 2015, showing greater community involvement.
- XWiki SAS contributes the majority of commits but external contributions have grown, although more could be done to attract contributors to projects under xwiki-contrib.
- Overall, usage is growing significantly while development activity and the number of contributors has remained steady, suggesting actions may be needed to further engage the community.
XWiki SAS est une société qui sponsorise le développement du logiciel open source XWiki (http://xwiki.org).
De plus le développement du logiciel est communautaire et suit les règles de développement de la fondation Apache.
Vincent Massol, directeur technique de XWiki SAS présentera comme la société est organisée de l’intérieur, ses sources de revenus, comment se font les recrutements et quels sont les liens avec le projet open source et les tensions inhérentes entre une société à but commercial et un projet open source communautaire.
XWiki: A web dev runtime for writing web apps @ FOSDEM 2014Vincent Massol
When developing a web application, the traditional way is to develop the application from scratch using a general purpose language such as PHP, Grails, Play, Java/JSP, etc.
This presentation will show that a next generation wiki (examples based on XWiki: http://xwiki.org) can be used as a web development platform to develop applications on top of it, providing a strong infrastructure scaffolding to building web applications.
The advantages are similar to those of using an application sever. However whereas an application server offers technical services only, a wiki platform offers higher level services such as content management, rendering, storage, WYSIWYGeditor, user management, and a lot more.
Not only are these services offered, you can develop using them in your traditional IDE or in the runtime, directly in wiki pages. This allows developing web applications extremely quickly, collaboratively and with a fast turnaround time, which is perfect for adhoc web application development.
Implementing Quality on Java projects (Short version)Vincent Massol
This document discusses implementing quality in Java projects. It defines quality as coding rules, test coverage, tracking bugs, stable APIs, code reviews, automated builds/tests, and regular releases. Specific tips are provided, such as using Checkstyle and Jacoco to enforce rules and ensure test coverage doesn't decrease. It also recommends dedicating one day per week to bug fixing to help close issues. The conclusion emphasizes that quality improvements should be added gradually with agreement, focusing on both preventative and reactive measures, and adapting checks as needed.
The document discusses implementing quality on Java projects. It provides five tips for ensuring quality: (1) maintaining API stability by avoiding deprecations and changes to public interfaces, (2) preventing "JAR hell" by avoiding duplicate dependencies and version conflicts, (3) enforcing high test coverage using tools like Jacoco, (4) improving stability of functional tests by filtering false positives in CI builds, and (5) dedicating time regularly for fixing bugs through a "Bug Fixing Day".
Presentation given at the Alpes JUG and Mars JUG on 10th and 11th of October 2012. Explains why XWiki is a runtime platform for developing web applications
Book industry standards are evolving rapidly. In the first part of this session, we’ll share an overview of key developments from 2024 and the early months of 2025. Then, BookNet’s resident standards expert, Tom Richardson, and CEO, Lauren Stewart, have a forward-looking conversation about what’s next.
Link to recording, presentation slides, and accompanying resource: https://bnctechforum.ca/sessions/standardsgoals-for-2025-standards-certification-roundup/
Presented by BookNet Canada on May 6, 2025 with support from the Department of Canadian Heritage.
Procurement Insights Cost To Value Guide.pptxJon Hansen
Procurement Insights integrated Historic Procurement Industry Archives, serves as a powerful complement — not a competitor — to other procurement industry firms. It fills critical gaps in depth, agility, and contextual insight that most traditional analyst and association models overlook.
Learn more about this value- driven proprietary service offering here.
Designing Low-Latency Systems with Rust and ScyllaDB: An Architectural Deep DiveScyllaDB
Want to learn practical tips for designing systems that can scale efficiently without compromising speed?
Join us for a workshop where we’ll address these challenges head-on and explore how to architect low-latency systems using Rust. During this free interactive workshop oriented for developers, engineers, and architects, we’ll cover how Rust’s unique language features and the Tokio async runtime enable high-performance application development.
As you explore key principles of designing low-latency systems with Rust, you will learn how to:
- Create and compile a real-world app with Rust
- Connect the application to ScyllaDB (NoSQL data store)
- Negotiate tradeoffs related to data modeling and querying
- Manage and monitor the database for consistently low latencies
Dev Dives: Automate and orchestrate your processes with UiPath MaestroUiPathCommunity
This session is designed to equip developers with the skills needed to build mission-critical, end-to-end processes that seamlessly orchestrate agents, people, and robots.
📕 Here's what you can expect:
- Modeling: Build end-to-end processes using BPMN.
- Implementing: Integrate agentic tasks, RPA, APIs, and advanced decisioning into processes.
- Operating: Control process instances with rewind, replay, pause, and stop functions.
- Monitoring: Use dashboards and embedded analytics for real-time insights into process instances.
This webinar is a must-attend for developers looking to enhance their agentic automation skills and orchestrate robust, mission-critical processes.
👨🏫 Speaker:
Andrei Vintila, Principal Product Manager @UiPath
This session streamed live on April 29, 2025, 16:00 CET.
Check out all our upcoming Dev Dives sessions at https://community.uipath.com/dev-dives-automation-developer-2025/.
AI and Data Privacy in 2025: Global TrendsInData Labs
In this infographic, we explore how businesses can implement effective governance frameworks to address AI data privacy. Understanding it is crucial for developing effective strategies that ensure compliance, safeguard customer trust, and leverage AI responsibly. Equip yourself with insights that can drive informed decision-making and position your organization for success in the future of data privacy.
This infographic contains:
-AI and data privacy: Key findings
-Statistics on AI data privacy in the today’s world
-Tips on how to overcome data privacy challenges
-Benefits of AI data security investments.
Keep up-to-date on how AI is reshaping privacy standards and what this entails for both individuals and organizations.
Andrew Marnell: Transforming Business Strategy Through Data-Driven InsightsAndrew Marnell
With expertise in data architecture, performance tracking, and revenue forecasting, Andrew Marnell plays a vital role in aligning business strategies with data insights. Andrew Marnell’s ability to lead cross-functional teams ensures businesses achieve sustainable growth and operational excellence.
HCL Nomad Web – Best Practices and Managing Multiuser Environmentspanagenda
Webinar Recording: https://www.panagenda.com/webinars/hcl-nomad-web-best-practices-and-managing-multiuser-environments/
HCL Nomad Web is heralded as the next generation of the HCL Notes client, offering numerous advantages such as eliminating the need for packaging, distribution, and installation. Nomad Web client upgrades will be installed “automatically” in the background. This significantly reduces the administrative footprint compared to traditional HCL Notes clients. However, troubleshooting issues in Nomad Web present unique challenges compared to the Notes client.
Join Christoph and Marc as they demonstrate how to simplify the troubleshooting process in HCL Nomad Web, ensuring a smoother and more efficient user experience.
In this webinar, we will explore effective strategies for diagnosing and resolving common problems in HCL Nomad Web, including
- Accessing the console
- Locating and interpreting log files
- Accessing the data folder within the browser’s cache (using OPFS)
- Understand the difference between single- and multi-user scenarios
- Utilizing Client Clocking
Noah Loul Shares 5 Steps to Implement AI Agents for Maximum Business Efficien...Noah Loul
Artificial intelligence is changing how businesses operate. Companies are using AI agents to automate tasks, reduce time spent on repetitive work, and focus more on high-value activities. Noah Loul, an AI strategist and entrepreneur, has helped dozens of companies streamline their operations using smart automation. He believes AI agents aren't just tools—they're workers that take on repeatable tasks so your human team can focus on what matters. If you want to reduce time waste and increase output, AI agents are the next move.
DevOpsDays Atlanta 2025 - Building 10x Development Organizations.pptxJustin Reock
Building 10x Organizations with Modern Productivity Metrics
10x developers may be a myth, but 10x organizations are very real, as proven by the influential study performed in the 1980s, ‘The Coding War Games.’
Right now, here in early 2025, we seem to be experiencing YAPP (Yet Another Productivity Philosophy), and that philosophy is converging on developer experience. It seems that with every new method we invent for the delivery of products, whether physical or virtual, we reinvent productivity philosophies to go alongside them.
But which of these approaches actually work? DORA? SPACE? DevEx? What should we invest in and create urgency behind today, so that we don’t find ourselves having the same discussion again in a decade?
Technology Trends in 2025: AI and Big Data AnalyticsInData Labs
At InData Labs, we have been keeping an ear to the ground, looking out for AI-enabled digital transformation trends coming our way in 2025. Our report will provide a look into the technology landscape of the future, including:
-Artificial Intelligence Market Overview
-Strategies for AI Adoption in 2025
-Anticipated drivers of AI adoption and transformative technologies
-Benefits of AI and Big data for your business
-Tips on how to prepare your business for innovation
-AI and data privacy: Strategies for securing data privacy in AI models, etc.
Download your free copy nowand implement the key findings to improve your business.
Increasing Retail Store Efficiency How can Planograms Save Time and Money.pptxAnoop Ashok
In today's fast-paced retail environment, efficiency is key. Every minute counts, and every penny matters. One tool that can significantly boost your store's efficiency is a well-executed planogram. These visual merchandising blueprints not only enhance store layouts but also save time and money in the process.
Big Data Analytics Quick Research Guide by Arthur MorganArthur Morgan
This is a Quick Research Guide (QRG).
QRGs include the following:
- A brief, high-level overview of the QRG topic.
- A milestone timeline for the QRG topic.
- Links to various free online resource materials to provide a deeper dive into the QRG topic.
- Conclusion and a recommendation for at least two books available in the SJPL system on the QRG topic.
QRGs planned for the series:
- Artificial Intelligence QRG
- Quantum Computing QRG
- Big Data Analytics QRG
- Spacecraft Guidance, Navigation & Control QRG (coming 2026)
- UK Home Computing & The Birth of ARM QRG (coming 2027)
Any questions or comments?
- Please contact Arthur Morgan at [email protected].
100% human made.
TrustArc Webinar: Consumer Expectations vs Corporate Realities on Data Broker...TrustArc
Most consumers believe they’re making informed decisions about their personal data—adjusting privacy settings, blocking trackers, and opting out where they can. However, our new research reveals that while awareness is high, taking meaningful action is still lacking. On the corporate side, many organizations report strong policies for managing third-party data and consumer consent yet fall short when it comes to consistency, accountability and transparency.
This session will explore the research findings from TrustArc’s Privacy Pulse Survey, examining consumer attitudes toward personal data collection and practical suggestions for corporate practices around purchasing third-party data.
Attendees will learn:
- Consumer awareness around data brokers and what consumers are doing to limit data collection
- How businesses assess third-party vendors and their consent management operations
- Where business preparedness needs improvement
- What these trends mean for the future of privacy governance and public trust
This discussion is essential for privacy, risk, and compliance professionals who want to ground their strategies in current data and prepare for what’s next in the privacy landscape.
Massive Power Outage Hits Spain, Portugal, and France: Causes, Impact, and On...Aqusag Technologies
In late April 2025, a significant portion of Europe, particularly Spain, Portugal, and parts of southern France, experienced widespread, rolling power outages that continue to affect millions of residents, businesses, and infrastructure systems.
Generative Artificial Intelligence (GenAI) in BusinessDr. Tathagat Varma
My talk for the Indian School of Business (ISB) Emerging Leaders Program Cohort 9. In this talk, I discussed key issues around adoption of GenAI in business - benefits, opportunities and limitations. I also discussed how my research on Theory of Cognitive Chasms helps address some of these issues
AI Changes Everything – Talk at Cardiff Metropolitan University, 29th April 2...Alan Dix
Talk at the final event of Data Fusion Dynamics: A Collaborative UK-Saudi Initiative in Cybersecurity and Artificial Intelligence funded by the British Council UK-Saudi Challenge Fund 2024, Cardiff Metropolitan University, 29th April 2025
https://alandix.com/academic/talks/CMet2025-AI-Changes-Everything/
Is AI just another technology, or does it fundamentally change the way we live and think?
Every technology has a direct impact with micro-ethical consequences, some good, some bad. However more profound are the ways in which some technologies reshape the very fabric of society with macro-ethical impacts. The invention of the stirrup revolutionised mounted combat, but as a side effect gave rise to the feudal system, which still shapes politics today. The internal combustion engine offers personal freedom and creates pollution, but has also transformed the nature of urban planning and international trade. When we look at AI the micro-ethical issues, such as bias, are most obvious, but the macro-ethical challenges may be greater.
At a micro-ethical level AI has the potential to deepen social, ethnic and gender bias, issues I have warned about since the early 1990s! It is also being used increasingly on the battlefield. However, it also offers amazing opportunities in health and educations, as the recent Nobel prizes for the developers of AlphaFold illustrate. More radically, the need to encode ethics acts as a mirror to surface essential ethical problems and conflicts.
At the macro-ethical level, by the early 2000s digital technology had already begun to undermine sovereignty (e.g. gambling), market economics (through network effects and emergent monopolies), and the very meaning of money. Modern AI is the child of big data, big computation and ultimately big business, intensifying the inherent tendency of digital technology to concentrate power. AI is already unravelling the fundamentals of the social, political and economic world around us, but this is a world that needs radical reimagining to overcome the global environmental and human challenges that confront us. Our challenge is whether to let the threads fall as they may, or to use them to weave a better future.
Artificial Intelligence is providing benefits in many areas of work within the heritage sector, from image analysis, to ideas generation, and new research tools. However, it is more critical than ever for people, with analogue intelligence, to ensure the integrity and ethical use of AI. Including real people can improve the use of AI by identifying potential biases, cross-checking results, refining workflows, and providing contextual relevance to AI-driven results.
News about the impact of AI often paints a rosy picture. In practice, there are many potential pitfalls. This presentation discusses these issues and looks at the role of analogue intelligence and analogue interfaces in providing the best results to our audiences. How do we deal with factually incorrect results? How do we get content generated that better reflects the diversity of our communities? What roles are there for physical, in-person experiences in the digital world?
Spark is a powerhouse for large datasets, but when it comes to smaller data workloads, its overhead can sometimes slow things down. What if you could achieve high performance and efficiency without the need for Spark?
At S&P Global Commodity Insights, having a complete view of global energy and commodities markets enables customers to make data-driven decisions with confidence and create long-term, sustainable value. 🌍
Explore delta-rs + CDC and how these open-source innovations power lightweight, high-performance data applications beyond Spark! 🚀
1. 27 au 29 mars 2013Vincent Massol,April 2019
Building XWiki
2. Vincent Massol
• CTO XWiki SAS
• Open source developer
• My Projects
• XWiki (community-driven open source project)
• Past: Maven,Apache Cargo,Apache Cactus, Pattern Testing
• Other Credentials:
• LesCastCodeurs podcast about Java news
• Creator of OSSGTP open source group in Paris
• 3 books: JUnit in Action, Maven:A Developer’s Notebook, BBWM
3. Agenda
• Part 0: XWiki
• The project
• Part 1:The XWiki Build
• Automated quality checks
• Different types of tests
• Part 2:The CI (Jenkins)
• The various XWiki pipelines
• Part 3: Release Process
• Putting it all together
• Future
4. Agenda
• Part 0: XWiki
• The project
• Part 1:The XWiki Build
• Automated quality checks
• Different types of tests
• Part 2:The CI (Jenkins)
• The various XWiki pipelines
• Part 3: Release Process
• Putting it all together
• Future
5. What is XWiki? (1/2)
• A structured open source enterprise wiki
6. What is XWiki? (2/2)
• A platform for developing content-based web applications
8. Motivation
• Change the world!
• Needs impact
• Needs max number of users
• Open source
• Needs to show progress
• Release often
• Needs developers / contributors
• Community-driven
• Requires Time-boxing
• XWiki releases every month (3
weeks for RC1, 1w for final)
• Requires integration between all
parts
• Requires CI tool
• Requires quality-control
• Requires automated Tests
• Requires releases as automated as
possible
• Requires automated Build
• Requires good communication
10. Governance
• Complete separation from
XWiki SAS and XWiki.org
• Only individuals working on the
open source project
• Rules similar to the ASF
• Committership, voting (0, +1, -1),
lazy consensus
• xwiki.org governance and
company advertising:
sponsoring companies
Source: http://dev.xwiki.org/xwiki/bin/view/Community/Governance
11. Agenda
• Part 0: XWiki
• The project
• Part 1: The XWiki Build
• Automated quality checks
• Different types of tests
• Part 2:The CI (Jenkins)
• The various XWiki pipelines
• Part 3: Release Process
• Putting it all together
• Future
12. Build
• Maven-based with several custom
plugins
• Active Quality vs Passive Quality.
• Strategy: if it’s not in the build it
doesn’t exist!
• Common to everyone
• If something is important it must fail
the build, otherwise it’s not important
• Try to reduce CI code to the
maximum for local reproducibility and
to be less tied to the CI
Source: http://dev.xwiki.org/xwiki/bin/view/Community/Building
Build = implement quality
13. Automated Checks
• Standard ones: compilation, tests, javadoc linter, etc
• Test execution: unit, functional, configuration,WCAG, HTML
validation
• Backward compatibility checks
• Code quality checks
• Best practices checks
• Test coverage checks
• Test quality checks
14. Tests (1/3)
• Unit tests with JUnit5 & Mockito
• XWiki is Component-based and we have some JUnit5 Extensions to
make it easy to test/mock dependent components
@ComponentTest
public class DefaultVelocityConfigurationTest
{
@InjectMockComponents
private DefaultVelocityConfiguration configuration;
@Test
public void getToolsReturnsDefaultTools()
{
assertEquals(ListTool.class.getName(), this.configuration.getTools().get("listtool"));
}
}
16. Tests (3/3)
• Configuration tests, based on Docker
• Based on TestContainers
• Supported Browsers, Servlet Engines & Databases
• Usable on dev machine, in the IDE!
• Various other more exotic configurations: LibreOffice
server, Clustering, External SOLR server
• Supports Docker Out Of Docker (DOOD)
@UITest(database = Database.MYSQL, databaseTag = "5", servletEngine = ServletEngine.TOMCAT,
servletEngineTag = “8", browser = Browser.CHROME)
public class MenuIT
...
17. Backward Compatibility Strategy
• Check in the build with Revapi
• When wanted failure, add to
ignore list in pom.xml
• @Deprecated then move to
Legacy module using AspectJ
• Use @Unstable + @Since for
young APIs
• Custom checkstyle check in build to prevent @Unstable from staying more
than 1 cycle
• {{backwardCompatibility}} xwiki macro in release notes
Source: http://dev.xwiki.org/xwiki/bin/view/Community/DevelopmentPractices#HBackwardCompatibility
18. Code Quality Checks
• Checkstyle with custom rules. For example
• Verify that Script Services are not located in the internal package
• Verify that @since javadoc tags have the correct format
• Verify that @Unstable annotation don't stay too long
• Verify that components.txt contains all Components
• Verify that JUnit tests don't output content to stdout or stderr.
• Verify header licenses
• And more…
19. Best Practices Checks
• Spoon checks
• Verify none of the listed methods are called in our Java code
• File#deleteOnExit() - Causes memory leaks since not
guaranteed to be called. Not good with server software.
• URL#equals() -Very slow, access the host with HTTP calls
• Verify that we don't use Commons Lang < 3 (i.e. that commons-
lang:commons-lang artifact is forbidden)
• Verify we don't use Commons Logging or Log4j (since we use SLF4J)
• And a lot more…
20. Test Coverage Checks - Local
• Using Jacoco and Clover
• Strategy - “Ratchet effect”:
• Each Maven module has a threshold
• Jacoco Maven plugin fails if new code has less
coverage than before in %
• Dev is allowed to increase threshold
• Global Coverage addressed in CI (see later)
21. Test Quality Checks
• Using PIT/Descartes Maven plugin
• Concepts of PIT
• Modify code under test (mutants) and run tests
• Good tests kill mutants
• Generates a mutation score similar to the coverage %
• Descartes = extreme mutations that execute fast and have high values
23. Mutation Example
@Test
public void testEquality()
{
MacroId id1 = new MacroId("id", Syntax.XWIKI_2_0);
MacroId id2 = new MacroId("id", Syntax.XWIKI_2_0);
MacroId id3 = new MacroId("otherid", Syntax.XWIKI_2_0);
MacroId id4 = new MacroId("id", Syntax.XHTML_1_0);
MacroId id5 = new MacroId("otherid", Syntax.XHTML_1_0);
MacroId id6 = new MacroId("id");
MacroId id7 = new MacroId("id");
Assert.assertEquals(id2, id1);
// Equal objects must have equal hashcode
Assert.assertTrue(id1.hashCode() == id2.hashCode());
Assert.assertFalse(id3 == id1);
Assert.assertFalse(id4 == id1);
Assert.assertFalse(id5 == id3);
Assert.assertFalse(id6 == id1);
Assert.assertEquals(id7, id6);
// Equal objects must have equal hashcode
Assert.assertTrue(id6.hashCode() == id7.hashCode());
}
Not testing
for inequality!
Improved thanks to Descartes!
24. Mutation Limitations
• Takes time to find interesting things to look at and decide if
that’s an issue to handle or not. Need better categorisation in
report (now reported by Descartes):
• Strong pseudo-tested methods:The worst! No matter what the return
values are the tests always fail
• Pseudo-tested methods: Grey area.The tests pass with at least one
modified value.
• Multi module support - PITmp
• But slow on large projects (e.g. 7+ hours just for xwiki-rendering)
25. Test Quality Checks - Strategy
• Fail the build when the mutation score of a given module is below a
defined threshold in the pom.xml
• The idea is that new tests should, in average, be of quality equal or better
General goal with coverage + mutation: maintain qualitythan past tests.
• Other idea: hook on CI to run it only on modified code/tests.
• Still some hiccups regarding the mutation score stability!
General goal with coverage + mutation: maintain quality
26. Agenda
• Part 0: XWiki
• The project
• Part 1:The XWiki Build
• Automated quality checks
• Different types of tests
• Part 2: The CI (Jenkins)
• The various XWiki pipelines
• Part 3: Release Process
• Putting it all together
• Future
27. XWiki’s CI - Jenkins
• XWiki Jobs are Pipeline jobs
• Using “GitHub Organization” type of jobs
• Autodiscovering of all Jenkinsfile in a GitHub organization
• Automatic handling of branches (job creation/deletion)
• Shared Pipeline library for all jobs
• Clover Pipeline job to compute global TPC
• Docker Pipeline jobs for running Docker-based tests on all
configurations
• Moving to Docker agent and DOOD (Docker Out of Docker)
28. Shared Pipeline Library
• Features
• Maven build
• Check for flickers both environment flickers and test flickers and don’t
send false positives emails in this case. Examples of environment
flickers:
• JVM crash
• GitHub connection issue
• X Display not ready for UI tests
• Uses JIRA to log test flickers
• Display screenshot of failing test in job report
29. Standard Pipeline Jobs
• 1 job = several builds (13+ in our case)
• Validates different things:
• “Main”: compile and test execution including functional tests
• “Quality”: Revapi checks, checkstyle, Descartes, Jacoco
• “TestRelease”: Simulate a release.Verifies Maven Central
requirements (javadoc, etc)
• “Flavor*”:Various types of functional tests
• Parallel execution for some jobs
30. Clover Pipeline
• Issue: Local coverage can increase
and global decrease
• Removed code with high TPC
• Code tested indirectly by
functional tests and code
refactoring led to different paths
used
• New module with lower TPC
than average
• Strategy: Fail the CI build if Global
TPC decreases for the current
version
31. Docker Pipeline Jobs
• Currently a separate pipeline from the main one
• Two issues
• Requires Jenkins Docker agent to be used (Docker
doesn’t work inside vServer that we use). Migration in
progress.
• Long to execute since it tests all configurations and thus
should only be executed once per day.
• Finds all Docker test modules and run Maven on
each of them, passing the configuration as system
properties.
32. DOOD
• Jenkins agent running as a Docker container
• Pipeline (and thus Maven) executing inside Docker
• Thus Functional tests based on Docker executing inside Docker
• To make it work:
• Mount Docker socket (only Docker client inside Docker)
• Don’t mount volumes: copy data (in and out)
• Requires special care when writing the JUnit5 Test Container
extension
35. Agenda
• Part 0: XWiki
• The project
• Part 1:The XWiki Build
• Automated quality checks
• Different types of tests
• Part 2:The CI (Jenkins)
• The various XWiki pipelines
• Part 3: Release Process
• Putting it all together
• Future
36. Release Process
• Ongoing Release Notes and
reference documentation
• Marked in JIRA with 2 custom
fields
• Rolling Release Managers
Source: http://dev.xwiki.org/xwiki/bin/view/ReleasePlans/
• Create Release Plan for the release
38. Release Plans (2/2)
• Release in JIRA
• Check that all issues are
documented
• Check Release Notes
• Import translations
• Build the Release
• Create mail
announcement
• Push to Maven Central
• Update Docker official
image
• etc
Source: http://dev.xwiki.org/xwiki/bin/view/ReleasePlans/ReleasePlan845
39. Agenda
• Part 0: XWiki
• The project
• Part 1:The XWiki Build
• Automated quality checks
• Different types of tests
• Part 2:The CI (Jenkins)
• The various XWiki pipelines
• Part 3: Release Process
• Putting it all together
• Future
40. Future - Build Level
• Move Test configurations to the build
• Fix UI flickerings which are a plague
• Idea: Change our DSL so that all calls always wait on something
41. Future - CI Level
• Docker pipeline integrated into main Pipeline library
• To handle branches (a pain right now)
• Needs Parametrized Scheduler Plugin
• Move to CD, i.e. implement the release steps in the CI
• Need to resolve Maven versions and put on staging & promote when
we want
• Auto deploy on myxwiki.org
• STAMP: DSpot on diffs, Evocrash (JIRA -> CI)