Lightning Talks I

Speaker 1: Uh we now continue on with lightning talks and I want to introduce Russell Keith McGee who's going to run them. All right.

Speaker 2: We have our first speaker come up on stage. Yep. Hello everyone. My name is Russell Keith McGee. If you have been to DjangoCon before, you've probably seen me. If you haven't, I'm sorry. My job here is to introduce the lightning talks. However, it occurs to me from seeing this morning, how many hands up say this is your first Django Con , that you may not know what a lightning talk is. A lightning talk is a short talk on any topic you want. If you've never spoken at a conference before and maybe you'd like, you know, maybe sti dip-stip uh dip your toe into the water. and find out where the conference speaking might be for you. A lightning talk is a great place to start. It can be about Django, it can be about Python, it can be about software development. Or it can be about anything else that happens to tickle your fancy. The Django Con stage has historically had some very entertaining talks about Zeppelins, for example.

Speaker 2: The only thing it can't be is an advertisement or a commercial for a company or a job advertisement or something like that. If you want to do a commercial advertisement, may I suggest possibly next year sponsoring this fine conference, you get your logo on stage the whole time Uh it's a short talk, it is five minutes, and we do mean five minutes, an absolute maximum. Um with one minute on the stage one minute left on the clock. I will sort of slowly come back onto the stage With about 10 seconds to go, our fine uh organizer Tobias over here will start warming up the gong. And when time runs out, there will be a gong hit. To stop all gong hits, at which point we will then find some way of dragging you off stage forcibly. Um I say it it's a maximum of five minutes. It can be less than five minutes if you so choose Uh there's no minimum length of time other than you know please don't waste our time just setting up your laptop for

Speaker 2: saying goodbye and walking off stage again. Um with that, that is a lightning talk. This has effectively been a lightning talk about lightning talks And I would now like to introduce Justin Mayer, who will talk to us about how to add multi-factor authentication to your Django project in less than five minutes. Take it away, Justin.

Speaker 3: Thanks very much, Russell. Uh my name is Justin Mayer. Originally from From Los Angeles, California, but just last week moved to a mountain village in the Italian Alps in a region called Trentino. I've used Django for a long time, most recently to create Fortressa, which allows you to create your own uh private self-contained VPN server. And today I'm excited to talk to you about multi-factor authentication. My goal is to show you how to add multi-factor authentication to your applications in the time that I have, which is obviously not very much. Last summer I gave a full-length talk on this topic at EuroPython. You can find a link to the video on justinmeyer. com. Here is a very fast lightning uh summary. Passwords are ubiquitous, they are terrible. Most uh the w most time people get around them by using SMS to send you a code. You've probably seen this.

Speaker 3: It's very common. Unfortunately, it's not very secure. A better method is TOTP or time-based one-time passwords You may have seen it. You get a six-digit number generated usually on an app on your phone. Another method that I really like is called second uh universal second factor. It's a small USB key. I have a tiny one in my machine right now It's a hardware key, the next generation of which is uh web standard called web authentication. There's a project called uh Django UT uh U2F that you can uh use to add this. It does both TOTP and U2F, and I want to show you how easy it is to implement it and add multi-factor authentication to your applications. So let's do it live and what could possibly possibly go wrong. So over here, uh what do you know? It's actually there. That's good.

Speaker 3: So um first thing we're gonna do is we are going to activate a virtual environment. And we're going to pip install Django and um the uh Django U2F package. Luckily I've cached all these wheels so I don't have to deal with Wi-Fi. Um or at least uh yeah there we go. So and then we're going to clone the project. And the reason we're doing that is that we're going to use a sample project that's inside it Switch to that directory. We're gonna install the requirements also from cached wheels, thankfully. We're gonna run migrations. So no, this is fast, everyone, but just try your best to keep up. We're now generating a TLS key for the local host domain.

Speaker 3: So that uh guess um U2F requires TLS. Um then we are going to now run our server. and switch over to a browser. And we're going to go ahead and load. Once we bypass the yes, we know it's not a signed certificate. I'm going to log in. And I probably forgot to create superuser because you know this is what happens when you're doing it live. Um okay, do that really quickly. Hi at foo. com Okay, go back to the browser, hopefully. And now we can try this again.

Speaker 3: And now we have a screen where we can manage uh all our multi-factor authentication. First thing I'm going to do is I'm going to add a um uh a U2F key, which I just did by putting my finger on it. It's now been added. I'm gonna go back to the settings and now I'm gonna add a TOTP device And I'm going to do that using an app on my phone. There's a variety of different ones. I use one password because I already use that to manage my other passwords. I tap it to add a new password. I'm going to scan the QR code. It's been added. I'm then given a number to enter into this token field. Once I do that It then registers the token and says device added.

Speaker 3: And then last we're going to create some emergency backup code. I may not have my device, I may not have my phone. This allows me to get in even in even in those cases. So we've proven that we can add those things. Now what happens when we log back in? So we log in as usual when I don't um And we can log in. We can go ahead and log in via either of the three methods that I just added. I'm going to just put my finger on the security key and I'm in. It is really that easy to do. Um now I'm going to quickly just show you what

Speaker 3: The only difference between a standard uh Django start project command and what uh the and the test project that I just added is what you see here. A couple of lines added to installed apps to add some needed packages there. A couple of lines added the end of your settings file to do um uh login URL and redirection. This is uh URLs. py Um it's just

Speaker 2: up on stage we have Johannes Hopper. While he's getting set up, you can't do it. uh with the with the microphone and the uh uh and the laptop. Um I've just returned from PyCon US uh when I was at PyCon US I I bumped into uh an interesting person sort of wandering around who was actually a uh had just returned from a different conference all about wasps. Um and at that uh at that conference they were um talking about whatnot and about about wasps as you do. And they just decided to go for a bit of a walk around the town and um uh came across a a vinyl shop is selling old old LP records and uh in the store in the storefront they had an advert up an advertisement up. that said um that they had had just had just released Wasp Noises as the as the uh an album that had just been made available. And so it World renow uh expert in wasps

Speaker 2: sees an album for wasp noises, thinks I've got to get I've got to find out about this, decides he's gonna go into the store. More details later Our next speaker is Johannes Hopper talking about instant feedback, making reviews great again on the new GitHub checks. Everyone making Walcam.

Speaker 4: Hey thanks. Uh I'm not gonna share any slides actually today because I didn't have much time to prepare. Um I try to keep this very short, probably shorter than five minutes. Maintaining open source projects is really hard. I think a lot of people here can empathize with that because they are maintainers. And other people can probably emphasize because they have a pull request hanging somewhere and with no response. And we were also discussing that yesterday evening already on on what kind of things are hard. And something that's very tedious as a maintainer is That comment like hey can you please remove the trailing white space or can you uh also wrap the dot strings at eighty characters? Uh stuff like that just comes repeatedly up and it's tedious for a maintainer and it's also

Speaker 4: bad to hear for a first-time contributor. It's just the negative feedback that you don't want to give to someone uh that otherwise did a really good job Luckily, something we heard earlier this morning as the first talk, the machines are taking over. And over time we built a lot of great lintis that help us do that job. Um but they're still, even though those do a really good job of giving you kind of machine feedback, which is a bit softer to the users, to the first-time contributors or frequent contributors to tell them hey they're It's maybe a trading white space that you want to get rid of, or please add a new line to the end of the file. And this is all great, but they're still kind of hidden usually within our continuous integration suites. Um there's this one link to the Travis Suite or use maybe Circle CI and there are a bunch of different services out there.

Speaker 4: And Not everyone is familiar with all of those and then you have to find the section that actually failed and you have to figure out what that means. Maybe you're not particularly familiar with that linter could be something like Pylon and there are a bunch of checks you maybe don't know them all Luckily, there has been a recent change on how GitHub works. There has been a new feature called checks. It's currently still in beta. And the API is now also available in beta. uh which allows you to kind of take all that onto a single platform. It allows machines to also add review comments Um and it introduces the new concept of a check which is really really made for for machine feedback for for for what we know is is lintus currently. Um so

Speaker 4: Since that was released, um colleague of mine and and me, we we sat back and thought, hey, that's a cool thing. Let's try to bring those two together Because they're made for each other. Um so we um put a lot of linters on AWS services, built a small service around it, uh and combined all that in order to run checks automatically without any tedious setup on repositories and give this feedback directly back onto onto GitHub without storing any data in between. It's just we process um the the data from the commit and we push our linting results back And the user can see them right where they where they push their code. If you're interested in that, in using that or in contributing to making that better, because obviously it's just started. um

Speaker 4: approach me. I'm Johannes Hoppe, uh coding Joe on GitHub. I don't know my Twitter channel really. And talk to me about it. I'm excited to to share. It's all open source obviously. So just find me later if you're interested in those sort of things and I hope that we can yeah make make contributing and maintaining uh a bit easier. Thanks.

Speaker 2: Thank you, Hannes, and thank you, Hannes, for pointing out that it can be less than five minutes. Um while our next speaker gets set up. Our uh friend here is uh he's gone into the into the store of the the the LP store and he says, uh I'd like to like can I listen to this record? Have you got you got an example I can I can listen to? And the guy uh the person behind the counter says, Yeah, no, no, no problem. Reaches behind the reaches down, gets up a copy of the record. So just go over to the listening booth there and uh and get set up there. And um once you're in the listening booth, I'll start the record and you can listen to it and see what you think. And so uh he he goes into the listening booth and the the storekeeper goes behind the the the the record player and puts puts it on and Starts playing and um a little bit more detail about what he hears in a moment. Next up we have Katie McLaughlin serialization formats are not toys

Speaker 5: Hi. By the way, you don't actually have to give your own lightning talk, you can give somebody else's lightning talk. This lightning talk was given as a full 30-minute talk by a guy called Tom Eastman. I'm gonna give it in full Minutes, 45 seconds, loading data into your application is the most boring part of your day. You want to get your data migrated into your app and then you want to keep on coding. The thing is, 90% of magic merely exists on knowing one extra fact. If I know one thing That your app doesn't prevent security-wise, I can take all your data for myself. Everything I'm going to be talking about today is not a bug, it is a feature. So This is my example uh application. It's just a simple bottle app. All I'm going to be doing today is posting data to various endpoints and then returning back the content. So let's talk about YAML.

Speaker 5: In YAML, if I was to post my first name is Tom, my last name is Eastman, and I have an email address, I get back a JSON result with my email address, first name, and last name. What I can also do in YAML is I can post Python objects. So what I can do here is I can post back a Python object of datetime. date with my birthday and I get back a J a Python date time object Who can see where this is going? What I can also do is I could uh tell it to uh call subprocess and tell me the entire contents of my uh directory that I'm in. So, I wonder if I can actually get my speaker notes to work. That would be useful. There we go. So, hey, I wonder if

Speaker 5: I can also get my slides to be. Yay! Okay. So what I could also do, instead of running uh LS, what I could also do is not have my speaker slides work at all. Come on. There we go. Alright. What I could also do is I could run RM star and then run an LS and I could uh delete my entire presentation while I was working on it, which is allegedly what happened to this speaker. So, surely this doesn't happen in real life, right? It happens all the time. It happened with uh Piston and Tasty Pie back in 2011. It happened with Rails twice. Uh it happened in Puppet and everyone was really upset and then it happened for Nota no one cared. So how do you protect yourself? You make the parser stupider What you should be doing instead of using YAML.

Speaker 5: load is using YAML. safe load, which is really easy to find when all you're doing in your telly sense thing is going yaml. ak load, okay, I want the first one. What you need to be using is safe load. So let's talk about XML, a slide that's scary enough just in itself. In XML, we have entities. In an entity, I can define an entity as a uh ampersand hash and then a number, and then I get back a smiley face. What I can also do is I can put an alias to that entity. So instead of using the percentage number, I can have a smiley. So then I can have, yay, smiley, smiley. It's like emoji except not So what I could also do is I could define an entity that's a bunch of other entities and another entity that's a bunch of those entities and I can have smiles going all the way down my page. This is also known as the billion

Speaker 5: loves attack and it can turn your laptop into a smoking ruin. Including if you try to load your presentation slides in Emacs and it tries to render your XML for you. So what else can we do? What we can also do is we could ask it to uh return back the contents of our ETC release information or our password files or anything else because If you're running XML, you're probably running in running in an enterprise environment. And if you're running in an enterprise environment, you're probably running as root. Which means you can do everything. Surely this doesn't happen in real life, right? It happens all the time. You don't even want to know. So how do you protect yourself? Just a simple list of things that you can do for your XML to make sure that it's not going to do anything.

Speaker 5: What you need to do is you need to make the parser stupider. What you can do is you can use diffuse XML and a few other things. I have one minute left, let's keep going. Jason, finally a stupid enough parser. Only if you use it. in a stupid way. Eval is not a stupid enough parser. Do not ever use eval to try to render JSON because on the documentation page What it says is it says up there, here, you should use eval. And then right down the bottom, like somewhere where the orchestra pit would be, it says do not actually use this. Um, it also says it right there, it says, hey, you can use eval, but but don't, but no one's actually going to keep on reading the documentation after they get their answer, right? So the lesson, beware of flexibility in your uh applications and in your uh serialization tokenizers because it will try to be smart and sometimes you don't want it to be smart, you want it to be dumb and you want it to play nice and you want to have your application

Speaker 5: Still work at the end of the day. Disable everything you don't need and keep it simple. Thank you so much for your time.

Speaker 2: Thank you very much, Katie. Or Tom or Katie, not sure. Um okay, so uh our friend's in the listening booth now and he's uh put the headphones on. And um he's sitting there, he listens to the the record starts playing, he starts listening and he's like, this something's not right here. I mean it's an insect. I can tell it's definitely an insect. Um and it yeah, but there's something something's just not right here. So he he kind of steps out of the out of the uh the listening booth and uh he goes to speak to the the store guy, the store fr uh uh store uh manager and says uh look are you sure you're playing the right record there because um I'm like a wasp expert I'm pretty sure they're not wasp noises and so the m the the manager says hang on I'll just I'll get a different pair of headphones for you we'll get you some good headphones We'll try it again. So he goes and gets the good headphones, gets him set up with the good headphones,

Speaker 2: and uh steps back over, moves back into the booth, uh starts the record playing again. And he sits there and he listens a little bit to the uh to the to the sounds again coming through. And no, we're still going. Alright. Um So he listens and listens again and No, there's something that's definitely not right here. There's something that's just not quite right in the sound that I'm hearing. And I'm a wasp expert, I know my wasps, that is definitely not a wasp. This album says it's wasp noises. It's wrong. It's not wasp noises. So he sits back out of the booth, goes back over to store management and says, Look, okay, I I don't know what to say here. It's definitely not wasp noises. There's something wrong with your record here The manager says, Well I I don't know, it's like it says here on the tin. The guy says, Oh, hang on, I'll tell you what he says

Speaker 2: right after this break when uh Johannes Will tell us uh why he hates CSV.

Speaker 6: But I need to know precisely. So hands up if you have ever used CSV in a project. Hands up and keep your hands up. Everyone. Excellent. So for those with the hands up um who liked the experience Alright, who had it work on the first try? Okay? For those of you with the hands up, this talk is not for you. Right, so what do you do as a developer when you have to work with CSV? I mean you have tabular data, so you think okay everyone uses CSV, so I'm gonna use CSV. So what would do we do at first? We go to Stack Overflow. And uh of course um you read through this uh thing and it's it's really simple and and all you have to do is like what

Speaker 6: And then you look at the documentation and it and it says uh things like okay, I have a reader and it's really simple and yeah, I c I can register uh uh uh what? I can what Why? And the problem is in CSV files we use commas to separate records and we use new lines to separate um lines, right? But sometimes we want to use commas inside of the strings that we want to serialize, and sometimes we want to use new lines. And then we have to find some kind of like escaping and we have to do magic to make it work. And That means we have to mess around and we have several choices. We could use semicolons. Excel uses semicolons.

Speaker 6: So all of this comes from the fact that we don't have dedicated symbols for separating records and separating lines. Now, let's go back in time to the 1960s. And let's have a look at ASCII. I mean, imagine being the person uh having this problem for the first time And um looking through their ASCII uh code and seeing, oh comma, I could use a comma. And um what if we had dedicated characters? For separating units and records and possibly even groups or files. So we could have more than one table. in in a in a file. And these

Speaker 6: have been in the standard since uh before many of us have been born, right? But nobody knows them and nobody uses these. So we have CSV and we have this mess. I'm gonna show you the code that we would need to use to use these ASCII separation things. And this is gonna work every time. And as you can see, it's almost as complicated as the one that we had for the CSVs. So what to do? Use ASCII separators if possible. And that's never possible. So so the sane thing to do is actually use use Esculite. If you have tabular data, use Esculte. But there's a more important lesson, and the important lesson is this hack that somebody put in 20, 30, 40 years ago is still with us and is still plaguing us.

Speaker 6: So don't put hacks into production. And even more so, if you put a hack into production, please think before you copy someone else's hack. And this is my message to you.

Speaker 2: Thank you very much, Johannes. And again another Johannes under time. You do not need to be five minutes.

Speaker 6: I can stay here and just

Speaker 2: No, we've applauded now. That's the end. You're done. You're done. We need to get back to the wasps. Um so uh hang on, hello, wasp more peop just a moment. There we go. More people coming. Yes, there we go. All right. Oh, hang on, I thought you had finished No, I'm choosing. Oh yeah, right, okay, then we can okay. Right, so anyway, our WASP expert's in the booth, he's had his second listen. He says, I know what I can do. I've just come back from WASPCON I can go and find the world expert on WASP. He's the convener of this conference. I can bring him into the store. We can get him to listen to the album and we can tell we can get definitive, we can get clarification about whether this is a WASP or not The store owner says, yeah, absolutely great. We'll do that. They come back the next day. Our next speaker is Bernard Bjulman of talking about Django for Managers. Thank you very much. Thank you very much.

Speaker 7: So actually I'm a manager but this is not a commercial talk so I hope you you will uh use it for be commercially successful So my name is Bernard Bühlmann. I'm co-founder and long-term CEO of 4-TeamWork in Bern, Switzerland, and I have a background of 15 years of Plone, so I know Python quite a bit. But now I became a sales manager and you can contact me on GitHub, for example. Now my problem was a few weeks ago I had a deadline for a sales pitch and on Monday morning I came to my company and said I need to have a working prototype by Tuesday afternoon and it has to look nice. So

Speaker 7: my developer team says no, that's that's not possible, it will take us at least two weeks. So I go back to my office and um I start to learn Django from scratch. So I go to the website simple is better than complex and uh two three hours um I did the tutorial and it didn't look nice the front end so I did some research and I found Django material. So I started my project. On GitHub I added requirements. txt, two lines of code. I added a model with some some fields. I added a view and that's it. So I had a running prototype

Speaker 7: which looks like this It's for creating user stories. I can add applications, I can add user stories, roles, I can add glossary subjects, I can add a new subject. frontend for example and when I when I add a new user story I can choose this new subject again and if I want to change the application it's very simple I go to the code To my model and I add a description field to my application model

Speaker 7: I'm not so fast like the others. I do the make migration, the migrate And we run again, and I go back to my application listing, and I have the description. All all already. And um it's really fast to to make this development And I can also add a new column to this listing just by adding the description to the view set

Speaker 7: I hope this works. So I have the description here in the view and it's really very easy to develop and it's also uh nice looking So the whole thing is on GitHub and it's less than 500 lines of code, which is fantastic And the developers they asked me, um where are the tests? And I said, Well, it's not so many lines of code, so we don't need tests. So my goal is to to reduce it even more under hundred lines of code. And you can try it yourself. Um we have one minute left so if you're very fast you can have it running

Speaker 7: on uh It's on our repository for teamwork user stories material. In the README it's a description and you should have it running in a few seconds or minutes and if you have problems you can come and ask me and I hope that it will help you. To get success to be successful in acquiring new projects by creating prototypes Really fast. Thank you very much.

Speaker 2: Thank you, Bernard. And while our next speaker gets set up So uh they they convene the next day, the uh world expert in wasps, walking, walking along with this guy who originally found the record store. And uh they walk in, the guy behind the cannon says, Oh yep, no, I remember you. So they get the record set up again, they get the expert into the booth and he connects up the uh the the record and the the good pair of headphones, the really good pair of headphones. And starts the record playing and the uh the um the expert sits there and he listens and he can really concentrating. You can tell he's concentrating and he's listening really, really hard. And he steps out of the booth and says, no, no, sorry. I can tell you, it's absolutely not wasps. There's no chance whatsoever that's a wasp. The store owner goes back, looks at the record, says, look, it says here that it you know here's the species.

Speaker 2: It definitely says it's this species. It says, Okay, I'll go back and have another listen. And he goes back in and he listens again. He listens. He's thinking about it. He steps out of the booth again. He says, look, I can I can tell you there's absolutely no chance that's a wasp. It's there's no no wasps on that recording at all that you're playing to me says well maybe maybe we should phone the publisher. We find the publisher and uh they talk to the publisher and says no no absolutely guaranteed that that that record it's playing it's got wasps on it. Um and the uh the record store owner says oh Oh no. I've just worked out what's happening. To find out what's happening, we'll have to wait until after Curtis. Curtis, we're talking about understanding Django static files.

Speaker 8: Uh hi, I'm Curtis Maloney, also known as Funky Bob online. I've been working with Django for um twelve, thirteen years now. Um And one of the biggest problems we have to help people online is dealing with static files for the first time. Hands up, anyone who got static files to work the first time they used it. Liars because nobody gets it the first time. Um and part of the problem is The documentation must not be good enough. I don't know why. I'd have to read it again and again and again to see why, but I keep asking the new people why didn't you understand it? And they say, I don't know So maybe we should scrap it and write again. Anyone who's got something on the sprints that they want to do, maybe.

Speaker 8: So what happens is with static files All of your apps can provide their own static files. This is a source of static files for your project. You can also give a list of static files directories. for where to find static files to collect. And then eventually you'll run the manage pie collect static St um command which takes all of these files and copies them into the static root. Here's problem number one that people run into is they think static root is where they put Their static files whilst they're developing. No, that's where they get copied into. Then you configure your web server so that when it somebody asks for something under the static URL, it goes and looks inside the static route.

Speaker 8: Now, it's only taken me what a minute to explain this, and it's about as long as it takes online to explain this But it was necessary to save us all this times 500 to get this video so that we can actually tell people go and watch this and hopefully you'll understand static files after this is done. Thank you very much

Speaker 2: There we go. And Curtis providing evidence, uh in addition to myself, that if you want something done quickly, give it to an Australian. So uh that concludes our lightning talks for today. There's nothing else to go on, um nothing else for me to say, but of course you all want to find out what happened to the wasps, don't you? So yeah, okay. So we're back in the scene, we're in the in the record store, we've got my friend, the wasp expert. His friend, the world-renowned WASP expert, and the store owner from the record store, and the store owners just heads in hand. I'm so I'm so embarrassed. You are world experts in wasps. I'm a world expert in vinyl and record players And I can't believe this has happened. I'm sitting here, I've put you in the booth, I've brought two of you in, I've brought in specialist headphones for the experience, I've played your record.

Speaker 2: Telling you that it's wasp sounds. I'm so I'm so embarrassed. I played you the B side Thank you very much. Lightning Talks will be back tomorrow if you care to have a lightning talk. Please sign up and put your lightning talk on the list for tomorrow and you may have the benefit of having a shaggy dog story in between it. Now off to Marcus for closing for the day.