JavaZone 2026 — program

Visste du at testdrevet utvikling (TDD) ikke bare er for backend? I dette foredraget viser jeg hvordan du kan refaktorere en React-applikasjon fra monolittiske komponenter til modulære byggeklosser, og hvordan denne arkitekturen åpner døren for TDD i frontend. Foredraget er todelt. Først ser vi på hvordan separation of concerns og custom hooks lar deg dele opp frontend-koden i små, uavhengige moduler som er enkle å forstå, teste og gjenbruke. Deretter tar vi steget videre og ser på hvordan denne strukturen gjør det mulig å jobbe testdrevet. Red, green, refactor. Alt vises live med en ekte React-applikasjon som refaktoreres steg for steg, fra “alt i én komponent” til en ren, modulær …

kl 09:00 · Room 3 · 45 min · Norsk · Tags: frontend, tdd, refaktorering, arkitektur, modularisering,

What happens when a weekend experiment accidentally finds a global audience? In this session, I share the raw, unpolished story of transforming a side project into a venture-backed company spanning three continents. Instead of a "grand master plan," this journey was fueled by the same principles that define great product development: fast iterations, doing things that don't scale, and early feedback loops. We’ll discuss why the "unscalable" early days are your greatest competitive advantage and how the feedback from your first ten users is more valuable than any market research report. If you’ve ever sat on an idea because it felt "too small" or "too risky," this talk is your invitation to …

kl 09:00 · Room 4 · 45 min · Engelsk · Tags: open-source, entrepreneurship, product management, global scaling, feedback

For years, we’ve relied on asynchronous functions—from simple thread launches to observable subscriptions and event handlers. While these tools solved our scaling problems, they quietly broke the fundamental rules we never knew we loved (spoiler, it’s structured programming!). They act like modern-day goto statements, ripping execution out of predictable scopes and making cancellation, exception handling, and resource management notoriously difficult to reason about. In this talk, we will learn what we can gain from Java’s upcoming structured concurrency feature. We will use a custom built visual debugger to give you, I dare to say, the last explanation of structured concurrency you will …

kl 09:00 · Room 5 · 1h · Engelsk · Tags: structured concurrency language jep thread

Bli med på en reise i min tidsmaskin! Reisen begynner i 1994, får katastrofale konsekvenser i 2011 og kan gi verdifull lærdom inn i utviklingsarbeidet vi gjør i politiet i 2026. Ta med disketter og pute og spenn deg fast, for dette blir en fartsfylt og humpete tur!

kl 09:00 · Room 6 · 20 min · Norsk · Tags: Design, mentale modeller, nyutvikling, utfasing, tidsmaskin

Reliability is not an accident — it's math. This session builds a clear, working understanding of SLIs, SLOs, and SLAs from first principles, starting with availability math: what the nines actually mean, how multi-service architectures compound failure, and what it realistically takes to move from two nines to four. We define exactly what to measure and why — the difference between infrastructure signals and user-experience signals, and how to derive SLIs that reflect real outcomes rather than server health. The centrepiece is the error budget: what it is, how it's calculated, and how it changes the way teams make decisions. Error budgets turn reliability from a feelings argument into a …

kl 09:00 · Room 7 · 1h · Engelsk · Tags: sre, nfr, sla

OAuth 2.0 shipped in 2012 with good intentions and glaring gaps. Public clients leaked secrets. Bearer tokens could be stolen and replayed. Authorization required users glued to their screens. Metadata lived in developer documentation rather than in discoverable endpoints. Token delegation meant copying credentials. Developers worked around these gaps with custom solutions and best practices until the spec formalized them. OAuth 2.1 isn't a revolution; it's a consolidation. PKCE moves from optional to mandatory. DPoP adds cryptographic proof of possession to bearer tokens and guards against replay attacks. CIBA decouples authorization from your browser session. Client ID Metadata Documents …

kl 09:00 · Room 8 · 45 min · Engelsk · Tags: Identity, Security

Den 27. juni 2025 hadde Norsk Tipping en feil i EuroJackpot som medførte at mer enn 47.000 kunder feilaktig fikk beskjed om at de var blitt millionærer. Hendelsen var den siste i en rekke av feil begått av Norsk Tipping og utløste et stort etterspill, med ekstern granskning, kritikk i media og at administrerende direktør gikk av. Internt ble det satt i gang en rekke tiltak. Et av disse var å finne ytterligere skjulte feil, samtidig som vi måtte sikre at nye feil ikke oppstår. Hvordan løser man et slikt oppdrag – og kan man egentlig forhindre at det skjer igjen? Jeg tar dere med inn bak avisoverskriftene og gir dere et innblikk i hvordan vi jobbet systematisk for å identifisere og håndtere …

kl 09:25 · Room 6 · 20 min · Norsk · Tags: testing, observerbarhet, kvalitet, produksjonsfeil, risikostyring

Git version 3 is slated for release late this year. In this lightning talk, we will take a look at its new features, notably the new SHA-256 commit ids and the "reftable" storage format. We will also take a brief look at the git worktree feature, which is relied upon by AI agents.

kl 09:50 · Room 6 · 10 min · Engelsk · Tags: git

Let's experience a web that's not made for you! This talk is not a checklist of rules. It’s an interactive wake-up call. 15–25% of the population needs websites to accommodate different types of disabilities. Still, 94.8% of websites contain accessibility issues that make them harder to use. It’s not because we don’t want to develop accessible websites and applications. But we often lack knowledge and perspective. We build based on our own experience because that’s what we know. In this talk, you’ll get to experience how our applications work for someone with a screen reader, low vision, or limited motor control, and feel firsthand the challenges they face. The talk combines knowledge …

kl 10:20 · Room 2 · 1h · Engelsk

Hvordan kan vi leve med avhengigheter uten at de lager vidåpne sikkerhetshull inn i kildekoden vår eller enda verre, organisasjonen vår? Tredjepartskode er ofte en uunngåelig del av moderne utvikling men hvordan kan vi sikre, vedlikeholde og verifisere disse avhengighetene våre?. Vi skal fokusere på håndfaste tips til hvordan øke sikkerheten i avhengighetene dine, fra enkle ting som å bruke eksakte versjoner til SBOM og full oversikt over alle dependencies i hele organisasjonen. Praktiske råd basert på det mitt team i NRK TV og det den kollektive intelligensen til Internett lærte under de hektiske dagene da Shai-hulud og axios-ormen herjet.

kl 10:20 · Room 4 · 45 min · Norsk · Tags: security, supply chain, dependency management

This talk examines a quiet enterprise uniformisation accelerated by Azure and Copilot: the gradual replacement of engineering judgment with Microsoft as the default answer to every question. "If it is from Microsoft, we should probably be using it." .NET, SharePoint, Teams, Bicep, Copilot, PowerShell — no engineering evaluation, no cost analysis, no critical thinking. "Following Microsoft best practices" is mistaken for strategy and treated as a silver bullet. This pattern is not new. Microsoft's ecosystem has traditionally been proprietary, and developers long ago learned to treat its offerings as the safe default and everything else as a risk. That cultural habit has driven the massive …

kl 10:20 · Room 6 · 20 min · Engelsk · Tags: microsoft, monoculture, azure,lock-in

As developers, we version-control our code, containerize our services, and declare our infrastructure as code. But when it comes to our own workstations? We're still manually installing packages, debugging broken updates, and praying that a kernel upgrade doesn't tank our day before a deadline. Immutable Linux distributions flip this on its head. Your operating system becomes a versioned, reproducible artifact — built from a Containerfile or a declarative config file, atomically updated, and trivially rolled back when things go wrong. In this talk, we'll explore two approaches reshaping how developers run Linux. First, Fedora Atomic and Universal Blue, where your OS is literally an OCI …

kl 10:20 · Room 8 · 45 min · Engelsk · Tags: 'Linux' 'Immutable Infrastructure' 'NixOS' 'Containers' 'Developer Experience'

Semantic versioning? Calendar versioning? Or do we need to bother with versions at all? No matter which you choose, they all bring their own possibilities and problems. Choose the wrong one, and you might end up dealing with issues that could be avoided altogether - for no actual benefit! Let's get systematic, and walk through the pros and cons of each variant, so that we're all better equipped to tackle this choice the next time it comes up!

kl 10:45 · Room 6 · 10 min · Engelsk · Tags: software, versioning, semver, calver

In this talk, I share a hands-on, opinionated journey from Kotlin’s concise, modern syntax back to Java’s more explicit (and sometimes verbose) world. Rumor has it that this can be a painful transition—but is Java still what it used to be, or have the changes over the past five years turned the developer experience into something far more enjoyable? We’ll look at real-world code examples, explore differences in language philosophies, and cover practical dos and don’ts for developers making the same transition. You will get insight into my experience making this shift in a large-scale project at the Norwegian Police. If you’ve ever wondered whether going from Kotlin to Java is doable—or if …

kl 11:15 · Room 6 · 20 min · Engelsk · Tags: Kotlin, Java, Change, Possibilities

Building app-like UX on the web has historically meant reaching for an SPA. You ship the data layer to the browser, manage a client cache, juggle loading states, coordinate mutations, and write a lot of code to keep the UI feeling fast and fresh. The result can be great, but the cost is high, and the model gets harder to maintain as your app grows. Next.js takes a different path. Since React Server Components first landed, we’ve been working toward a way to build where each piece of your app runs where it belongs, while the mental model stays the same: components. In this talk, you’ll see how that translates into instant-feeling UX, streamed UI, fresh data, coordinated updates, caching …

kl 11:40 · Room 5 · 45 min · Engelsk · Tags: react, nextjs, react server components, performance, ecommerce

Dei fleste produktteam måler suksess i vekst, brukartal og nye tekniske eigenskapar. Teamet vårt vil heller måla suksess i kor mange som har slutta å bruka løysingane våre. I 2015 bygde Difi (no Digdir) ein "transisjonsarkitektur" for meldingsutveksling i offentleg sektor. Peppol-nettverket vart sett på som framtida, men infrastrukturen var ikkje heilt klar. Så me bygde ei bru, som etter kvart fekk eit namn (eFormidling), eit team, eit vegkart, og ein plass i portefølja av digitale fellesløysingar. Men midlertidige løysingar som fungerar har gjerne ein tendens til å verta meir og meir permanente. Gode innspel kjem inn, vegkartet veks, teamet susar avgårde, og eit viktig premiss glimrar med …

kl 11:40 · Room 6 · 10 min · Norsk · Tags: modernisation, legacy, architecture, strategy, decommissioning

In this talk, we're going to analyze the best way we can fetch a multi-level hierarchy from an RDBMS so that we can store the result set in a cache, such as Redis. I'm going to go through various solutions and analyze the performance impact of each option. From plain JDBC to JdbcTemplate, Spring Data JDBC, Spring Data JPA, and Blaze. Therefore, we are going to compare how all these options work and conclude what is the most efficient way to fetch a multi-level hierarchical structure with the most common Java data access technologies.

kl 11:40 · Room 7 · 45 min · Engelsk · Tags: Java, Spring Data JPA, Hibernate, Blaze Persistence, performance tuning

En reise gjennom utfordringene og frustrasjonene ved å være utvikler i et produktteam i en ikke-produktorientert organisasjon. Hva skjer når man blir kastet inn i et prosjekt der en ferdig løsning blir kjøpt inn for å erstatte et kritisk delsystem – uten at man har fullført jobben med å forstå de eksisterende prosessene eller integrasjonene? Dette foredraget dykker ned i de konkrete problemene som oppsto, hvordan vi håndterte dem, og de lærerike erfaringene vi sitter igjen med etter å ha jobbet med et produkt som skulle løse alt, men i stedet skapte mer kaos.

kl 11:55 · Room 6 · 20 min · Norsk · Tags: produktorientering, kommunikasjon, modellering, systemarkitektur, utvikling

På et eller annet tidspunkt begynte vi å behandle metodikk som religion. Agile ble en dogme, Design Thinking et rituale, og Double Diamond et ikon folk tilber uten å ane hva det egentlig betyr. Alle snakker om å “gjøre det riktig”, men få husker hvorfor vi gjør det i det hele tatt. Folk fyller ut canvaser som om de står til eksamen og blir stressa når virkeligheten ikke passer inn i malen. Team sitter fast i seremonier de hater, men tør ikke droppe dem fordi “det står jo i boka”. Når noen endelig spør “gir dette mening?”, blir de sett på som vanskelige. Det handler ikke om å kaste metodene. De fleste av dem ble tross alt laget for en grunn, men vi må slutte å late som om virkeligheten må …

kl 12:20 · Room 6 · 20 min · Norsk · Tags: Metodikk, prosess, produktutviklinga, pragmatisme

En mission for å forenkle oppsettet på prosjektet førte til en innsikt om at vi kan gjenbruke hvordan docker gjør authentication og bruke dette når vi skal gjøre maven repository authentication.

kl 12:45 · Room 6 · 10 min · Norsk · Tags: java maven

Knowledge engineering often feels like a big leap for data engineers: new concepts, new tooling, and unfamiliar terminology. In this talk, I show that it is actually quite a small leap to get started! By using well-known data engineering tooling, I'll demonstrate how you can easily acquire skills in knowledge engineering. From data frames, pipelines, and transformations--we’ll walk through how the same data can be expressed as a knowledge graph with minimal extra complexity. The focus is practical: how to think in relationships instead of tables, how to get started quickly, and when knowledge graphs actually add value. This is not a deep dive into theory, but a hands-on introduction for …

kl 13:00 · Room 2 · 45 min · Norsk · Tags: data engineering, knowledge engineering, knowledge graphs, AI

Quantum computing is no longer a distant concept—it’s an imminent challenge to today’s cryptographic standards. The shift to Post-Quantum Cryptography (PQC) is not optional; it’s inevitable. Yet, the practical steps for adapting existing applications to PQC, and the critical considerations for ensuring compatibility, remain largely unclear. This session goes beyond theory. We’ll start with a concise overview of PQC fundamentals, then dive into real-world migration experiences—what worked, what didn’t, and why. Attendees will gain actionable best practices drawn from hands-on projects, offering guidance not only for those planning future migrations but also for developers designing new …

kl 13:00 · Room 3 · 45 min · Engelsk · Tags: Security, Cryptography, Post-Quantum, PQC, Migration, JDK, NIST

OpenTelemetry makes traces, metrics, and logs appear as if by magic but what actually happens behind the JVM agent we routinely add to our applications? This talk goes where most developers never look. You’ll see how the OpenTelemetry agent sneaks into your JVM, intercepts class loading, and rewrites your application on the fly. We’ll explore the power of the javaagent mechanism, the Instrumentation API, and the internals of ByteBuddy that allow instrumenting Spring, Servlets, JDBC, or gRPC without changing a single line of your code. Your application is running, but not quite the way you think it is. You’ll leave with a clear understanding of the real impact these changes can have in …

kl 13:00 · Room 4 · 1h · Engelsk · Tags: opentelemetry, instrumentation, jvm, agent, bytecode

Fra høsten 2025 til høsten 2026 følger vi 15 team fra 8 organisasjoner for å forstå hva som faktisk skjer når AI-agenter tas i bruk i praksis, ikke bare hva vi tror skal skje. Det gir oss et unikt innblikk i hvordan ulike team nærmer seg AI og hvorfor noen kommer videre enn andre. I tillegg samlet vi i juni 2026 over 30 av norges ledende utviklere, tech leads og forskere til åpne samtaler om det vi ser og det vi ennå ikke forstår. Vi stilte spørsmål som: Hvordan ser fremtidens programvareutvikling ut som sosioteknisk system, med vår arbeidskultur, våre regulatoriske rammer og vår tradisjon for autonome team? Når utviklingstakten øker og mer arbeid automatiseres, blir lærende team enda …

kl 13:00 · Room 5 · 45 min · Norsk · Tags: produktutvikling, ai, ai-agenter, team, ledelse

Passord er en av de største svakhetene i moderne sikkerhet – de er vanskelige å huske, enkle å kompromittere, og frustrerende å bruke. Passkeys representerer et fundamentalt skifte i hvordan vi tenker på autentisering. I dette foredraget får du en praktisk og teknisk innføring i hvordan passkeys fungerer, hva som skjer “under panseret”, og hvorfor de er både sikrere og enklere enn tradisjonelle passord. Vi går gjennom hvordan WebAuthn og FIDO2 muliggjør passordløs pålogging, og hvordan dette faktisk fungerer i nettleseren og på tvers av enheter. Du får også se en live demonstrasjon av hvordan man implementerer passkeys i en moderne webapplikasjon – fra registrering til innlogging – med …

kl 13:00 · Room 6 · 20 min · Norsk · Tags: Autentisering, sikkerhet, passkeys

EU innfører eit felles europeisk økosystem for digitale identitetslommebøker. eIDAS2-forordningen kjem alt i år i EU og Norge følgjer etter om nokre år. Med EU Digital Identity Wallet kan 450 millioner innbyggjarar logge inn, signere elektronisk, og dele informasjon frå digitale bevis som førarkort og vitnemål. Lommeboka virker sømlaust på tvers av landegrenser og gir brukeren kontroll over eigne data. Det er mykje å love på ein gong! Korleis fungerer dette eigentleg i praksis? Me nyttar den nasjonale sandkasse for digitale lommebøker som økosystem for å demonstrere kva digitale bevis (Verifiable Credentials) er og kan delast og verifiserast. Deretter dukkar me ned i spesifikasjon OpenID …

kl 13:00 · Room 8 · 45 min · Norsk · Tags: eudi-wallet, digital lommebok, digital identitet, sikkerhet, datadeling

Have you ever wanted to prove you meet an age requirement without revealing any information about your identity? That's exactly what you need to do when a website that respects anonymity needs to be sure it offers services for the right age group. This is just one application of a concept known as zero-knowledge proof. Zero-knowledge proof is simply a concept where you prove you know something -- or more generally that some statement is true -- without revealing anything about what you know -- or about that statement. In this lightning talk, we will examine how to prove you know something without actually spilling the beans about what you actually know.

kl 13:25 · Room 6 · 20 min · Engelsk · Tags: security, cryptography

I used to hear about hexagonal architecture at every conference or event that I attended. The talks where always so theoretical with arrows pointing everywhere in different graphs and illustrations. When I finally saw some code, the examples were so very simple I had no idea how to apply it to my existing codebase. And even when I tried, I struggled with: What felt like lots of boilerplate code Developer laziness wanting to take shortcuts Deadlines New people on the team not following the pattern I tried to implement Until I finally was on a project where we built things from scratch, and then it clicked! For the past six months I've come to love the pattern, and I want to share to love …

kl 14:20 · Room 2 · 45 min · Engelsk · Tags: Hexagonal architecture, patterns, java, happiness

Every org enforcing Terraform standards eventually hits the same wall: policy tools can flag issues, but they cannot fix module code. The result is a graveyard of forked modules that drift from upstream and turn upgrades into a full-time job. This talk introduces policy transformation: automatically rewriting Terraform modules at download time so teams get compliant code without maintaining forks. I will demo eight real transformation rules across four categories: lifecycle management (prevent_destroy, ignore tag drift, protect KMS keys), block removal (strip provisioners), attribute restriction (deny GPU or specialty instances), and content sanitization (safe regex cleanups). You will see …

kl 14:20 · Room 3 · 1h · Engelsk · Tags: Terraform, Compliance, best-practices

Elevator Pitch --- In the globalized tech landscape, understanding cultural influences on testing practices has never been more critical. I have conducted a study with contributions from testing professionals across 20+ countries and 15+ nationalities, revealing how deeply cultural values impact work styles. Study website: https://mesutdurukal.github.io/Global-Testing-Practices/ Problem Statement --- Global software teams frequently encounter challenges stemming from unaddressed cultural differences rather than technical deficiencies. Teams struggle with misaligned expectations and inefficient communication patterns that arise when working across different cultural contexts. I’ve had …

kl 14:20 · Room 4 · 45 min · Engelsk · Tags: Cultural Intelligence, Global Testing, Distributed Teams, Quality Engineering, Agile Testing, Cross-cultural Communication, Leadership in Testing, Quality Culture, International Software Development

Your application database handles writes. Your data warehouse handles analytics. Your ETL pipelines connect them. Your data scientists complain about stale data. Your platform team owns three systems, four schemas, and a Friday incident rotation. None of this was inevitable. It was only ever a workaround to technical limitations. We just forgot. The transactional/analytical split made sense when RAM was expensive, consensus protocols were slow, and columnar scans blocked the write path. Those constraints have shifted quietly, over the last five years. The architecture most of us inherited now costs more than it earns. Agentic AI is making this urgent, because agents want fresh data and …

kl 14:20 · Room 5 · 1h · Engelsk · Tags: distributed systems, HTAP, vendor neutral, open source, data architecture

Hvert år kommer ny funksjonalitet til språket JavaScript. La meg gå gjennom hva som er nytt i 2026.

kl 14:20 · Room 6 · 10 min · Norsk · Tags: JavaScript, Frontend

Are you curious about lock-free programming but only familiar with using locks in concurrent Java? This talk is for you! We'll make the concepts of lock-free programming approachable, starting with why it matters and the basics of progress guarantees. You’ll learn to differentiate between wait-freedom, lock-freedom, and obstruction-freedom, understanding why these guarantees are crucial. We’ll explore essential lock-free programming idioms, like Compare-And-Swap (CAS) for atomic updates, markable references for efficient state management, and the sentinel node technique for simplifying concurrent data structures. The infamous ABA problem will be demystified—what it is, why it’s problematic …

kl 14:20 · Room 8 · 1h · Engelsk

Våren 2024 skulle Designsystemet komme i versjon 1. Dette skjedde ikkje. Kvifor? Fordi me var misfornøgde med at det var kun React fokus – i noko som skulle hjelpe alle. Fant me ein perfekt løysing? Nei. Kunne me gjere noko som skifta fokuset litt bort frå React? Ja, sett CSS og DOM i fokus. Arbeidet gjorde at me utsatte versjon 1 med eitt heilt år. Kva inngjekk i arbeidet med å rydde opp i alt rusket som me fekk av React? Jo, det blei ryddigare DOM, meir fokus på HTML, og ein god del ryddigare CSS. Denne talken vil raskt gå over korleis me jobba for å få til dette, og kva fordelar me fekk ved å fokusere på CSS og DOM.

kl 14:35 · Room 6 · 10 min · Norsk

Få oversikt over JSON med JSONata-spørringer Du skal integrere med en ny REST-tjeneste du ikke kjenner fra før. Du kaller et endepunkt i Postman og får noen hundre (eller tusen!) linjer JSON tilbake. Så er det din jobb å finne ut hva alt dette betyr, og hvordan resultatet endrer seg når du kaller tjenesten med litt ulike parametre. Å scrolle gjennom store mengder JSON er slitsomt, særlig når du bare er interessert i deler av innholdet. Hva om du kunne skrive en spørring mot JSON-dokumentet for å få litt oversikt? I denne lyntalen viser jeg hvordan spørrespråket JSONata lar deg trekke ut deler av et stort JSON-dokument og flate ut dypt nøstede strukturer, slik at du lettere kan forstå …

kl 14:50 · Room 6 · 20 min · Norsk · Tags: JSON JSONata REST

Every team has that one API client that someone wrote 18 months ago. And every time the backend changes, someone has to remember to update it manually — and they don't. OpenAPI + openapi-generator solves this completely. Your framework (Spring, Micronaut, FastAPI) already generates an OpenAPI spec at build time. One config file and one command later, you have a fully typed, auto-generated SDK in Python, TypeScript, Java, Go, or Kotlin — with Pydantic models, typed method signatures, and proper serialization. No hand-writing. No drift. This talk shows the full pipeline end-to-end: how the spec is generated, how to configure the generator, what the output looks like, and how to wire it into …

kl 15:15 · Room 6 · 20 min · Engelsk · Tags: OpenAPI, API design, code generation, developer tooling, REST

While heavyweight technologies such as Kubernetes and Backstage are often touted as necessary ingredients for an internal developer platform, their flexibility and complexity can easily turn into costly maintenance nightmares, disgruntled developers, or platforms that never see the light of day. In this talk I’m going to shed light on an alternative, lightweight approach to building internal developer platforms on Amazon Web Services (AWS) that colleagues and I have applied at mid-size companies to boost delivery velocity, get development teams productive on day 1, and keep the platform lean and evolvable over time -- all supported by a tiny platform team, a lot of high-level managed …

kl 15:40 · Room 3 · 45 min · Engelsk · Tags: platform engineering, public cloud

JPA makes database interaction feel almost magical—until your app grinds to a halt. In this talk, we’ll take a tour through the common (and not-so-common) performance pitfalls that turn object-relational mapping into an object-relational mess. From data loading surprises to connection mismanagement, we’ll explore real-world issues using a sample app: the FunFactStore, where fun facts are sold, but bugs are free. We’ll dig into how seemingly harmless libraries can sometimes do more harm than good, and how tooling can help you spot trouble before your users do. Whether you’re using Spring Data JPA, navigating tricky transaction boundaries, or just wondering why things suddenly got slow, this …

kl 15:40 · Room 4 · 1h · Engelsk · Tags: JPA Hibernate Java SpringBoot SpringDataJpa

Random number generators (RNGs) generate "supposedly" random numbers for use in your application or solution. However, most RNGs are algorithmic, "pseudo", that anyone who deeply understands the algorithm may be able to regenerate the "random" numbers. Often this isn't too concerning: go ahead, recreate the shuffled songs played by Sonos. But when it's important, it's REALLY important: cryptographic keys, digital signatures, authentication challenges, statistical analysis, gaming and gambling. Different algorithms have different entropy: higher entropy leading to better randomness - assuming, of course, no back doors were injected! That said, even strong algorithms displaying high entropy …

kl 15:40 · Room 5 · 45 min · Engelsk · Tags: random number generation; IoT; security

Regulære uttrykk (Regex’er) er et nyttig verktøy som brukes overalt til mye forskjellig. Men visste du at den enkle, korte Regex’en din er en potensiell tikkende CPU-bombe? I denne lyntalen deler jeg vår tabbe med en uskyldig Regex som førte til bom stopp i produksjon hos en stort norsk kringkastingselskap…

kl 15:40 · Room 6 · 10 min · Norsk · Tags: regex programming mistakes screwup

As software engineers, we are faced with lots of choices. Additionally, when developing libraries or frameworks that are used by lots of other software engineers to build their products, even small decisions can have unforeseeable and unintended consequences down the line. From timeless classics like the importance of naming in software and the proper reuse of existing components, to the unknowns of build time optimization and all the way to bold decisions like rewriting the entire I/O layer and everything in between, this session will give you valuable insights into how and why important decisions were made when developing Quarkus, with the hope of helping you avoid our mistakes and …

kl 15:40 · Room 8 · 45 min · Engelsk

Mange team automatiserer regresjonstestene sine for å få raskere tilbakemeldinger og mindre manuelt arbeid. Det er et viktig steg. Men når de repeterbare kontrollene blir tatt av verktøyene, oppstår et nytt spørsmål: Hvor skaper testeren mest verdi da? I denne lyntalen utforsker jeg hvordan testerrollen endrer seg når regresjonen blir automatisert. Jeg viser hvorfor automatisering ikke reduserer behovet for testfaglig kompetanse, men tvert imot gjør den enda viktigere i andre deler av utviklingen. Når testeren får mindre tid bundet opp i faste sjekker, kan mer energi brukes på risikovurdering, utforskende testing, kvalitet i krav, testdesign og læring i teamet. Dette er en lyntale for team …

kl 15:55 · Room 6 · 10 min · Norsk

Do you keep the spec around after the feature is built? Most of us do not. It goes stale, the tests get written separately, and the documentation comes later if at all — three artefacts, three chances to drift apart. Specification by example gives you one instead. Agree the behaviour first, as a table of concrete examples. With TableTest, an open-source JUnit extension, that same table runs as a test and publishes as a report someone who does not read Java can read. We will follow one small feature through: written, reviewed, green, published. Then the rules change and we do it again. A coding agent drafts the tables; the decisions stay yours.

kl 16:10 · Room 6 · 20 min · Engelsk · Tags: Agentic coding, Spec-driven development, Testing, JUnit, Executable Specifications, Specification-by-example

On October 1st 2025, Open AI announces buying 900 000 wafers DRAM, about 40% of the global market production. As a direct consequence, some DDR5 kits that cost about 300€ in 2023, exceeded 1.000€ by the beginning of 2026. The SSD market was also impacted with price"only" doubling so far. How long will it take "non-AI" data centers to run out of stock and start raising their prices to compensate for future hardware investment? On the developer side, we have a plethora of backend frameworks based on the V8 JS engine, the JVM and similar technologies. They all have one thing in common: CPU and memory consumption. But most cloud providers charge by how much you use those resources. We can …

kl 16:35 · Room 6 · 20 min · Engelsk · Tags: backend, rust, cost-management, performances

Kubernetes operators have revolutionized how we manage complex, stateful applications on Kubernetes. By encoding domain expertise into custom controllers, operators extend Kubernetes capabilities and automate operational tasks that would otherwise require manual intervention. In this session, we'll explore the fundamentals of building a Kubernetes operator from scratch. You'll learn how to: - Understand operator patterns: Discover why operators are essential for managing sophisticated applications and how they leverage Kubernetes' declarative model - Design custom resources: Learn how to define Custom Resource Definitions (CRDs) that model your application's desired state Implement robust …

kl 17:00 · Room 3 · 45 min · Engelsk · Tags: Kubernetes, Operator, Java, Platform Engineering

Architecture books teach you patterns. They don't teach you how to choose between them when you're under pressure, facing incomplete information, and living with real consequences. In mission-critical systems, architectural decisions aren't just about code quality - they're about operational success. A poor choice doesn't just create technical debt; it can impact system availability, security posture, and the ability to respond when things go wrong. This talk explores the reality of architectural decision-making in high-stakes environments through several real scenarios: - A legacy system that needs modernization - rewrite or evolve? - A performance vs. maintainability trade-off with no …

kl 17:00 · Room 4 · 45 min · Engelsk · Tags: software architrecture, decision making, technical leadership, architecture patterns, trade-offs, system design, best practices

Processing large amounts of data efficiently is a common challenge. Many workloads spend most of their time doing simple math on large arrays. Modern CPUs can speed this up using SIMD, where one instruction processes multiple values at once, but using it from Java has traditionally been difficult and required native code. The Panama Vector API changes this by letting developers express these operations directly in Java, while the JVM translates them into efficient CPU instructions. Elasticsearch is a real-world example. Features like vector search and ES|QL rely on repeated operations over large datasets. Under the hood, Elasticsearch and Lucene use the Vector API to take advantage of SIMD …

kl 17:00 · Room 5 · 45 min · Engelsk · Tags: java, SIMD, vector API

I fjor viste jeg på JavaZone hvordan OpenTelemetry og Java-agenter gir deg røntgensyn i produksjon. I år viser jeg hva som skjer når du kobler en AI-agent til de samme dataene — og til kildekoden. Dashboards krever at du vet hva du leter etter. Men hva om du bare kunne spørre? Med AI-agenter som har tilgang til kildekode metrikker og traces fra produksjon kan du stille spørsmål i naturlig språk, grave deg nedover i dataene, og gå rett fra innsikt til handling. Foredraget starter med en rask oppsummering av observability fra fjorårets foredrag, før vi dykker ned i samtale som grensesnitt mot telemetri, og agenter som kryssrefererer produksjonsinformasjon mot kildekoden din. Jeg viser …

kl 17:00 · Room 6 · 20 min · Norsk · Tags: OpenTelemetry, AI Agents, Observability, Application Insights, Developer Experience

If you work on enterprise grade microservices on the JVM, you have undoubtedly heard of Spring Boot. Most developers see it as the reliable backbone of enterprise software. It is stable, predictable, and safe. But what if we took all those conventions and threw them out the window? What if we repurposed the IoC container, event listeners, and bean lifecycles to reveal what Spring Boot was always meant to be? A game development framework! Join Alexander as he attempts to deconstruct and demystify the Spring ecosystem by forcing it to do things it was definitely not designed for. We are not talking about simple text adventures here. We are talking about building complex, real-time games like …

kl 17:00 · Room 7 · 45 min · Engelsk · Tags: Spring Boot, Fun, Games

Ever heard of the demoscene? It is this amazing community of recreational and competitive programmers. The point is to use code to create the most amazing graphical creations and impress everyone with artistic algorithmic brilliance. The demoscene taught me so much about being a good programmer, and I thought I'd give you all the opportunity to join in on the fun and learn how to create some great demos! I will guide you through the following: - Old school demo effect concepts - Modern-day demo effect concepts - Entry to shadercoding on Directx12 - Tools of the trade - How to be creative with mathematics - Bringing it all together to a demo-concept So bring out your graphic calculators, and …

kl 17:00 · Room 8 · 45 min · Norsk · Tags: Graphics, Shaders, Skills

Across the industry, teams are asking the same question: "What problem can we solve today with AI?" It sounds like the right place to start. In practice, it rarely is. Again and again, the real answer turns out to be simpler: the problem can already be solved by a trustworthy dashboard that people actually use. The data foundation just was not there yet. For most organizations, trusted and easy-to-use dashboards cover the majority of real decision needs. AI becomes a high-value addition only after that foundation exists. High-confidence visibility beats low-confidence intelligence. If your team is asking "What can we solve with AI?" but cannot yet answer "Which KPI can we trust today?" …

kl 17:50 · Room 6 · 20 min · Engelsk · Tags: Data, AI, data engineering, data driven decisions

Is your development team working well? How do you know? Teams can easily fall prey to groupthink and convince themselves they are doing great and are high performers. In reality, they're trailing behind without realising they need to up their game. The DevOps Research and Assessment (DORA) have provided a possible antidote, the DORA metrics, that have become an industry standard and can give good insights on how you're doing compared to other developers. This presentation will give an introduction to the DORA metrics and what they measure. I will then tell about the experiences Stø, the company behind services like BankID and BankAxept, have had so far implementing the metrics in a …

kl 18:20 · Room 3 · 45 min · Engelsk · Tags: High performing developer teams

What happens when security measures cannot be used by everyone? Any security control that is not accessible becomes a barrier, and barriers trigger unsafe workarounds that create security risks. We face a paradox, security mechanisms designed to protect users can systematically exclude the most vulnerable populations, including people with disabilities and older adults, and this exclusion can become an exploitable vulnerability. Users facing accessibility barriers often adopt insecure coping mechanisms: they share passwords, delegate authentication to others, store credentials insecurely, rely on weaker fallback paths, or abandon security measures altogether. Each workaround is a …

kl 18:20 · Room 4 · 45 min · Engelsk · Tags: accessibility, security, testing, inclusion, secure-by-inclusion

Has this ever happened to you: You just spent 50k€ on a humanoid robot but it's not very fun at parties so you have to train it to dance using reinforcement learning in a simulation environment on your 100k€ GPU Cluster? What do you mean "NO"? In this talk, we will teach you how you can train your humanoid robot to dance using reinforcement learning in simulation environments. We're gonna kick things off with an introduction into Reinforcement Learning (RL), covering the basics of policies and rewards. After that, we'll take our first steps in simulation environments with the introduction of NVIDIA Isaac Sim and the Unitree RL Lab. We will run through the steps of shaping a walking policy …

kl 18:20 · Room 5 · 45 min · Engelsk · Tags: Robotics, AI, Reinforcement Learning, IsaacLab

Treng me framleis å forstå koden me produserer når KIar tilsynelatande kan løysa problem mykje raskare enn oss? Kvifor skal me bry oss om å læra noko som helst anna enn å bruka ein KI? Teknologi kan ikkje forståast i isolasjon. For å forstå teknologien må me også forstå korleis hjernen vår fungerer. Heilt sidan teknologi blei ei greie så har menneskeleg ekspertise mista terreng til teknologien, men om me ser alt med teknologibrillene på så er me blinde for dei problema som ikkje let seg reduserast til tekniske løysningar. Då risikerer me å laga produkt som ingen intelligens, korkje kunstig eller organisk, kan forstå eller rydda opp i. Dette foredraget vil gje deg eit vokabular og rammeverk …

kl 09:00 · Room 2 · 45 min · Norsk · Tags: Pedagogisk psykologi, læring, psykoteknisk

Docker is the cornerstone of today's development! Let's overview quickly how we use it in JVM development, and then transition to practical examples. We will start with a simple Docker image containing a popular "one fat JAR" and look into its downsides (deployment speed, traffic volume). To address them, we will discuss the strategy of splitting the JAR into multiple layers and using multistage Dockerfiles, gradually improving our image. Join me to learn how to build the ultimate Docker image for Spring applications.

kl 09:00 · Room 3 · 45 min · Engelsk · Tags: Java, Spring, JVM

Public transport is full of decisions that sound simple until you try to automate them. Where should self-driving vehicles wait between trips? How can we reduce bus bunching and keep buses running at more regular intervals? In this talk, we show how we built two optimization systems for public transport at Ruter. The first uses historical demand to build a weighted graph and determine where self-driving vehicles should be staged between trips. We solve this problem using established optimization methods and explore where quantum computing could provide an alternative approach. The second focuses on bus bunching, using real-time data and predictions to support decisions such as holding a …

kl 09:00 · Room 4 · 45 min · Engelsk · Tags: optimization, operations research, bus bunching, public transport, self-driving, autonomous vehicles, quantum computing, decision systems

Har du lyst til å bli datadreven, men opplever at avstanden mellom idé og gjennomføring er for stor? I SAMT-BU-prosjektet jobbar vi med å redusere denne avstanden ved å bygge bru mellom utviklarar og datafolk – og mellom proprietære løysingar og åpne standardar. Målet er ikkje berre betre system, men betre flyt: i utvikling, integrasjon og samarbeid på tvers av kommunar. I dette foredraget deler vi korleis vi nyttar opensource-verktøy, felles standardar og ein bevisst samarbeidskultur for å skape fart og gjenbruk. Du får konkrete erfaringar, praktiske grep og ein verktøykasse du kan ta med deg vidare – uavhengig av om du jobbar teknisk, strategisk eller operativt.

kl 09:00 · Room 6 · 20 min · Norsk

A greenfield dream of one API front door to access all services crashed through four major iterations. Every conversation waded through the IAM alphabet-soup of acronyms. It should be just who, what and where. Easy, right? Signicat grew through acquisitions and dreamed of product-led growth with self-service APIs. But real-world scalability, security, compliance, and technical debt threatened delivery of that vision. This technical retrospective will cover the battles won and lost with cache drift, latency spikes, risk profiles, organizational competency gaps and naive OIDC implementations, token leakage exposure and secret sprawl while serving millions of users per day. The team pieced …

kl 09:00 · Room 7 · 45 min · Engelsk · Tags: Security, API, IAM, Authentication, Authorization

Hvordan kan frontend-utviklere, backend-utvikler og kanskje til og med en designer jobbe sammen og samtidig på et prosjekt? Mobbprogrammering er svaret. Blir man mer eller mindre produktiv, og hvordan blir resultatet? Hvis du vil vite mer om hva mobbprogrammering er og hvordan man kan teste det ut er dette presentasjonen for deg.

kl 09:25 · Room 6 · 20 min · Norsk · Tags: Software utvikling, samarbeid, metode

Vi kjenner alle til smerten i overgangen mellom relasjonsdatabaser og objekter. Skaler opp til tusenvis av klasser, relasjoner og constraints fra en internasjonal standard, og du ender med forenklinger og kode som ikke egentlig greier å uttrykke domenet skikkelig. For å strø salt i såret, innse at domenet egentlig ligner mer på en graf enn en haug tabeller. Vi sto overfor akkurat dette. Standarden vi jobber mot er enorm, grafbasert, og skrevet for og av domeneeksperter med årevis av erfaring. For en utvikler er den nærmest uleselig. Men den er maskinlesbar. I stedet for å redusere standarden til noe en relasjonsdatabase kan håndtere, genererte vi Kotlin-kode direkte fra spesifikasjonen og …

kl 09:50 · Room 6 · 20 min · Norsk · Tags: Domain-Driven Design, Kotlin, Code Generation, Graph-OOP impedance, Ontology

Maven is an ubiquitous build tool in the Java ecosystem, some even claim it’s the de facto standard build tool. Configuring Maven is deceptively simple, after all it’s just a matter of writing XML, isn’t it? Things look differently when the rubber meets the road. One must know the intricacies of the build lifecycle; how plugins, goals (mojos), and phases come together; rules for dependency resolution; configuration inheritance between parent – child POM files; enhancing the build with profiles; and more. That’s a lot to keep track of. Fortunately modern IDEs like IntelliJ IDEA provide great support to configure and run Maven, with code completion, navigation, custom run configurations, and …

kl 10:20 · Room 1 · 45 min · Engelsk · Tags: Maven, build tools, dependencies, IDE, IntelliJ IDEA

Welcome to the apocalypse! Huh? You didn't notice when digital trust in Norway died? Well, you are not alone, but rest assured – we are all already hacked. Or almost surely, anyway. In the world of "Harvest Now, Decrypt Later," the breach isn't coming; it already happened. And for Norway as a country, it no longer matters if the Quantum Threat is a physical reality or a fever nightmare. With tightening deadlines and punishing laws like NIS2 and DORA, the security of your data is no longer just in the hands of IT. It is – dear God – the responsibility of your Board of Directors! What, if anything, can be done before the clock hits midnight (35 minutes ago)? This talk explores Post-Quantum …

kl 10:20 · Room 2 · 45 min · Engelsk · Tags: Q-day, Doom(!), Security, Compliance, Entertainment, Visual novel

Basic feature flags gave teams on/off control over what users see, decoupling code deployments from feature releases. More advanced targeted flags let us release the right features, to the right people, at the right time. But in 2026, the challenge isn't toggling — it's managing the entire feature lifecycle from idea to impact. Packed with lessons from production, live demos, and a healthy dose of engineering humor - you’ll learn: * How to build runtime feature management into your architecture * How to find bottlenecks in your feature lifecycle * How to make releases consistently boring * How to make releases that monitor themselves

kl 10:20 · Room 3 · 1h · Engelsk · Tags: feature flags, feature management, feature lifecycle, safer releases

Vi forteller historien om hvordan Statens vegvesen snudde mediekritikk til tverrfaglig samarbeid og innovasjon. Å 'bygge bro' mellom fagmiljøer er ikke alltid like lett, men en brukollaps tente gnisten til tverrfaglige produktteam som fikk dronepiloter, bruinspektører og IT-teknologer til å innovere og samarbeide om nye digitale løsninger med data fra droner og maskinlæring.

kl 10:20 · Room 4 · 45 min · Norsk · Tags: produktorientering, maskinlæring, data, offentlig sektor, samarbeid

Universell utforming (UU) er utrolig viktig for å skape en inkluderende og brukervennlig nettside, men hvor skal man starte når man først skal lage en universelt utformet nettside? Hvis man aldri har testet UU før så kan det lett virke som en uoverkommelig utfordring, men med rette rutiner og verktøy så må det ikke være det. I denne presentasjonen skal vi gå gjennom tips og triks vi har lært gjennom vårt arbeid hos Vy for hvordan man kan få universell utforming til å bli en integrert del av utviklingsprosessen. Vi kommer til å gå gjennom ulike lærdommer vi har lært, hvilke plugins vi ofte tar i bruk og hvilke rutiner kan være en god ide å implementere for at testing og forbedring av UU skal …

kl 10:20 · Room 6 · 20 min · Norsk · Tags: Frontend, UniversellUtforming, Tilgjengelighet

An introduction to shadow rendering and related techniques. This talk will give an overview of real time rendering of shadows using three.js and openGL, with a practical example of how we created performant sharp shadows independent of resolution using techniques dating back to the video game DOOM 3 in order to solve a user problem we encountered in our own product.

kl 10:45 · Room 6 · 20 min · Engelsk · Tags: Rendering, shadows, three.js, OpenGL

Utviklerjobben du hadde finnes ikke lenger. Håndverket er slukt av modellen, kollegaen har ikke puls, og vi er sliten alle sammen. Jobben er blitt utelukkende spesifisering, validering og prioritering. Sorg og angst er helt naturlig respons når yrket du elsket skifter form under føttene på deg. Her tar vi sorgen på alvor før vi beveger oss videre. For selv om håndverket er blitt hobby, er det en hobby ingen ta fra deg. Du må endre deg, men det må vi alle, og ingen har svarene. Etter sorg og angst følger glede, og kanskje til og med eufori. Uansett hvor du er nå, håper jeg denne lyntalen kan gi noen nye tanker (noen også oppløftende), og i beste fall litt ro midt i uroens tid.

kl 11:10 · Room 6 · 10 min · Norsk

The Cassandra database is a widely deployed Java infrastructure piece, and a critical part of many services. A core part of it's work is deduplicating and deleting data through periodic compactions. In this talk I will discuss a recent patch in which I re-implemented compaction to deliver a large performance improvement. This is an exploration of the delivery of a meaningful performance improvement to a long standing, industry standard, OSS project. Key Takeaways: - Picking the right target - Setting meaningful goals and metrics - The contribution process - Re-occurring optimisation techniques

kl 11:40 · Room 2 · 1h · Engelsk · Tags: Cassandra, Performance, Profiling

Are you interested in how the world works outside of the JVM or the Java ecosystem as a whole? How would one work with a language that has no exceptions? What about working in an ecosystem where the mantra is "let it crash"? Gleam is a statically-typed, functional, immutable language that runs on the BEAM VM—a VM where every process is tiny, isolated, and communicates via messaging, and that can even run across a cluster. And if that’s not enough, Gleam can also compile to JavaScript. Join me as we explore a different language on a different VM, discover what makes the BEAM unique, and see how Gleam brings strong typing and modern syntax to this powerful ecosystem.

kl 11:40 · Room 3 · 45 min · Engelsk · Tags: Functional programming, Distributed applications, Gleam, BEAM

Du er på vei til jobb når toget stopper. Ingen vet hvorfor. Behovet for rask og presis informasjon er akutt. Når et avvik oppstår på jernbanen settes en kompleks kjede i gang på tvers av organisasjoner, systemer og teknologier; der hvert ledd påvirker hva de reisende opplever. I denne lyntalen følger vi én konkret avviksmelding, fra den oppstår hos Bane NOR, gjennom Vy sine systemer, og helt ut til de reisende. Samme avvik. Samme data. Ulike behov, systemer og mottakere. Vi viser hvordan informasjon endrer form fra en teknisk og operativ hendelse, til konkret og tydelig kommunikasjon. Dette er historien om én melding, men også om hvordan teknologi, mennesker og samfunnskritisk infrastruktur …

kl 11:40 · Room 6 · 20 min · Norsk · Tags: infrastruktur, design, brukeropplevelse, samarbeid, informasjonsflyt

CRA, NIS2, DORA Does it ring a bell? By December 2027, the EU Cyber Resilience Act (CRA) will require Software Bills of Materials (SBOMs) for almost all software products placed on the European market. For teams working with Java, this is a significant compliance task, given their work with deep dependency trees, complex build systems and layered deployment models. This is an architectural and operational deadline that demands immediate attention. The purpose of this session is to provide a clear and technical overview of what Java engineers, architects and DevOps teams must understand in order to meet CRA expectations and to avoid risk under NIS2 and DORA. These two initiatives …

kl 11:40 · Room 7 · 45 min · Engelsk · Tags: Security, Compliance, SBOM, CRA

JDK 8-to-25 Without the Pain. Most Java teams carry more technical debt than they realise. Moving from JDK 8 or 11 to JDK 21 or 25 is not a simple upgrade; it is a shift across a decade of removals, encapsulation, JPMS changes, GC updates, and performance improvements that reshape how you deploy software. This talk gives developers and architects a direct look at what it takes to modernise a large Java estate. What breaks, why it breaks, how to diagnose issues early, and how to build a repeatable migration path without risking the platform or the budget. Includes: • Using JDK tooling (jdeps, jdeprscan, runtime flags) to find hidden technical debt • Internal API removals, split-package …

kl 11:40 · Room 8 · 1h · Engelsk · Tags: Migration, JDK 25, Dependencies, Compatibility, Diagnostics

– slutt på “noen burde…” “Kan noen fikse dette?” Ingen gjør det. Vi gjorde “noen” til en faktisk rolle: Noen™. En person som roteres hver sprint, med ett ansvar: Få det som ellers faller mellom stolene til å bli gjort. Resultatet? Mindre mas, færre løse tråder, og et team som faktisk leverer – uten å lene seg på en teamleder. Ingen nye rammeverk. Bare en liten endring som funker. Lei av “noen burde…”? Kom og stjel ideen.

kl 12:05 · Room 6 · 10 min · Norsk · Tags: team, autonomi, ansvar

Glow er et system for ruteplanlegging og pakkelevering utviklet av et datterselskap heleid av Posten. Det har blitt utviklet over 7 år av svært erfarne utviklere. Mot slutten av 2025 begynte vi å bruke AI i utviklingen. Dette er er en fortelling om hvordan det gikk. Er AI så bra som alle sier? Hva skjer når erfarne utviklere kobler AI på utviklingsprosessen i en eksisterende kodebase? Forstår AI hvordan vi vil kode nå basert på hvordan vi har kodet før?

kl 12:20 · Room 6 · 20 min · Norsk

Java has had a dependency descriptor since 2017, and neither Maven nor Gradle will resolve a dependency by module name. This talk argues the POM is the wrong artifact to hang a dependency graph on, and shows Jenesis: a build tool that reads module-info.java instead of a build file, ships as Java source rather than a wrapper binary, and pins every dependency by content hash. Plus a crawl of Maven Central showing how modular the ecosystem already is, and an uncomfortable question about who owns the repository all of this depends on.

kl 13:00 · Room 2 · 1h · Engelsk · Tags: build,Java

If you are tired of API churn, bundlers, transpilers and JS dependency hell, we may have a solution for you. Explore why developers at SpareBank 1 Østlandet decided to build their frontend using Kotlin DSL for HTML with HTMX rather than "traditional" JavaScript frameworks, and which experiences we are left with a year later. I will walk you through reasons to think different (and perhaps old-fashioned) about the frontend, and why in some cases it still makes sense to stick with JS frameworks such as React. You will also learn how you can get started with the HTMX/Kotlin stack for yourself. Amongst other things we will discuss: 1. The web 1.0 frontend and how the frontend space ended up …

kl 13:00 · Room 4 · 45 min · Engelsk · Tags: Kotlin DSL, HTMX, HATEOAS, REST, KTor

CargoNet er et togselskap og et terminalselskap og har i over 20 år basert driften på et felles, egenutviklet IT-system som burde vært erstattet for lengst. Andre aktører, som CargoNet integrerer med, har også systemer laget i og for en annen tidsalder. For ikke å glemme steinras, flom, avsporinger og kjøreledninger som faller ned. Aldri en kjedelig dag! I dette foredraget vil du får høre om erfaringer vi har gjort oss med å bygge og ikke minste rulle ut nye IT-systemer de siste 3 årene. Stikkord: Noen feil, noen suksesser, noen patterns og noen gode råd.

kl 13:00 · Room 5 · 45 min · Norsk · Tags: erfaringsrapport, patterns, arkitektur

Du sender en EHF-faktura. Den går gjennom en aksesspunkt-leverandør du ikke kjenner, via et nettverk du ikke kontrollerer, til en mottaker du ikke har noen direkte relasjon til. Likevel forventer du at den kommer frem, og at du kan stole på svaret. Det nettverket heter Peppol. Det har båret EHF-fakturaen i over ti år, og store deler av norsk næringsliv er allerede tilkoblet uten å vite om det. Peppol er ikke et selskap eller en plattform. Det er et nettverk der nasjonale myndigheter og over 700 sertifiserte tjenesteleverandører på tvers av Europa, Asia og Australia har blitt enige om å stole på hverandre. Ingen sitter i midten. Ingen har full kontroll. Hvordan er det mulig? I dette …

kl 13:00 · Room 6 · 20 min · Norsk · Tags: EHF, Peppol, trust architecture, distributed systems, European Business Wallet

Writing a "Hello World" endpoint is easy. But building an API that is secure, observable, and capable of evolving without breaking every client? That’s where the real engineering happens. We often pollute our business logic with validation, security checks, and boilerplate, creating a maintenance nightmare. It’s time to clean up our act. In this session, we’ll move beyond basic CRUD to explore 5 essential patterns for building production-grade APIs. We will combine standard Jakarta EE/MicroProfile features with powerful custom implementations to tackle the cross-cutting concerns that matter most.

kl 13:00 · Room 7 · 45 min · Engelsk · Tags: API design, REST, architecture, Java, JakartaEE

Coolify og Hetzner gjør det enkelt å hoste egne applikasjoner på europeisk grunn. I denne lyntalen viser jeg hvordan du raskt setter opp Coolify på en Hetzner-server og deployer en applikasjon med HTTPS og eget domene. Jeg tar alle snarveiene: én server, én Dockerfile og ingen avansert konfigurasjon. Perfekt for hobbyprosjekter og prototyper du vil dele.

kl 13:25 · Room 6 · 10 min · Norsk · Tags: hetzner coolify selfhosting suverenitet europeisk

Service layers often start simple but slowly turn into a mix of business logic, infrastructure calls, and "just one more thing". The result is hard-to-read code, fragile tests, and a structure that depends more on discipline than design. There are well-known solutions like onion, hexagonal, or clean architecture. They work - but they also require a lot of upfront understanding and ongoing effort to keep intact. In practice, many teams don't fully adopt them. In this talk, I'll share a small, practical approach I've used to bring structure back into service layers - without introducing heavy patterns or requiring everyone to "buy in" to a big architectural model. We'll look at a real …

kl 13:40 · Room 6 · 20 min · Engelsk · Tags: architecture, backend, testing, maintainability

Med 3.8 millioner brukere og 40.000 bedriftskunder, har Digipost en helt unik posisjon til å utforske digitale lommebøker i Norge. Det siste året har teamet jobbet sammen med andre aktører og hatt piloter i sandkassen til Digdir. Brukerhistorier innen sertifisering og organisasjonsidentitet har vært fokuset, som teamet har videreutviklet lommebok-konsepter; en ny måte for virksomheter å dele bevis digitalt, på en trygg måte og på tvers av landegrenser. Målet er å følge bølgen som kommer i Europa med EU-forordningen eIDAS 2.0 (Electronic Identification and Trust Services) om at alle EU/EØS-land skal tilby en offentlig utstedt eID på høyt sikkerhetsnivå. Vi deler erfaringer fra pilotene vi …

kl 14:20 · Room 2 · 45 min · Norsk · Tags: UX, brukeropplevelse, innsikt, lommebok, eIDAS

Would you like to move your data and workloads to a European public cloud provider, but don't know where to start? Or did you try to find one, and couldn't decide between too many choices? Join this session and get some practical advice on how to get started, things you should consider before making a decision, and what to expect. And maybe just as important: valid reasons for when European public cloud providers aren't the right choice for you, because like always in our business, “it depends” is the right answer to the question whether European public cloud providers are a fit for your needs.

kl 14:20 · Room 3 · 45 min · Engelsk · Tags: Digital Sovereignty

19. Juli 2024 ble det sendt en oppdatering til IDS-systemet Crowstrike på Windows. Denne oppdateringen endte opp med å krasje det meste av datamaskinene som kjørte denne kombinasjonen av IDS og operativsystem med konsekvenser som stengte flyplasser, forringede tjenester i helsevesen og kostnader i milliard-klassen. Denne hendelsen eksemplifiserer et større problem med at avhengighet av enkelt-teknologier og tjenester gjør oss utsatte når disse teknologiene feiler. I denne presentasjonen vil vi gå gjennom hva som gjorde at denne og aldre hendelser får så store konsekvenser. Vi vil også se på hvordan teknologisk mangfold kan hjelpe til med å redusere konsekvensene av denne typen hendelser og …

kl 14:20 · Room 4 · 45 min · Norsk · Tags: verdikjederisiko, sikkerhet, mangfold, suveren IT

In a world where code is increasingly being generated by AI, the hard work is no longer in writing the code, but in domain discovery, understanding workflows, establishing service boundaries, and supporting personas. Some may argue that this has always been the case, but it's now becoming more apparent than ever. In order to fully acknowledge this shift, we need to rethink how we design our web APIs. Instead of focusing on the technical aspects of API design, we should focus on the business domain and the behaviors that we want to expose through our APIs. If you believe that the best, or perhaps even only way to design a web API is around the four verbs of CRUD (Create, Read, Update …

kl 14:20 · Room 5 · 1h · Engelsk · Tags: rest, domain-driven design, web api design, api design, best practices, patterns

Hvordan organiserer du koden din i pakker/moduler? Da jeg begynte å utvikle software profesjonelt i 2001 lærte jeg å organisere koden i tekniske lag; package-by-layer. Dette opplevde jeg lenge som en bransjestandard, men rundt 2010 begynte jeg å utforske andre måter å organisere koden jeg jobbet på. Da oppdaget jeg at det er flere måter å gjøre dette på. Jeg har gjort meg en god del gode erfaringer, men jeg har også gjort feil på veien som jeg ønsker å dele. Mitt største ønske er å skape nysgjerrighet for å utforske andre måter å designe software på, samtidig som jeg er klar over at dette heller ikke er noen fasit. Jeg har også erfart at hvordan jeg deler bort, ikke alltid treffer like …

kl 14:20 · Room 6 · 20 min · Norsk · Tags: Applikasjonsarkitektur, design

When testing a concurrent program, you never know if it really works or if you got lucky. As the famous Dijkstra quote says: "Program testing can be used to show the presence of bugs, but never to show their absence!". Full model checking or formal correctness proofs remain largely intractable: too expensive, too slow to develop (even with AI assistance), and too hard to maintain over time. However, not all hope is lost: a growing body of tools is available to help you gain more confidence with your concurrent programs. These tools work by instrumenting the bytecode and executing a series of thread interleavings deterministically. It's not a correctness proof, but it might boost your …

kl 14:20 · Room 7 · 45 min · Engelsk · Tags: java, concurrency, testing

Have you ever wondered why a particular class was loaded at that exact moment? Getting to the bottom of it can be surprisingly hard. I recently encountered a bug with a particularly nasty linkage error in which classes were loading unexpectedly, and I needed to figure out what triggered that. In this talk, I’ll walk through the steps I used to track it down. We’ll build a slowdebug JVM, attach GDB, and use breakpoints and inspection to identify the precise cause of the class loading. If you’re curious about how the JVM really works and want to peek under the hood, this talk is for you.

kl 14:45 · Room 6 · 20 min · Engelsk · Tags: JVM, JVMTI, C++, GDB

You've built a Java application, but how do you actually package, install and run it? Packaging, distribution and execution of Java applications have mostly been only a JAR-file since the beginning of Java, but in these days we can do much better. This session takes you on a practical journey through the full landscape of Java packaging, from the humble JAR to native binaries and OS-specific installation packages.

kl 15:10 · Room 6 · 20 min · Engelsk · Tags: java, build, packaging, installation

As developers, we’re embracing AI and large language models (LLMs) in our applications more than ever. However, there’s an increasing concern we need to be aware of: prompt injection. This sneaky attack can undermine our AI systems by manipulating the input to produce unintended outputs. In this session, we’ll break down what prompt injection really means and look at some common techniques attackers use, like instruction overrides and hidden prompts. But we won't stop there; we’ll also explore advanced challenges, including escalation techniques that can exacerbate the risks. Most importantly, we won’t just identify the problem. We’ll dive into practical steps you can take to mitigate these …

kl 15:40 · Room 1 · 1h · Engelsk · Tags: Java, Security, AI

Choice of a testing framework to be used in a team is usually overlooked (let’s just take what we have used before, i.e., JUnit). However, nowadays the choice is not that obvious anymore, and the support for testing libraries like Spock and Kotest is much better than many years ago, especially in cooperation with Spring Boot. There are many gotchas you should be aware of. Spock, Kotest, and JUnit seem to be similar, however, the devil is in the details, and those can sting hard! They differ in terms of features, complexity, flexibility, performance, integration with Spring Boot and Testcontainers, developer friendliness, and maintenance. You could be surprised that switching to another …

kl 15:40 · Room 3 · 45 min · Engelsk · Tags: java kotlin kotest spock testing spring

Provisioning infrastructure shouldn’t require every developer to become an expert in Terraform, Bicep, or cloud-specific tooling. In this talk, I’ll show how Crossplane lets you treat infrastructure like any other Kubernetes resource—making it significantly more accessible for developers while still enforcing platform-level guardrails. We’ll start with a quick introduction to what Crossplane is and how it works, before diving into real-world usage based on a year of platform engineering experience. You’ll see live demos of provisioning both individual resources (like a virtual network in Azure) and complete landing zones through simple, developer-friendly APIs. The focus is on Azure, but …

kl 15:40 · Room 4 · 1h · Engelsk · Tags: Crossplane, Platform Engineering, Kubernetes, Infrastructure as Code, Developer Experience

JetBrains' Ktor is built from the ground up on Kotlin Coroutines. Yet Coroutines remain one of the more challenging concepts for many Kotlin developers - myself included. For the last 3 years I have been working as a backend developer on a project where we used Ktor. I have picked up both good habits and hard lessons along the way. This talk focuses on how Coroutines work in Ktor, and how you can leverage Coroutines effectively in your own projects. While it is possible to use Ktor without thinking much about Coroutines, a solid understanding can help you write safer, more resource efficient, and more maintainable code. We will cover the key benefits of Kotlin Coroutines, how Ktor uses them …

kl 15:40 · Room 6 · 20 min · Engelsk · Tags: Kotlin, Coroutines, Kotlin Coroutines, Ktor, Backend

We all use Java everywhere, from IoT devices and desktops to servers and even mainframes. All we need these days is made available in frameworks and libraries but how much do we know about what’s going on in the Java Virtual Machine. This session will try to give you an idea of how Java source code will be transformed from text to byte code in classes, to be interpreted and later eventually become compiled machine code. How is code loaded into the JVM, which of this code will be interpreted or compiled and why? Why will some code be optimised and others not? How does the JVM handle the memory management? What are the good and bad parts of JIT compilation? How does the startup of the JVM …

kl 15:40 · Room 7 · 45 min · Engelsk · Tags: Java,JVM

Ever felt like your Git history is the scene of a gruesome crime? Have you ever seen commits so messy they should be classified as felonies? In this darkly humorous session, we’ll explore the most heinous Git crimes - from rebase disasters to merge conflicts so brutal they could be featured in a forensic case study. Through the lens of a "how-to" crime guide, we’ll teach you all the wrong ways to use Git - force-pushing straight to main, rewriting history with reckless abandon, and covering your tracks with git commit --amend - before revealing how to actually clean up your act and become a model Gitizen. Come for the crime, stay for the redemption. By the end, you’ll be armed with the best …

kl 15:40 · Room 8 · 45 min · Engelsk · Tags: git, fun

You might think Java is type-safe, but did you know you can *break* type safety too? It all comes down to variance: co-, contra-, and invariance. Maybe you’ve heard of these terms, but you’re not entirely sure what they mean or how to use them effectively. That was exactly my situation — even after more than ten years of experience with Java. I’ve noticed this same knowledge gap among the students I teach. Type safety gives us reliability but also adds complexity compared to weakly, dynamically typed languages. Why do we even have types? What makes something a subtype? Do you think you can pass an `Integer` into a parameter of type `Number`? And what about a “type that has a type”? Generics …

kl 16:05 · Room 6 · 20 min · Engelsk · Tags: generics, type erasure, covariant, contravariant, subtype

We’ve all said it: "It works on my machine." Docker solved this by shipping the machine, but it didn't necessarily make the build reproducible, just the artifact. Enter Nix: a functional package manager that treats builds like pure mathematical functions. In this 20-minute talk, we’ll compare the "Imperative vs. Functional" approaches to environment management, discuss why Docker images often drift over time, and see how Nix provides bit-for-bit reproducibility. You’ll walk away knowing when to stick with a Dockerfile and when to reach for a Nix Flake.

kl 16:30 · Room 6 · 20 min · Engelsk · Tags: nix, nixos, nixpkgs, docker, containers

I got into programming because I wanted to make cool graphics, and that’s still what excites me most about coding. These days, shader coding is the ultimate playground for creating stunning real-time visuals. In this talk, I’ll start from scratch and show how to build 3D graphics using nothing but shader code. Along the way, I’ll share tips, tricks, and a bit of shader wizardry to help you get started as well.

kl 17:00 · Room 3 · 45 min · Engelsk · Tags: ShaderArt,GLSL,ShaderToy,CodingForFun,OpenGL

Cloud Native Buildpacks make it easier for developers to create container images, offering a seamless experience with built-in features such as rebasing, reproducibility, and support for multiple entry points. In this talk, we'll start by covering the basics of Buildpacks, looking at their architecture and the benefits they bring compared to traditional methods of building container images. We’ll then explore the lifecycle component, which is the central binary of Cloud Native Buildpacks. This part will reveal how it manages the conversion of source code into OCI images and oversees the various stages of the build process, including detection, installation, and export. We will also discuss …

kl 17:00 · Room 8 · 45 min · Engelsk · Tags: Containers, Paketo, Buildpacks, Spring Boot