DjangoCon Europe 2018 - Lightning Talks I
CC Attribution - NoDerivatives 4.0 International:
You are free to use, copy, distribute and transmit the work or content in unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Keith-Magee, Russell
Mayer, Justin
McLaughlin, Katie
Spielmann, Johannes
Mayer, Justin: Django Multi-Factor Authentication McLaughlin, Katie: Serialization formats are not toys Spielmann, Johannes: I hate CSV N. N.: Django for Managers: How to create a nice looking application in just two days Maloney, Curtis (Funkybob): Django Staticfiles
 We now continue on with lightning talks and I want to introduce Russell Keith McGee who is going to run them. We have our first speaker. Hello everyone. My name is Russell Keith McGee. If you have been to DjangoCon before you've probably seen me. If you haven't, I'm sorry. My job here is to introduce the lightning talks. However, it occurs to me from seeing this morning how many hands up to say this is your first DjangoCon that you may not know what a lightning talk is. A lightning talk is a short talk on any topic you want. If you've never spoken at a conference before and maybe you'd like, you know, maybe dip your toe into the water and find out whether conference speaking might be for you, a lightning talk is a great place to start. It can be about Django, it can be about Python, it can be about software development or it can be about anything else that happens to tickle your fancy. The DjangoCon stage has historically had some very entertaining talks about Zeplins, for example. The only thing it can't be is an advertisement or a commercial for a company or a job advertisement or something like that. If you want to do a commercial advertisement, may I suggest possibly next year sponsoring this fine conference, you get your logo on stage the whole time. As a short talk, it is five minutes and we do mean five minutes, an absolute maximum. With one minute left on the clock, I will sort of slowly come back onto the stage. With about ten seconds to go, our fine organizer Tobias over here will start warming up the gong and when time runs out, there will be a gong hit to stop all gong hits, at which point we will then find some way of dragging you off stage forcibly. I say it's a maximum of five minutes. It can be less than five minutes if you so choose. There's no minimum length of time other than, you know, please don't waste our time just setting up your laptop for saying goodbye and walking off stage again. With that, that is a lightning talk. This has effectively been a lightning talk about lightning talks. And I would now like to introduce Justin Mayer, who will talk to us about how to add multi-factor authentication to your Django project in less than five minutes. Take it away, Justin. Thanks very much, Russell. My name is Justin Mayer, originally from Los Angeles, California, but just last week moved to a mountain village in the Italian Alps in a region called Trentino. I've used Django for a long time, most recently to create Fortressa, which allows you to create your own private self-contained VPN server. And today I'm excited to talk to you about multi-factor authentication. My goal is to show you how to add multi-factor authentication to your applications in the time that I have, which is obviously not very much. Last summer I gave a full-length talk on this topic at EuroPython. You can find a link to the video on JustinMayer.com. Here's a very fast lightning summary. Passwords are ubiquitous. They are terrible. Most time people get around them by using SMS to send you a code. You've probably seen this. It's very common. Unfortunately, it's not very secure. A better method is TOTP, or time-based one-time passwords. You may have seen it. You get a six-digit number generated usually on an app on your phone. Another method that I really like is called universal second factor. It's a small USB key. I have a tiny one in my machine right now. It's a hardware key, the next generation of which is a web standard called web authentication. There's a project called Django U2F that you can use to add this. It does both TOTP and U2F. I want to show you how easy it is to implement it and add multi-factor authentication to your applications. So let's do it live and what could possibly go wrong. So over here, what do you know? It's actually there. That's good. First thing we're going to do is we are going to activate a virtual environment and we're going to pip install Django and the Django U2F package. Luckily, I've cached all these wheels so I don't have to deal with Wi-Fi. There we go. So then we're going to clone the project and the reason we're doing that is that we're going to use a sample project that's inside it. Switch to that directory. We're going to install the requirements. Also from cached wheels, thankfully. We're going to run migrations. I know this is fast, everyone, but just try your best to keep up. We're now generating a TLS key for the local host domain so U2F requires TLS. Then we are going to now run our server and switch over to a browser. And we're going to go ahead and load. Once we bypass the yes, we know it's not a signed certificate. I'm going to log in and I probably forgot to create a super user. This is what happens when you're doing it live. Okay, do that really quickly. Hi, at food.com. Okay, go back to the browser, hopefully. And now we can try this again. And now we have a screen where we can manage all our multi-factor authentication. First thing I'm going to do is add a U2F key, which I just did by putting my finger on it. It's now been added. I'm going to go back to the settings and add a TOTP device. And I'm going to do that using an app on my phone. There's a variety of different ones. I use one password because I already used that to manage my other passwords. I tap it to add a new password. I'm going to scan the QR code. It's been added. I'm then given a number to enter into this token field. Once I do that, it then registers the token and says device added. And then last, we're going to create some emergency backup codes. I may not have my device. I may not have my phone. This allows me to get in even in those cases. So we've proven that we can add those things. Now what happens when we log back in? So we log in as usual when I don't fork the password. And we can go ahead and log in via either of the three methods that I just added. I'm going to just put my finger on the security key and I'm in. It is really that easy to do. And now I'm going to quickly just show you what the only difference between a standard Django start project command and the test project that I just added is what you see here. A couple of lines added to installed apps to add some needed packages there. A couple of lines added at the end of your settings file to do login URL and redirection. This is URL start pie. Thank you very much, Justin. Next up on stage we have Johannes Hopper while he's getting set up with the microphone and the laptop. I've just returned from PyCon US. When I was at PyCon US, I bumped into an interesting person sort of wandering around. It was actually a different conference all about wasps. At that conference they were talking about what not and about wasps as you do. They just decided to go for a walk around the town. And came across a vinyl shop. It's having old LP records. In the store front they had an advertisement up that said that they had just released wasp noises as an album that had just been made available. So an expert in wasps sees an album for wasp noises and thinks I've got to find out about this. Decides he's going to go into the store. More details later. Our next speaker is Johannes Hopper talking about instant feedback, making reviews great again on the new GitHub checks. Everyone make him walk him. Thanks, I'm not going to share any slides today because I didn't have much time to prepare. I try to keep this very short, probably shorter than five minutes. Maintaining open source projects is really hard. I think a lot of people here can empathize with that because they are maintainers. And other people can probably empathize because they have a pull request hanging somewhere and with no response. And we were discussing the evening already on what kind of things are hard. Something that's very tedious as a maintainer is that comment like, hey, can you please remove a white space or can you also wrap the doc strings at 80 characters. Stuff like that just comes repeatedly up and it's tedious for a maintainer. It's also bad to hear for a first time contributor. It's just negative feedback that you don't want to give to someone that otherwise did a really good job. Luckily, something we heard earlier this morning as a first talk, the machines are taking over and over time we built a lot of great lintists that help us do that job. But they're still, even though those do a really good job of giving you machine feedback which is a bit softer to the users, to the first time contributors or frequent contributors to tell them, hey, there's maybe a trading white space that you want to get rid of or please add a new line to the end of the file. And this is all great but they're still kind of hidden usually within our continuous integration suites. There's this one link to the Travis suite or use maybe CircleCI and there are a bunch of different services out there and not everyone is familiar with all of those. And then you have to find the section that actually failed and you have to figure out what that means. Maybe you're not particularly familiar with that lintta. Could be something like Pylon and there are a bunch of checks. You maybe don't know them all. Luckily, there has been a recent change on how GitHub works. There has been a new feature called checks. It's currently still in beta and the API is now also available in beta which allows you to kind of take all that onto a single platform. It allows machines to also add review comments and it introduces the new concept of a check which is really, really made for machine feedback for what we know is lintta currently. So since that was released, a colleague of mine and me, we sat back and thought, hey, that's a cool thing. Let's try to bring those two together because they're made for each other. So we put a lot of lintta on AWS services, build a small service around it and combined all that in order to run checks automatically without any tedious setup on repositories and give the feedback directly back onto GitHub without storing any data in between. It's just we process the data from the commit and we push our linting results back and the user can see them right where they push their code. If you're interested in using that or in contributing to making that better because obviously it's just started, approach me. I'm Johannes Hopper, coding Joe on GitHub. I don't know my Twitter handle really. And talk to me about it. I'm excited to share. It's all open source obviously. Yeah. So just find me later if you're interested in those sort of things and I hope that we can make contributing and maintaining a bit easier. Thanks. Thank you, Johannes, for pointing out that it can be less than five minutes. While I expect it to get set up, our friend here has gone into the store of the LP store and he says, can I listen to this record? If you've got an example I can listen to and the person behind the counter says, yeah, no, no problem. Reaches down, gets up, a copy of the record. Just go over the listening booth there and get set up there. And once you're in the listening booth, I'll start the record and you can listen to it and see what you think. And so he goes into the listening booth and the storekeeper goes behind the record player and puts it on and starts playing and a little bit more detail about what he hears in a moment. Next up we have Katie McLaughlin. Serialization formats are not toys. Hi. By the way, you don't actually have to give your own lightning talk. You can give somebody else a lightning talk. This lightning talk was given as a full 30 minute talk by a guy called Tommy Spinn. I'm going to give it in four minutes 45 seconds. Loading data into your application is the most boring part of your day. You want to get your data migrated into your app and then you want to keep on coding. The thing is 90% of magic merely exists on knowing one extra fact. If I know one thing that your app doesn't prevent security-wise, I can take all your data for myself. Everything I'm going to be talking about today is not a bug, it is a feature. So this is my example application, it's just a simple bottle app. All I'm going to be doing today is posting data to various endpoints and then returning back the content. So let's talk about YAML. In YAML, if I was to post my first name is Tom, my last name is Eastman, and I have an email address I get back a JSON result with my email address, first name and last name. What I can also do in YAML is I can post Python objects. So what I can do here is I can post back a Python object at date time dot date with my birthday and I get back a Python daytime object. Who can see where this is going? What I can also do is I could tell it to a call sub process and tell me the entire contents of my directory that I'm in. So I wonder if I can actually get my speaker notes to work. That would be useful. There we go. So hey, I wonder if I can also get my slides to be good. Yay! Okay. So what I could also do instead of running LS, what I could also do is not have my speakers slides work at all. Come on. There we go. All right. What I could also do is I could run RM star and then run an LS and I could delete my entire presentation while I was working on it, which is allegedly what happened to this speaker. So surely this doesn't happen in real life, right? It happens all the time. It happened with Piston and Tasty Pie back in 2011. It happened with Rails twice. It happened in Puppet and everyone was really upset and then it happened for no to no one cared. So how do you protect yourself? You make the parser stupider. What you should be doing instead of using YAML.load is using YAML.safeload, which is really easy to find when all you're doing in your tele-sense thing is going YAML.RK, load, okay, I want the first one. What you need to be using is safe load. So let's talk about XML, a slide that's scary enough just in itself. In XML we have entities. In an entity I can define an entity as a ampersand hash and then a number and then I get back a smiley face. What I can also do is I can put an alias to that entity. So instead of using the percentage number, I can have a smiley. So then I can have, yay, smiley, smiley. It's like emoji except not. So what I could also do is I could define an entity that's a bunch of other entities and another entity that's a bunch of those entities and I can have smiles going all the way down my page. This is also known as the billion laughs attack and you can turn your laptop into a smoking ruin. Including if you try to load your presentation slides in Emacs and it tries to render your XML for you. So what else can we do? What we can also do is we could ask it to return back the contents of our ETC release information or our password files or anything else because if you're running XML you're probably running in an enterprise environment and if you're running in an enterprise environment you're probably running as root. Which means you can do everything. Surely this doesn't happen in real life, right? It happens all the time. You don't even want to know. So how do you protect yourself just a simple list of things that you can do for your XML to make sure that it's not going to do anything? What you need to do is you need to make the parser stupider. What you can do is you can use diffuse XML on a few other things. I have one minute left. Let's keep going. Jason, finally a stupid enough parser. Only if you use it in a stupid way. Eval is not a stupid enough parser. Do not ever use eval to try to render Jason because on the documentation page what it says is it says up there here. You should use eval and write down the bottom like somewhere where the orchestra pit would be. It says do not actually use this. It also says it right there. It says hey, you can use eval but don't. No one is going to keep on reading the documentation after they get their answer, right? So the lesson. Beware of flexibility in your applications and in your serialization tokenizers because it will try to be smart and sometimes you don't want it to be smart. You want it to be dumb and you want it to play nice and you want to have your application still work at the end of the day. All everything you don't need and keep it simple. Thank you so much for your time. Thank you very much, Katie or Tom or Katie. Not sure. Okay, so our friend is in the listening booth now and he's put the headphones on. And he's sitting there. He listens to the record, starts playing. He starts listening and he's like, something's not right here. I mean, it's an insect. You can tell it's definitely an insect. And yeah, something's just not right here. So he comes out of the listening booth and he goes to speak to the store guy, the store manager and says, look, are you sure you're playing the right record there? Because I'm like a wasp expert. I'm pretty sure they're not wasp noises. And so the manager says, hang on, I'll get a different pair of headphones for you. We'll get you some good headphones. We'll try it again. So he goes and gets the good headphones, gets him set up with the good headphones. And steps back over, moves back into the booth, starts the record playing again. And he sits there and he listens a little bit to the sounds again coming through. And no, he's still going. All right. So he listens and listens again. And no, there's something that's definitely not right here. There's something that's just not quite right in the sound that I'm hearing. And I'm a wasp expert. I know my wasps. That is definitely not a wasp. This album says it's wasp noises. It's wrong. It's not wasp noises. So he sits back out of the booth, goes back over to the store manager and says, look, I don't know what to say here. It's definitely not wasp noises. There's something wrong with your record here. The manager says, I don't know. It says here on the tin. I can only gub at what it says here on the record. The guy says, hang on, I'll tell you what he says right after this break when Johannes will tell us why he hates CSV, everyone. All right. I don't seem to be the only one in the room. But I need to know precisely. So hands up if you have ever used CSV in a project. Hands up and keep your hands up. Everyone, excellent. So for those with the hands up who liked the experience, all right. Who had it work on the first try? Okay. For those of you with the hands up, this talk is not for you. All right. So what do you do as a developer when you have to work with CSV? I mean, you have tabular data, so you think, okay, everyone uses CSV. So I'm going to use CSV. So what do we do at first? We go to Stack Overflow. And of course, you read through this thing, and it's really simple. And all you have to do is, like, what? And then you look at the documentation, and it says things like, okay, I have a reader, and it's really simple. And yeah, I can register a what? I can what? Why? And the problem is, in CSV files, we use commas to separate records, and we use new lines to separate lines, right? But sometimes we want to use commas inside of the strings that we want to serialize, and sometimes we want to use new lines. And then we have to find some kind of, like, escaping, and we have to do magic to make it work. And that means we have to mess around, and we have several choices. We could use semicolons. Excel uses semicolons. So all of this comes from the fact that we don't have dedicated symbols for separating records and separating lines. Now, let's go back in time to the 1960s, and let's have a look at ASCII. I mean, imagine being the person having this problem for the first time, and looking through their ASCII code and seeing, oh, comma, I could use a comma. And what if we had dedicated characters for separating units and records, and possibly even groups or files, so we could have more than one table in a file? And these have been in the standard since before many of us have been born, right? But nobody knows them. Nobody uses these. So we have CSV, and we have this mess. I'm going to show you the code that we would need to use, to use these ASCII separation things. And this is going to work every time. And as you can see, it's almost as complicated as the one that we had for the CSVs. So what to do? Use ASCII separators if possible. And that's never possible. So the same thing to do is actually use Escalite. If you have tabular data, use Escalite. But there's a more important lesson. And the important lesson is this hack that somebody put in 20, 30, 40 years ago is still with us and is still plaguing us. So don't put hacks into production. And even more so, if you put a hack into production, please think before you copy someone else's hack, and this is my message to you. Thank you very much, Johannes. And again, another Johannes under time. You do not need to be five minutes. I can stay here and just... No, we've applauded now. That's the end. You're done. You're done. We need to get back to the wasps. Hang on. Hello. Wasp. More people coming. Yes. There we go. All right. Hang on. I thought you said you finished. Okay. There we go. Okay. Right. So anyway, our wasp expert in the booth, he's had his second listen. He says, I know what I can do. I've just come back from WaspCon. I can go and find the world expert on wasps. He's a convener of this conference. I can bring him into the store. We can get him to listen to the album. And we can get definitive. We can get clarification about whether this is a wasp or not. The store owner says, yeah, absolutely great. We'll do that. They come back the next day. Our next speaker is Bernard Buhlman, talking about Django for managers. Thank you very much. So actually I'm a manager, but this is not a commercial talk. So I hope you will use it for the commercially successful. So my name is Bernard Buhlman. I'm co-founder and long-term CEO of 14 work in Burn Switzerland. And I have a background of 15 years of plowing. So I know Python quite a bit. But now I became a sales manager. And you can contact me on GitHub, for example. Now my problem was a few weeks ago. I had a deadline for a sales pitch. And on Monday morning I came to my company and said I need to have a working prototype by Tuesday afternoon. And it has to look nice. So my developer team says, no, that's not possible. It will take us at least two weeks. So I go back to my office and I start to learn Django from scratch. So I go to the website. Simple is better than complex. And two, three hours I did the tutorial. And it didn't look nice the front end. So I did some research and I found Django material. So I started my project. On GitHub I added requirements.txt, two lines of code. I added a model with some fields. I added a view. And that's it. So I had a running prototype which looks like this. It's for creating user stories. I can add applications. I can add user stories, roles. I can add glossary, subjects. I can add a new subject front end, for example. And when I add a new user story I can choose this new subject again. And if I want to change the application it's very simple. I go to the code, to my model and I add a description field to my application model. I'm not so fast like the others. I do the make migration, the migrate and we run again. And I go back to my application, listing and I have the description already. And it's really fast to make this development. And I can also add a new column to this listing just by adding the description to the view set. I hope this works. So I have the description here in the view and it's really very easy to develop and it's also nice looking. So the whole thing is on GitHub and it's less than 500 lines of code, which is fantastic. And the developers they ask me where are the tests and they said well it's not so many lines of code so we don't need tests. So my goal is to reduce it even more under 400 lines of code. And you can try it yourself. We have one minute left so if you're very fast you can have it running on our repository for teamwork, user stories material. In the read me it's a description and you should have it running in a few seconds or minutes and if you have problems you can come and ask me and I hope that it will help you to get success, to be successful in acquiring new projects by creating prototypes really fast. Thank you very much. Thank you Bernard and while our next speaker gets set up, so they convene the next day, the world expert in WASPs walking along with this guy who originally found the record store and they walk in the guy behind the camera and say oh, yep, no, I remember you. So they get the record set up again, they get the expert into the booth and they connect up the record and the good pair of headphones, the really good pair of headphones and starts the record playing and the expert says is there any listens, really concentrating, you can tell he's concentrating and he's listening really, really hard and he steps out of the booth and says no, no, sorry, I can tell you, it's absolutely not WASPs. There's no chance whatsoever that's a WASP. So Warner goes back, looks at the record, says look, it says here, here's the species, it definitely says it's this species. He says, okay, I'll go back and have another listen and he goes back in and he listens again. He listens, he's thinking about it, he steps out of the booth again, he says look, I can tell you, there's absolutely no chance that's a WASP. There's no WASPs on that recording at all that you're playing to me. He says, well maybe we should phone the publisher, we phone the publisher and they talk to the publisher and he says no, no, absolutely guaranteed that record, it's playing, it's got WASPs on it and the record store owner says oh no, I've just worked out what's happening. We'll have to wait until after Curtis. Curtis, I'll talk to you about understanding Django static files. Hi, I'm Curtis Maloney, also known as Funky Bob online. I've been working with Django for 12, 13 years now. And one of the biggest problems we have to help people online is dealing with static files for the first time, hands up, anyone who got static files to work the first time they used it, liars. Because nobody gets it the first time. And part of the problem is the documentation must not be good enough, I don't know why, I'd have to read it again and again and again to see why, but I keep asking the new people, why didn't you understand it and they say, I don't know. So maybe we should scrap it and write again. Someone has got something on the sprints they want to do, maybe. So what happens is with static files, all of your apps can provide their own static files, this is a source of static files for your project. You can also give a list of static files directories for where to find static files to collect. And then eventually you'll run the managepy collect static command, which takes all of these files and copies them into the static route. Here's problem number one that people run into is they think static route is where they put their static files whilst they're developing. No, that's where they get copied into. Then you configure your web server so that when somebody asks for something under the static URL, it goes and looks inside the static route. Now it's only taken me a minute to explain this and it's about as long as it takes online to explain this. But it was necessary to save us all this times 500 to get this video so that we can actually tell people go and watch this and hopefully you'll understand static files after this is done. Thank you very much. There we go. Curtis providing evidence in addition to myself that if you want something done quickly, give it to an Australian. So that concludes our lightning talks for today. There's nothing else to go on, nothing else for me to say, but of course you all want to find out what happened to the Wasps, don't you? So yeah, okay. So we're back in the scene. We're in the record store. We've got my friend, the Wasp expert, his friend, the world renowned Wasp expert and the store owner from the record store. And the store owner is his heads in hand. I'm so embarrassed. You are world experts in Wasps. I'm a world expert in vinyl and record players. And I can't believe this has happened. I'm sitting here. I've put you in the booth. I've brought two of you in. I've brought in specialist headphones for the experience. I've played your record telling you that it's Wasp sounds. I'm so embarrassed. I played you the B side. Thank you very much. Lightning talks will be back tomorrow. If you care to have a lightning talk, please sign up and put your lightning talk on the list for tomorrow. And you may have the benefit of having a shaggy dog story in between it. Now off to Marcus for closing for the day.
 We now continue on with lightning talks and I want to introduce Russell Keith McGee who  is going to run them.  We have our first speaker.  Hello everyone.  My name is Russell Keith McGee.  If you have been to DjangoCon before you've probably seen me.  If you haven't, I'm sorry.  My job here is to introduce the lightning talks.  However, it occurs to me from seeing this morning how many hands up to say this is your  first DjangoCon that you may not know what a lightning talk is.  A lightning talk is a short talk on any topic you want.  If you've never spoken at a conference before and maybe you'd like, you know, maybe dip  your toe into the water and find out whether conference speaking might be for you, a lightning  talk is a great place to start.  It can be about Django, it can be about Python, it can be about software development or it  can be about anything else that happens to tickle your fancy.  The DjangoCon stage has historically had some very entertaining talks about Zeplins,  for example.  The only thing it can't be is an advertisement or a commercial for a company or a job advertisement  or something like that.  If you want to do a commercial advertisement, may I suggest possibly next year sponsoring  this fine conference, you get your logo on stage the whole time.  As a short talk, it is five minutes and we do mean five minutes, an absolute maximum.  With one minute left on the clock, I will sort of slowly come back onto the stage.  With about ten seconds to go, our fine organizer Tobias over here will start warming up the  gong and when time runs out, there will be a gong hit to stop all gong hits, at which  point we will then find some way of dragging you off stage forcibly.  I say it's a maximum of five minutes.  It can be less than five minutes if you so choose.  There's no minimum length of time other than, you know, please don't waste our time just  setting up your laptop for saying goodbye and walking off stage again.  With that, that is a lightning talk.  This has effectively been a lightning talk about lightning talks.  And I would now like to introduce Justin Mayer, who will talk to us about how to add multi-factor  authentication to your Django project in less than five minutes.  Take it away, Justin.  Thanks very much, Russell.  My name is Justin Mayer, originally from Los Angeles, California, but just last week moved  to a mountain village in the Italian Alps in a region called Trentino.  I've used Django for a long time, most recently to create Fortressa, which allows you to create  your own private self-contained VPN server.  And today I'm excited to talk to you about multi-factor authentication.  My goal is to show you how to add multi-factor authentication to your applications in the  time that I have, which is obviously not very much.  Last summer I gave a full-length talk on this topic at EuroPython.  You can find a link to the video on JustinMayer.com.  Here's a very fast lightning summary.  Passwords are ubiquitous.  They are terrible.  Most time people get around them by using SMS to send you a code.  You've probably seen this.  It's very common.  Unfortunately, it's not very secure.  A better method is TOTP, or time-based one-time passwords.  You may have seen it.  You get a six-digit number generated usually on an app on your phone.  Another method that I really like is called universal second factor.  It's a small USB key.  I have a tiny one in my machine right now.  It's a hardware key, the next generation of which is a web standard called web authentication.  There's a project called Django U2F that you can use to add this.  It does both TOTP and U2F.  I want to show you how easy it is to implement it and add multi-factor authentication to  your applications.  So let's do it live and what could possibly go wrong.  So over here, what do you know?  It's actually there.  That's good.  First thing we're going to do is we are going to activate a virtual environment and we're  going to pip install Django and the Django U2F package.  Luckily, I've cached all these wheels so I don't have to deal with Wi-Fi.  There we go.  So then we're going to clone the project and the reason we're doing that is that we're  going to use a sample project that's inside it.  Switch to that directory.  We're going to install the requirements.  Also from cached wheels, thankfully.  We're going to run migrations.  I know this is fast, everyone, but just try your best to keep up.  We're now generating a TLS key for the local host domain so U2F requires TLS.  Then we are going to now run our server and switch over to a browser.  And we're going to go ahead and load.  Once we bypass the yes, we know it's not a signed certificate.  I'm going to log in and I probably forgot to create a super user.  This is what happens when you're doing it live.  Okay, do that really quickly.  Hi, at food.com.  Okay, go back to the browser, hopefully.  And now we can try this again.  And now we have a screen where we can manage all our multi-factor authentication.  First thing I'm going to do is add a U2F key, which I just did by putting my finger on  it.  It's now been added.  I'm going to go back to the settings and add a TOTP device.  And I'm going to do that using an app on my phone.  There's a variety of different ones.  I use one password because I already used that to manage my other passwords.  I tap it to add a new password.  I'm going to scan the QR code.  It's been added.  I'm then given a number to enter into this token field.  Once I do that, it then registers the token and says device added.  And then last, we're going to create some emergency backup codes.  I may not have my device.  I may not have my phone.  This allows me to get in even in those cases.  So we've proven that we can add those things.  Now what happens when we log back in?  So we log in as usual when I don't fork the password.  And we can go ahead and log in via either of the three methods that I just added.  I'm going to just put my finger on the security key and I'm in.  It is really that easy to do.  And now I'm going to quickly just show you what the only difference between a standard  Django start project command and the test project that I just added is what you see  here.  A couple of lines added to installed apps to add some needed packages there.  A couple of lines added at the end of your settings file to do login URL and redirection.  This is URL start pie.  Thank you very much, Justin.  Next up on stage we have Johannes Hopper while he's getting set up with the microphone and  the laptop.  I've just returned from PyCon US.  When I was at PyCon US, I bumped into an interesting person sort of wandering around.  It was actually a different conference all about wasps.  At that conference they were talking about what not and about wasps as you do.  They just decided to go for a walk around the town.  And came across a vinyl shop.  It's having old LP records.  In the store front they had an advertisement up that said that they had just released wasp  noises as an album that had just been made available.  So an expert in wasps sees an album for wasp noises and thinks I've got to find out about  this.  Decides he's going to go into the store.  More details later.  Our next speaker is Johannes Hopper talking about instant feedback, making reviews great  again on the new GitHub checks.  Everyone make him walk him.  Thanks, I'm not going to share any slides today because I didn't have much time to prepare.  I try to keep this very short, probably shorter than five minutes.  Maintaining open source projects is really hard.  I think a lot of people here can empathize with that because they are maintainers.  And other people can probably empathize because they have a pull request hanging somewhere  and with no response.  And we were discussing the evening already on what kind of things are hard.  Something that's very tedious as a maintainer is that comment like, hey, can you please  remove a white space or can you also wrap the doc strings at 80 characters.  Stuff like that just comes repeatedly up and it's tedious for a maintainer.  It's also bad to hear for a first time contributor.  It's just negative feedback that you don't want to give to someone that otherwise did  a really good job.  Luckily, something we heard earlier this morning as a first talk, the machines are taking over  and over time we built a lot of great lintists that help us do that job.  But they're still, even though those do a really good job of giving you machine feedback  which is a bit softer to the users, to the first time contributors or frequent contributors  to tell them, hey, there's maybe a trading white space that you want to get rid of or  please add a new line to the end of the file.  And this is all great but they're still kind of hidden usually within our continuous integration  suites.  There's this one link to the Travis suite or use maybe CircleCI and there are a bunch  of different services out there and not everyone is familiar with all of those.  And then you have to find the section that actually failed and you have to figure out  what that means.  Maybe you're not particularly familiar with that lintta.  Could be something like Pylon and there are a bunch of checks.  You maybe don't know them all.  Luckily, there has been a recent change on how GitHub works.  There has been a new feature called checks.  It's currently still in beta and the API is now also available in beta which allows you  to kind of take all that onto a single platform.  It allows machines to also add review comments and it introduces the new concept of a check  which is really, really made for machine feedback for what we know is lintta currently.  So since that was released, a colleague of mine and me, we sat back and thought, hey,  that's a cool thing.  Let's try to bring those two together because they're made for each other.  So we put a lot of lintta on AWS services, build a small service around it and combined  all that in order to run checks automatically without any tedious setup on repositories and  give the feedback directly back onto GitHub without storing any data in between.  It's just we process the data from the commit and we push our linting results back and the  user can see them right where they push their code.  If you're interested in using that or in contributing to making that better because obviously it's  just started, approach me.  I'm Johannes Hopper, coding Joe on GitHub.  I don't know my Twitter handle really.  And talk to me about it.  I'm excited to share.  It's all open source obviously.  Yeah.  So just find me later if you're interested in those sort of things and I hope that we  can make contributing and maintaining a bit easier.  Thanks.  Thank you, Johannes, for pointing out that it can be less than five minutes.  While I expect it to get set up, our friend here has gone into the store of the LP store  and he says, can I listen to this record?  If you've got an example I can listen to and the person behind the counter says, yeah,  no, no problem.  Reaches down, gets up, a copy of the record.  Just go over the listening booth there and get set up there.  And once you're in the listening booth, I'll start the record and you can listen to it  and see what you think.  And so he goes into the listening booth and the storekeeper goes behind the record player  and puts it on and starts playing and a little bit more detail about what he hears in a moment.  Next up we have Katie McLaughlin.  Serialization formats are not toys.  Hi.  By the way, you don't actually have to give your own lightning talk.  You can give somebody else a lightning talk.  This lightning talk was given as a full 30 minute talk by a guy called Tommy Spinn.  I'm going to give it in four minutes 45 seconds.  Loading data into your application is the most boring part of your day.  You want to get your data migrated into your app and then you want to keep on coding.  The thing is 90% of magic merely exists on knowing one extra fact.  If I know one thing that your app doesn't prevent security-wise, I can take all your  data for myself.  Everything I'm going to be talking about today is not a bug, it is a feature.  So this is my example application, it's just a simple bottle app.  All I'm going to be doing today is posting data to various endpoints and then returning  back the content.  So let's talk about YAML.  In YAML, if I was to post my first name is Tom, my last name is Eastman, and I have  an email address I get back a JSON result with my email address, first name and last  name.  What I can also do in YAML is I can post Python objects.  So what I can do here is I can post back a Python object at date time dot date with my  birthday and I get back a Python daytime object.  Who can see where this is going?  What I can also do is I could tell it to a call sub process and tell me the entire contents  of my directory that I'm in.  So I wonder if I can actually get my speaker notes to work.  That would be useful.  There we go.  So hey, I wonder if I can also get my slides to be good.  Yay!  Okay.  So what I could also do instead of running LS, what I could also do is not have my speakers  slides work at all.  Come on.  There we go.  All right.  What I could also do is I could run RM star and then run an LS and I could delete my entire  presentation while I was working on it, which is allegedly what happened to this speaker.  So surely this doesn't happen in real life, right?  It happens all the time.  It happened with Piston and Tasty Pie back in 2011.  It happened with Rails twice.  It happened in Puppet and everyone was really upset and then it happened for no to no one  cared.  So how do you protect yourself?  You make the parser stupider.  What you should be doing instead of using YAML.load is using YAML.safeload, which is  really easy to find when all you're doing in your tele-sense thing is going YAML.RK,  load, okay, I want the first one.  What you need to be using is safe load.  So let's talk about XML, a slide that's scary enough just in itself.  In XML we have entities.  In an entity I can define an entity as a ampersand hash and then a number and then I get back  a smiley face.  What I can also do is I can put an alias to that entity.  So instead of using the percentage number, I can have a smiley.  So then I can have, yay, smiley, smiley.  It's like emoji except not.  So what I could also do is I could define an entity that's a bunch of other entities  and another entity that's a bunch of those entities and I can have smiles going all the  way down my page.  This is also known as the billion laughs attack and you can turn your laptop into a smoking  ruin.  Including if you try to load your presentation slides in Emacs and it tries to render your  XML for you.  So what else can we do?  What we can also do is we could ask it to return back the contents of our ETC release  information or our password files or anything else because if you're running XML you're  probably running in an enterprise environment and if you're running in an enterprise environment  you're probably running as root.  Which means you can do everything.  Surely this doesn't happen in real life, right?  It happens all the time.  You don't even want to know.  So how do you protect yourself just a simple list of things that you can do for your XML  to make sure that it's not going to do anything?  What you need to do is you need to make the parser stupider.  What you can do is you can use diffuse XML on a few other things.  I have one minute left.  Let's keep going.  Jason, finally a stupid enough parser.  Only if you use it in a stupid way.  Eval is not a stupid enough parser.  Do not ever use eval to try to render Jason because on the documentation page what it  says is it says up there here.  You should use eval and write down the bottom like somewhere where the orchestra pit would  be.  It says do not actually use this.  It also says it right there.  It says hey, you can use eval but don't.  No one is going to keep on reading the documentation after they get their answer, right?  So the lesson.  Beware of flexibility in your applications and in your serialization tokenizers because  it will try to be smart and sometimes you don't want it to be smart.  You want it to be dumb and you want it to play nice and you want to have your application  still work at the end of the day.  All everything you don't need and keep it simple.  Thank you so much for your time.  Thank you very much, Katie or Tom or Katie.  Not sure.  Okay, so our friend is in the listening booth now and he's put the headphones on.  And he's sitting there.  He listens to the record, starts playing.  He starts listening and he's like, something's not right here.  I mean, it's an insect.  You can tell it's definitely an insect.  And yeah, something's just not right here.  So he comes out of the listening booth and he goes to speak to the store guy, the store  manager and says, look, are you sure you're playing the right record there?  Because I'm like a wasp expert.  I'm pretty sure they're not wasp noises.  And so the manager says, hang on, I'll get a different pair of headphones for you.  We'll get you some good headphones.  We'll try it again.  So he goes and gets the good headphones, gets him set up with the good headphones.  And steps back over, moves back into the booth, starts the record playing again.  And he sits there and he listens a little bit to the sounds again coming through.  And no, he's still going.  All right.  So he listens and listens again.  And no, there's something that's definitely not right here.  There's something that's just not quite right in the sound that I'm hearing.  And I'm a wasp expert.  I know my wasps.  That is definitely not a wasp.  This album says it's wasp noises.  It's wrong.  It's not wasp noises.  So he sits back out of the booth, goes back over to the store manager and says, look,  I don't know what to say here.  It's definitely not wasp noises.  There's something wrong with your record here.  The manager says, I don't know.  It says here on the tin.  I can only gub at what it says here on the record.  The guy says, hang on, I'll tell you what he says right after this break when Johannes  will tell us why he hates CSV, everyone.  All right.  I don't seem to be the only one in the room.  But I need to know precisely.  So hands up if you have ever used CSV in a project.  Hands up and keep your hands up.  Everyone, excellent.  So for those with the hands up who liked the experience, all right.  Who had it work on the first try?  Okay.  For those of you with the hands up, this talk is not for you.  All right.  So what do you do as a developer when you have to work with CSV?  I mean, you have tabular data, so you think, okay, everyone uses CSV.  So I'm going to use CSV.  So what do we do at first?  We go to Stack Overflow.  And of course, you read through this thing, and it's really simple.  And all you have to do is, like, what?  And then you look at the documentation, and it says things like, okay, I have a reader,  and it's really simple.  And yeah, I can register a what?  I can what?  Why?  And the problem is, in CSV files, we use commas to separate records, and we use new lines  to separate lines, right?  But sometimes we want to use commas inside of the strings that we want to serialize,  and sometimes we want to use new lines.  And then we have to find some kind of, like, escaping, and we have to do magic to make it  work.  And that means we have to mess around, and we have several choices.  We could use semicolons.  Excel uses semicolons.  So all of this comes from the fact that we don't have dedicated symbols for separating  records and separating lines.  Now, let's go back in time to the 1960s, and let's have a look at ASCII.  I mean, imagine being the person having this problem for the first time, and looking through  their ASCII code and seeing, oh, comma, I could use a comma.  And what if we had dedicated characters for separating units and records, and possibly  even groups or files, so we could have more than one table in a file?  And these have been in the standard since before many of us have been born, right?  But nobody knows them.  Nobody uses these.  So we have CSV, and we have this mess.  I'm going to show you the code that we would need to use, to use these ASCII separation  things.  And this is going to work every time.  And as you can see, it's almost as complicated as the one that we had for the CSVs.  So what to do?  Use ASCII separators if possible.  And that's never possible.  So the same thing to do is actually use Escalite.  If you have tabular data, use Escalite.  But there's a more important lesson.  And the important lesson is this hack that somebody put in 20, 30, 40 years ago is still  with us and is still plaguing us.  So don't put hacks into production.  And even more so, if you put a hack into production, please think before you copy someone else's  hack, and this is my message to you.  Thank you very much, Johannes.  And again, another Johannes under time.  You do not need to be five minutes.  I can stay here and just...  No, we've applauded now.  That's the end.  You're done.  You're done.  We need to get back to the wasps.  Hang on.  Hello.  Wasp.  More people coming.  Yes.  There we go.  All right.  Hang on.  I thought you said you finished.  Okay.  There we go.  Okay.  Right.  So anyway, our wasp expert in the booth, he's had his second listen.  He says, I know what I can do.  I've just come back from WaspCon.  I can go and find the world expert on wasps.  He's a convener of this conference.  I can bring him into the store.  We can get him to listen to the album.  And we can get definitive.  We can get clarification about whether this is a wasp or not.  The store owner says, yeah, absolutely great.  We'll do that.  They come back the next day.  Our next speaker is Bernard Buhlman, talking about Django for managers.  Thank you very much.  So actually I'm a manager, but this is not a commercial talk.  So I hope you will use it for the commercially successful.  So my name is Bernard Buhlman.  I'm co-founder and long-term CEO of 14 work in Burn Switzerland.  And I have a background of 15 years of plowing.  So I know Python quite a bit.  But now I became a sales manager.  And you can contact me on GitHub, for example.  Now my problem was a few weeks ago.  I had a deadline for a sales pitch.  And on Monday morning I came to my company and said I need to have a working prototype  by Tuesday afternoon.  And it has to look nice.  So my developer team says, no, that's not possible.  It will take us at least two weeks.  So I go back to my office and I start to learn Django from scratch.  So I go to the website.  Simple is better than complex.  And two, three hours I did the tutorial.  And it didn't look nice the front end.  So I did some research and I found Django material.  So I started my project.  On GitHub I added requirements.txt, two lines of code.  I added a model with some fields.  I added a view.  And that's it.  So I had a running prototype which looks like this.  It's for creating user stories.  I can add applications.  I can add user stories, roles.  I can add glossary, subjects.  I can add a new subject front end, for example.  And when I add a new user story I can choose this new subject again.  And if I want to change the application it's very simple.  I go to the code, to my model and I add a description field to my application model.  I'm not so fast like the others.  I do the make migration, the migrate and we run again.  And I go back to my application, listing and I have the description already.  And it's really fast to make this development.  And I can also add a new column to this listing just by adding the description to the view  set.  I hope this works.  So I have the description here in the view and it's really very easy to develop and it's  also nice looking.  So the whole thing is on GitHub and it's less than 500 lines of code, which is fantastic.  And the developers they ask me where are the tests and they said well it's not so many  lines of code so we don't need tests.  So my goal is to reduce it even more under 400 lines of code.  And you can try it yourself.  We have one minute left so if you're very fast you can have it running on our repository  for teamwork, user stories material.  In the read me it's a description and you should have it running in a few seconds or  minutes and if you have problems you can come and ask me and I hope that it will help you  to get success, to be successful in acquiring new projects by creating prototypes really  fast.  Thank you very much.  Thank you Bernard and while our next speaker gets set up, so they convene the next day,  the world expert in WASPs walking along with this guy who originally found the record store  and they walk in the guy behind the camera and say oh, yep, no, I remember you.  So they get the record set up again, they get the expert into the booth and they connect  up the record and the good pair of headphones, the really good pair of headphones and starts  the record playing and the expert says is there any listens, really concentrating, you  can tell he's concentrating and he's listening really, really hard and he steps out of the  booth and says no, no, sorry, I can tell you, it's absolutely not WASPs.  There's no chance whatsoever that's a WASP.  So Warner goes back, looks at the record, says look, it says here, here's the species,  it definitely says it's this species.  He says, okay, I'll go back and have another listen and he goes back in and he listens  again.  He listens, he's thinking about it, he steps out of the booth again, he says look, I can  tell you, there's absolutely no chance that's a WASP.  There's no WASPs on that recording at all that you're playing to me.  He says, well maybe we should phone the publisher, we phone the publisher and they talk to the  publisher and he says no, no, absolutely guaranteed that record, it's playing, it's got WASPs  on it and the record store owner says oh no, I've just worked out what's happening.  We'll have to wait until after Curtis.  Curtis, I'll talk to you about understanding Django static files.  Hi, I'm Curtis Maloney, also known as Funky Bob online.  I've been working with Django for 12, 13 years now.  And one of the biggest problems we have to help people online is dealing with static  files for the first time, hands up, anyone who got static files to work the first time  they used it, liars.  Because nobody gets it the first time.  And part of the problem is the documentation must not be good enough, I don't know why,  I'd have to read it again and again and again to see why, but I keep asking the new people,  why didn't you understand it and they say, I don't know.  So maybe we should scrap it and write again.  Someone has got something on the sprints they want to do, maybe.  So what happens is with static files, all of your apps can provide their own static  files, this is a source of static files for your project.  You can also give a list of static files directories for where to find static files to collect.  And then eventually you'll run the managepy collect static command, which takes all of  these files and copies them into the static route.  Here's problem number one that people run into is they think static route is where they  put their static files whilst they're developing.  No, that's where they get copied into.  Then you configure your web server so that when somebody asks for something under the  static URL, it goes and looks inside the static route.  Now it's only taken me a minute to explain this and it's about as long as it takes online  to explain this.  But it was necessary to save us all this times 500 to get this video so that we can actually  tell people go and watch this and hopefully you'll understand static files after this is  done.  Thank you very much.  There we go.  Curtis providing evidence in addition to myself that if you want something done quickly, give  it to an Australian.  So that concludes our lightning talks for today.  There's nothing else to go on, nothing else for me to say, but of course you all want  to find out what happened to the Wasps, don't you?  So yeah, okay.  So we're back in the scene.  We're in the record store.  We've got my friend, the Wasp expert, his friend, the world renowned Wasp expert and  the store owner from the record store.  And the store owner is his heads in hand.  I'm so embarrassed.  You are world experts in Wasps.  I'm a world expert in vinyl and record players.  And I can't believe this has happened.  I'm sitting here.  I've put you in the booth.  I've brought two of you in.  I've brought in specialist headphones for the experience.  I've played your record telling you that it's Wasp sounds.  I'm so embarrassed.  I played you the B side.  Thank you very much.  Lightning talks will be back tomorrow.  If you care to have a lightning talk, please sign up and put your lightning talk on the  list for tomorrow.  And you may have the benefit of having a shaggy dog story in between it.  Now off to Marcus for closing for the day.
DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__0_47.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__48_4991.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__4992_7571.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__7572_8831.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__8832_9011.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__9012_13583.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__13584_14399.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__14400_16367.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__16368_16751.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__16752_19199.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__19200_22655.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__22656_22727.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__22728_23819.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__23820_25631.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__25632_25955.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__25956_27299.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__27300_28019.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__28020_29135.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__29136_29207.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__29208_29435.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__29436_30095.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__30096_30491.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__30492_31187.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__31188_31283.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__31284_33215.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__33216_35603.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__35604_35915.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__35916_36755.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__36756_37847.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__37848_38387.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__38388_38783.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__38784_41555.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__41556_42515.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__42516_43667.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__43668_44363.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__44364_44723.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__44724_46967.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__46968_47075.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__47076_49835.png DjangoCon_2018_-_Lightning_Talks_I__1080p_25fps_H264-128kbit_AAC__49836_49902.png