A sun-soaked celebration of tech, talent, and taste in Sophia Antipolis

Set against the sun-drenched backdrop of Sophia Antipolis, RivieraDev 2025 once again proved why it’s one of the most beloved developer conferences in the region. Held in July at the SKEMA Business School, the event brought together around 700 attendees for three days of learning, sharing, and connecting — with a distinctly local flavor.

For some, it was a return to familiar grounds; for others, a first-time experience that exceeded expectations. Whether reconnecting with former colleagues, meeting new faces, or finally putting a face to a name, RivieraDev offered a warm, welcoming atmosphere that felt more like a community gathering than a formal tech event.

The conference agenda offered a variety of talks, from quick “snorkeling” talks on emerging tools to immersive three-hour deep dives, and even sessions that reminded us we’re “not only developers”. The opening keynote cleverly gave each speaker a moment to pitch their talk, helping attendees curate their own journey through the event.

And of course, it wouldn’t be RivieraDev without the food. From local specialties like socca and meat-filled ravioli to craft beer from Antibes and expertly brewed flat whites, the culinary experience was as thoughtfully curated as the talks. The organizers even hosted sessions with a BBQ master and a coffee expert — because why not learn while you eat?

The Speaker Experience (by Kini)

In Kini’s words: “Participating in RivierDev marked a significant milestone for me. It was my first experience as a speaker at a conference outside of Spain, something that had been on my To-Do list for ages! 😄 I finally made it happen! The organization made me feel incredibly welcome, and I enjoyed connecting with fellow speakers like Camille and Roberto. I don’t mean to make anyone jealous, but the speakers’ dinner was absolutely fantastic! ❤️

It was also challenging because of the topic. I had never given this talk before, but it was a very familiar subject to me. The concept of continuous learning, often highlighted in books about agile, extreme programming, and crafters movements, is and has always been a cornerstone in my daily routine. Since I was working at a previous company in my local region in Spain — around 16 years ago (really? OMG!) — I’ve been trying to expand my own culture of learning to my team and even the entire company.

Over the years, I’ve tried different activities, faced many challenges and excuses, and collected priceless feedback from everyone who participated. This talk aimed to explain why you should care about learning and fostering the right culture for yourself and your team. It’s not just a personal benefit but something that needs to be embedded into the company culture. At Criteo, I’m happy to say that many of those activities are happening, and people are very motivated and engaged.

Since this is a very broad topic, I won’t go into too much detail in this recap. Maybe I should write another article about it? Let’s see. For now, I’ll share one of the slides, where you can see most of what I discussed during my talk.”

There is no recording but you can check the slides here.

Our Main Takeaways

Do LLMs dream of electrical horse riders? by Thibaut Giraud

Thibaut Giraud (aka Mister Phi on YouTube) delivered a great opening keynote on whether LLMs can truly “understand” and build their own model of the world as opposed to being “stochastic parrots” that only predict word sequences based on probabilistic methodology and repeating only what they learnt (like parrots). He used the context of chess play: Can a LLM play a full chess game without an illegal move? Can an LLM reach a good ELO level?

The presentation was very interactive. For instance, in the image above, he asked the audience to guess the next text sequence using logic and observing the different patterns, in order to show what a probabilistic guess would predict as the next sequence, but that it won’t be accurate if you don’t understand the full context.

Then Thibaut revealed the sequence of patterns was a transcription of a chess game and that many people claimed LLMs were not able to play chess and published articles on that.

Then he showed that since 2023, GPT (GPT 3.5) plays chess at 1800 ELO (a very good level for a chess player). It was demonstrated that the LLM built an internal representation of the chessboard with a strategic dimension, unlike stochastic parrots.

Main takeaways:

• When doing an experience, a negative result does not necessarily indicate a lack of capacity. Only a positive result informs about a current or future capacity. Thibaut said it’s like asking people in the street randomly if they can do something, and concluding no human is able to do it if you can’t find anyone. This applies to LLM: the secret sauce is using the correct prompt, and the number of possible prompts is huge!
• The quality of training of an LLM is key.

Developers & Designers: What if we really spoke the same language? by Camille Le Roux

In her interactive one-hour session, Camille explored how to foster effective collaboration between developers and designers to build better software products. Drawing from her experience in multidisciplinary teams across companies like Amadeus and Datadog, she emphasized the importance of early and continuous collaboration throughout the product development lifecycle.

Camille introduced the concept of user experience using a visual iceberg metaphor and outlined the fundamentals of design thinking. She detailed how UX can be measured through self-reported, behavioral, and performance metrics, as well as analytics and A/B testing.

The talk highlighted several best practices implemented at Datadog to bridge the gap between design and development, including:

• Involving developers early in UX and design discussions to avoid misalignment and inefficiencies.
• Using shared tools and language, such as Figma in developer mode with real business data.
• Treating handoff as a continuous process rather than a one-time event.
• Building a culture of continuous feedback and collaborative testing.

Through practical examples, Camille demonstrated how these practices lead to more efficient workflows and better product outcomes.

How difficult can it be to write efficient code? by Roberto Cortez

In this insightful session, Roberto Cortez tackled the complexities of writing efficient code, particularly from the perspective of backend development within the JVM ecosystem. He began by revisiting the well-known quote, “Premature optimization is the root of all evil,” and provided its full context to emphasize the importance of focusing on meaningful performance improvements rather than minor efficiencies.

Roberto presented a series of coding challenges to illustrate how different approaches can impact software performance. Using tools like the Async Profiler, he demonstrated how developers’ decisions directly affect the behavior and efficiency of their applications. His talk emphasized the importance of monitoring, observation, and measurement in guiding performance-aware development.

Through a critical and analytical lens, Roberto highlighted how everyday coding choices — often overlooked — can have significant implications when software is deployed and scaled. The session served as a practical reminder of the value of profiling and performance testing in writing robust, efficient code.

Crafting Intelligent Applications with Quarkus/LangChain4j by Dimitris Andreadis

In this forward-looking session, Dimitris Andreadis explored the integration of artificial intelligence into Java applications using Quarkus and LangChain4j. With the growing accessibility of generative AI tools like ChatGPT, Dimitris demonstrated how developers can now treat AI services as standard APIs, significantly lowering the barrier to entry for building intelligent applications.

The talk began with a brief introduction to large language models (LLMs) and their role in modern software development. Dimitris then showcased a practical example of building an AI-powered application using Quarkus and LangChain4j, leveraging the OpenAI model. He emphasized the simplicity and flexibility of the integration, whether using pre-configured services or custom setups.

By combining the lightweight nature of Quarkus with the conversational capabilities of LangChain4j, developers can now create applications that interact seamlessly with AI models — opening up new possibilities for innovation across domains.

How would you rate yourself on CSS? by Théo Gianella and Julien Sulpis

One of the standout sessions at RivieraDev 2025 came from Théo and Julien, who delivered an engaging and insightful live coding talk titled “How Would You Rate Yourself on CSS?”. With a mix of humor, clarity, and technical depth, they walked the audience through the evolving challenges of responsive design in a world where digital content is no longer confined to desktops and phones.

From foundational techniques to advanced layout strategies, the duo demonstrated how to architect CSS that adapts gracefully across a growing spectrum of devices — including wearables like smartwatches and AR glasses. Their approach emphasized not just technical correctness, but also design empathy: building interfaces that respond to context and usage.

The session was a reminder that CSS is far from a solved problem — it’s a living, breathing part of the web that demands continuous learning. For those eager to dive deeper, Théo and Julien have shared additional resources and examples here: Tu te mets combien en responsive CSS ?

Anatomy of a failure attack by Olivier Poncet

Among the sessions at RivieraDev 2025 was a retrospective on the xz-utils backdoor incident, a chilling reminder of how fragile the software supply chain can be — even in the open-source world. Classified as a critical vulnerability with a CVSS score of 10 by Red Hat, the attack was one of the most sophisticated and alarming in recent memory.

Xz-utils, a widely used compression tool in Linux and Unix-like systems, became the target of a long-term infiltration. The attacker, operating under the alias Jia Tan, spent over two years contributing legitimate code and building trust within the project. Eventually, they gained co-maintainer status and introduced a backdoor that enabled remote code execution via OpenSSH — a core component of secure server communication.

The attack was only discovered by chance, thanks to Andres Freund, who noticed unusual CPU usage and memory behavior during SSH logins. His meticulous investigation led to the uncovering of the malicious code, which had been deeply embedded and obfuscated within the library.

The speaker at RivieraDev walked attendees through the timeline, attack techniques, and lessons learned, emphasizing the need for vigilance in open-source governance. Key takeaways included:

• Sophisticated attackers are patient and capable of long-term social engineering.
• Critical infrastructure often relies on open-source projects with limited oversight.
• Maintainer trust models need reform — some projects now require in-person verification and ID sharing.
• Supply chain security is paramount: companies should consider maintaining their own dependency repositories, despite the cost, to ensure greater control.

This session served as a stark reminder that while open-source software powers much of the digital world, its security depends on the integrity of its maintainers and the vigilance of its users.

Retrieval Augmented Generation (RAG): Get High-Quality Answers with Advanced Techniques by Guillaume Laforge

In this technically rich session, Guillaume explored advanced strategies for implementing Retrieval Augmented Generation (RAG), a method that enhances large language model (LLM) outputs by grounding them in external data sources. RAG enables developers to query their own datasets by retrieving relevant document excerpts from a vector database and injecting them into the model’s context.

Guillaume outlined several state-of-the-art techniques to improve the accuracy and relevance of RAG-based systems:

• Chunking strategies for document ingestion, including sliding windows, hypothetical questions, and semantic segmentation.
• Query compression and decompression to refine search precision.
• Metadata utilization to better identify relevant documents.
• Reranking mechanisms to optimize the quality of retrieved content.
• Evaluation methods to assess the effectiveness of the RAG pipeline.

The session included a live coding demonstration using Java and LangChain4j, showcasing how these techniques can be applied in practice. A key takeaway was the importance of tailoring the RAG pipeline to specific use cases — there is no universal solution. Guillaume also emphasized the growing capabilities of LLMs with large context windows and their potential to assist in tasks like document chunking.

Web Bots: A Developer’s Best Friend or Worst Nightmare? by Elisa Chiapponi and Martynas Buožis

In one of the most eye-opening sessions of RivieraDev 2025, Elisa and Martynas took the audience on a deep dive into the world of web bots — both the helpful and the harmful. Their talk, titled “Web Bots: A Developer’s Best Friend or Worst Nightmare?”, explored the evolving landscape of automated web traffic and the sophisticated tactics used by malicious actors today.

The numbers alone were staggering: bots now account for over 50% of global internet traffic. While some bots serve legitimate purposes — like indexing content or automating routine tasks — even these can unintentionally cause harm, such as triggering DDoS-like effects. The real threat, however, comes from bad bots: those designed to scrape data, overload servers, commit fraud, or manipulate online services.

With the rise of generative AI, creating bot scripts has become faster and more accessible than ever. Traditional detection methods like browser fingerprinting, cookies, and CAPTCHAs are increasingly ineffective. Sophisticated bot networks now rely on residential proxies (RESIP) — legitimate devices like phones and tablets — to mask their activity and evade detection.

To combat this, the team at Amadeus has developed an innovative detection method based on network behavior analysis. By comparing the Round Trip Time (RTT) of TCP and TLS layers, they can distinguish between real users and bots: human traffic tends to show consistent RTTs, while RESIP-based bots do not. This technique, combined with IP clustering and risk scoring, allows them to proactively block malicious traffic while minimizing false positives through curated whitelists.

This session was a powerful reminder that bot detection is no longer a solved problem — it’s an arms race. And as bots become more human-like, defenders must become more creative and precise.

---

RivieraDev 2025 wasn’t just another stop on the tech conference circuit — whether it was your first time attending or a return visit, the experience left a lasting impression. From the thoughtful organization and diverse session formats to the unforgettable food and warm Mediterranean hospitality, RivieraDev delivered on every front.

You can check the official photos here and the videos on their YouTube channel 😃