CommitConf 2024 took place one more time this year in Madrid, from April 19 to April 20, drawing over 1000 participants and hosting more than 80 speakers. The event provided an excellent platform for delving into topics such as software architecture, Machine Learning, Developer Experience, and real-world experiences.

This two-day conference is one of the most important for software industry professionals in Spain. It has consistently served as a meeting point for tech communities within Spain, facilitating the exchange of experiences across a wide array of subjects — ranging from harnessing the latest JS frameworks to implementing best practices in testing and software architectures, not forgetting discussions on Machine Learning and Generative AI.

The agenda for the 2024 edition featured seven tracks dedicated to hosting 45-minute talks along with an open-space track. Choosing which talk to attend during each slot was no simple task. Attendees could be seen hurrying between sessions during breaks, striving to make it to their next preferred talk. Some rooms were bustling with activity, prompting attendees to either find another session or utilize the time by visiting sponsors’ booths in the hall.

This year, our R&D Ambassador Julian provided a fantastic representation by discussing Criteo’s transition from various solutions to a unified authorization system. This new system is characterized by its transparency, speed, and flexibility.

Criteo Talk by Julian Fuchs

At CommitConf, it was my first time giving a talk at a Conference. While I’ve had the chance to visit other conferences with Criteo before, it was always as a visitor. The experience of going to a conference as a speaker was very new and exciting for me. It was a great opportunity to talk about how we at Criteo are planning to make authorization transparent, fast, and flexible (the topic of my talk).

As a first-time speaker, I appreciated the New Speakers program that Commit Conf has launched, and I was especially lucky since my own mentor, Kini, happened to work for Criteo too! It was great to receive feedback and guidance during all stages of preparing the talk and in conversation with other participants of the New Speakers program, I know that they had the same experience.

Even though it was my first time talking at a Conference, I was not too nervous thanks to my previous experience giving a talk at a Tech Meetup in our Criteo Barcelona office about a month prior. Having presented before gave me confidence for this talk, and I noticed as well that my presentation skills improved from one time to the next.

Although my talk was in English at a conference where most talks were held in Spanish, it was great to get a lot of questions form the attendees, which I took as an indication that the talk was engaging and received well.

The San Pablo CEU University in Madrid was an excellent venue for the conference, and with seven tracks to choose from, it was a great way to spend a Friday and Saturday to learn and to get to know passionate individuals. I also want to highlight the Speaker’s Dinner that was held on Thursday night before the conference which provided an informal setting where speakers could mingle beforehand, it was a great opportunity for networking and getting to know oneantoher.

Takeaways by Criteos

José’s Best Moments at CommitConf

Venturing into my inaugural conference experience at Criteo brought a wave of anticipation. While I’ve immersed myself in other gatherings in the past, primarily centered around security, like the memorable RootedCON, this event promised a fresh perspective.

What struck me immediately was the distinct vibe of the CommitConf community. The organizers’ unwavering dedication to fostering a nurturing environment for passionate discourse aficionados and networking enthusiasts was palpable. Their meticulous attention to detail ensured that the two-day affair exuded an aura of vibrancy and inclusivity. I’m compelled to extend my heartfelt gratitude to them for orchestrating such an enriching experience.

Welcoming and New Speakers program introduction

As the conference commenced, we were greeted with genuine warmth, accompanied by invaluable insights on optimizing our conference experience and an introduction to the New Speakers program.

My team, Security Yellow, holds a deep-seated enthusiasm for conference participation and is eager to impart our knowledge to the community and absorb new perspectives to enhance our solutions. Thus, the announcement of the New Speakers program sparked huge excitement within me. I firmly believe that my team, along with myself, stands to gain immensely from this initiative, enabling us to maximize our impact at the conferences we are fortunate to be a part of.

I had the privilege of attending numerous captivating talks during the conference, including the one that our great speaker kindly imparted to us. Yet there are a few that truly stood out to me 👇

Prepare your applications to build images in ARM and x86 containers securely

Christian Menendez from AWS provided a compelling reminder of the advantages inherent in the ARM architecture, showcasing its undeniable superiority over x86 in terms of both performance and energy efficiency. Particularly for resource-intensive workloads, ARM64 has emerged as a game-changer, unlocking unprecedented capacity.

While this is a well-known fact within Criteo, with ongoing efforts to integrate ARM servers into our Datacenters, it’s crucial to approach this migration with caution. As emphasized by the speaker, a hasty transition could potentially undermine the performance of our applications. Therefore, it’s imperative to meticulously consider various factors to ensure optimal utilization of this architecture.

While many of Christian’s insights are tailored to the AWS ecosystem, the principles he highlighted are equally applicable to our on-premises environment at Criteo.

My key takeaways from this enlightening discussion, which I believe should serve as guiding principles as we embark on our ARM journey, are as follows:

1. Avoid container emulation: While ARM can indeed execute x86 containers through emulation, it’s imperative to steer clear of this approach as it significantly impacts performance.
2. Utilize ARM64 images whenever possible: When operating within an ARM environment, prioritize the use of ARM64 images to optimize performance and compatibility.
3. Upgrade dependency versions: An intriguing observation stems from my experience with the MacBook Air featuring the M1 chip, which operates on the ARM architecture. Notably, I’ve observed reduced heat generation and prolonged battery life. However, when running Criteo images designed for x86 architecture, I’ve encountered sporadic dependency issues, often traced back to low-level dependencies like librdkafka. The community must advocate for maintainers to extend support for this new architecture to fully harness its benefits.
4. Thoroughly test the image: Our organization stands to reap substantial benefits from embracing ARM architecture. With our commitment to engineering excellence, I’m confident that we will implement robust mechanisms to ensure a seamless transition without compromising the integrity of our workloads.
5. Consider direct building if pulling and bumping versions are impractical: In scenarios where pulling and upgrading dependencies prove challenging, prioritize building directly to mitigate compatibility issues.

These insights underscore the importance of strategic planning and meticulous execution as we navigate the complexities of transitioning to ARM architecture.

They’re hacking us! Now what?

Jonathan Fernandez, from Thoughtworks, took on a creative endeavor during the conference by crafting an anime movie plot centered around Martha, the resilient founder of a meticulously built-from-scratch company. However, Martha’s organization faces a grave threat when it falls victim to a devastating cyberattack, resulting in the complete collapse of its digital infrastructure and tarnishing of its once pristine reputation.

Plot twist! Martha has a DeLorean in her garage! Instead of indulging in the allure of revisiting 2005 to invest in Bitcoin, Martha rather decides to avert her company’s imminent catastrophe. Determined to salvage her business from the brink of ruin, Martha embarks on a daring journey through time, armed with the singular purpose of safeguarding her company’s future.

Jonathan gracefully introduced the crucial topics of Incident Response Plans (IRP) and Disaster Recovery Plans (DRP) through the captivating narrative of Martha’s journey. This talk immediately piqued my interest, knowing that establishing company-wide IRP and DRP is an ongoing initiative at Criteo. I was keen to assess any potential disparities between Jonathan’s recommendations and our current practices.

As Martha navigated through her challenges, she delved into the acclaimed best practices outlined by NIST for incident response and preparation. Ultimately, she emerged victorious, successfully averting the looming disaster.

Jonathan’s discourse shed light on fundamental concepts that, while challenging to implement at scale within big organizations like ours, are nonetheless essential aspirations. Encouragingly, many of the points discussed resonated with initiatives already underway at Criteo:

• We have insurance coverage in place.
• We have an IRP in development.
• We are actively developing a company-wide DRP, a prerequisite for SOC2 compliance, which is a milestone we’re working towards.
• Our efforts to enhance forensic capabilities align with the need for a forensic playbook.
• Our focus on Security Observability demonstrates our commitment to proactive threat detection and response.
• While we possess the ability to isolate affected systems, there’s room for refinement and streamlining.
• Ensuring effective communication with affected users is a priority, and we recognize opportunities for further optimization.

Jonathan also highlighted the value of tabletop exercises for testing IRP, fostering training and awareness, and identifying gaps, as elucidated by CISA guidelines. I’m confident that once our IRP matures from its current draft state, such practices will become integral to our operational resilience.

In summary, Jonathan’s insightful talk served as a valuable refresher on foundational principles, prompting a reflective examination of our security posture vis-à-vis industry best practices. It reaffirmed our alignment with these standards while inspiring a continued pursuit of excellence in safeguarding our digital assets and organizational resilience.

Kini’s Notes from a CommitConf Special Edition

CommitConf holds a special place in my heart. Over the years, I have been actively involved in this conference, both as a grateful speaker and an eager attendee hungry for knowledge. It brings me immense joy to reunite with familiar faces — many of whom have transitioned from speakers and attendees to lifelong friends. The influx of new participants also adds to the positivity of the event. While I do not have the exact figures for this latest edition, it marked the inaugural CommitConf experience for numerous individuals.

The 2024 edition of CommitConf marked a significant milestone in my relationship with the event. Over the past few months, I have been spearheading an initiative aimed at providing a secure and inclusive platform for new speakers. Notably, I had the privilege of mentoring Julian, a speaker from Criteo R&D, during the event and assisting him with his presentation. For more information about this initiative, please visit here (in Spanish).

Out of the final agenda, 12 talks originated from the “New Speakers” program, involving 16 new speakers and 12 mentors. I am a firm believer in creating opportunities for newcomers and diverse topics; this year was just the beginning.

Enough about me, let’s delve into some of the talks that I found most enjoyable 🙂 I make it a point to explore topics beyond my comfort zone. On this occasion, I had the opportunity to attend talks ranging from Machine Learning and Large Language Models to Data Science and programming languages like Kotlin or Rust. Besides Julian’s talk — he nailed it! — I want to highlight the following three ones 👇

How to use AI and LLMs to create a product in the Real World

Large Language Models (LLMs) have become ubiquitous in our daily lives. Until now, I hadn’t had the chance to explore the topic deeply from a “how-to-build-something” perspective. Andrea and Ángel elucidated the practical application of AI and LLMs in a real-world project, presenting every aspect of the puzzle through a use case at Inditex (the company behind Zara, Pull & Bear, etc.).

It’s common for people to underestimate this type of solution, often assuming that it’s a task anyone could accomplish in just two days. However, while experimenting with the model and obtaining initial results may indeed be achievable within a few days, integrating it into a production pipeline is far from simple.

The process involved training the model using information from Inditex APIs, internal documentation, and specific use case guidelines. The objective was to enable the creation of new API contracts simply by making natural language requests. Their presentation highlighted a 20% reduction in development time when creating a new API from inception.

Kotlin Multiplatform

I have always been a JVM person. My journey began with Java, which was my first programming language over fifteen years ago as I embarked on my career as a backend engineer. Over time, I’ve incorporated various languages into my toolkit until about five years ago when I discovered Kotlin. The transition to coding in Kotlin from Java 8 was truly enjoyable! It felt like a breath of fresh air for someone deeply entrenched in the world of JVM programming like me. Although things have evolved with Java since then, at that time, Kotlin brought about a refreshing change for me.

I first met Antonio years ago, probably at an Android meetup or conference. While most of us were just experimenting with Kotlin, he was deeply passionate about it and had invested a significant amount of time in the language. As one of the foremost experts on the topic, I eagerly anticipated his talk. Much has changed since I last opened an IDE, and I was keen to learn about the evolution of the ecosystem.

In today’s “multiplatform” environment, creating an app that functions across multiple platforms is a core objective for many companies. Numerous solutions have been proposed and are still in use to tackle this challenge. It brought me great joy to see Kotlin being part of this landscape as well. Antonio’s presentation provided me with valuable insights into the platform’s development over time. He revisited various solutions, candidly discussing their respective advantages and disadvantages from his honest perspective while also highlighting where Kotlin Multiplatform might find its place (although not suitable for every scenario).

Only time will reveal whether this marks another stage in the ongoing “multiplatform” journey or if it signifies a lasting shift in technology.

Rust FOMO can be conquered

FOMO, or fear of missing out, is a genuine concern. The tech world is constantly buzzing with numerous events and developments, making it seemingly impossible to stay updated. I have personally experienced this when it comes to programming languages or Javascript frameworks 😬.

I came across Rust years ago while casually browsing Twitter X on a typical Wednesday: “Oh great, another programming language that I should learn. Let’s add it to my never-ending ToDo list. I’ll get around to it (eventually).” Spoiler alert: I didn’t. Since then, Rust crossed my path from time to time, but it failed to capture my interest enough for me to invest five minutes of my life in learning about it. That changed when I joined Criteo. Given the scale at which we operate and our emphasis on performance, integrating Rust into our tech stack seemed like a promising idea.

As far as I’m aware, we are not currently using Rust in production; however, there is genuine enthusiasm for the language among some individuals (we even have a “Rust learning group”). During Roberto’s presentation, he didn’t focus on providing a simple “Hello World!” example but instead highlighted various tools, libraries, and frameworks currently employing Rust along with their use cases. He also pointed out common pitfalls, misunderstandings, and moments of revelation experienced when first delving into or using this language. His comparison between “Control” and “Safety” when working with certain programming languages left an impression on me — according to his own words, Rust offers both.

The presentation was very educative and quite funny. You can view the slides here.

---

In conclusion, CommitConf 2024 offered an amazing experience and a valuable opportunity to learn best practices and new technologies, as well as connect with individuals from other tech communities. We extend our heartfelt thanks to the organizers for their exceptional work in coordinating this fantastic event.

Looking forward to next year! 🚀