[devnexus 2026] privacy by design (pdb) in devsecops

Speaker: Anita Dakamarri

See the DevNexus live blog table of contents for more posts


Why developers

  • Developers are first line of defense
  • Gap between dev and security teams. Rivals a decade ago. Now same time. Rivals are attackers outside
  • Developers use untrusted images to meet deadlines
  • Business people/leadership want it fast and bypass security. Then blame developers and security people
  • No software is vulnerability free. Goal is to reduce vulnerabilities.

Famous Data Privacy Breaches

  • Equifax – in 2017 – unpatched Struts vulnerability. Got Social security numbers, birthdates, etc for 147 million people. Cost over 1.3 billion. Fired security people and executives
  • United Health – in 2024 – Ransomware attack on Citrix remote access portal without MFA. Exposed medical, insuring, billing and personal data of 192 million people. Billions in recovery costs, ransom of $22 million and lost revenue
  • BadeSaba Calendar App – in late February/early March – Iranian app hacked to include messages like “help has arrived”

Privacy By Design Principles

  • Proactive, not reactive. Preventative not remedial
  • Privacy as the default setting (ex: car automatically has a seatbelt)
  • Privacy embedded into design
  • Full functionality, postive sum, not zero sum
  • End to end security; full lifecycle protection
  • Visibility and transparency; keep it open
  • Respect for user privacy; keep it user centric

Requirements/planning

  • Identify personal data early
  • Minimize data collection
  • Definite lawful purpose and retention
  • Conduct privacy assessments PIA (privacy impact assessment) /DPIA (data protection impact assessment)
  • Translate privacy laws into requirements – ex: GDPR, CCPA (California Consumer Privacy Act)/CPRA (California Privacy Rights Act)/ HIPPA). Requirements include consent, access and deletion

Code with privacy

  • Avoid hardcoding sensitive data – Never embed secets, API keys or personal data in code/configs
  • Mask/redact personal data – especially in logs/error messages/debugging
  • Implement strong encryption – user modern, vetted crypto libraries
  • Validate data inputs – prevent injection/data poisoning attacks
  • Build deletion and portability features – ensure data can be deleted/exported programmatically

My take

Good end to the day. I learned some acronyms like DPIA and CCPA. So nice to see a session about privacy and not just security overall.

[devnexus 2026] how to run 1 on 1s for everyone

Speaker: Alex Riviere (@fimion@notacult.social)

See the DevNexus live blog table of contents for more posts


Bad One on Ones

  • How was the conference?
  • Anything you want to talk about?
  • Ok, Talk to you next month

Assumption

  • Collaborative environment
  • Small team
  • Non-hostile environment (aka if your manager is trying to get you fired)
  • Ideal situation. Ok to not want to do some of these when lower trust

Types of one on ones

  • Manager to employee (or team lead to team member)
  • Peer to peer. People you work with
  • Employee to Manager. Employee leads meeting.

Expectations

  • Both parties state their expectations for the meeting
  • What’s important to you
  • ex: open and honest about how work makes you feel, clear understanding of work responsibilities or bring up if not, bring up if work not on track
  • ex: don’t surprise me. “I’m going to talk to you about X in 5 minutes”
  • ex: I want you to help me level up
  • ex: I need brace when I mess up

Notes

  • Have notes from last meeting on one side of screen and notes from this meeting on other side.
  • Good when answers are the same from previous time.
  • If answer changes, ask for more information.

Always ask

  • Am I living up these expectations for you? Usually the answer is yes.
  • Are there any expectations you want to edit or add? Circumstances change over time.

Manager to Employee

Meets monthly for up to an hour. Sometimes take 15 minutes, but can use up to an hour. Could be every two weeks if junior/need more involvement. That one is shorter.

  • Check in on role. – Do you feel like you clearly understand your role in the business? Are you being asked to do work that doesn’t align with your role? What do you think about the company’s culture/vision/direction? Are you feeling burned out at all? What’s something you are doing a lot of today that you weren’t doing a year ago? (also can use these for annual review). Do you see any opportunities to change your role? What kind of impact do you feel you are making? Are you doing meaningful or important work?
  • Reserve a time for a specific topic or question – What’s something I do that annoys you? (ok to say nothing) What technologies are you interested in that you wish you could be using at work? What issues do you think we should be prioritizing that we aren’t currently? Team specific question: (ex How do you think our QA process could be better)
  • Set and track goal process – individual (employee wants to do) and assigned (from company) goals. Also can use for annual review as well)

Peer to Peer

He allocates 30 minutes; sometimes uses 15. Ok to be quarterly. Ensure next one scheduled before end prior one

  • Fortering relations – Do you feel like you clearly understand my role in the business? Both answer this question. Are we asking too much/little of your team
  • Retro checkin – What challenges have you faced since the last meeting? What went well since our last meeting. Cover schedule for next x days (a few days more than the meeting cadence to ensure enough notice)
  • Vibe check – Are you feeling burned out/how’s it going?
  • Track goals – Accountability buddies. Each have one goal want to achieve and check in on it

Employee to Manager

  • What is coming up in the next x months that I should be aware of?
  • Are there any tasks that you have concerns about our progress on?
  • Are there things we are doing that concern you? (could be just one person or the team). Allows answer to be “no”
  • What are things we are doing that you like?
  • Is there anything we didn’t already cover that you want to talk through?

Other notes

  • Track action items – carry forward if not done between meetings
  • Repetitive by design
  • Can add questions based on the person or level. ex: ask a junior what struggling with
  • Never cancel a one on one. Ok to move, but don’t cancel as won’t communicate effectively.

Slides: https://github.com/fimion/1-on-1s-for-everyone

My take

It feels like it would be repetitive to ask the same questions every month. But these are great ideas of things to think about and bring up!

[devnexus 2026] 10 things i hate about ai

Speakers: Cody Frenzel & Laurie Lay

See the DevNexus live blog table of contents for more posts


General

  • Skeptics are useful
  • Don’t shut how haters down

AI Adoption Metrics

  • DORA – includes how often deploy and lead time to deploy changes
  • Developer time savings
  • PR throughput (instead of % of generated code)
  • Utilization, impact, cost

Other notes

  • Don’t mandate AI
  • Measure what matters
  • AI gains depend on foundation. Technical excellence matters. ex: testability, code reviews, quality gates
  • AI will write imperfect code; just like humans. Guzrd rzils prevent it from getting to prod.
  • Culture still matters more than tools

AI Literacy

  • Tool churn is normal for a new ecosystem. Just like JavaScript in the early days.
  • Maintain fundamentals. ex: code review, systems thinking
  • We learn through repetition, If we outsource that repetition we don’t learn. Juniors need to write by hand to gain intuition on how to program.
  • For seniors, can make instincts weaker, dull senses, lose detecting problems like scale. Need to have non AI periods. Don’t want to be able to assemble but not maintain
  • AI use involves self awareness

Things to hate include

  • AI slop
  • Bad ideas
  • Too many tools
  • Prompting is a skill
  • AI makes you week

My take

The Women in Tech lunch ran late and then I was talking to someone so I was 20 minutes late to this session. It was easy to jump into following from when I walked in though. I like the format of having the 10 things to hate and highlighting them in small groups to talk about concepts