SlideShare ist ein Scribd-Unternehmen logo
1 von 20
Downloaden Sie, um offline zu lesen
Sogeti Java Meetup Quality Engineering
How to ensure your
code is maintainable
Peter Rombouts
Senior Technology Consultant
Sogeti
Security Classification © 2019 Sogeti. All rights reserved. 2
Presentation title | Date 2
Who am I
https://peterrombouts.nl
https://www.twitter.com/prombouts
https://www.github.com/prombouts
https://labs.sogeti.com
Senior Technology Consultant
Peter Rombouts
Cloud Software Architect
 Over 18 years of experience in IT
 Passionate about Software
Development, Architecture and
Cloud
SogetiLabs Fellow
 Azure
 Cloud
 Cognitive Services
 Software Development
Multi Cloud
QSD
Security Classification © 2019 Sogeti. All rights reserved. 3
Presentation title | Date
Systems and software engineering — Systems and
software Quality Requirements and Evaluation (SQuaRE) —
System and software quality models
ISO 25010 for short
What is Software Quality?
Security Classification © 2019 Sogeti. All rights reserved. 4
Presentation title | Date
The International Standard defines:
Quality in Use Model Product Quality Model
Security Classification © 2019 Sogeti. All rights reserved. 5
Presentation title | Date
The International Standard defines:
Quality in Use Model Product Quality Model
Security Classification © 2019 Sogeti. All rights reserved. 6
Presentation title | Date
The International Standard defines:
Quality in Use Model Product Quality Model
Security Classification © 2019 Sogeti. All rights reserved. 7
Presentation title | Date
Guidelines (SIG)
1. Write Short Units of Code
2. Write Simple Units of Code
3. Write Code Once
4. Keep Unit Interfaces Small
5. Separate Concerns in Modules
6. Couple Architecture Components Loosely
7. Keep Architecture Components Balanced
8. Keep Your Codebase Small
9. Automate Tests
10.Write Clean Code
SIG was established in 2000. Its roots can be
traced back to the Dutch National Research
Institute for Mathematics and Computer
Science (Centrum voor Wiskunde en
Informatica [CWI]).
Security Classification © 2019 Sogeti. All rights reserved. 8
Presentation title | Date
Guidelines (SIG)
1. Write Short Units of Code
2. Write Simple Units of Code
3. Write Code Once
4. Keep Unit Interfaces Small
5. Separate Concerns in Modules
6. Couple Architecture Components Loosely
7. Keep Architecture Components Balanced
8. Keep Your Codebase Small
9. Automate Tests
10.Write Clean Code
SIG was established in 2000. Its roots can be
traced back to the Dutch National Research
Institute for Mathematics and Computer
Science (Centrum voor Wiskunde en
Informatica [CWI]).
Security Classification © 2019 Sogeti. All rights reserved. 9
Presentation title | Date
Tools
How to choose?
Static Code Analysis?
Software Composition Analysis?
Security Classification © 2019 Sogeti. All rights reserved. 10
Presentation title | Date
What tooling is available?
Analyses the(lines of) code.
Normally used in automated pipelines.
Examples:
• SonarQube
• PMD
• NDepend
• BinSkim
Analyses the dependencies
Mostly stand-alone products with notification
capabilities. Also often used for checking
licenses in open-source packages and if they
comply with company policies..
Examples:
• WhiteSource
• WhiteSource Bolt
• Snyk
• Fossa
• npm-audit
• David (Node.JS)
Static Code Analysis Software Composition Analysis
Security Classification © 2019 Sogeti. All rights reserved. 11
Presentation title | Date
What tooling is available?
Analyses the(lines of) code.
Normally used in automated pipelines.
Examples:
• SonarQube
• PMD
• NDepend
• BinSkim
Analyses the dependencies
Mostly stand-alone products with notification
capabilities. Also often used for checking
licenses in open-source packages and if they
comply with company policies..
Examples:
• WhiteSource
• WhiteSource Bolt
• Snyk
• Fossa
• npm-audit
• David (Node.JS)
Static Code Analysis Software Composition Analysis
Security Classification © 2019 Sogeti. All rights reserved. 12
Presentation title | Date
Static Code Analysis: SonarQube
Security Classification © 2019 Sogeti. All rights reserved. 13
Presentation title | Date
Security Classification © 2019 Sogeti. All rights reserved. 14
Presentation title | Date
Software Composition Analysis: WhiteSource Bolt
Security Classification © 2019 Sogeti. All rights reserved. 15
Presentation title | Date
Software Composition Analysis: WhiteSource Bolt
Security Classification © 2019 Sogeti. All rights reserved. 16
Presentation title | Date
Software Composition Analysis: WhiteSource Bolt
17
Sogeti Global Overview | © 2019 Sogeti. All rights reserved.
Sogeti Global Overview | © 2019 Sogeti. All rights reserved.
Mind The (Tool) Gap!
Security Classification © 2019 Sogeti. All rights reserved. 18
Presentation title | Date
How to proceed?
Security Classification © 2019 Sogeti. All rights reserved. 19
Presentation title | Date
Hoe nu verder?
Sogeti Java Meetup Quality Engineering
Questions?
peter.rombouts@sogeti.com
https://peterrombouts.nl
https://labs.sogeti.com
Twitter @prombouts
GitHub @prombouts

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Bosch: AN UPDATE ON OUR ACTIVITIES IN AUTOMATING OSS COMPLIANCE: A WORKING SH...
Bosch: AN UPDATE ON OUR ACTIVITIES IN AUTOMATING OSS COMPLIANCE: A WORKING SH...Bosch: AN UPDATE ON OUR ACTIVITIES IN AUTOMATING OSS COMPLIANCE: A WORKING SH...
Bosch: AN UPDATE ON OUR ACTIVITIES IN AUTOMATING OSS COMPLIANCE: A WORKING SH...
 
OpenChain Webinar #11 - Open Source Issues Remediation - Jari Koivisto - 2020...
OpenChain Webinar #11 - Open Source Issues Remediation - Jari Koivisto - 2020...OpenChain Webinar #11 - Open Source Issues Remediation - Jari Koivisto - 2020...
OpenChain Webinar #11 - Open Source Issues Remediation - Jari Koivisto - 2020...
 
Webinar–That is Not How This Works
Webinar–That is Not How This WorksWebinar–That is Not How This Works
Webinar–That is Not How This Works
 
OpenChain Automotive Work Group Meeting #2 - Lyon
OpenChain Automotive Work Group Meeting #2 - LyonOpenChain Automotive Work Group Meeting #2 - Lyon
OpenChain Automotive Work Group Meeting #2 - Lyon
 
Osborne Clarke - OpenChain - FOSSmatrix
Osborne Clarke - OpenChain - FOSSmatrixOsborne Clarke - OpenChain - FOSSmatrix
Osborne Clarke - OpenChain - FOSSmatrix
 
OpenChain Webinar #11 - cii-bp-badge-intro
OpenChain Webinar #11 - cii-bp-badge-introOpenChain Webinar #11 - cii-bp-badge-intro
OpenChain Webinar #11 - cii-bp-badge-intro
 
Build your own_photobooth
Build your own_photoboothBuild your own_photobooth
Build your own_photobooth
 
Embed Spark calling SDK in Your App - Olivier PROFFIT - Cisco Live Berlin 2017
Embed Spark calling SDK in Your App - Olivier PROFFIT - Cisco Live Berlin 2017Embed Spark calling SDK in Your App - Olivier PROFFIT - Cisco Live Berlin 2017
Embed Spark calling SDK in Your App - Olivier PROFFIT - Cisco Live Berlin 2017
 
OpenChain Automation Case Study - September to December 2021
OpenChain Automation Case Study - September to December 2021OpenChain Automation Case Study - September to December 2021
OpenChain Automation Case Study - September to December 2021
 
OpenChain Automation Case Study - September to December 2021
OpenChain Automation Case Study - September to December 2021OpenChain Automation Case Study - September to December 2021
OpenChain Automation Case Study - September to December 2021
 
Free and Open Source Software - Challenges for the Automotive Supply Chain
Free and Open Source Software - Challenges for the Automotive Supply ChainFree and Open Source Software - Challenges for the Automotive Supply Chain
Free and Open Source Software - Challenges for the Automotive Supply Chain
 
Licensing in Composite Projects
Licensing in Composite ProjectsLicensing in Composite Projects
Licensing in Composite Projects
 
Easing IoT Development for Novice Programmers Through Code Recipes
Easing IoT Development for Novice Programmers Through Code RecipesEasing IoT Development for Novice Programmers Through Code Recipes
Easing IoT Development for Novice Programmers Through Code Recipes
 
OpenChain Continual Improvement Case Studies
OpenChain Continual Improvement Case StudiesOpenChain Continual Improvement Case Studies
OpenChain Continual Improvement Case Studies
 
How to Effectively Manage Virtual Teams
How to Effectively Manage Virtual TeamsHow to Effectively Manage Virtual Teams
How to Effectively Manage Virtual Teams
 
Licensing in Composite Open Source Projects
Licensing in Composite Open Source ProjectsLicensing in Composite Open Source Projects
Licensing in Composite Open Source Projects
 
Spo2 r33
Spo2 r33Spo2 r33
Spo2 r33
 
Strategies to Reap the Benefits of Software Patents in an Open Source Softwar...
Strategies to Reap the Benefits of Software Patents in an Open Source Softwar...Strategies to Reap the Benefits of Software Patents in an Open Source Softwar...
Strategies to Reap the Benefits of Software Patents in an Open Source Softwar...
 
Fabrizio Cornelli - Securing Android Apps by Reversing - Codemotion Milan 2018
Fabrizio Cornelli - Securing Android Apps by Reversing - Codemotion Milan 2018Fabrizio Cornelli - Securing Android Apps by Reversing - Codemotion Milan 2018
Fabrizio Cornelli - Securing Android Apps by Reversing - Codemotion Milan 2018
 
vivek_resume1
vivek_resume1vivek_resume1
vivek_resume1
 

Ähnlich wie Sogeti Java Meetup - How to ensure your code is maintainable

Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Denim Group
 
Mid market collaboration architecture presentation
Mid market collaboration architecture presentationMid market collaboration architecture presentation
Mid market collaboration architecture presentation
Trinny Chacko
 

Ähnlich wie Sogeti Java Meetup - How to ensure your code is maintainable (20)

Maintainability Sogeti Qx Day 2020
Maintainability Sogeti Qx Day 2020Maintainability Sogeti Qx Day 2020
Maintainability Sogeti Qx Day 2020
 
Webinar–AppSec: Hype or Reality
Webinar–AppSec: Hype or RealityWebinar–AppSec: Hype or Reality
Webinar–AppSec: Hype or Reality
 
Webinar – Streamling Your Tech Due Diligence Process for Software Assets
Webinar – Streamling Your Tech Due Diligence Process for Software AssetsWebinar – Streamling Your Tech Due Diligence Process for Software Assets
Webinar – Streamling Your Tech Due Diligence Process for Software Assets
 
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
RSA Conference Presentation–Creating a Modern AppSec Toolchain to Quantify Se...
 
Why Automate the Network?
Why Automate the Network?Why Automate the Network?
Why Automate the Network?
 
Bridging the Security Testing Gap in Your CI/CD Pipeline
Bridging the Security Testing Gap in Your CI/CD PipelineBridging the Security Testing Gap in Your CI/CD Pipeline
Bridging the Security Testing Gap in Your CI/CD Pipeline
 
The Future of IoT: Why We Need the Open Interconnect Consortium
The Future of IoT: Why We Need the Open Interconnect ConsortiumThe Future of IoT: Why We Need the Open Interconnect Consortium
The Future of IoT: Why We Need the Open Interconnect Consortium
 
Webinar–Reviewing Modern JavaScript Applications
Webinar–Reviewing Modern JavaScript ApplicationsWebinar–Reviewing Modern JavaScript Applications
Webinar–Reviewing Modern JavaScript Applications
 
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
Continuous Authority to Operate (ATO) with ThreadFix – Bringing Commercial In...
 
Software Bill of Materials - Accelerating Your Secure Embedded Development.pdf
Software Bill of Materials - Accelerating Your Secure Embedded Development.pdfSoftware Bill of Materials - Accelerating Your Secure Embedded Development.pdf
Software Bill of Materials - Accelerating Your Secure Embedded Development.pdf
 
The Future of IoT: Why We Need the Open Interconnect Consortium
The Future of IoT: Why We Need the Open Interconnect ConsortiumThe Future of IoT: Why We Need the Open Interconnect Consortium
The Future of IoT: Why We Need the Open Interconnect Consortium
 
How to Achieve NIST Compliance using SanerNow?
How to Achieve NIST Compliance using SanerNow?How to Achieve NIST Compliance using SanerNow?
How to Achieve NIST Compliance using SanerNow?
 
IoT Panel- Cisco and Intel
IoT Panel- Cisco and Intel IoT Panel- Cisco and Intel
IoT Panel- Cisco and Intel
 
Webinar – Risk-based adaptive DevSecOps
Webinar – Risk-based adaptive DevSecOps Webinar – Risk-based adaptive DevSecOps
Webinar – Risk-based adaptive DevSecOps
 
Steps to Scale Internet of Things (IoT)
Steps to Scale Internet of Things (IoT)Steps to Scale Internet of Things (IoT)
Steps to Scale Internet of Things (IoT)
 
Mid market collaboration architecture presentation
Mid market collaboration architecture presentationMid market collaboration architecture presentation
Mid market collaboration architecture presentation
 
Automate and Enhance Application Security Analysis
Automate and Enhance Application Security AnalysisAutomate and Enhance Application Security Analysis
Automate and Enhance Application Security Analysis
 
Cilium + Istio with Gloo Mesh
Cilium + Istio with Gloo MeshCilium + Istio with Gloo Mesh
Cilium + Istio with Gloo Mesh
 
Certified Internet of Things Specialist ( CIoTS )
Certified Internet of Things Specialist ( CIoTS ) Certified Internet of Things Specialist ( CIoTS )
Certified Internet of Things Specialist ( CIoTS )
 
Cisco Connect Toronto 2018 DevNet Overview
Cisco Connect Toronto 2018  DevNet OverviewCisco Connect Toronto 2018  DevNet Overview
Cisco Connect Toronto 2018 DevNet Overview
 

Kürzlich hochgeladen

VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
dharasingh5698
 
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
dharasingh5698
 
AKTU Computer Networks notes --- Unit 3.pdf
AKTU Computer Networks notes ---  Unit 3.pdfAKTU Computer Networks notes ---  Unit 3.pdf
AKTU Computer Networks notes --- Unit 3.pdf
ankushspencer015
 
Call for Papers - African Journal of Biological Sciences, E-ISSN: 2663-2187, ...
Call for Papers - African Journal of Biological Sciences, E-ISSN: 2663-2187, ...Call for Papers - African Journal of Biological Sciences, E-ISSN: 2663-2187, ...
Call for Papers - African Journal of Biological Sciences, E-ISSN: 2663-2187, ...
Christo Ananth
 
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar  ≼🔝 Delhi door step de...Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar  ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
9953056974 Low Rate Call Girls In Saket, Delhi NCR
 

Kürzlich hochgeladen (20)

The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...
The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...
The Most Attractive Pune Call Girls Budhwar Peth 8250192130 Will You Miss Thi...
 
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Palanpur 7001035870 Whatsapp Number, 24/07 Booking
 
Generative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPTGenerative AI or GenAI technology based PPT
Generative AI or GenAI technology based PPT
 
Intze Overhead Water Tank Design by Working Stress - IS Method.pdf
Intze Overhead Water Tank  Design by Working Stress - IS Method.pdfIntze Overhead Water Tank  Design by Working Stress - IS Method.pdf
Intze Overhead Water Tank Design by Working Stress - IS Method.pdf
 
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 BookingVIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
VIP Call Girls Ankleshwar 7001035870 Whatsapp Number, 24/07 Booking
 
chapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineeringchapter 5.pptx: drainage and irrigation engineering
chapter 5.pptx: drainage and irrigation engineering
 
AKTU Computer Networks notes --- Unit 3.pdf
AKTU Computer Networks notes ---  Unit 3.pdfAKTU Computer Networks notes ---  Unit 3.pdf
AKTU Computer Networks notes --- Unit 3.pdf
 
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
Call Girls Pimpri Chinchwad Call Me 7737669865 Budget Friendly No Advance Boo...
 
BSides Seattle 2024 - Stopping Ethan Hunt From Taking Your Data.pptx
BSides Seattle 2024 - Stopping Ethan Hunt From Taking Your Data.pptxBSides Seattle 2024 - Stopping Ethan Hunt From Taking Your Data.pptx
BSides Seattle 2024 - Stopping Ethan Hunt From Taking Your Data.pptx
 
Booking open Available Pune Call Girls Koregaon Park 6297143586 Call Hot Ind...
Booking open Available Pune Call Girls Koregaon Park  6297143586 Call Hot Ind...Booking open Available Pune Call Girls Koregaon Park  6297143586 Call Hot Ind...
Booking open Available Pune Call Girls Koregaon Park 6297143586 Call Hot Ind...
 
Call for Papers - African Journal of Biological Sciences, E-ISSN: 2663-2187, ...
Call for Papers - African Journal of Biological Sciences, E-ISSN: 2663-2187, ...Call for Papers - African Journal of Biological Sciences, E-ISSN: 2663-2187, ...
Call for Papers - African Journal of Biological Sciences, E-ISSN: 2663-2187, ...
 
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
(INDIRA) Call Girl Aurangabad Call Now 8617697112 Aurangabad Escorts 24x7
 
data_management_and _data_science_cheat_sheet.pdf
data_management_and _data_science_cheat_sheet.pdfdata_management_and _data_science_cheat_sheet.pdf
data_management_and _data_science_cheat_sheet.pdf
 
Double rodded leveling 1 pdf activity 01
Double rodded leveling 1 pdf activity 01Double rodded leveling 1 pdf activity 01
Double rodded leveling 1 pdf activity 01
 
UNIT - IV - Air Compressors and its Performance
UNIT - IV - Air Compressors and its PerformanceUNIT - IV - Air Compressors and its Performance
UNIT - IV - Air Compressors and its Performance
 
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar  ≼🔝 Delhi door step de...Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar  ≼🔝 Delhi door step de...
Call Now ≽ 9953056974 ≼🔝 Call Girls In New Ashok Nagar ≼🔝 Delhi door step de...
 
University management System project report..pdf
University management System project report..pdfUniversity management System project report..pdf
University management System project report..pdf
 
Call Girls Walvekar Nagar Call Me 7737669865 Budget Friendly No Advance Booking
Call Girls Walvekar Nagar Call Me 7737669865 Budget Friendly No Advance BookingCall Girls Walvekar Nagar Call Me 7737669865 Budget Friendly No Advance Booking
Call Girls Walvekar Nagar Call Me 7737669865 Budget Friendly No Advance Booking
 
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
Bhosari ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready For ...Bhosari ( Call Girls ) Pune  6297143586  Hot Model With Sexy Bhabi Ready For ...
Bhosari ( Call Girls ) Pune 6297143586 Hot Model With Sexy Bhabi Ready For ...
 
Booking open Available Pune Call Girls Pargaon 6297143586 Call Hot Indian Gi...
Booking open Available Pune Call Girls Pargaon  6297143586 Call Hot Indian Gi...Booking open Available Pune Call Girls Pargaon  6297143586 Call Hot Indian Gi...
Booking open Available Pune Call Girls Pargaon 6297143586 Call Hot Indian Gi...
 

Sogeti Java Meetup - How to ensure your code is maintainable

  • 1. Sogeti Java Meetup Quality Engineering How to ensure your code is maintainable Peter Rombouts Senior Technology Consultant Sogeti
  • 2. Security Classification © 2019 Sogeti. All rights reserved. 2 Presentation title | Date 2 Who am I https://peterrombouts.nl https://www.twitter.com/prombouts https://www.github.com/prombouts https://labs.sogeti.com Senior Technology Consultant Peter Rombouts Cloud Software Architect  Over 18 years of experience in IT  Passionate about Software Development, Architecture and Cloud SogetiLabs Fellow  Azure  Cloud  Cognitive Services  Software Development Multi Cloud QSD
  • 3. Security Classification © 2019 Sogeti. All rights reserved. 3 Presentation title | Date Systems and software engineering — Systems and software Quality Requirements and Evaluation (SQuaRE) — System and software quality models ISO 25010 for short What is Software Quality?
  • 4. Security Classification © 2019 Sogeti. All rights reserved. 4 Presentation title | Date The International Standard defines: Quality in Use Model Product Quality Model
  • 5. Security Classification © 2019 Sogeti. All rights reserved. 5 Presentation title | Date The International Standard defines: Quality in Use Model Product Quality Model
  • 6. Security Classification © 2019 Sogeti. All rights reserved. 6 Presentation title | Date The International Standard defines: Quality in Use Model Product Quality Model
  • 7. Security Classification © 2019 Sogeti. All rights reserved. 7 Presentation title | Date Guidelines (SIG) 1. Write Short Units of Code 2. Write Simple Units of Code 3. Write Code Once 4. Keep Unit Interfaces Small 5. Separate Concerns in Modules 6. Couple Architecture Components Loosely 7. Keep Architecture Components Balanced 8. Keep Your Codebase Small 9. Automate Tests 10.Write Clean Code SIG was established in 2000. Its roots can be traced back to the Dutch National Research Institute for Mathematics and Computer Science (Centrum voor Wiskunde en Informatica [CWI]).
  • 8. Security Classification © 2019 Sogeti. All rights reserved. 8 Presentation title | Date Guidelines (SIG) 1. Write Short Units of Code 2. Write Simple Units of Code 3. Write Code Once 4. Keep Unit Interfaces Small 5. Separate Concerns in Modules 6. Couple Architecture Components Loosely 7. Keep Architecture Components Balanced 8. Keep Your Codebase Small 9. Automate Tests 10.Write Clean Code SIG was established in 2000. Its roots can be traced back to the Dutch National Research Institute for Mathematics and Computer Science (Centrum voor Wiskunde en Informatica [CWI]).
  • 9. Security Classification © 2019 Sogeti. All rights reserved. 9 Presentation title | Date Tools How to choose? Static Code Analysis? Software Composition Analysis?
  • 10. Security Classification © 2019 Sogeti. All rights reserved. 10 Presentation title | Date What tooling is available? Analyses the(lines of) code. Normally used in automated pipelines. Examples: • SonarQube • PMD • NDepend • BinSkim Analyses the dependencies Mostly stand-alone products with notification capabilities. Also often used for checking licenses in open-source packages and if they comply with company policies.. Examples: • WhiteSource • WhiteSource Bolt • Snyk • Fossa • npm-audit • David (Node.JS) Static Code Analysis Software Composition Analysis
  • 11. Security Classification © 2019 Sogeti. All rights reserved. 11 Presentation title | Date What tooling is available? Analyses the(lines of) code. Normally used in automated pipelines. Examples: • SonarQube • PMD • NDepend • BinSkim Analyses the dependencies Mostly stand-alone products with notification capabilities. Also often used for checking licenses in open-source packages and if they comply with company policies.. Examples: • WhiteSource • WhiteSource Bolt • Snyk • Fossa • npm-audit • David (Node.JS) Static Code Analysis Software Composition Analysis
  • 12. Security Classification © 2019 Sogeti. All rights reserved. 12 Presentation title | Date Static Code Analysis: SonarQube
  • 13. Security Classification © 2019 Sogeti. All rights reserved. 13 Presentation title | Date
  • 14. Security Classification © 2019 Sogeti. All rights reserved. 14 Presentation title | Date Software Composition Analysis: WhiteSource Bolt
  • 15. Security Classification © 2019 Sogeti. All rights reserved. 15 Presentation title | Date Software Composition Analysis: WhiteSource Bolt
  • 16. Security Classification © 2019 Sogeti. All rights reserved. 16 Presentation title | Date Software Composition Analysis: WhiteSource Bolt
  • 17. 17 Sogeti Global Overview | © 2019 Sogeti. All rights reserved. Sogeti Global Overview | © 2019 Sogeti. All rights reserved. Mind The (Tool) Gap!
  • 18. Security Classification © 2019 Sogeti. All rights reserved. 18 Presentation title | Date How to proceed?
  • 19. Security Classification © 2019 Sogeti. All rights reserved. 19 Presentation title | Date Hoe nu verder?
  • 20. Sogeti Java Meetup Quality Engineering Questions? peter.rombouts@sogeti.com https://peterrombouts.nl https://labs.sogeti.com Twitter @prombouts GitHub @prombouts

Hinweis der Redaktion

  1. Quality in Use -> 5 characteristics related to outcomes of interaction with a system (including users) Product Quality Model -> Focuses on target computer system that includes the target software product.
  2. Quality in Use -> 5 characteristics related to outcomes of interaction with a system (including users) Product Quality Model -> Focuses on target computer system that includes the target software product.
  3. 1. Modularity 2. Reusability 3. Analyzability 4. Modifiability 5. Testability
  4. At the time of writing, in total SIG has analyzed 7.1 billion lines of code, and 72.7 million new lines of code are uploaded to SIG weekly. SIG is the only organization in the world certified by TÜViT for Trusted Product Maintainability. we have selected metrics that: • Are contained in a set as small as possible • Are technology-independent • Are easy to measure • Enable a meaningful comparison of real-world enterprise software systems
  5. At the time of writing, in total SIG has analyzed 7.1 billion lines of code, and 72.7 million new lines of code are uploaded to SIG weekly. SIG is the only organization in the world certified by TÜViT for Trusted Product Maintainability. we have selected metrics that: • Are contained in a set as small as possible • Are technology-independent • Are easy to measure • Enable a meaningful comparison of real-world enterprise software systems
  6. Many tools, what is the ‘golden record’ Another time, another session! C? XML? T-SQL, PL-SQL NIET gratis?
  7. RDP Session
  8. RDP Session
  9. Edge: https://dev.azure.com/sogetiazurefundamentals/sogetiazurefundamentals/_build/results?buildId=258&view=whitesource.ws-bolt.build-tab.wss
  10. Edge: https://dev.azure.com/sogetiazurefundamentals/sogetiazurefundamentals/_build/results?buildId=258&view=whitesource.ws-bolt.build-tab.wss
  11. Edge: https://dev.azure.com/sogetiazurefundamentals/sogetiazurefundamentals/_build/results?buildId=258&view=whitesource.ws-bolt.build-tab.wss
  12. Tool gap! Hard to interpret Will never replace pair programming. Peer review, Expert review.
  13. Turning the Guidelines into Practice Ensuring that your code is easy to maintain depends on two behaviors in your daily routine: discipline and setting priorities. Discipline Lower-Level (Unit) Guidelines Take Precedence Over Higher-Level (Component) Guidelines\ Remember That Every Commit Counts
  14. Turning the Guidelines into Practice Ensuring that your code is easy to maintain depends on two behaviors in your daily routine: discipline and setting priorities. Discipline Lower-Level (Unit) Guidelines Take Precedence Over Higher-Level (Component) Guidelines\ Remember That Every Commit Counts 15 -> SKIP INDIEN NO TIME