Research software environments must reach an increasingly high standard for security. But we all know that “security” is hard to measure. The typical method is threat modeling, in which one constructs a system model, identifies attackers and their capabilities, and looks for ways in which the system can be hardened to prevent or mitigate attacks. However, threat modeling remains challenging to apply effectively in the context of RSEs, whose operating environments involve complex, distributed environments, intricate dependencies, and emerging concerns related to software agents. Many in the community feel there are latent “vulnerabilities” but lack a clear notion of the actual threat surface.

This interactive, group-based workshop works towards a group understanding of the problem and the methods to resolving it. We will introduce a high-level system model for a typical research software project and an initial, draft threat model. Participants will be divided into small groups to collaboratively analyze, critique, and specialize this model for their contexts. The exercises will focus on identifying specific threats related to the software supply chain, dependency management, and organizational factors. Attendees will gain actionable, hands-on experience in structuring their security analysis, transforming abstract concerns into defined threats and tangible hardening measures. This workshop is designed for Research Software Engineers (RSEs) who wish to operationalize security and better communicate risk in their projects

Participants are expected to bring a laptop.

Do you want to improve how users interact with your product or organization? By creating a journey map, you can recognize opportunities to improve the user’s experience, increase their satisfaction, and create vital documentation for your development team. Journey maps are chronological narratives that visualize interactions between users and products or organizations. Additionally, journey maps can be valuable tools for building empathy with users and are appropriate for use at any point during your development lifecycle. Journey maps compel their authors to consider each step of a workflow in detail, making it easy to see when user experience drops off and when an interface can be simplified or made more predictable. This hands-on workshop will teach you how to create a journey map of your own and how it can be used to identify opportunities to improve user experience. Bring your computer.

An all-too-common life cycle of research software begins with enthusiasm and momentum, generating (whether by agent or by postdoc) a lot of code for a specific problem, only to go dormant when interest moves to a slightly different research problem or a key contributor leaves the project. The resulting code base either becomes a brittle fossil whose eventual failure everyone dreads, or is thrown away entirely, leaving the team to reinvent the same solutions for the next project. How can that work be reused?

In this workshop, we’ll discuss how to refactor heirloom code so it can be maintained, understood, and used for new problems. We will look at how to create an appropriate organizational principle for a project that lacks an explicit design or structure. We’ll also introduce common patterns of simplification that will help make the code more legible to you and others, and best practices for doing your renovations safely and efficiently. Working in small groups, participants will engage with a case study project to identify reusable functionality, break the code into discrete components, and rewrite for readability and maintenance.

A computer will be needed for full participation, though the discussion will be informative for attendees without one. Exercises will be provided in Python (typed and untyped).