Houston .NET User Group

Code metrics: we’ve seen them in dashboards, status reports, and maybe even used them to win an argument or two. But what do they actually mean—and are they even helpful?

In this light-hearted but informative session, we’ll take a look at a whole grab bag of code metrics, including (but not limited to) Cyclomatic Complexity, Code Coverage %, Maintainability Index, Code Churn, Coupling, Cohesion, and everyone's favorite: Lines. Of. Code.

You’ll learn:

What these metrics can tell you about your code

What they absolutely cannot

How to avoid weaponizing them (intentionally or otherwise)

When it's okay to say, “Yeah, this number means nothing.”

We’ll bust some myths, share some laughs, and maybe have a little audience participation along the way. If you've ever looked at a sonar report and felt a mix of confusion, curiosity, and existential dread—this talk is for you.

Bring your questions, your skepticism, and your metric horror stories. You’ll leave with a clearer sense of how to use metrics without losing your mind—or your team's trust.

If you've filled out lengthy security questionnaires before, you'll know that any organization operating a software service will be asked for their security guidelines: usually some combination of SOC 2, ISO 27001, or IEC 62443 (for you industrial folks). Certificate, password and key rotation are required in all these guidelines, but are usually left as an afterthought. Lucky for you, the best (and easiest) strategy to start uses all the systems and processes already in your automated workflows (you ARE using automated workflows ,right?), leveraging the security services offered by your cloud provider. Then you can gather feedback on what works and doesn't to inform a later purchasing decision for a dedicated security product.

In this talk, we'll dive deep into the benefits and challenges of implementing all the requirements of a basic secrets management and rotation strategy in Azure (that could be extended to AWS as well), leveraging your existing automation pipelines (like GitHub Actions). We'll also bring in the real life experience (and fun stories) of trying to run this in a constrained corporate Azure environment. By the end of this session, you'll have a strong understanding of how an effective secrets management strategy should work so you can decide on what and how to implement it for your own team (avoiding the inevitable late night manual key rotation that you put off until the next quarter to launch on time).