This talk explores the landscape of AI coding assistants, from code completion tools to chatbots, and examines the implications of their adoption. The presentation will also highlight GovTech’s efforts in driving the adoption across the sector

Learn about the magic of developer platforms and how they defy the IT laws of physics: platforms spur innovation despite harmonization; they speed up development while assuring compliance; and they reduce cognitive load without restricting choice. But building such an in-house platform, or even deploying one, is far from easy. Gregor packages his experience in building platforms into a series of mental models and metaphors that will help you understand design decisions and trade-offs. You'll also find out how platforms are related to cars, submarines, and fruit salads!

In a rapidly evolving technological landscape with heightened security concerns, automating governance processes has become essential for organisations. This presentation explores how the Singapore Government has embraced an innovative approach to automate policy enforcement and streamline governance processes through technology. Through real-world examples and practical insights, attendees will discover how organisations can leverage Policy as Code to drive significant change, improve decision-making, and succeed in the digital era. Attendees can expect to gain valuable knowledge and insights on how to effectively implement ICT governance strategies using Policy as Code principles."

Agile Software development is a fun filled collaborative team sport that promotes adaptability and flexibility as the first-class citizen, but we continue to see challenges across multiple industries such as: - Lack of collaboration, resistance to change in adopting new ways of working - Ineffective and manual approach towards building software, accumulated shortcuts leading to massive and unmanaged technical debt - Inadequate ways of measuring productivity and efficiencies - Slow feedback loops - Command and control ways of working - Lack of engineering practices, inappropriate use of tools adding to burden -Last, but not least, following agilefall The goal of our talk is to share some practical ways to overcome these challenges through continuous delivery practices and meaningful metrics, and where AI can be leveraged to enhance efficiency. We will also talk about some blind spots e.g. misunderstood or misuse of matrices could lead to unintended consequences. Whether you're a developer, team lead, or manager, you will leave with a deeper understanding of meaningful metrics, practical engineering practices, and actionable insights to enhance their team's productivity and collaboration.

In web development, perception is reality. A website that feels fast is fast, no matter what the metrics say. Discover the art and science of perceived performance in React applications. We'll explore proven patterns and techniques used in large-scale codebases to create lightning-fast user experiences that lead to happier customers and higher conversions. Learn how to make your React apps not just performant, but feel instantaneous to your users. Topics include reducing/removing layout junk, better use of loading indicators, pre-fetching resources, leveraging the browser cache, image loading optimisation, and much more.

With increasing digitalisation, citizens are also increasingly vulnerable to malicious actors online. With the rise in scam cases in recent times, GovTech seeks to keep citizens safe from possible scams through the development of the Scam Website Classifier (rMSE), which automatically evaluates potential scam sites using their technical attributes and enables the Government to substantially scale its anti-scam efforts through the use of machine learning.

Accurate detection and mitigation of vulnerabilities found in application source code is part of the shift-left paradigm embraced in Whole-of-Government (WoG), where security efforts are initialised at earlier stages of the software development lifecycle. Given the volume and frequency of changes made to the codebase, manual reviews are impractical, not to mention inefficient, laborious and highly dependent on the experience of the reviewer. This has pushed for widespread adoption of Static Application Security Testing (SAST) tools to automate the process. Commercial-off-the-shelf SAST tools analyse the input code with a series of rules that are crafted with generic rules that are neither precise nor have a high recall. This led to more false positives than can be reasonably triaged and managed by the development team, while missing multiple vulnerabilities within the source code. This makes the SAST tool hard to use and depend on for important and actionable warnings as the accurate findings are few and far between, buried within the long alert list - a proverbial needle-in-the-haystack situation. The abysmal performance of commercial SAST tools can be partly attributed to their inability to keep pace with the increasing complexity of modern software applications that hinders a precise modelling by the SAST tool. To address these challenges in both source code modelling and poor detection performance, Project Titan aims to leverage the ability of LLMs to capture source code semantics to build a just-in-time vulnerability discovery tool. Preliminary studies by the team have pointed to the potential of LLMs to be an effective, language-agnostic platform for such a task. This solution will build on general-purpose and open-source models fine-tuned for the task of vulnerability discovery with publicly available data, before a contextualisation phase to adapt it to WoG source code. Project Titan is an attempt by the team to work on a multi-faceted challenge in the form of developing a large-scale, contextualised vulnerability detection tool powered by LLMs. This talk aims to highlight the thinking and process behind the tool’s conceptualisation. It will also include a section on the challenges that the team encountered during the development process, and the iterative nature with which these challenges have been addressed.

Every year, Singaporean-registered companies have to submit the salary data of their employees under the Auto-Inclusion Scheme (AIS) to the Inland Revenue Authority of Singapore (IRAS). Every quarter and every year, they also need to update the Ministry of Manpower (MOM) on changes to their workforce composition and complete a labour survey. Every month, the Central Provident Fund Board (CPFB) requires employers to submit details of their contributions to their employees. The data required for filing to the different government agencies are all stored in the companies’ payroll or HR software. How might we integrate with the HR and payroll software so that the submission process can be streamlined, reducing the manual efforts and saving employers valuable time and resources? Enter APEX, which could consolidate APIs from different agencies on its platform and facilitate secured access and integration by developers, including the HR and payroll software vendors. By housing all required APIs and submitting necessary information to the three agencies, APEX eliminates the need for manual submissions, reduces administrative workload, and promotes compliance with payroll-related regulatory obligations.

The Housing and Development Board (HDB) is actively pursuing its IT Transformation goals by leveraging the Cloud to achieve scalability and availability. As part of this initiative, HDB has adopted a distributed approach in designing its cloud architecture, as opposed to a shared common infrastructure or monolithic technology stacks that some may adopt. This shift towards distributed systems in the cloud offers increased flexibility, enabling each cloud product to architect and rapidly develop their resources and applications based on their specific requirements. Additionally, it allows for the isolation of risks within the boundary of a defined system. This approach also facilitates the utilisation of auto-scaling and on-demand services to balance performance and costs, while minimising the risk of a single point of failure that large shared technical stacks are susceptible to. However, the autonomy of distributed products also presents its own set of challenges, responsibilities, and overheads that each individual product needs to address. One such complexity is the need for continuous application and health monitoring, which scales horizontally with every cloud product released. The lack of a 'single-pane of glass' visibility across the board can be disconcerting to the organisation when the health and performance of their distributed workload are left in the dark. To tackle this challenge, StackOps, the Singapore Government Tech Stack (SGTS) product for continuous log monitoring, has provided HDB with a platform and tools to unify logs, metrics, and traces from distributed systems. The Cross-Cluster Search capability allows HDB's Security and Enabling teams to monitor all HDB Elasticsearch clusters from a single Kibana console, eliminating the need to toggle between various monitoring platforms. Additionally, this capability provides insights into the alerts' indices of the distributed clusters, which are alerts generated based on privileged or suspicious activities processed according to Elastic's security rules. By leveraging these native Elastic security features, HDB has been able to centrally curate its own privileged activity review processes and workflow for distributed product teams, saving costs from onboarding separate tools to manage and track the completion of log reviews, while ensuring compliance with privileged activities log reviews for all teams.

Successful UX design is not just about creating aesthetically pleasing interfaces but also about making informed, strategic decisions that align with both user needs and business goals. This talk "Designing Success Together: UX Strategies for Facilitating Decision-Making" aims to provide the audience with the essential strategies and tools to guide clients towards making smart, collaborative decisions. This talk will highlight on 4 key topics: Understanding client needs, Design thinking, Collaboration and Facilitations, and Prioritisations.

In the rapidly evolving world of AI, measuring developer productivity and experience requires more than just tracking output—it demands a holistic approach that captures the multifaceted nature of engineering work while keeping the focus on the driving force behind it all: the developers themselves. Enter the SPACE framework, a comprehensive model designed to assess developer productivity across multiple key dimensions. In this session, we’ll revisit the SPACE framework and explore how its principles remain not only relevant but essential in this new AI-driven era. We’ll discuss how AI is reshaping traditional workflows, influencing developer experience and why understanding these impacts through SPACE is more critical than ever. At its core, the framework ensures that the well-being of developers—the people behind the code—remains central to the conversation about productivity. You’ll walk away with practical insights on how to apply the SPACE framework to measure and improve your team's developer experience, while also navigating the opportunities and challenges brought by AI. Whether you're looking to optimize your team's focus time, gauge the effectiveness of AI-enhanced tools, or ensure collaboration and well-being in hybrid work environments, this talk will offer actionable strategies to help your developers thrive.

The Kanban Method is a modern 21st-century knowledge management method that produces agility and transformative improvements to organizations. Out of the six practices of the Kanban Method, there is one that is the most contentious to implement but it will bring you tremendous results. This session is delivered by an experienced Kanban Coach and Trainer who has experience in implementing Kanban Systems successfully in multiple organizations. You will learn why this practice is controversial, how it will help transform your team into a hyper-productive one with the maths to back it up, and how teams adopt this practice using an evolutionary approach. After this, you will never manage work in the same way again.

In today's digital age, public service agencies are increasingly creating, receiving, and working with multimedia assets. Effectively managing this growing volume of media content is crucial to fostering a coherent information ecosystem that facilitates flexible organization, efficient discovery, and seamless exchange of these assets and the insights contained within them. In this talk, we will introduce MediaDex, a content management platform that integrates intuitive user interfaces with smart processing capabilities to allow agencies to leverage the full value of their content. MediaDex brings together content repositories, applications and workflows across WOG to not only deliver immediate time savings, but also empower public officers to transform how they work with media.

Currently, there is huge interest in AI development using LLM models. Everyone is scrambling to build a proof of concept. However, rolling out AI apps or that cool chatbot goes beyond monitoring performance. Security, cost and more intangible qualitative measures like sentiment, truthfulness, bias, and toxicity play a key role. Amidst an evolving landscape, we look at what are the potential "golden signals" (inspired by Google SRE handbook) of AI apps that can help us better design and operationalize our ideas.

While DORA, SPACE, and DevEx provide valuable guidance, the growing number of frameworks can make it difficult to decide what to measure. Join this session with Abi Noda, CEO of DX, to learn about the recently published DX Core 4. The DX Core 4 is a unified framework for measuring developer productivity that encapsulates DORA, SPACE, and DevEx. Learn about how the DX Core 4 provides a standardized measurement approach that's useful at all levels of the organization—from the boardroom down to frontline teams.

One of Digital Ops-Tech Centre (DOTC) product is Pinpoint, pinpoint.gov.sg, a Digital Asset Management tool that helps in archiving and retrieving media items such as images and video. Pinpoint is open to WoG use, but is designed and developed at the start with military users in mind. In this talk, we would like to share how we did the user journey to designing and implementation of the collaboration feature within our application. A key highlight is how we had to adapt to the SAF's users way of working and the different layers and restrictions they require whilst collaborating with their media data. The talk will first give an overview of who is Pinpoint's users, what are we trying to solve, and how we solved it. We will further delve into our collaboration feature and how we had to adapt the engineering of collaborative space permissions to address SAF specific needs.

This session will focus on Security, Data Governance and Protection Strategies that an organisation should consider when embarking on a Data and AI journey, this includes identifying the potential risks and threats to Generative AI (GenAI) and Large Language Models (LLMs) and the necessary controls one should consider when experimenting or fully adopting AI as a part of your business.

Today, we journeyed through the shift from Low-Ops to No-Ops, tackling major challenges in IT Operations. We explored how tools like JSMOps help streamline alert flow, reduce alert fatigue, and speed up incident resolution, building a more resilient and efficient environment. A key part of this transformation involves the use of chatbots and LLMs to automate ticket responses and even create tickets when necessary. By handling routine inquiries and escalations, these AI tools can help eliminate the need for L1 support, freeing teams to focus on higher-impact tasks. As you consider your own workflows, think about how automation, AI, and better alert practices can move your team toward this vision of a proactive, resilient Ops culture."

Since last year, the integration of generative artificial intelligence (AI) into governmental systems has emerged as a transformative force, promising more efficient, transparent, and responsive governance. Despite the initial enthusiasm and investment, only a select few prototypes successfully navigate the complex journey to production-grade status. Transitioning Gen AI prototypes to scalable, production-ready solutions presents a unique set of challenges. This presentation aims to explore the journey from Gen AI prototypes to production-grade applications in government settings, drawing upon real-world implementations of Generative AI (Gen AI) technologies. By examining application patterns and sharing key insights gleaned from these deployments, attendees will gain valuable knowledge and actionable strategies for navigating the complexities of AI adoption within governmental organisations.

In the rapidly evolving landscape of technology, developer platforms are undergoing a significant transformation. This talk explores the future of developer platforms, focusing on the convergence of cloud-native services, resilient architectures, and AI-assisted development. We'll contrast the different needs driving the way we think about these platforms. While the application of Unix-styled small, single-purpose managed cloud services to modern cloud architectures will drive rapid deployment and scaled solutions, the use of Kubernetes ecosystem, with cloud agnostic data stores and networking, will alleviate the concentration risk of single point of cloud failure. Technology aside, we also need to break down silos between development, operations, and security to realize the original devsecops promise. The role of the central platform engineering team aims to simplify the developer experience. To make this change across our organisation, we need to continuously upskill, leverage enabling teams to spread platform-use know-how, and integrate AI as a super-charged assistant throughout the system lifecycle from inception to operations.

StackOps Observability Accelerator (SOA) speeds up the process of discovering the resources which are not being monitored in AWS environments leveraging on OpenTelemetry. Once these resources are discovered, configurations will be generated to deploy Elastic Agent which can be used to monitor these resources. These generated configurations massively decrease the time to enable observability across various services in AWS. Also, the discovery data can be used to improve observability by setting up alerts regarding changes in the system status.

Join us for an insider’s look into our adventure with DevConsole as we unveil how we supercharge SGTS Product teams. Discover how we tackled challenges and implemented innovative solutions to deliver faster and smoother experiences with a suite of common services that simplify the discovery, subscription, and management of SGTS Products. Catch a glimpse of how we're transforming complexity into effortless efficiency!

Government organisations have it tough: they need to deliver to increasingly complex requirements in shorter time frames while reducing risk, effort and cost. While this may well work with mainstream application areas by picking well-established COTS, it still creates skill and maintenance challenges with applicative silos based on different technologies and does not address more niche and innovative needs adequately. Neither does custom development using emerging technologies. What if the Singapore Government could have the best of both worlds: field-proven vertical capabilities and an ability to address bespoke requirements with a common modern technology base featuring three updates a year, enabling to work off a common skill set for a wide variety of applications? Join this session to learn how applying bespoke developer experience in a developer-friendly JavaScript-based Platform, which supports no-code, low-code to pro-code, can achieve capabilities and innovation including data modelling and management, AI, process automation, integration, security and more.

The Government on Commercial Cloud Plus (GCC+), launched in 2023, is the next-generation cloud hosting environment for Confidential Systems. This session will provide an introduction to GCC+, the services available and how to deploy systems on GCC+. Key Points Covered: 1) Differentiating GPC from GCC+ - Unveiling the enhanced features and pivotal advancements of GCC+ that set it apart from its predecessor. 2) GCC+ Services Roadmap: Pioneering the Future - Charting the roadmap for GCC+ services, revolutionizing the hosting landscape for Confidential systems. 3) Empowering Hosting Models - Showcasing how GCC+ empowers diverse hosting models, revolutionizing the landscape for hosting Confidential systems. This synopsis sets the stage for an impactful 101 session on GCC+.

In a microservice architecture - development and testing changes in microservice(s) without affecting stability of shared environments say staging, pre-prod, etc. is challenging. We are excited to share an approach to address it by provisioning a developer environment on demand, which only contains a subset of services that have code changes. Traffic to other services and datastores, which are not in the developer environment, is routed to a shared environment. With this, we can have multiple developer environments running in-parallel sharing the same shared environment - enabling the developer and/or feature development team to have an isolated environment to test out the code changes and rollout with confidence. Further we will share how 3rd party callbacks flows can be baked into the solution. Lastly, we will also cover how tools like, mirrord with enhance the effectiveness and experience further. With a prerequisite of service/application to be containerised, this solution can be adopted and we plan to share live demo as time permits. Overall these solutions and tooling in-practice have improved improving the developer efficiency by 20% while maintaining the stability of shared environments and keeping costs in check.

In today's data-driven organisations, efficiently retrieving and utilizing information from vast repositories of meeting notes is a critical challenge. Our team has embarked on implementing Retrieval Augmented Generation (RAG) to transform how users access and utilise meeting information within our organisation. Facing challenges such as diverse data formats and varied user queries, we developed a dynamic RAG system with agentic capabilities. This system leverages large language models (LLMs) to discern user intent, enabling it to execute appropriate actions—such as structured queries for specific data retrieval or summarisation for broader inquiries. Additionally, we employed dynamic chunking to optimise data processing and retrieval. This presentation will delve into the intricacies of our RAG implementation, showcase the innovative solutions our engineers devised, and provide insights for RAG practitioners looking to enhance their own knowledge retrieval systems.

Distributed systems create opportunities to improve resilience that are not addressed by traditional approaches to development and testing. To solve these unknowns in distributed systems, chaos engineering was created 11 years ago with the mission to create methodologies and tools that help build a culture of resilience in the presence of unexpected outcomes. This session provides you with an understanding of what chaos engineering is and what it isn't, where it provides value, and how you can create your own chaos engineering program to verify the resilience of your distributed mission-critical systems on AWS.

The rise of internal engineering platforms presents both opportunities and challenges. While platforms can enforce standards, boost efficiency, and optimize cloud usage, their success hinges on more than just features. This talk delves into the critical connection between platform design and developer experience (DevEx). We'll explore how to build platforms that address developer pain points, fostering a state of flow and minimizing distractions. I'll draw on our extensive experience building engineering platforms around the world to identify the practices, tools, and metrics that ensure your platform drives not just efficiency, but buy-in from both developers and executives. Many platform efforts fail because the value was never clearly articulated. I'll show how we model the tangible value the platform delivers, ensuring alignment with business goals and developer needs. This session equips you with a set of practices to maximize the value of your platform. We'll also briefly explore the future of platform engineering, including trends like platform orchestration and large language models. By the end, you'll be ready to tame the platform beast and empower your developers for groundbreaking achievements.