Ixchel Ruiz
Karakun AG
Karakun AG
Basel, Switzerland
Actions
Ixchel Ruiz has been developing software applications and tools since 2000. Her research interests include Java, dynamic languages, client-side technologies, and testing. As a member of the JCP Executive Committee, Java Champion, Oracle ACE Pro, Testcontainers Community Champion, CDF Ambassador, Hackergarten enthusiast, Open Source advocate, public speaker, and mentor, Ixchel is deeply committed to fostering inclusive and collaborative tech communities. She actively mentors aspiring developers and champions initiatives aimed at increasing diversity and accessibility in the technology sector.
Ixchel’s work is characterised by a relentless pursuit of innovation, a deep understanding of user needs, and an unwavering commitment to ethical technology development.
Ixchel Ruiz ha desarrollado aplicaciones y herramientas de software desde el 2000. Sus intereses de investigación incluyen Java, lenguajes dinámicos, tecnologías del lado del cliente, DevSecOps y pruebas. Java Champion, embajadora de CD Foundation, SuperFrog, entusiasta de Hackergarten, promotora de aplicaciones open source, conferencista y mentora, Ixchel viaja por todo el mundo (a veces virtualmente) compartiendo conocimientos; es uno de sus principales objetivos en la vida.
Links
Badges
Area of Expertise
Topics
All about dependencies
Modern software is built on dependencies. They accelerate delivery, extend capabilities, and allow teams to focus on differentiation. But every import is an architectural decision with long term consequences. Beneath the convenience of package managers lie transitive vulnerabilities, maintenance risks, hidden operational costs, license exposure, performance trade offs, and ecosystem fragility.
The real cost of adopting a dependency is the probability of failure multiplied by its impact. What seems efficient today can become technical debt tomorrow when maintainers disappear, APIs shift unexpectedly, governance models change, or security flaws surface deep in transitive trees. Systems that must live for years inherit not just functionality but assumptions about threading, memory, serialization, and lifecycle management.
In regulated environments shaped by the EU Cyber Resilience Act, dependency decisions intersect with secure by design and secure by default obligations, SBOM transparency, and supply chain accountability. However, dependency risk is not merely an infrastructure or compliance problem. It is a core software engineering concern. Architectural boundaries, upgrade strategies, abstraction choices, and test isolation determine whether a dependency can be replaced, patched, or contained when it fails. These are design decisions made in code, not policies written in audit documents.
This session reframes dependency management as strategic engineering rather than administrative hygiene. We examine how to evaluate long term sustainability, assess project health beyond popularity metrics, manage upgrade fatigue, design for replaceability, and build systems that remain adaptable as ecosystems evolve.
Dependencies are not downloads. They are commitments that shape system behavior, resilience, and long term ownership. This talk equips teams to choose them deliberately, responsibly, and with sustained engineering stewardship in mind.
Elevator Pitch
Every dependency you introduce is an architectural commitment that shapes your system’s risk, resilience, and long term maintainability.
This session shows why dependency management is a core software engineering discipline and how to treat external code as a deliberate, auditable design decision rather than a convenience.
CRA Meets Reality: Compliance in the Consulting Trenches
The Cyber Resilience Act introduces new expectations regarding software development, security and accountability. For consulting companies, implementation presents particular challenges. We develop software that we do not own, maintain systems that we did not design, and operate within customer processes, budgets and priorities that we cannot control.
Responsibilities are distributed, contractual boundaries are not always clear, and engineering teams must reconcile regulatory expectations with delivery commitments. The costs extend beyond tooling and formal processes, consuming engineering capacity that is rarely accounted for.
This session reflects on our experience of introducing CRA-related practices in a consulting environment. We will examine what has worked, where difficulties persist and which assumptions have been hard to reconcile with day-to-day engineering.
A central question is how to engage people. While compliance can be mandated, meaningful adoption requires more than just instructions, checklists and additional controls. Changing established practices, gaining acceptance and balancing competing interests remain substantial challenges.
We will discuss the lessons we have learned, the unresolved questions we have, and the possible directions in which we could move as CRA implementation moves from regulatory interpretation into engineering reality.
The Cyber Resilience Act is complex to navigate in consulting environments due to distributed responsibilities and external constraints. This session will share practical insights on overcoming these challenges, focusing on meaningful adoption beyond compliance checklists and on balancing regulatory demands with engineering realities.
The key takeaways are:
- Implementing the CRA in a consulting environment is challenging because software ownership and control are often external.
Clear contractual boundaries are essential, yet they are often lacking, which complicates the allocation of responsibility.
Compliance efforts consume significant engineering resources, extending beyond tooling and processes.
Successful CRA adoption requires cultural change and active engagement, not just mandates.
Balancing regulatory requirements with delivery commitments remains a persistent challenge.
Digital Sovereignty: Whose choices are we protecting?
Digital sovereignty is realised when organisations can make informed decisions about their data and systems, and implement them. This involves keeping essential services operational, adapting systems to evolving requirements, and switching providers when necessary.
But whose choices count? Management, engineering teams, and users may have different priorities. A decision that simplifies procurement today may restrict the options available to those maintaining or relying on the system tomorrow.
Drawing on our experiences and conversations with clients, we explore how to preserve meaningful choice within the constraints of existing systems, investments, skills, and commercial relationships. Which dependencies can we manage, and which could prevent us from acting when necessary? When does replacing a vendor improve our position, and when does it simply shift the dependency elsewhere?
We examine how open source, open standards and portability can support this goal, as well as the necessary skills, resources and clear responsibilities to transform potential alternatives into viable options. We also consider who should bear the cost of keeping those options open and how much independence is worth pursuing.
Participants will leave with a practical set of questions for identifying critical dependencies, assessing the viability of alternatives, and testing whether a plan B can be implemented. These questions help to connect technical decisions with organisational priorities and make explicit the choices that a system preserves, the cost of these choices and how long they are preserved for.
In the talk, we could use this as the main thread:
Whose choice? Who gains freedom to act, who is constrained, and who has to live with the consequences?
Which dependency? Which specific dependency affects our ability to act?
Can we act? Can we actually implement an alternative with the people and resources available to us, within a reasonable timeframe? What do we need to do today to keep the choices?
JChampions Conference 2023 Sessionize Event
DevOpsDays Tel Aviv 2022 Sessionize Event
JavaSummit IL '22 Sessionize Event
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top