Technology and Friends

2024-11-14 · open the original ↗

• Kim's security company has stayed bootstrapped and founder-run for decades. He started it at Cornell with two college roommates, a political science and a hotel management major, before graduating in 1990; the first product ran on DOS 2.0 and locked and encrypted drives, files and directories on the fly. He says the three are still together 38 years on, took no VC or investment money, and now serve enterprises (Walmart, Boeing, Bank of America) and, more recently, government work he cannot detail. His closing advice is to start a company with friends who share your passion, vision and principles.
• Assume attackers are already inside, and hide the critical assets. Kim calls the end user a weak link that cannot be re-engineered. He says his lead architect, an ex-CIA hacker, saw two freshly started Azure VMs attacked more than 5,000 times over lunch, which led to a product (captioned as "Shepard") that removes the need for open ports without changing the application or server. He claims an unnamed agency averaging up to 10,000 attempted breaches and breaches a month went to zero after deploying it, and pitches it as additive to existing defences.
• AI scaled attacks first; defenders are using it to catch up. Kim says threat actors used AI to scale their attack vectors and were ahead at the start, while defenders now use it to learn user behaviour and spot a hacker's, alongside behaviour-analytics firms such as CrowdStrike. He puts the average time an attacker sits in a network before ransomware or exfiltration at three to four months; Giard adds that AI can track patterns spanning months that no administrator could.
• Education is a prime target: regulated data, weak defences, easy ransom. Kim says he has heard education is the third most attacked industry, because children's data is regulated like finance and healthcare data while schools have low cybersecurity resilience, and hackers are "inherently lazy". He says a sister school of the high school where he volunteers had its student information system data encrypted a couple of months earlier and paid a half-million-dollar ransom the next day; he adds that a small business with its order system down can be put out of business.
• Kim's nonprofit aims to bring hands-on STEM and cybersecurity to all students. He says his nonprofit, Quest, began as a San Jose STEM program, built with NASA a permanent experiment unit on the International Space Station with capacity for 8 million experiments, runs an underwater facility 20 miles off Monterey, and now teaches middle and high school students cybersecurity, including a Chicago event in Microsoft offices organized by Microsoft's Lori Kim. He argues cybersecurity needs communicators and managers, not only deep hackers, and that the biggest change he sees is in underserved students' confidence.

2024-10-30 · open the original ↗

• Career transitions strain mental health, so get two mentors. Aldan, who sits on the boards of two mental health nonprofits, says transitions are the most stressful periods of life, including layoffs and promotions from developer to manager without training. She urges a career mentor for networking and resume review and a technical mentor for getting unstuck, and says mentors push people to apply when only, say, 90% qualified. Giard raised women's reluctance to apply without meeting every requirement; Aldan says peer-reviewed studies repeatedly find it, and adds cultural pressure for perfection among the Asian Pacific Islander students she mentors for free.
• Knowing your core values tells you which jobs to refuse. Aldan turned down an entry-level front-end job in Las Vegas 17 years ago when the sites turned out to be pornography sites, and she says values also settle questions like working in the legal marijuana industry. Giard gives his own case: he left an e-commerce build because it sold cigarettes behind an age checkbox a child could tick. Aldan says enforcing such a boundary also builds confidence.
• Protect sleep and health during a job search, or interviews suffer. Aldan recommends at least seven hours of sleep, nourishing food, walks, coffee with a friend and time in nature, so that your nervous system is calm when the interview comes. Searching around the clock on four cups of coffee, she says, makes you interview out of desperation and exhaustion. Both agree that rejection is routine, often comes with no reason given, and does not mean you did anything wrong.
• Rehearsing a hard conversation makes the next one easier. Aldan and her LinkedIn Live co-host Leslie Martinich run a workshop with role-play of difficult conversations and salary negotiation. Her reasoning is that once the neural pathway has been created it only needs reinforcing, so each hard interview leaves you better prepared rather than more afraid. She reminds people they have "survived 100% of your worst days so far."
• Aldan is leaving tech-adjacent consulting to train in myofascial release. Her brand strategy clients, mostly mid-sized tech companies and startups, closed or lost funding during lockdown. After a seminar and retreats of one month and 10 days in John Barnes's style of myofascial release, she was told the advanced classes require a licence such as massage therapist, so she is in massage school four days a week. She says losing an identity built on 18–19 years of marketing work is hard, and she steadies herself with her core values: contribution, growth and community.

2024-10-01 · open the original ↗

• No two migrations are alike, and old directories hide unknown policy. Sharmer, a pre-sales principal solutions architect at Quest Software who talks to five to 10 organizations a week, says nearly 20 years of migration work has never shown him two identical projects. Twenty years of Group Policy Objects layered on each other leave customers unsure what the policies do and afraid to remove them, so the environment must be found, cleaned up and catalogued before any path to Entra.
• On-prem and cloud administration demand different skills. Sharmer describes friction between long-time AD administrators and cloud administrators, and a knowledge gap at C-level about what moving to the cloud means. He says Microsoft no longer offers an Active Directory certification, which he reads as a sign that AD is aging.
• Passwords alone are no longer secure enough. Sharmer credits the point to Giard's roadshow presentation and says Entra brings multi-factor authentication and conditional access that on-prem AD lacks. He says on-prem AD's vulnerabilities have been public for 20 years: a web search shows how to crack the directory file holding everyone's passwords. He says about 95% of the organizations he talks to want to adopt the cloud security model.
• Cloud-only is unrealistic for large organizations; start with endpoints. A CIO at a financial institution of about 130,000 employees mandated moving all of AD, workstations and identities into Entra in 12 months, which Sharmer says was not possible. Above roughly 500–1,000 seats, on-prem applications using NTLM or Kerberos, or homegrown code with hard-coded IP addresses, block a full move. He advises cloud-first for new applications, managing identities in the cloud, and moving endpoints off on-prem and hybrid join, where Intune is "bolted onto" an AD-joined device.
• Devices can move to the cloud without being wiped, he says. Sharmer says Microsoft's Autopilot route wipes the device, reinstalls the OS and can take up to five hours, and waiting for hardware refresh means about four years. Quest's tool, as he describes it, combines its long-standing re-ACLing of data and SID insertion with the bulk enrollment package from Microsoft's Windows Configuration Designer, keeping user data intact and taking about five minutes per device. He points viewers to Quest.com's AD modernization and migration pages.

2024-09-26 · open the original ↗

• Most data API code is copied CRUD that a tool should provide. Nixon, a Microsoft product manager on the SQL Server team under Azure Data who is in charge of Data API Builder, says the layer between client and database is mostly create/read/update/delete repositories, endpoints, unit tests and CI/CD steps copied from project to project, "almost a third of the code" in an application. Data API Builder (DAB) drops that data API on top of the database instead; he jokes it should be "CRUDE", with execute for stored procedures.
• It is zero code: a JSON file handed to a stock container. The file describes the database, which can be SQL Server, Postgres, Cosmos DB or MySQL, in Azure, AWS or on-prem. The container is a standard Microsoft one that runs on Kubernetes, Azure Container Apps, Azure Container Instances, or inside Static Web Apps, which hides the container for the many users who cannot run one. Clients in any language just call it over HTTP and get JSON back. Nixon says large customers whose policies now forbid talking to the database directly use it, sometimes with a citizen developer and no development team. The config can be built with a .NET CLI tool (dab init, dab add) rather than by hand-editing JSON, and a drag-and-drop configurator is planned for "hopefully sometime next year".
• REST and GraphQL can be served at once from one config. Nixon says this meets REST shops trying out GraphQL as well as GraphQL shops with one REST operation. He argues GraphQL saves mobile bandwidth with one nested query, such as an invoice, its line items and product photos, and can insert an invoice and its lines as one transaction with no custom endpoint. Entities can point at tables, views, stored procedures or NoSQL documents. A Cosmos DB and a SQL Server source can be queried together into one payload, and relationships can be declared even where the database has none ("we can make a crappy database look awesome").
• Security is set per entity in the config, not by the DBA. Each entity lists roles and their allowed actions; his example lets anonymous users create and read but not delete. Policies such as owner ID equalling the caller's user-ID claim restrict users to their own rows. Connections can use passwords, system- or user-assigned managed identities, or secrets read from environment variables, and telemetry goes to Application Insights, with more log sinks planned.
• DAB replaces only the CRUD, and it is free and open source. Nixon says business operations ("launch the missile") still need their own API, possibly still on Entity Framework, which DAB neither uses nor replaces. It has no Microsoft prerequisite and runs fully on-prem for some customers. The repository is at aka.ms/dab, where community sign-ups shaped the team's priorities for the coming six-month planning "semester".

2024-09-17 · open the original ↗

• Managed identities hand secret management to Azure, shrinking leak risk. Rodriguez, who works at Microsoft supporting enterprise Azure customers, says you set the permissions and Azure creates and rotates the tokens underneath. A connection string or access token can always leak by human error, and the question is the blast radius and the work to clean it up. He notes that GitHub has become better at blocking token uploads. Giard adds that his employer scans his repos and emails him about checked-in secrets, and that Teams blocks messages containing connection strings, which Rodriguez says can be tricked.
• Service principals, the mechanism underneath, are what make this painful by hand. Rodriguez compares them to on-prem service accounts. Their client secret expires after a maximum he is unsure of ("something like six months, nine months"), and he says Azure gives no reminder, so the first warning is users complaining. He says he relearned how to create one three or four times because he used them so rarely.
• The managed identity only covers Azure-to-Azure calls. For on-prem, AWS or Google resources you are back to managing secrets. His approach is to keep those in Azure Key Vault and read them with a managed identity. He warns against apps holding the Key Vault's own password, since that one leak exposes everything in the vault.
• Code passes a credential object instead of a connection string. In C# you construct DefaultAzureCredential and pass it to the service client. It walks a list of credential sources, and he recommends disabling the unused ones for performance. Alternatively, ChainedTokenCredential starts empty and you add only the sources you use. Giard calls the chained form more secure; Rodriguez says only that it fits zero trust better. Locally, it picks up the developer's Azure CLI, PowerShell or Visual Studio sign-in, so the developer personally needs the same permissions the deployed app's identity has.
• The up-front learning makes development easier afterwards. Rodriguez says each developer can stand up their own environment and grant themselves access, so nobody asks in team chat for an updated connection string and nobody is tempted to commit one. He blames Microsoft for early Azure samples that used connection strings. He says learn.microsoft.com documentation now defaults to the managed-identity version of the code, though not everywhere yet.

2024-09-10 · open the original ↗

• Developers should keep the web controlled by its users, not corporations. Stahl says the issue is not corporate control as such but control by someone other than us; on Mastodon, open-source W3C-based software anyone can host, each instance states its own moderation policy, and a user who dislikes it can move all their content and social graph to another instance or their own. He urges POSSE (publish on your own site, syndicate elsewhere), suggesting self-hosting Mastodon from ready-made container instances on Azure under your own domain, so every piece of content has a canonical URL; Giard adds that the $150 monthly Azure credit in an MSDN subscription would cover it.
• ActivityPub can describe any stream of activities, not just social posts. Stahl describes ActivityPub, a W3C spec he puts at version 2.0, as actor–activity–entity messages ("David posted a photo", "Barry liked it") that are easy to extend, with ActivityStreams, in his account, defining the APIs; a Mastodon instance is an implementation of those APIs plus a data store. He floats, without being sure it makes sense, publishing his car company's field advocates' activities (such as fuelling a vehicle) in that format and showing them on a big board through a Mastodon client.
• Fediverse apps interoperate, so cross-posting to every service becomes unnecessary. Mastodon (microblogging), PixelFed (photos) and WriteFreely (blogs) speak the same protocol, so a Mastodon user can follow a WriteFreely blog directly. Stahl says his static GitHub Pages blog could post to his Mastodon account as a GitHub Actions step, or have its own presence (Cognitive Inheritance) that his account follows and boosts; Giard, who copies and pastes each post to Mastodon, Facebook and LinkedIn by hand, summarizes this as push and pull models.
• The Fediverse could save democracy because nothing rewards outrage. Stahl argues engagement-driven corporate platforms profit from anger and push users to extremes and misinformation, while Fediverse feeds are chronological, with no algorithm, no universal policy and no single owner who can boost or silence voices. Governments cannot remove it either: a group whose instance sat on Afghanistan's .af domain was banned by the Taliban, who control the DNS, but could move the instance elsewhere, which he says suits organizing direct action.
• It probably won't, through inertia and missing money, unless technologists act. Stahl calls this a warning rather than a prediction: network effects favour incumbents, and though each upset (Brazil blocking Twitter after its owner refused to appoint a legal representative there) brings an influx, he has an order of magnitude more contacts on Twitter, Facebook and LinkedIn than on Mastodon, and the software is largely a hobby with no financial incentive. He asks listeners to contribute code, reviews, documentation, moderation or money, to build on the open APIs as developers did on Twitter's before it closed (his own idea is an activity-stream bot to "radiate intent" to coworkers privately), and points to a governance report, published "last month", backed by the Digital Infrastructure Insights Fund, that studied which Fediverse governance policies work.

2024-09-04 · open the original ↗

• Pull-request reviews serve two ends: quality gating and knowledge sharing. Dixon, a director of web and mobile development at the agency VML, says the gate keeps changes within a project's architectural constraints. Her examples are rejecting an unmaintained third-party library where the rule requires maintained, unit-tested ones, and catching a React dependency array that triggers an infinite loop. She prefers "better practice" to "best practice", because best is relative.
• Reviewing active pull requests is how she onboards fast. She says developers typically take six to eight months to know a codebase, but her agency contracts run three to six months. She reads the pull requests because that is the code being actively worked on, and that is how she finds things like helper functions. She did not write the codebase of over 30,000 lines that her team asks her about; she read as much of it as she could.
• Skipped reviews cost more time than they save. She says a pull request should rarely live beyond about 48 hours, and longer ones point to process problems. Her example is a car-service scheduling client with three entry points: the dealer's website, the owner's portal and an app, including in-vehicle. They share React components, so a size change made for the in-vehicle or phone screen silently broke desktop. She counts work that breaks production as not done. She also wants changes small: about 10 files at most, two or three for a single component, because 88 changed files take her a long time to review.
• Reviews go faster with a team mindset and agreed norms. On one team she introduced an experiment in which everyone unblocks the team first thing each morning, before stand-up across time zones, by reviewing open code. She wants a few designated reviewers who rotate, so the burden does not fall on the lead or architect. She asks whether a solution is good enough within the project's constraints rather than her favourite, and links to the existing helper rather than just rejecting a rewrite. Authors need not accept every suggestion and should discuss them. The other reasons people skip reviews, she says, are reviewing outside their own stack and juniors afraid to review seniors.
• Her review routine starts from the ticket and reads code bottom-up. She uses a PR template that links the ticket ("if there's not a ticket for it, why are we working on it?") and checks that the change solves that scope. She may pull the branch and run it locally, since "works on my box" is not acceptable for enterprise customer-facing sites. She opens the smallest files first and ticks GitHub's "viewed" box, then reads from the bottom up, a habit from English essays, so her brain does not fill in missing words. She traces logic such as a continue button's validation and checks accessibility, such as close buttons without labels and carousels without arrows. She also checks that the design system's styles and the existing custom button are used rather than new ones.

2024-08-30 · open the original ↗

• Marsman's Office of the CTO job is technology transfer and demos. At Microsoft she explores new OpenAI models as they arrive and works out which product groups and field staff need to know about them. She also helps Fortune 100 strategic partners, among them Etsy, whose CTO and search engineering head presented with her at Build 2024, and she is Kevin Scott's official demo engineer. She likens the role to a grad student serving a visionary professor: running experiments toward his vision and bringing insightful papers back to him.
• Hands-on, crowd-sourced prompting taught her DALL-E's limits within a month. She joined the office about two years before the recording, as DALL-E 2 released, and ran "30 days of DALL-E" on prompts solicited on Twitter; by the end, she says, she could tell from a prompt whether the model would handle it well. A later C# game on her GitHub shows an image and has the player guess its prompt. It grew out of coaching a colleague to add detail (viewpoint, empty or full field, a 1920s–30s look) to a bare "baseball stadium" prompt, and she says it is still wired to DALL-E 2.
• Chaining model calls produced a genuinely useful end-to-end copilot demo. For Scott's Build 2023 keynote she automated the social posts he hates writing for his podcast, Behind the Tech. Audio went through OpenAI's Whisper for speech-to-text, a local model extracted the guest's name, a Bing web search fetched a bio, and GPT-4 wrote the post plus a prompt for a DALL-E image; a tool written with the LinkedIn team then posted it. She presents it as the power of orchestration layers such as Semantic Kernel and LangChain.
• Small local models enable uses too costly for cloud LLMs. Her Phi-3 vision demo puts local recycling rules in the prompt and says whether an item held up to the camera can be recycled. She ran it on a laptop GPU and tested it offline on her flight to Build with a plastic cup, an Aquafina bottle and an aerosol can; it was cut from Build 2024 for time but is on her GitHub. Her argument is that nobody would pay GPT-4-class prices at the scale of public-park bins or a recycling center, while a local model removes the cost, latency and network dependence.
• Her boss pre-empted her worry that a staged mistake looked bad. She got access to GPT-4o's audio-in, audio-out mode only at 1 PM the day before the Build 2024 keynote, and built a demo of asking it for help with a simple Python error. She feared that erring deliberately in public reflected badly on women in tech. She says Scott, unprompted and without his comms staff in the room, proposed saying on stage that she would never make that mistake in real life, and she gives this as the reason she trusts him.

2024-08-02 · open the original ↗

• Container queries style components by their container, not the viewport. Riviere calls them the next step in responsive design, now termed "intrinsic design", and suited to component-based front ends built with React or Vue. He believes they now work in all browsers, with Firefox the last to catch up.
• One container query can replace several media-query breakpoints. In his live demo a pagination div is declared container: pagination / inline-size, and @container pagination (max-width: 200px) hides the list of page links and shows a select dropdown instead. Placed in a fixed 200-pixel sidebar, the same component always shows the dropdown. On a Shopify cart sidebar he says an icon grid that moved between one and two columns would have taken four media queries but needed one container query.
• CSS nesting now works natively in the browser. Riviere says the nesting of styles and media queries that once needed a preprocessor such as Sass or Less is now plain CSS. He nests the container query inside the .pagination rule.
• CSS is strongly typed, and @property lets you declare types. His example is that CSS ignores a pixel value assigned to a colour. With @property he defines --background-color with a colour syntax, inherits, and an initial value of white, then applies it to html and main.
• Style queries act as an if statement on a custom property's value. His demo turns a component hot pink when --background-color is black. He was unsure of support at the start, and a reference page said Firefox lacked it. Live documentation then said every element can be a style query container, and he concluded it should work in every browser today. He says it is limited to custom properties for now, with the goal, "I believe", of supporting any property. Giard suggests a use: when users set their own theme colours, the components can keep contrast automatically.

2024-07-29 · open the original ↗

• Responsible AI is a social problem, not only a technical one. Frost, a senior developer at CREMA in Kansas City who sits on the Center for Practical Bioethics' Ethical AI Council, says privacy, bias and value alignment can only be handled by a socio-technical approach that puts "a lot of different people in the room". Giard argues technology is just a tool for good or bad people; Frost agrees, but says AI moves fast enough that its consequences can reach further than earlier tools.
• AI's history shows we may be measuring success wrongly. Frost traces the idea of an artificial person back to the myth of Talos (around 750 BC), 1500s clockwork automata and Vaucanson's 1700s digesting duck, before the term was coined in 1956. She asks whether replicating humans, as the Turing test, chess, Go and sonnet-writing do, is the right goal, and argues AI should augment what people do rather than replace things that are inherently human, like creativity.
• Fear of job loss and AGI crowds out today's problems. She says some job displacement always happens and that forecasts of what will be replaced have historically been wrong. Giard adds his own career advice: watch which skills will be in demand five years out, though he grants AI's pace makes retraining harder.
• Governance should be proactive: consult domain experts before coding. Frost says a developer building a healthcare app needs doctors, health-tech people and legal input as stakeholders, thinking about impact at one, five and ten years. Governance to her means guardrails, measuring fairness and bias, knowing data provenance and building explainability in up front. She expects the rest of 2024 and the next few years to be "a wild ride" for regulation, with state rules from Colorado and California putting borders on technology that has none.
• LLM bias is an error worth understanding, not reality to accept. She cites "mid twenties" of fairness metrics, a number she hedges, and says no single fix exists. Her examples: a story about an engineer comes out male, and one about an engineer named Michelle turns into a story about a woman in a male-dominated field. When Giard says such stereotypes are grounded in the data, she answers that prejudice is a human error and that understanding the errors we feed a model is how it could "do better than us".

2024-07-26 · open the original ↗

• Bitnami gives developers ready-made open-source building blocks. Salmeron, a staff engineer on the Bitnami content team (VMware, now Broadcom), describes a free catalog of more than 200 applications and components, including PostgreSQL, MariaDB, Redis, MongoDB and WordPress. It ships as OVAs, cloud images, containers and Helm charts, so a developer can run something like helm install for Postgres instead of configuring it by hand. He says that historically cloud providers paid Bitnami for marketplace listings while users were not charged.
• The paid Tanzu Application Catalog serves platform operators. Salmeron says enterprises need control of licences, software bills of materials, known vulnerabilities and compliance checklists such as STIG, which he calls "a very, very painful process" to do by hand. The open-source catalog uses only Debian, while Tanzu lets a company build the same catalog on Red Hat 9, Ubuntu 22 or its own hardened base image. He points to Log4Shell, when many companies could not tell whether they were affected, as the case for per-component SBOMs.
• Operators curate the catalog and developers pull from a private repository. An operator picks the applications and operating system and sets a target repository. The system pushes container images and Helm charts there in OCI format, and developers use it as they would Docker Hub. He says the charts follow community security checklists, so tools like kubescape and kube-bench report the essential security features as configured, and OVAs are available for teams not on Kubernetes.
• Vulnerability-exchange documents separate scanner noise from real exposure. Salmeron says scanners such as Trivy and Grype often return "terrifying" lists that users cannot interpret. Bitnami bundles analyses saying which reported CVEs actually affect each application, so five critical findings can drop to zero once the document is applied.
• An in-house operating system can get closer to zero CVEs. He says the team cannot do much about Debian, Ubuntu or Red Hat because it does not own them, but has full control over Photon OS, a lean in-house image. He recommends it to vulnerability-sensitive users as part of the commercial Tanzu offering, his employer's product.

2024-07-23 · open the original ↗

• Source generators make code generation part of compilation itself. Bock, a staff software engineer at Rocket Mortgage after almost 25 years as a consultant, says that unlike older tools such as CodeSmith or T4 templates, a generator plugs into the Roslyn compiler pipeline. It runs whenever code changes in Visual Studio or Rider and also under dotnet build at the command line. It can work from the project's existing C# or from "additional files" such as a JSON data file. The feature is C#-only and purely additive: it can add code to a project but never edit existing code.
• The output is ordinary C# you can read and debug. Bock counts this as an advantage over IL weavers such as Fody, which rewrite the binary and need knowledge of intermediate language. Generated code is compiled into your assembly and you can F12 or step into it. By default it is not written into the project folder, which he thinks keeps it out of the Git repo; a project-file setting saves it to a chosen directory. Anyone who clones the repo and builds gets it generated afresh.
• Consuming a generator is easy; authoring and packaging one is not. Using one, such as his own compile-time mocking library Rocks (an alternative to frameworks like Moq), means referencing a NuGet package and adding attributes. Writing one means implementing a single interface, IIncrementalGenerator, with a single method, but it requires understanding syntax trees and semantic models and building C# inside strings. He relies on raw string literals for this, which he thinks arrived in C# 10, and on Microsoft's helper libraries for input/output tests. Packaging has "weird little idiosyncrasies": any dependency the generator itself needs at compile time, and that dependency's own dependencies, need special handling. His lesson is to minimize generator dependencies, and he points to Microsoft's two "C# source generator cookbook" documents.
• A badly built generator slows the compiler, so design for caching. Bock says to avoid the original ISourceGenerator interface, still referenced three years on, because it did not plug into the pipeline well. With IIncrementalGenerator, if the generator builds an immutable model with value equality (records give this out of the box), the compiler skips regeneration when a change yields an identical model. Without that, the generator regenerates the same code on every change. He also says never to make REST or other network calls in a generator: relative to the compiler they are a big performance hit, and they can fail.
• .NET itself now ships generators, the regex one being his showcase. Marking a partial method with what he recalls as a "generated regex" attribute makes the generator write the regular expression's implementation. He says this is typically faster than runtime regex, is AOT-friendly because unused generated code can be trimmed, and gives a hover description of what the generator thinks the pattern does. Its source uses tricks such as goto statements for speed. He also cites community dependency-injection generators that surface IoC registration mistakes at compile time rather than runtime. To learn more he recommends the cookbooks, a Discord channel where Microsoft compiler-team members answer questions, and reading the source of the .NET regex generator, Rocks or others.

2024-07-19 · open the original ↗

• Good Copilot prompts give context and keep the conversation going. Garcia, managing director of Xebia's US Microsoft services line, says "give me a loop" gets a generic loop. Stating your role, the application's tiers and microservices, the target (Azure), the language and the goal gets an answer fitted to the scenario. He says not to accept the first answer but to follow up ("yes, and also this") until it is right, and that the main way to learn is to keep trying rather than give up after one miss, with GitHub's Copilot enablement videos as a supplement.
• His most useful prompts scaffold, explain or debug code. His examples: ask Copilot to scaffold a cloud data-fetching utility for Azure in a named language, and it builds the whole file structure; ask it to explain a coworker's five-year-old code instead of spending a day reading it. In his own recent code it found an infinite loop he could not locate and pointed to a variable that needed initializing. Giard adds his own use: a starter for a language or library he has never used.
• Copilot's context depends on where it runs and which licence you have. In VS Code it learns from the files you have open. Garcia says Copilot Enterprise on GitHub.com sees the whole repository, so slash commands such as /doc, /explain, /tests and /generate follow the codebase's naming conventions and reuse its existing pieces, such as connection strings. He describes individual, business and enterprise tiers, with enterprise adding controls such as blocking suggestions that could raise copyright problems.
• Copilot won't replace developers; developers who use it will pass them. Garcia says the developer stays the pilot, setting intent and architecture, and that Copilot will not turn a junior developer into a senior one. He compares it to the modern IDE of about 25 years ago: optional, but faster. He predicts that in a year or two developers who have embraced it will get the jobs others do not. If it gets you "maybe 75%" of the way, he says, you spend the rest on the business problem, a point Giard backs with his own story of a manager who said good developers should write the code themselves.
• Copilot is heading into security fixes and browser-proposed pull requests. Citing what GitHub and Microsoft showed at Build "like a month ago", Garcia expects Copilot to work with GitHub Advanced Security to fix flagged issues. He also describes GitHub Copilot Workspace, where you describe a change in the browser and Copilot proposes a pull request that you approve.

2024-07-16 · open the original ↗

• Developers build for power users, but most users are novices. Schuster, of the South Carolina UX consultancy True Matter, says most user errors are about getting into apps at all. Novices struggle to tell whether they are logged in, two-factor authentication makes them angry, and even corporate power users on single sign-on report more than typical frustration. He says developers tend to think "login, I've got a module for this, done".
• Good UX answers basic questions so users never stop to think. Users need to know where they are, what they can do, what the rules are for an input, and what went wrong and what to do about it, in plain language. A field label like "ID" is not clear to most people. One pause is small, Schuster says, but five to ten of them become friction that frustrates.
• Watching real users fail is what changes a team's mind. Schuster runs task-based tests with developers watching behind one-way glass. He says they move through the Kübler-Ross stages, starting with "this person's dumb". By about the third user with the same problem the team accepts it is a design problem, and after that the fixes need no argument and are often small. He also says teams that claim to know their users are often off base, building what they or their stakeholders want.
• If you can't get access to users, find them anyway. He calls an organization that insulates its team from users "basically guessing", and says a customer wish list almost never equals what users want or need. His advice is to observe users without asking permission, perhaps on a learning-and-growth budget, as his own firm did in its early days. Otherwise, find an organization that lets you.
• Speed is the shared ground between UX and developers. Schuster says slowness has been users' number one complaint for his whole career, so his researchers look for the number two complaint. He recommends Don Norman's The Design of Everyday Things as the first book on UX. He urges developers to learn a little UX, and people on the humanities side to learn a little development, so both can "talk at the same table".

2024-07-12 · open the original ↗

• Model data around your queries, and choose the partition key early. Cocchi, a PM on Microsoft's Azure Cosmos DB team working on the .NET and Go SDKs for the NoSQL API, says to denormalize, for example by embedding a person's addresses in the person document. Cosmos scales horizontally by adding machines, and the partition key must be chosen when a container is created. The logical partition is the property value, such as a city, which is hashed to a physical partition, the machine that stores it. A good key reduces cross-partition queries but cannot eliminate them.
• Size throughput in request units before you build. A point read, one item fetched by ID and partition key, costs about one RU for a 1 KB document. Cocchi points to the capacity calculator, which takes document size and requests per second, and warns that under-provisioning shows up as 429 throttling errors.
• Direct mode is fastest, but gateway mode limits open connections. In direct mode the .NET and Java SDKs connect straight to the backend nodes, opening four connections per physical partition, one per replica. With hundreds or, for some customers, thousands of partitions, that adds up, so the gateway's extra hop can be worth it. She says the client is heavy, carrying routing, caches and service logic, so create it as a singleton: one client per account for the application's lifetime.
• Consistency choices trade freshness against latency, especially across regions. Cosmos offers five modes. Strong consistency commits every write to all replicas, in every region, before acknowledging it. Cocchi recalls a limit of "like 5,000 miles or something" for strong consistency with multiple write regions. Bounded staleness lets reads lag by K versions or T time, and throttles writes if the lag exceeds those bounds. Session consistency lets a user read their own writes. She recommends at least two regions for any production app, and says the point-read SLA is under 10 ms.
• Use diagnostics and OpenTelemetry, and write your own retry policy. Every SDK request returns a diagnostic string listing retries, the regions contacted and the handler pipeline; support will ask for it when the P99 is affected. The .NET and Java SDKs now emit OpenTelemetry traces, with latency thresholds that capture diagnostics automatically and send them to tools such as Application Insights. The SDK retries 429s only a limited number of times, so she says the application should still handle cases such as 408 timeouts from a faulty pod or high client CPU. She was due to cover these topics at VSLive Redmond in August.

2024-07-09 · open the original ↗

• Outsourced identity is now the norm, so integration is the hard part. Sempf, an application security architect, says he long told developers not to build their own identity system: code against corporate AD or use Google or Facebook OAuth so they never store passwords. He says providers such as Okta, Ping and Microsoft Entra now do this at scale. The risk has moved to integration, such as moving a 2004 Spring MVC app with its own password store onto Ping. Vendors' sample code also takes shortcuts, like repeatedly sending basic-auth credentials in a header, which he says is unsafe even over TLS.
• Misconfigured cloud systems are a frequent finding in his assessments. The open S3 bucket protected only by an unguessable URL is his classic example. Sempf says the expert who knew how to tune the on-premises servers, Cisco gear and WAF no longer applies once everything moves to Azure. Configuration has to be relearned, mistakes are "rampant", and providers keep changing their back ends.
• SQL injection never went away; he now finds it in GET parameters. ORMs parameterize queries, but teams hand-concatenate SQL when the ORM falls short, for example searching two companies' products after an acquisition. Because the examples always show form posts, Sempf says developers assume query-string parameters can't be injected, when they are easier to inject and less validated. He used to find one or two injections a month and lately one or two a week, all in GET parameters. The only real fix is a parameterized query at the database layer.
• Open source is a trust chain that few people examine. Beyond API keys and connection strings checked into public repos, Sempf points to dependency chains four or five deep, kept up by volunteers without oversight. He calls the XZ Utils backdoor, inserted by a community helper after the maintainer fell behind, a nation-state attack three years in planning that was caught by "blind luck", when someone noticed a timing change in performance testing. Giard counters that closed source also needs trust, but has more eyes on it.
• Use actionable security guidance and fix one thing at a time. Sempf says the OWASP Top 10 is mostly for persuading a CIO to fund security, while the Proactive Controls are its how-to side. He advises picking one control and improving it rather than being overwhelmed. For developers curious about the security world, he recommends a local BSides, of which he says there are 190 worldwide, usually with 300–400 attendees, over the fire hose of DEF CON.

2024-07-05 · open the original ↗

• Client demand for AI moved from strategy, to pilots, to production revenue. Pendse, ThoughtWorks' global director for AI strategy, says clients first asked whether generative AI was a threat or an opportunity. Next they wanted a handful of POCs, which at many companies became hundreds. Then they wanted platforms to standardize data versioning and security, and now they ask how to put these into production and make money from them.
• Easy RAG demos inflate expectations that production can't meet quickly. Dragging PDFs into a web tool yields a chatbot, so executives expect enterprise-wide scale "in another two weeks or two months". Pendse says security staff have to learn AI, and AI staff have to flag risks, to catch AI-specific issues. Those include whether a cloud agreement protects the data, staff uploading data classes that aren't allowed, and tools that by default use prompts to improve the model. A shared platform lets the enterprise make such decisions once instead of in every POC.
• AI makes money by freeing highly paid experts from mundane work. He calls RAG for knowledge access the first, perhaps only, enterprise generative-AI use case with traction. He cites a client team's "search, ask, do" progression: find the source document, then a chatbot, then agents that act. His examples are drug-discovery researchers reading papers and cleaning data, and financial analysts reading thousands of 10-Ks. For a question spanning proteomics, genomics, immunology and radiology, he says a multi-agent system fine-tuned per field could answer faster than five or six human experts.
• Cost, missing baselines and compliance slow adoption. Per-token spending scales unpredictably with demand, though Pendse notes prices are falling as OpenAI cuts costs and competition grows. Many firms can't quantify value because they never measured a baseline, so "the data house" has to be in order first. In financial services, he says the Federal Reserve's SR 11-7 requires traceability of the data used to train a model. LLM vendors won't provide that, so firms must either persuade the auditor or regulator or train their own model at great expense.
• Weak CI/CD practice gets worse once AI is layered on top. Pendse says continuous integration for AI is "one order of magnitude more complex". Teams that keep long-lived branches and rarely merge will see the same chaos spread to model and data versions. He argues fixing those processes is the route to showing traceable value, such as cost savings or new markets.

2024-07-02 · open the original ↗

• Enterprise AI demand centres on conversational agents where security is simple. Kotvis, a principal architect in Insight's AI-enabled apps and data group, says organizations want knowledge bases and help desks where role-level security is not in play. He sees enrolling enterprise security into AI, so people don't get information they shouldn't, as the biggest opportunity.
• Every legacy app gets rehosted, refactored or re-envisioned. Kotvis says scarce mainframe talent and the pull of cheaper, independently scalable cloud infrastructure drive modernization, especially in finance and insurance. After sorting an estate into commercial and custom apps, a custom app takes one of three paths. Rehosting is lift-and-shift with adjusted connection strings. Refactoring makes a working app able to use PaaS SQL or a distributed cache. Re-envisioning rebuilds an app that no longer delivers value, starting with UX and visual design. Of 100 apps, he estimates 5–10% are re-envisioned and 10–20% reach end of life.
• Finding people who understand the legacy system is the biggest delay. Old schemas hide "sins", such as columns tripled as first_name_1, first_name_2 and first_name_3, and cryptic mainframe abbreviations. Kotvis says that with full information and available stakeholders, projects would take half or a third of the time.
• Pragmatic 80/20 design with escape hatches beats dogma. Kotvis uses Entity Framework for most work but plans for the 10–20% that needs hand-written SQL, such as common table expressions or recursion, saying "dogma is kind of going to kill any momentum". He applies the same thinking to choosing tools like Apigee, MuleSoft or Logic Apps, and builds modularly so multi-cloud moves or acquisitions don't force a rewrite. He predicts brownfield skill will be highly valuable for the next five to ten years. Giard adds his own experience porting a .NET 1.1 app with help from Michael Feathers' book on legacy code.
• Dev containers and 12-factor principles make environments predictable and portable. Kotvis runs about 50 dev containers on a Linux server in his basement through VS Code, which he compares to GitHub Codespaces. They keep multiple Go or .NET versions apart and end "works on my machine". He uses the 12-factor app principles as guidance and notes that containers move easily between Azure Functions, Container Apps, Container Instances and App Service. Even so, shared files, caches or a socket backplane still need deliberate design.

2024-06-28 · open the original ↗

• Multithreaded Income is personal finance aimed only at technologists. Griffin, independent for 13 years, started it in September 2023 to talk about using tech skills to build several streams of income, prompted by a job market he says has been "deflating" for the past year or two. He aims for weekly episodes but often manages one every two weeks, and had about 40 out at recording.
• A frugal audience is very hard to sell to. His earlier podcast, Two Frugal Dudes, grew somewhat popular but earned perhaps a couple of hundred dollars, enough to pay the accountant, so it was shut down. He took from that the decision to narrow the new show to technologists and software developers.
• His guests fall into a few kinds of income thread. Moonlighters freelancing beside a day job, people who go fully independent after quitting or losing a job, and builders of SaaS or installed products, which usually start by solving their own problem. Some of those businesses have passed the million-dollar mark; one guest's conference stage timer earns about five figures a month with one developer. Others run conferences as businesses, write books or make courses.
• The show covers the business of software, not the tech. Griffin says nobody pays because a product is written in TypeScript or C# or built on Next.js or Laravel; they pay for the problem solved. He wants to cover what developers avoid: pricing, finding first customers, getting feedback and marketing.
• The plan is audience first, paid offerings later. The podcast earns nothing yet. Griffin intends to follow it with coaching, from group "masterminds" with built-in accountability up to one-on-one sessions, and with courses, starting with one on going independent as a consultant. He says he has not built those yet because he does not have an audience to sell to.

2024-06-25 · open the original ↗

• RAG lets an LLM answer with what your organization uniquely knows. Bogue defines retrieval augmented generation as bringing internal content to the model at query time, so answers use the organization's knowledge and language. He calls Copilot a wrapper around the model, which today is ChatGPT's, and says Microsoft could swap or add models without users having to care.
• M365 Copilot already does RAG by sitting on Microsoft Search. Bogue says it turns your prompt into a search query, retrieves results and generates a response from them. Because it goes through search it keeps existing permissions, so content you cannot open in search, such as an executive's salary, never reaches the answer. He found the Microsoft365.com portal chat the best way to use it at the time of recording.
• Better RAG answers come from tuning search. When answers go wrong, Bogue's remedy is search work rather than Copilot work: marking content as authoritative, building information architecture, or tuning search directly where no architecture exists. Connectors such as one for ServiceNow put line-of-business data in the index too. He expects questions like "what did we last sell this customer?" to become possible as small technical gaps close.
• Bogue credits Microsoft's responsible-AI handling, but calls it unfinished. His suicide-prevention research work gets shut down whenever the system does not read the word "suicide" as prevention, which he calls appropriate. He calls the commitment not to train models on a tenant's content or queries "huge", and says bias keeps creeping in however models are trained. His view is that AI will change jobs more than eliminate them, taking work such as Excel cell manipulation and slide design.
• Readiness for Copilot means change, content access and information hygiene. He points to a paper he wrote for AIIM, "Organizational Readiness for Generative Artificial Intelligence", still a draft then, which the host describes as about 30 pages. It covers change management so staff are not afraid, getting priority content into search so Copilot can reach it, and information architecture as hygiene.

2024-06-21 · open the original ↗

• Observability means getting ahead of problems rather than reacting. Crist, a solution architect in Elastic's partner organization, says teams traditionally waited for a "website's down" call, then pulled OS, database and firewall logs and CPU, memory and disk metrics separately and matched them by timestamp, sometimes in a spreadsheet. He defines observability broadly: uptime and performance, the customer's experience on a site, and successful rollouts.
• Logs, metrics and traces belong in one place under a common schema. Crist says Elastic began as search over petabytes of unstructured data; users started ingesting log files into it, and Elastic built tooling around that. Its Elastic Common Schema, which he says Elastic has donated to open source, keys on timestamp plus common fields such as host and IP address, so engineers need not switch tools. He says it also covers Kubernetes pods and containers.
• Traces and machine learning surface anomalies before outages. Traces show latency between services, normally 7–25 ms in his example, jumping to 100 ms or two seconds, and service maps show which service eats the most of a five-second response. Crist says Elastic ships "three or 400" machine learning jobs for anomaly detection, and correlation analysis finds which fields differ when a log rate goes from 100 to 10,000 entries a minute. Security examples include logins at 2 AM from users who log in 8 AM–6 PM, and data leaving for an unusual country.
• Elastic's AI assistant applies RAG to logs, knowledge base and business data. Crist describes asking in plain language whether an error matters or to summarize today's alerts, with the answer built from the customer's logs, metrics and traces through a model such as Azure OpenAI. Resolved problems go into a knowledge base for the next engineer. Customers adding revenue data and service-level objectives can ask the revenue impact of an outage, in his example $5,000 a minute; automated responses to alerts are what he sees as the future.
• Synthetic monitoring adds the user's view to the service's view. Crist says the roadmap includes scripted jobs that simulate a user, such as a Chrome browser in Japan searching a product and checking price and inventory, run every five minutes or hourly. He says this matters most for multinationals running thousands of pods worldwide. He also notes Elastic is API-driven, has a basic open-source version, and integrates with case tools such as ServiceNow.

2024-06-18 · open the original ↗

• AI services are pulling a late-moving public sector into the cloud. Martensson, an Azure consultant who runs his own company, says government lags because of decades of legacy IT and some of the most sensitive data there is, such as citizens' patient records, governed by codes and EU rules. Because the large AI services run on Azure, using them on that data means moving it to the cloud, possibly petabytes of it.
• His region is already migrating, ahead of its peers. He works for Region Skåne, which he calls Sweden's third-largest region, with a large centralized IT department; Azure's data centers in Sweden "make the conversation smoother". Its Azure subscriptions went from about 40, few in use and not set up uniformly, to over 100 and rising, and he says local Microsoft representatives tell them other regions and communes are mostly behind. He knows of no separate government cloud in Europe like Azure's in the US, so the region uses public cloud as is, starting with things like its public website, classed as critical infrastructure because it informs citizens in a crisis and so must stay available.
• The public body must own cloud governance, not its suppliers. Martensson says the region needs its own core team, which he sits on, deciding "what goes" and telling its long-standing server and operations partners. That competence does not exist in-house in the public sector, so it must be trained or hired; he calls the work honourable because "this is my tax money at work".
• Meet the regulation, not the legacy system built for it. When told everything must go through an old central control system, he asks for the actual requirement, since no law mandates that system, only governance. He refuses to "weigh the cloud down" by reproducing it in Azure and uses the platform's built-in auditing and other services instead.
• AI may replace one of two doctors reading pathology images. In a current project, Martensson says, pathology photographs that traditionally need two doctors to check for tumours are reviewed by AI, which flags regions of interest, plus one doctor. The two-doctor and AI-plus-doctor results are being compared to see if they are "within reason"; his case is that the AI does not tire and scales, saving doctors' time.

2024-06-14 · open the original ↗

• Open-source big data descends from Google's published papers. Brust, a journalist and analyst who was once a developer, says Google published papers on MapReduce and the Google File System, and a Yahoo team built an open-source implementation that became Hadoop and then the company Hortonworks. Hortonworks later merged with Cloudera, which kept the name though, he says, mostly Hortonworks' technology survived; Brust discloses Cloudera is his client. He says Hadoop has since given way to Spark.
• Microsoft arrived late because big data meant Linux and Java. Brust says Microsoft entered by partnering with Hortonworks to port Hadoop to Windows, then ported its own distribution back to Linux, followed by its HDInsight cloud service; around 2010 the world was not Microsoft-friendly. The cloud lowered the entry cost of a rack of commodity servers and abstracted away the Linux setup that Windows and Visual Studio developers would not have done. He calls Amazon's Redshift arguably the first cloud data warehouse, and notes Google's BigQuery.
• Fabric is real integration, not a rebranding. The industry's problem now, Brust argues, is fragmentation: even Microsoft customers had to stitch together Azure SQL Data Warehouse, Data Factory, Event Hubs and Blob or Data Lake Storage. Fabric unifies them technologically and economically, as SaaS paid for as one pool of compute; it is Spark-based for data engineering and data science, SQL Server-based elsewhere, and includes KQL databases from Kusto. He traces the lineage from SQL Server's OLAP Services, acquired with Israel's Panorama, to Amir Netz, now a technical fellow and "mastermind" behind Fabric. Brust is a 20-year Microsoft MVP and was in Fabric's early adopter program.
• Rivals are extending products rather than unifying platforms. Brust says Google is adding capabilities to BigQuery, and Snowflake is pitching its warehouse as a data platform, but he does not think that equals putting an abstraction over "seven or eight specialized platforms". He grants that the Cloudera Data Platform is also a platform. In his view the 2010–2012 rush of invention was the "scatter" phase and the industry is now in the "gather".
• AI's role in data will be assistive, starting with governance. Brust says the data world does not yet know what to do with AI for its mainline work. He hopes for easier generative AI and machine learning, sees AI populating data catalogs and drafting governance policy as a starting point for data stewards to correct, and says self-healing ETL pipelines that adapt to schema changes are "science fiction-y" but starting to happen.

2024-06-11 · open the original ↗

• Responsible AI has moved from principles to operational practice. Sandford, Microsoft's Developer Engagement Lead in Asia, says this year's talks are about operationalizing responsible generative AI. She advises a pinch of salt with influencers' claims: by the time a trick is shown it is usually blocked, and one TikTok clip she checked presented as a Microsoft release a deepfake project that was only research, used generated rather than real faces and was not even in preview.
• Protection works as defence in depth across four levels. Sandford lists the foundation model's training, then system or "meta" prompts that set purpose and rules (no harm, no offensive content, no copying others' material), then content filters, then the user experience layer. She describes jailbreaking as getting a model to reveal or work around its hidden rules, often through a "fictional story" without constraints, and says it used to be possible before GPT-3.5, when there was no system prompt.
• Content filters are adjustable because some uses need sensitive topics. Sandford says jailbreak and safety filters are sliders that can all be turned on, which suits a front-end customer-service bot. A health application's patients may need to discuss sexual or violent content, so there the filters stay off and the conversation is controlled through more detailed system prompts.
• Grounding settings and red-teaming limit hallucination. She says OpenAI's scale runs from zero, fully grounded and answering "I don't know", to four, while Azure OpenAI stops at two, enough in Microsoft's view for an imaginative story. A company bot grounded in its data can be set to zero and told in the prompt not to make answers up; temperature controls how far repeat answers diverge. The final level is red teams trying to break the bot, with improvement that never ends.
• Humans stay accountable for what their AI agents say. Sandford cites an airline whose chatbot told a bereaved customer he could claim a funeral discount within 90 days after buying; the airline argued in court the bot was its own legal entity, and she says the judge held it responsible for all its agents, AI or human. She adds that transparency means telling users they are talking to a bot and handing off to a human where needed, and uses a bank manager openly lending only to straight white men aged 30–40 to show something can be transparent without being fair.

2024-06-07 · open the original ↗

• Aspire's build output is a JSON manifest that deployment tools consume. Fritz describes .NET Aspire as a stack, not a framework, for observability, resiliency, scalability and manageability. AZD (the Azure Developer CLI) is the first-class tool for Azure. A community tool, Aspir8, generates Kubernetes YAML from the same manifest, and other tools target AWS, but Azure-only services such as Cosmos DB cannot go to a non-Azure cluster.
• azd init then azd up builds, provisions and deploys. azd up asks for region, subscription and resource group, generates unique names for background resources such as the container registry and key vault, and names services as the app host does, so a service called "web" becomes a container app called "web". Fritz says a Redis cache deploys by default as a container in Azure Container Apps. Extra app-host configuration switches it to the Azure Redis service or to a supplied connection string.
• AZD generates most of the CI/CD pipeline for you. azd init writes a next-steps.md pointing to GitHub Actions or Azure DevOps scripts. Fritz prefers GitHub Actions, and says azd pipeline config prompts for parameters and creates the pipeline secrets so every commit builds and deploys.
• The hidden Bicep can be written to disk and edited. Fritz did this on Aspirify.net, a .NET Aspire news hub he builds with Aspire on his live streams, to give the container app its custom domain and certificates. That was during the previews, when templates were rough and one preview-to-preview change broke his deployment completely. He says it now deploys properly and the customization is documented.
• Some deployment defaults need explicit overriding. Azure storage defaults to geo-redundant storage, and Fritz says the cheaper locally redundant option has to be set in the app host's Program.cs. Ingress must be turned on explicitly for a site to take external HTTP traffic, which caught him out after Azure App Service, while internal APIs such as his thumbnail service stay unexposed.

2024-06-07 · open the original ↗

• Aspire turns on cloud-native features .NET already had. Hunter, who runs Microsoft's Azure Developer Experience team after 15 years on .NET, calls Aspire Microsoft's first "opinion" of what a cloud-native .NET app looks like, inspired partly by Java's Spring. It switches on by default the HTTP client resiliency using Polly and Entity Framework Core retries added around ASP.NET Core 3.0, health checks for orchestrators like Kubernetes, and OpenTelemetry. Those defaults sit in a service defaults project the developer owns and can edit, which he presents as his answer to the "magic" he found hard to debug in Spring Boot and ASP.NET Web Forms.
• The app host runs multi-project apps in a set order everywhere. Hunter says Visual Studio's multiple startup projects were "klutzy" and VS Code had no equivalent. The app host's AddProject with WithReference defines what starts and in what order from the command line, VS Code or Visual Studio, and WithExternalHttpEndpoints marks which projects are visible on the public internet when published; an API called only by the Blazor front end stays private.
• Service discovery ends hard-coded localhost ports. Instead of copying a random port from another project's launchSettings.json, Hunter says, the front end calls the API by its app host name, such as http://api, and the orchestrator injects the real address through environment variables. He says the same app then runs on his machine, Azure or AWS without changes.
• Dependencies run in Docker locally and become Azure resources on publish. Hunter says packages for Redis, SQL Server, Postgres, MySQL and Azure Storage start containers through Docker Desktop, so nothing is installed locally. Publishing creates the proper Azure resource, such as Azure SQL Database, wires connection strings through environment variables, and uses managed identity or Key Vault where it can.
• azd publishes the whole app without a Dockerfile. Hunter says azd init and azd up create an Azure Container Apps environment with one container per project; azd infra synth writes out the Bicep for ops teams, and azd pipeline sets up CI/CD. The dashboard also runs in Azure but keeps data in memory for hours, not days; Application Insights stores history. He says 1.0 shipped at Build in May, numbered 8.0 because it ships with .NET 8, and expects 2.0 at .NET Conf in November with .NET 9.

2024-06-05 · open the original ↗

• SOA failed partly through the shared "master document". Lhotka, who does cloud modernization consulting at Xebia, says many SOA efforts 12 to 14 years ago defined one master customer document to pass from service to service, an idea he says large consulting firms pushed because they could sell tooling around it. In microservices as he thinks SOA should have been, each service defines its own input and output contract.
• Brownfield modernization starts with cataloguing what you actually run. Lhotka says clients have found forgotten VB6 apps used once a quarter or once a year that the business cannot run without, and one had no source code because the departed developer's PC had been recycled. The catalogue ranks each asset by business value and technical debt, then decides whether to buy a SaaS replacement, lift and shift it into a cloud VM, which he says gains little since you still patch the OS, or rewrite it.
• Cloud-native means following the 12 factors at 12factor.net. Lhotka calls them behavioural patterns, covering startup, shutdown, configuration, memory and source management, and says modern .NET absorbed many, such as a new configuration system. Greenfield apps should aim for all 12; for existing apps a former colleague's "fast five" makes them "cloud capable". The one he recalls is externalized configuration from environment variables or a store such as Key Vault, not an app.config.
• Business logic buried in the UI makes modernization hard. Lhotka says tooling from VB to Blazor makes it easiest to put code in button-click events, which cannot be tested without the form and must be teased out to move to services; his open-source framework CSLA exists to give business logic its own layer. He advises extracting only the parts that change often, such as regulatory or pricing logic, while 90% stays in the monolith, and treating every app as mission-critical because two-year stopgaps run for 20.
• Migrations need a business driver or a technology driver. On the business side Lhotka looks for real pain such as scale or competitors, while admitting some projects start because a CTO was sold Kubernetes; lift and shift can be a first step to gain Azure's fault tolerance. On the technology side he cites FoxPro apps rewritten when the platform faded and argues .NET Framework, maintained but not innovated, needs a multi-year strategy to modern .NET before developers willing to work on it become scarce and expensive.

2024-05-20 · open the original ↗

• Skipping documentation saves money now and costs more later. Gurka, who runs a software development company of five architects and 10 engineers and has done project and engineering management for over 20 years, says clients with no documentation, or none they can find, end up paying staff and then outside help to research code nobody understands, and often rewrite it from scratch. Documentation, she says, does not spare you the work on a system; it spares you starting from zero.
• Different audiences need different kinds of documentation. Gurka lists technical documentation (architecture diagrams, what talks to what, databases), written in parallel with the coding rather than before or after it; requirements kept as a backlog in tools such as Jira or Azure DevOps and exported to a document for the client, which she sees replacing the old waterfall business requirements document; user guides, which she says are often missed at the end of a project; and release notes, which clients should not have to ask for. On code comments she defers to Giard, who prefers documenting method by method or class by class and wants the code itself to be self-documenting line by line.
• Good documentation is concise, free of jargon and kept current. Gurka says to make the point clearly rather than write a novel, avoid acronyms or add a glossary page, and update the document with every enhancement so it is versioned alongside the system. She favours tools developers can write in together, such as Confluence or SharePoint.
• AI removes the writer's block, but its output still needs review. Gurka has AI write release notes from the code and uses a tool that turns uploaded meeting transcripts into summaries and action items; Giard adds that GitHub Copilot can generate documentation for code he right-clicks on. She says there is no shame in using it as a tool, provided you check what it writes.
• Put documentation in the estimate and name the deliverables. Gurka says projects skip documentation because it was never estimated and the budget or time ran out, so she writes it into the estimate and statement of work as specific items: backlog, architecture diagram, user guide, release notes. The most common problem she meets is outdated documentation, such as an architecture diagram that describes the system as it was years ago and that the client sends without looking at it.

2024-05-14 · open the original ↗

• Fabric aims to give a company one copy of its data under one set of controls. Hermes, an Azure platform architect at a digital consultancy, describes it as a Microsoft SaaS product wrapping services such as Data Factory, Synapse and Data Lake Storage around OneLake, "OneDrive for the enterprise", with one layer of security, governance and discoverability. He cites a client that paid for the same dataset two or three times because no one could find what the company had already bought.
• Data can join Fabric without being migrated. Hermes says shortcuts query data where it sits: Amazon S3 at launch, and now Google Cloud Storage, any S3-compatible store and Dataverse, with an on-premises gateway in public preview. Mirroring keeps a read-only replica close by for performance, with Snowflake newly announced; mirrored storage is free up to an allowance, F64 capacity getting 64 TB. Coverage is incomplete: on AWS only S3 is reachable, and he says Mongo is on the roadmap.
• Fabric complements Databricks rather than replacing it. Hermes says teams happy on Databricks should stay there, since Fabric stores everything as Parquet in the Delta Lake format Databricks uses, and newly announced shortcuts link Fabric and Databricks' Unity Catalog in both directions. A team can start in Fabric and add Azure Databricks later against the same lake.
• Git integration now covers the definitions, though not the data. Hermes says Power BI reports and semantic models, notebooks, lakehouse definitions and Spark job definitions can now go into Git, and a workspace can be branched. As far as he knows this works through Azure DevOps only, not directly with GitHub. On security, rights now reach the individual item as well as the workspace, and capacity is set by region, with a switch for access from anywhere that is off by default to protect data sovereignty.
• Fabric is adding features faster than any product Hermes has seen. He puts it at around 60 new features a month, because six or seven product teams, Power BI and pipelines among them, each ship on their own. Features he expects to matter include Copilot for Fabric, which comes with higher capacity tiers, and a redesigned Microsoft Purview interface aimed at business users who decide what is confidential.

2024-05-12 · open the original ↗

• AI is old; what changed is how little modelling it now takes. Krishnan says he once used integer and linear programming on historical queue data to staff a call centre, and that this kind of algorithmic AI (regression, prediction, clustering) needed data scientists and parameter tuning. Now, he says, you hand data to a model and tell it what to do, citing TimeGPT producing what he calls pretty accurate forecasts from raw data; Giard adds cheap rented cloud compute and OpenAI's work as the two drivers.
• Retrieval-augmented generation is harder than the demos make it look. Krishnan says a model built for around $100 million on internet data gives no references and can hallucinate, so enterprises vectorize their own knowledge, find the chunks most similar to a question, and tell the model to answer only from those. He says what you vectorize, how you chunk it, the chunk size and the prompt all change the answer; people who saw a demo built on Paul Graham's essays will be disappointed when they ask questions of their own data, such as an insurance client wanting policies similar to a given one.
• Grounding RAG in a knowledge graph first is the next step. Krishnan describes building a graph of nodes and relationships in Cosmos DB or Neo4j, which he calls more deterministic, querying it before the retrieval step, and then using RAG. He says much current work focuses on combining the two.
• Too many tools are arriving, and cost has to steer the choice. Krishnan, who works for Microsoft, lists AutoGen (open-source agents that write code, talk to each other and correct themselves), Semantic Kernel for .NET, LlamaIndex, LangChain and TaskWeaver, and says his job is trying them to see what works. He still rates GPT-4, and even GPT-3.5, as the best at summarization and entity extraction, but says GPT-4's price means testing whether an open-source model or a combination gives similar results; he also likes LlamaIndex's semantic chunking, which sizes chunks by content so related text stays together.
• Beginners should start with low-code tools and generated code. Krishnan recommends Copilot Studio or AI Studio on your own data first, moving to LangChain or Semantic Kernel only when they hit a limitation. He uses generated code from TaskWeaver or GitHub Copilot to learn, finding it better commented than his own, but would not ship it as production code; Giard says Copilot gets him about 80% of the way and he never trusts it fully, and Krishnan calls it "a job aid", not a job killer.

2024-05-10 · open the original ↗

• Episode 800 is a montage of past guests' closing remarks. Instead of an interview, it strings together dozens of short clips, nearly all variations on the show's "technology and friends" sign-off; few speakers are named in the captions beyond Buck Woody and Jeff Fritz, who plugs .NET Conf and live streaming.
• The recurring claim is that tech careers run on community. Many guests say their closest friends came from user groups, conferences, open-source mailing lists or long tenure at one company. One says the pandemic showed that "talks aren't great, but hallway tracks are"; another urges viewers to find events on Meetup and LinkedIn as in-person events restart.
• Programmers underestimate how differently others use technology. One guest says that when they asked friends how to turn a paragraph into all caps, the most common answer was to retype it with caps lock on. They draw the lesson that small help, like the few months they spent cleaning up all of one nonprofit's computers, can matter a great deal.
• A few clips make substantive professional points. One guest argues open source shared among friends and open source as a corporate commons are both valid but must not be conflated. Another repeats the "people, process, and tools, in that order" line they say they wrote about in Code Magazine for over 20 years, holding that only people can decide the what and why of a technology; a third says friends don't let friends build distributed systems without OpenTelemetry "in 2022".
• Tech has more roles than development, and newcomers should explore them. A designer in one clip lists design, development and cybersecurity, and advises against copying whatever someone with a technology title does. Another guest says over 20 years their work has become less about technical detail and more about people, process and delivery.

2024-03-19 · open the original ↗

• A firm's accumulated knowledge becomes queryable when put before a model. Nicholas, who leads the Cloud Solutions Group at the consultancy Trace3, gives his own firm as the example: about 1,400 professionals working roughly 48 weeks of 40 hours, around 2.5 million hours a year over two decades plus. Coupling that body of deliverables with a model through retrieval augmented generation would let a new or experienced consultant ask, say, for a summary of the last six healthcare strategy engagements, their outcomes, roadblocks and financials, instead of taking months to learn the firm.
• Enterprises must adopt several kinds of AI, so governance comes first. Nicholas lists personal assistants (Microsoft's Copilot), repeatable custom copilots published internally (Copilot Studio), RAG over enterprise data, and full agents such as Devin, and says AI governance is missing or immature at most organizations Trace3 talks to. He defines it as a published AI stance and risk tolerance, chosen control frameworks translated into controls, guardrails you are informed by rather than hit, and a federated committee drawn from finance, people, business and IT rather than IT alone.
• Many proposed use cases are matched to the wrong type of AI. In one four-hour ideation session a client produced over 300 use cases for AI assistants, and over half were found not suited to them. His recruiting story shows one problem split three ways: Copilot screening 300 emailed applications against five criteria, which he says gave over 90% efficiency on the recruiter's time in early testing with human spot checks for bias; a Copilot Studio version other recruiters can reuse; and RAG over five years of past applicants to find, for example, a ColdFusion expert.
• Sensitive data management is the foundation for successful AI. Nicholas says knowing where sensitive data is, who can access it, how long to keep it and what controls apply is the precondition, alongside data readiness: curating data into a form where models can be grounded properly. He adds that within RAG, Trace3 is exploring both vector-database and knowledge-graph architectures.
• Start small in all three areas at once, not one big goal. He recommends an MVP approach to security, using the OWASP top 10 for AI as a starting point rather than first interpreting the full NIST AI RMF, plus one small use case each for assistants, custom copilots and RAG, run through a pilot group of trusted, early-promise staff. His prediction is that enterprises will need all of these, and he warns against spending a year or two on controls before touching AI; Giard likens the approach to agile's iterate-and-fail-fast.

2024-03-13 · open the original ↗

• Platform engineering fixes the bottlenecks DevOps itself created. Burns, a senior staff platform engineer at Grubhub, says DevOps rightly made dev teams own their code in production, but in doing so required every team to hold its own expertise in CI and CD pipelines and deployment. A platform team instead builds self-service tools with those problems already solved, while each team still owns its process; he describes it as a practice of about the last 10 years that emerges where companies run microservices with a dozen or more teams.
• Offer a paved "golden path" but allow off-roading. At Grubhub, Burns says, the platform team supplies pre-built Jenkins templates (Jenkins DSL, which is Groovy, behind the team's own YAML layer) and standard Gradle plugins, with parameters teams can tune and room to extend for services that need something custom. About 170 microservices run on the platform.
• The payoff only appears at scale. Burns says a handful of services or teams gets little benefit, but cutting each team's build-and-deploy toil by even an hour a week across 20 or 30 teams saves almost a full-time developer. Centralizing the under-the-hood expertise in the platform team also lowers the learning curve of adopting DevOps.
• Start by settling the microservices platform, then extract one problem at a time. Burns says first decide the standard way to deploy (today often Kubernetes and Docker containers, which did not exist for Grubhub 10 years ago), build, run CI, and handle metrics, logs and service discovery; implement it for a service or two, then pull out the common code. He points to Netflix's open-sourced tooling (Spinnaker; runtime libraries that fed into Spring Cloud), the Netflix tech blog, Gradle's "developer productivity" material, and a public platform-engineering Slack run by a consulting company he could not name.
• Kotlin linting needed a Gradle plugin, which Burns now maintains. He says KTLint, a Kotlin linter owned by Pinterest, exists because JetBrains' own linter lives inside IntelliJ and is not built for command-line or CI use; the Gradle plugin adds caching and tool download. He took it over about a year before recording because its original author was busy with open-source security work, and has also contributed to Spring, Micrometer and Google's Jib.

2024-03-07 · open the original ↗

• AI hype is running far ahead of planning. Dojutrek, a tech coach, says "the most dangerous thing a CIO can do is actually read an article," and that the push is consumer-driven, trickling up from household use of generative AI to product owners. Kramer, a consultant, likens it to cloud 10 years earlier and expects adoption to take years; neither sees customers going heavy into AI yet, only experimenting and "learning what we want to do."
• Security and legal exposure come first. Dojutrek names security as the number-one concern, including bad actors poisoning the large pools of data models draw on. Kramer adds court rulings that AI-generated output is not copyrightable and royalty claims over training data, so a healthcare client such as Cigna might refuse AI coding help over where its code goes and its lack of legal recourse if the output is stolen; his firm pitches on-prem models trained on a company's own material, with some headway.
• Measure whether AI makes people more effective, not just more productive. Dojutrek says Copilot let him, after about 30 years away from coding, write code much faster but not better: "having a faster car doesn't make you a better driver," and over-reliance could make coders lazy. Giard, who says he works for the company behind GitHub Copilot, adds that it gets you perhaps 80% of the way and the developer must review the rest; Dojutrek urges defining the outcome wanted and working backwards.
• Begin with quick wins on mundane work. Dojutrek suggests writing test cases as you go, getting entry-level hires up to speed faster, and repetitive code (a month's logic replicated for all 12 months in one line with Copilot). He thinks retail benefits most because it handles less sensitive data than healthcare.
• AI will change tech jobs rather than eliminate them. Kramer expects tech jobs to keep growing long term and blames the current slowdown on high interest rates and lower consumer spending, not AI, noting he knows of no 200–300-person projects rewriting systems with AI. Dojutrek says companies are waiting for someone else to go first, and predicts value shifting from tool skills to prompt engineering ("garbage in, garbage out") and engineering principles such as continuous quality, holistic stewardship and continuous learning, with college curricula needing to follow.

2024-03-03 · open the original ↗

• Scrum's ideas were published before Schwaber and Sutherland presented it. Petersen, a former lawyer and one of the first Scrum.org professional Scrum trainers in 2010, traces the rugby metaphor to Hirotaka Takeuchi and Ikujiro Nonaka's 1986 Harvard Business Review article, "The New New Product Development Game". He reads the preface of their 1995 book, which says the article used the Scrum metaphor for how Japanese companies developed products, with the ball passed within the team.
• A 1990 book already described "Scrum" and "sashimi" approaches. Petersen shows a 1990 Yourdon Press book, Wicked Problems, Righteous Solutions, containing both terms and citing Takeuchi and Nonaka, not Schwaber or Sutherland. He says the 1995 OOPSLA paper that introduced Scrum lists it as reference 9 but never cites it in the text, which he takes as proof nobody seriously reviewed the paper.
• His objection is to erasure, not borrowing. Petersen says the 1995 paper's wording "We call the approach the Scrum methodology" claims a name the earlier authors used, and that over time their credit has been erased. He argues that applying an idea is not creating it, as applying the Gang of Four's adapter pattern would not make him its co-creator.
• Today's Scrum is a certification mill, unlike the original idea. In his reading the original was about knowledge creation, the ball being the knowledge passed within a team, with Scrum itself an aside. He says Scrum has been co-opted into certification and training, that its dogma rejects home-grown variants, and he counts himself as part of that.
• That gap explains why Scrum fails in many workplaces. Petersen says what organizations call Scrum has nothing to do with what it was meant to be, and calls on Scrum Alliance and Scrum.org to give credit where it is due. He names Prentice Hall as the likely rights holder of the earlier material.

2024-02-21 · open the original ↗

• Formal specification checks the design, not the code. Wayne, a formal methods consultant, separates it from the better-known branch that proves code correct with a theorem prover (his "Let's Prove LeftPad" project shows that branch). Specification checks an abstract blueprint of the system. He says it is less powerful because it cannot show the code works, but faster and cheaper for companies, and has grown more popular than proof over the past few years.
• TLA+ explores every interleaving of a concurrent design. Instead of being run, a TLA+ spec is model checked: every random outcome and concurrent interleaving from the initial state is checked against safety properties ("no account ever goes below $0") and liveness properties (the money in the system adds up once every transaction has been processed, even if a process crashes partway). His example is a bank wire, where a check-withdraw-deposit design can hit a race condition and overdraft an account.
• Writing the spec first is cheap compared with the code. Wayne says a spec usually takes a tenth to a twentieth as long as the code; on one project the spec took two days and the code two months. Code cannot practically be generated from a spec. His pitch is that you then write code for a design you know is correct, not one that may be fundamentally flawed. He says generating test suites from specs is a promising but not yet mainstream field, in which MongoDB has shown good results.
• Some work is not worth specifying. Wayne names three cases: code that will be finished within a day or two (he finds TLA+ economical for projects of a couple of weeks to a month); complicated legacy code where a change would need a very large model first; and simulation or highly computational code such as machine learning, where you do not know the answer until you run it. He has seen ETL pipelines into ML systems specified, but not the ML itself.
• The tooling is free, open source and funded by Microsoft Research. The TLA toolbox IDE or a VS Code extension includes the model checker, and specs should be checked in and code reviewed with the source. The syntax is mathematical, so Wayne points beginners to PlusCal, which compiles to TLA+ and which AWS used around 2014 to find complicated bugs in S3 and DynamoDB, to a newer language called Quint, and to his site learntla.com. He says the work began at AT&T before the inventor joined Microsoft Research about 15 years ago, and a TLA+ foundation now oversees funding and development.

2024-02-19 · open the original ↗

• Start with a cash cushion and as few obligations as possible. Sheriff went independent in 1991 after Boeing and about a year at a small, fast-growing consulting firm in Munich. A friend's national training-seminar series paid enough in a couple of weeks a month to leave the rest for finding clients, and seminar attendees became clients. He advises six months of living expenses in the bank, says the best time to start is when single with no kids, and says a spouse needs full buy-in. He worked 60 to 80 hours a week from a small apartment.
• Clients find you if you keep your name out there. Early advice he took: teach and write articles, because an audience assumes a speaker is an expert. Today that means consistent LinkedIn posting, blogging, and speaking at user groups and conferences. He says strong programmers often fail at the marketing and sales side, and that anyone poor at time management should not go into business, because the non-billable hours spent finding the next client are unavoidable.
• Incorporate once you have employees, and buy the management you lack. He moved from sole proprietor to an S corporation for limited liability and lower taxes than a C corp, and he distrusts partnerships unless the skills complement each other. At his peak he had about 16 employees. Calling himself "the worst manager in the world", he hired a former Boeing IT director as manager, who stayed 17 years. Staff were hired by word of mouth and in-person interviews, worked from an office, and followed a 10-minute rule: if you can't find an answer in 10 minutes, ask a colleague. He stresses a lawyer, client contracts, an employee handbook, workers' comp, and the employer's half (7.5%) of the 15% payroll taxes.
• Survive lean times with a rainy-day fund and open books. Incoming revenue was split by percentage into an operating account and a rainy-day account, and he says that fund should never drop below six months. In one downturn he gave staff the choice between one layoff and an across-the-board pay cut, with his own cut 50% deeper. They chose the cut, and he restored salaries once business recovered. His lesson is to talk to employees when things get tough.
• Selling the company took two years because fit mattered more than speed. He lists the exit options as winding down, an employee buyout paid over about 10 years, a merger with a friendly competitor (he tried, without success), or a business broker, which is what he used in 2017 after 27 years. He kept the sale secret from staff, since nervous employees leave and the value falls, and he turned away a buyer with cash but no business experience. The buyer gave everyone a raise, then sold to a larger company two years later.

2024-02-16 · open the original ↗

• Roslyn source generators made a successor to PostSharp possible. Fraiteur says PostSharp, begun in 2004 when the C# compiler was closed-source C++, had to read, rewrite and recompile MSIL to inject boilerplate such as logging and INotifyPropertyChanged. Microsoft's source generators three or four years ago led him to build Metalama on Roslyn, which became generally available in May of the previous year. PostSharp is now in maintenance mode: still supported and updated for new platforms, but getting no new features, which all go into Metalama.
• Aspects transform code, report errors and suggest refactorings. A Metalama aspect runs at compile time and in the IDE. It can add code (implement an interface, override properties, add methods), raise diagnostics when its preconditions are not met, and offer a refactoring that writes the generated code into source. Developers apply aspects by custom attribute, by LINQ-style queries over the codebase in a "fabric", or by inheritance from a base class.
• Templates are written in "T#", a dialect fully compatible with C#. In one template method, build-time expressions such as a parameter's name sit beside runtime expressions such as its value. Fraiteur compares this to Blazor, except that the input and output languages are both C#. Aspects can live in a separate project for reuse, but he says they usually sit next to the classes that need them, such as a change-tracking aspect beside its base entity.
• The core ships as NuGet packages on Metalama's own Roslyn fork. At build time, the open-source Metalama Compiler adds an ISourceTransformer entry point that turns one compilation into another, because standard Roslyn does not allow code to be changed during compilation. At design time it uses the standard analyzer, source generator and code fix extension points, so it works in any editor. An optional Visual Studio extension adds aspect syntax highlighting, a diff between source and generated code, and CodeLens markers for aspects.
• Code validation enforces a team's own architecture rules in the IDE. Fraiteur argues that architecture erodes because guidelines exist only as text checked in code review, where lapses slip through. Existing analyzers enforce community-wide .NET conventions, and architecture unit tests (he names NetArchTest) check a team's own rules through the test runner. Metalama instead shows violations as red squiggles in the editor.

2024-02-05 · open the original ↗

• Fluid Framework syncs application data between clients almost instantly. Simons describes it as a client-side runtime plus a service, built for Microsoft Office productivity apps; Microsoft Loop and Whiteboard use it. Qureshi adds that Teams meeting notes run on Loop components built on it. Any JSON-shaped data can be synced, but it currently has to fit in client memory: about 10 MB is a good ballpark, and the team is working past that limit. The guests name Autodesk and the manufacturing firm Hexagon as the most prominent external partners.
• Developers use synced data structures as if they were local. The runtime is TypeScript (JavaScript also works) and fits any front-end framework. Writing to the data model updates every client and fires a change event. A service is still required: Azure Fluid Relay, where you bring your own authentication and permissions, or SharePoint Embedded, in preview, which stores Fluid data in customers' M365 tenants. Client code barely changes between them. There is an open-source reference service, but the guests say running your own is a months-long effort for a large team, while a working collaborative app on the hosted services takes an afternoon.
• Version 2.0's main addition is SharedTree, a schema-based tree structure. Simons says users found 1.0's primitives, mainly SharedMap (key-value pairs, nestable), inflexible. SharedTree supports classes, objects and full arrays, and merges concurrent array edits so there is no data loss or merge conflict, letting a whole app run on one structure. The 2.0 beta shipped in January, with general release expected "later this spring", around mid-year.
• A browser dev-tools extension shows Fluid state during testing. Qureshi describes a Fluid tab in the Edge developer tools, with a Chrome version too, that shows an app's Fluid components, the current state of its SharedTree, and who else is in the session. More features are to be announced in the coming weeks at aka.ms/fluid and fluidframework.com.
• The runtime is free and open source; the service is not. Azure Fluid Relay has a free tier for development but none for production. The guests present open source as the answer to reservations about adopting a big company's technology, backed by Microsoft's scale, and they are asking for feedback through GitHub Discussions ahead of the final 2.0 release.

2024-02-04 · open the original ↗

• Large language models jumped forward abruptly, after long incremental progress. Thayer, AI practice lead at a software product consultancy, says fields move slowly and then advance "as if 10 years happened overnight". He credits more special-purpose hardware and deep-learning advances in compression that keep large models in memory. The models are now used for work needing more state and structure, such as coding assistants and image, time-series and video generation.
• Most of his recent projects were not generative AI. He says clients think of generative AI first, but most of his projects in the last couple of years were vision and planning or scheduling systems. Those techniques have been fielded longer, and clients' equipment telemetry is in better order than their internal knowledge bases. Manufacturing examples: deciding where to cut a two-by-four from a board to minimise waste, and estimating the remaining useful life of tractor-trailer parts, which he calls state estimation. The two big needs he sees are avoiding unscheduled downtime and making the most of raw material, time or labour.
• In regulated industries, he puts generative output in front of an expert. He sees three camps of client: those with a defined problem, those exploring generative techniques, and those who need "AI in the box" for funding or competitive reasons. He warned a pharmaceutical company that a product-recommending chatbot raised medical-device and liability concerns, which "wasn't what they wanted to hear". For a financial services firm with a similar idea, the workable version fed the generated advice to its expert advisers as a draft, with them as the final check.
• Developers should learn older, less hyped AI fields too. His own background is heuristic search and optimization, close to operations research. It covers puzzles and pathfinding, and also FedEx depot placement, US Air Force air-to-air refuelling sorties, ship scheduling and nurse rosters. He also recommends classic machine learning (decision trees, clustering, k-nearest neighbours), classic NLP such as sentiment analysis, which needs less hardware and maths than LLMs, and OpenCV vision; a friend built a cat-versus-possum detector. His reading list: 3Blue1Brown on YouTube, Russell and Norvig's AI: A Modern Approach, Judea Pearl's Heuristics, and Toby Walsh's Machines Behaving Badly.
• AI's impressive results come from "comically stupid" methods. He says a solver finds the shortest Rubik's Cube solution by trying move sequences hundreds of thousands of times a second, and most approaches just encode a problem as linear algebra: "it's just doing math". His looming concern is that people stop scrutinising output they don't have to check, so he sees a lot of UX and human-computer-interaction work ahead before these systems are used responsibly in medicine or driving. Giard cites Tesla's eye-tracking alerts. Thayer is most excited about self-driving cars letting ageing people, like his parents in rural Kentucky, keep their independence.

2024-01-31 · open the original ↗

• Decompressing and re-encoding beats editing sorted lists in place. Eini says that because the compression runs faster than memcpy and moving data to the CPU is the dominant cost, Corax updates a posting list by unpacking a buffer, scanning it alongside the additions and removals, and re-encoding it; a 4 KB buffer holds about 7,000 document IDs, so the index updates incrementally without Lucene's deferred merge cost. Part of this rests on a machine-generated code file of about 17,000 lines.
• Corax lets users query any combination of fields without compound indexes. He says a traditional compound index (last name, then first name) fixes its structure up front and cannot serve a first-name-only search, so supporting arbitrary queries means a combinatorial explosion of indexes; Corax intersects independent, compressed posting lists per term instead, which he says is largely how Lucene works too.
• Sorting a large result set nearly broke the design. His example is "all published blog posts, sorted by date, top five" over 70 million records in a data set of a few hundred gigabytes: Lucene caches every unique value of the sort field in memory, but Corax cannot assume data stays unchanged, and fetching each date meant random disk reads. Corax now rewrites such queries internally, speculatively scanning the date index from the bottom up and matching against the results so they come back already in descending order.
• Corax shipped with zero client changes, by deliberate rule. Eini says it reached the 10x goal, was released in early October (about three months before recording) and is switched on by one configuration setting; customer feedback is "it's faster", alongside some missing Lucene features and bugs. The no-visible-change rule comes from RavenDB's 2015 break of backward compatibility, which he calls the right technical decision but "really annoying", since he still supports old versions, including users of a Silverlight management interface from 2012–13.
• Infrastructure vendors end up debugging systems nobody remembers. He describes a customer system that threw an unhandled optimistic-concurrency error after three years because two people finally edited the same document, with its authors gone and the operations staff knowing only the process name; he cites Leslie Lamport's line that a distributed system is one where a server you never knew existed breaks yours. For one client who refused source control, he shipped a zip of all sources embedded in each deployed binary.

2024-01-31 · open the original ↗

• Lucene is built for a search engine, not a database. Eini says Lucene, which RavenDB used for about 15 years, assumes large periodic batches merged later, so a small index write takes milliseconds until a merge hits and takes 30 seconds; a database sees steady small writes (he cites 100 a second) and users expect to query a change immediately.
• Lucene's compact file format costs RavenDB twice per query. He says the format dates from the early 2000s, when disk was expensive, and must be decoded into managed objects at query time and then garbage-collected; against his target of one million requests per second, cutting allocations "even a little bit" adds 2–3% to overall performance. He says RavenDB already exceeds 500 queries per second on a Raspberry Pi Zero (quad-core 1 GHz ARM, 512 MB).
• Replacing Lucene had to pay for its risk tenfold. Work on Corax (Latin for raven) began in 2014 but was never fully staffed for years; the bar Eini set was 10 times faster than Lucene for indexing and querying in all common scenarios, without losing Lucene's features.
• An index is conceptually simple: terms mapped to posting lists. On a slide he shows an index as a dictionary of fields to terms to sets of document IDs, queried by intersecting sets; for persistence Corax encodes terms with HOPE (High-speed Order-Preserving Encoder), whose compressed keys sort the same as the originals, letting him fit a 100 GB test data set onto the 512 MB Pi Zero.
• Corax uses 64-bit document IDs, compressed with SIMD in C#. Lucene's int32 IDs cap it at 2 billion records, which RavenDB users hit and had to shard around; to keep 8-byte IDs from bloating posting lists (8 MB per million), Corax uses a published integer-compression algorithm the captions render as "Fast P4", which Eini says took him three weeks to understand after five years of returning to the paper. He implements its SIMD instructions in C# through .NET JIT intrinsics rather than P/Invoke, which he says costs too much at billions of calls a second, and says the code hits hardware memory-bandwidth limits while effectively outrunning memcpy because it works on compressed data.

2024-01-27 · open the original ↗

• Everyone has something worth sharing, however junior. Eaton, who has talked with many developer boot camp graduates, says newcomers assume they have nothing to say; he objects to a social media post asking people to stop blogging about SOLID, because a beginner's fresh wording may be what finally makes the principles click for someone who has struggled with them. "Don't gatekeep," he says.
• Write primarily for your future self. His "Things I Learned" blog series (an attempt at daily posts that lasted 15 days, about 20 posts so far) records small fixes such as controlling Spotify from the terminal and an Azure Functions failure on his Mac traced to a mismatched .NET version; he also keeps a GitHub "snippets" repo of commands he forgets, and calls his weekly interesting-links post his own bookmarks. He says he shares not for credit but almost for selfish reasons. Giard says the same of his blog: notes to his future self, and his own perspective rather than a copy of the documentation.
• Put shared material in public, low-friction places like GitHub. After collecting job-search resources in a private Slack channel during his own search 2–3 years earlier, he moved them to a public GitHub readme that takes pull requests; his Ohio tech events repo has had pull requests from five or six people. He prefers this to LinkedIn, which not everyone uses or will log into, and says it is free of paywalls, walled gardens and algorithms. Giard adds that his own Midwest events list needed a modified blog engine to avoid a post date, where a repo would have been simpler.
• Sharing need not mean blogs or conference stages. Eaton suggests showing two or three teammates something, a lunch and learn, or a five-minute lightning talk at a meetup, and says a CodeMash lightning talk changed his own perspective; one person getting something out of it is enough. He urges anyone helped by a talk to tell the speaker.
• Start in the medium you are comfortable with. He says forced writing shows, so writers should write and speakers should start small; he prefers blogging because a post lasts and can be sent as a link, while a talk is "an hour and poof, it's gone". Everything he writes starts on paper, including talks scripted word for word before the slides. Of online critics, he stays off X, finds Mastodon engagement higher quality, and ignores the "well, actually" crowd.

2024-01-25 · open the original ↗

• The fault is prescriptive architecture, not Clean Architecture itself. Miller, who founded Jasper FX Software the year before, objects to Clean or Onion Architecture templates used as infallible rules: four or five projects from the start, and a noun-based chain (invoice controller, invoice service, invoice repository, DTOs) in separate projects that scatters closely related code. His advice to technical leaders is to hand over a decision tree, not black-and-white rules, explaining why and when the advice does not apply.
• Broad horizontal layers block incremental modernization. Miller says swapping a library or database (NHibernate to the latest EF Core, or SQL Server to Cosmos DB, DynamoDB or his own Marten) means changing every handler in a layer at once, too big to sell to product owners. He wants loose coupling between modules so one can be upgraded at a time; Giard adds his own experience of a new column having to be carried through every layer, which Miller knows as the "wormhole anti-pattern".
• The full template is severe overkill on small services. Miller has repeatedly seen teams build a microservice of two or three controllers and about 12 endpoints with separate controller, service and repository projects, a mediator and base classes everywhere. In his view that erased the microservice's advantage: small enough to test purely with integration tests and so written as much simpler code.
• Prioritize test automation, now easier with disposable databases. Miller says layering is worth it only where it serves testability, and good test coverage keeps the architecture reversible so layers can be added later. Mocks arose because databases were hard to set up; engines that spin up in Docker and wipe state between tests let him choose integration testing over clean-architecture abstractions, and he calls mocks "overused", not evil.
• Organize vertically around use cases, then horizontally within each slice. Miller favours "vertical slice architecture" (Jimmy Bogard's term), grouping code by commands or events so one feature lives in one place. He credits Bogard's MediatR with breaking up bloated MVC controllers of 15–20 HTTP methods into single-message handlers, and offers his own Wolverine, a messaging and mediator tool with a 10–12-year lineage under earlier names, whose HTTP endpoint layer can replace MVC Core plus MediatR.

2024-01-24 · open the original ↗

• CSS custom properties remove the need for a preprocessor for variables. Riviere says developers who learned CSS 10 or 20 years ago still reach for Sass or Less to get variables, but a property defined with a -- prefix and read with var() can hold fonts, colours or sizes; he defines a shared font fallback stack and colours named "paper" and "ink", which he prefers to foreground and background as clearer. Redefining a property on an element (headers, or one element's style attribute) overrides it for everything inside through the cascade, and browser dev tools show each variable's current value and where it came from.
• CSS Grid with named template areas is his favourite way to do page layout. He says Grid originated at Microsoft in Internet Explorer and reached every browser in about a month in 2018; he applies display: grid to a wrapper rather than the body, because third-party scripts inject elements into the body, names areas (side, content, footer) with grid-template-areas, assigns elements to them, and spaces them with gap, which applies only between rows and columns. Wrapping the grid in a min-width: 768px media query makes the single-column mobile view the default and the fallback.
• The :has() selector styles a parent by what it contains, without JavaScript. Riviere's example is highlighting the box around a label and an invalid input, which previously meant listening to the input and toggling a class on the parent in script; he demonstrates bordering any article that contains a tag link with a given data attribute. He says it now works in all major browsers, with Firefox the last to ship it, about a month before recording.
• Logical properties keep spacing correct in right-to-left languages. He shows that padding-left stays on the left when text is translated into Hebrew, which used to require direction-specific selectors; properties such as padding-inline-start, padding-inline-end, padding-block-start and padding-block-end attach spacing to where text starts and ends instead.

2024-01-22 · open the original ↗

• Microsoft's military team runs a tech boot camp for transitioning veterans. Gorman describes the Microsoft Software and Systems Academy, a 17-week program with three paths: cloud application development (ending with AZ-204), cloud administration (AZ-104), and a new cybersecurity path, which he says suits veterans who already hold clearances. Active-duty members take it under orders in roughly their last six months of service, honorably discharged veterans can also join (one of his students left three years ago), and there are Pacific and Central European regions, though one overseas student is attending his Central-time cohort from 7 p.m. to 3 a.m.
• Admission is selective and takes a couple of months. As Gorman understands it, applicants complete LinkedIn Learning courses, may once have had to pass a Pearson aptitude exam, and go through several interviews. He tells interested veterans to follow the Microsoft military team on LinkedIn for informational webinars and application deadlines; Giard gives the site as military.microsoft.com/mssa.
• The developer curriculum takes beginners from C# to Azure certifications. Gorman's current class is the 13th run of the cloud application track: 15 students, all virtual, four days a week, most of whom had never programmed. They start with C# console apps built around their own interests (one student's collectible Starbucks cups, used to teach inheritance), then Microsoft Learn's C# path with the free 80-question freeCodeCamp C# certification, data structures, and AZ-900 and AZ-204.
• Placement support includes a guaranteed Microsoft interview. Fridays, and one full mid-course week, go to professional development with Microsoft mentors on resumes and interviewing. Gorman says 8 of his first cohort's 15 got Microsoft offers and several students were placed at Southwest Airlines, a Microsoft partner, while his second cohort took longer to place in a weaker job market; he has students build GitHub portfolios and team MVC projects to stand out as juniors.
• Gorman calls this the most rewarding work he has done. He teaches as a subcontractor through Opsgility, his former employer and a Microsoft partner that manages cohorts, and cites seeing veterans move from military pay to developer salaries. He jokes, and says students confirm, that their hardest civilian adjustment is that nobody shows up to meetings on time.

2024-01-20 · open the original ↗

• The pursuit of immersion led them from live-action film to animated VR. The Mojicas say their feature The Life Peddler shot every scene in one take to feel like watching real lives, and VR promised to put the viewer inside the story. With 360-degree 3D live-action cameras the viewer stays fixed in one spot, so to let viewers move around they had to build digital worlds with digital characters.
• Viewers choose which of several simultaneous storylines to follow. Their VR movies run four or five storylines at once; the demo has about 10 characters, each with a full story in roughly four to five minutes, meant as short, rewatchable episodes. Jose says the hard part is telling a story when the viewer can abandon the main character for a side story.
• A pre-recorded "reference video" lets two people perform every character. Because one long take allows no cuts, they first record themselves reading all parts and edit that into a synced, captioned reference video, a method they say took about a year to work out. They then perform each part separately while watching it, recording body motion apart from face and voice; characters built in iClone and Character Creator are driven by motion-capture suits, and odd bodies need care, since the bacon-wrapped avocado is all head and Jose must pivot his whole body to play it.
• They chose Unreal Engine for its easy path to a VR headset. Laurel says its VR template built and ran on a Meta Quest far more easily than Unity, and its blueprint system needs no low-level programming. The engine supplies collisions, gravity and interaction: viewers can pick up a pizza box or carry a lantern, and climb onto the roof or into trees; an artist builds assets in Blender on top of purchased graveyard and forest sets.
• The self-funded demo is aimed at future investors. It is a graveyard scene in a town of monsters who make bad low-budget horror films, with the Mojicas as the directors, and they hoped to finish it by March, speaking on 15 January 2024. The team is five people (the two of them, an artist, a gaming-degree programmer who writes the blueprints, and a social-media hire), with clips at baconwrappedavocado.com and on YouTube, and T-shirt sales planned.

2024-01-20 · open the original ↗

• Kubernetes won by building the largest coalition, not by being first. Burns says he, Craig McLuckie and Joe Beda began in fall 2013, went public at DockerCon in 2014 and hit 1.0 a year later, but it was 2016 or 2017 before they stopped arguing for it against Mesos, Docker Swarm and tens of other orchestrators. The mature ones were internal to large internet companies and not open source, Mesos was built for big data, and Docker focused on the single machine, while they felt they "had the puzzle box"; what made Kubernetes dominant, he says, was a safe place where any company could see a way to succeed.
• A new project starts with a demo people can actually use. Burns says the key early task is getting others to believe the vision, and a hands-on demo, not a PowerPoint, does that; his analogy is that people fixated on snowy passes and speed traps never leave Seattle, but show them a Walla Walla winery and they forget the six-hour drive.
• Open source was not optional if Kubernetes was to win. At Google he had to argue against making it a product that ran only on Google's platform, and a colleague accused him of getting the company to fund his startup; his answer was that the world is multi-cloud and hybrid and wants one solution, so a project that does not go everywhere is abandoned. He calls himself no zealot, saying "it wasn't this should, it was this has to be", and adds that open technology widens hiring, since someone with years on AWS can run workloads on AKS.
• The CNCF exists to provide vendor-neutral trust. Burns credits McLuckie with building the Cloud Native Computing Foundation under the Linux Foundation, launched a year after Kubernetes' release with Kubernetes as its flagship, so companies building on it need not fear trademark or IP claims; he cites Istio as the most egregious holdout, donated only about a year before recording. To avoid kingmaking amid a venture-funded "Cambrian explosion" of projects, and after pressure from VCs and connections began burning out governance people, CNCF settled on tiers: an unendorsed sandbox, a carefully judged incubating stage, and a handful of graduated projects.
• Kubernetes had to invent its governance as it grew. He says few open-source projects had been this successful, and neither Node.js nor the Linux kernel (which leaves much to distributors and grew up on mailed patches) fit a GitHub-native project that also did its own releases, testing and documentation; it needed elections and voting rules that large companies could not capture, a code of conduct with eviction, and an embargoed security-disclosure process. At Microsoft, his team now runs the Azure Kubernetes Service, packages AKS for edge and IoT, and keeps a dedicated team contributing upstream to Kubernetes and CNCF projects.

2024-01-02 · open the original ↗

• On-camera AI now anticipates the shot by tracking subjects from any angle. Gates's new primary camera, a Sony a7R V, recognizes people, birds and animals even from the side or behind, locking on a dog's head so focus jumps to the eye when it turns. He explains mirrorless bodies as sending the sensor image straight to an electronic viewfinder, which makes them smaller, and suggests renting gear from LensRentals (mostly seven-day rentals) before buying.
• The phone remains a working camera alongside the big one. Gates takes "safety shots" on his iPhone 15 because it exposes every face in the scene without lights, and relies on phones for panoramas: one taken on an iPhone X at North Avenue Beach in Chicago in 2019, the best of about 10 tries, still looks good blown up to room size. Giard adds his own view that phone cameras have advanced much faster than digital SLRs.
• Most of his shooting tips are low-tech habits. Gates wipes the lens every time he takes the phone out, turns the subject to face the light so a window behind it does not "photobomb" the shot, and shoots at the subject's eye level using a tilting screen. For background blur he combines a wide aperture (an f/1.4 lens) with distance between subject and background, and he tells beginners to start in aperture-priority mode; Giard's tip is to turn the phone upside down for shots near the ground.
• Culling happens in two passes before any editing. With roughly 80 MB files from the Sony, an M1 Mac, and Lightroom syncing originals to the cloud and keeping only thumbnails locally, Gates flags anything promising, then picks the best of each cluster, taking 1,000 shots to about 50 favourites and then about 40 to edit. Editing covers composition (rule of thirds, broken where it suits), straight lines and color, with AI tools such as Lightroom's noise reduction, which treats grain in water differently from grain on a suitcase.
• His photo site serves resized images from Azure blob storage. Gates has built his site for over 20 years and hosts it on Azure; he uploads to a blob storage account, and an image service (captioned "ImageX", apparently imgix) is pointed at that account and returns versions at the ratio and size requested in the URL, cropping tall images to the face. He recommends YouTube channels such as Adorama and Tony and Chelsea Northrup for learning.

2023-12-16 · open the original ↗

• Clean architecture puts business logic, not the database, at the center. Smith calls it the latest name for a decades-old idea also known as ports and adapters, hexagonal or onion architecture, coined by Robert Martin: code depends on interfaces saying what it wants (fetch a record, send an email), and the how is an implementation detail it neither knows nor cares about. He says his clean architecture talk at the previous month's .NET Conf drew more YouTube views than the keynote or any other session; Giard contrasts it with the database-centric habits he carried over from FoxPro.
• Tight coupling bites 24–36 months in, not early. Smith says fast early work and copy-paste reuse leave code bound to its infrastructure, which he calls a sign of success that his company, NimblePros, is often hired to refactor. To the pushback "we'll never change our production database", he answers that pipelines through dev, test and staging environments are where swapping the database, mail server or file system pays off.
• Abstracted dependencies make business logic unit-testable. In his e-commerce checkout example, a method that saves the order, charges the card and sends SMTP mail directly can only be integration-tested, brittly; with a faked payment processor and email sender, a unit test can check that a successful charge leads to the success email and a failed one to the payment-failed email, without sending either.
• The compiler enforces the dependency rule across three projects. Smith uses a Core project (entities, value objects, aggregates, domain services, domain events and specifications from domain-driven design), an Infrastructure project that depends on Core, and a UI project, typically ASP.NET Core; because .NET forbids circular references, Core cannot depend on infrastructure except through reflection that would stand out in code review. His free solution template on GitHub and NuGet sets this up, and CQRS can be added as a further layer separating commands from queries, possibly with separate data stores.
• Clean architecture is overkill for small, simple systems. Smith says it adds projects and abstraction and hides the single followable method some developers want, so it suits larger systems or ones with thousand-line methods making 20 database calls. Giard frames the choice as whether reduced code complexity outweighs the architecture's own; Smith calls it "the bang and the buck" and says everything in architecture is a trade-off.

2023-12-13 · open the original ↗

• DDoS attacks now often serve as a smoke screen. Hébert, a Microsoft partner solution architect, says the pattern has changed over the last 10 years: rather than one big volumetric takedown, attackers pulse traffic up and down to trip and reset DDoS suppression while scanning and trying exploits in between. Smaller DDoS events of 10–12 gigabits in your logs can hide real attacks, so the logs between them have to be searched.
• Attackers now poison the third-party APIs you consume. He points to "unsafe consumption of APIs", a new entry in the 2022 OWASP API Top 10. Instead of a malicious package, the attacker compromises an API you call, such as an address-validation service, and injects bad data that your system trusts because you pay for it, then exploits it once it is inside.
• A DevOps pipeline needs SAST, DAST, composition analysis and fuzzing. Hébert starts from the MITRE ATT&CK framework, then runs static code analysis, dynamic scanning of the hosted API, and software composition analysis covering vulnerable packages and region-restricted licences, pairing a paid tool with a free fallback in case funding is lost (WhiteSource with OWASP Dependency-Check). He says most practitioners skip fuzzing, and recommends RESTler from Microsoft Research, a stateful REST fuzzer that infers producer-consumer dependencies from a Swagger definition and aims to provoke the 500 errors used in exploit development.
• Security checks can start at the API contract, before any code. For API-first design he uses SwaggerHub for collaborative design with intended users, with integration into Azure API Management for mocks. He says 42Crunch, a Microsoft partner integrated into Defender for APIs, has a free audit that runs about 300 checks against the uploaded Swagger contract, which shifts security left to the documentation phase. He also recommends its apisecurity.io newsletter, which explains how breached organisations were exploited.
• Forgotten, uninventoried APIs are a vulnerability in themselves. He cites "improper inventory management", also in the 2022 OWASP API Top 10, and recalls consulting clients who could not say how many APIs, SOA endpoints or BizTalk orchestrations they had. He promotes his employer's Azure API Center, then in preview, as a complement to API Management for cataloguing APIs by environment and version, and says the Defender for APIs plan flags an API unused for 30 days as likely stale.

2023-12-09 · open the original ↗

• Security strategy starts with knowing what you must protect. Da Silva, a cybersecurity architect at Microsoft who builds security strategies with its partners, treats cyber risk as business risk and uses the NIST (National Institute of Standards and Technology) Cybersecurity Framework, whose first pillar, identify, means knowing devices, users and workloads. A production server needs a different approach from a test server, and important accounts whose compromise would endanger the business get their own strategies.
• Protection needs people, process and technology together. For the second pillar, protect, he covers physical security (guards, gates) and digital controls such as firewalls, antivirus and EDR, and says processes, such as how internal information may be shared, matter as much as the tools.
• Monitoring catches what protection misses, and response can be automated. Detect means monitoring the perimeter and the security tools themselves; Giard raises breaches that went undiscovered for months. For respond, Da Silva compares an apartment's cameras and alarm that call the police with SOAR (security orchestration, automation and response), which triggers actions once a threat is detected.
• Recovery must be planned because some attacks will succeed. His example is ransomware encrypting a company's data after detection and response fail, then clean-up and restoration; he likens recovery to home insurance, which you hold but would rather invest to avoid using. Giard frames the five pillars as sequential and argues, shift-left style, that stopping problems upstream makes later recovery easier; Da Silva answers that security works in layers.
• Da Silva says Microsoft's portfolio covers all five pillars. As a Microsoft employee he describes the Defender XDR family (Defender for Endpoint, Identity, SQL, Cloud, Containers) for protection, and Microsoft Sentinel for correlating events to detect threats and automating responses such as emailing, blocking a user or isolating an endpoint. He says detection does not remove the need for protection, and that Microsoft is integrating its tools into one extended detection and response (XDR) strategy to simplify the work.

2023-11-29 · open the original ↗

• Most Azure customer workloads now run on Linux. Randall, a principal product manager for Linux strategy in Azure Core who joined Microsoft about two and a half years ago through its acquisition of the Berlin startup Kinvolk, says Linux has been the majority for "quite a few years" because it is the OS that powers the cloud, and a cloud company cannot succeed without a strong Linux experience.
• Managed Ubuntu snapshots make fleet updates predictable. Randall says Microsoft and Canonical announced the joint service at the Ubuntu Summit: rather than pulling the latest packages in whatever order they arrive, enterprises can validate a fixed set of updates and roll it out across servers, enabled by changes Microsoft made upstream in APT.
• Microsoft built Azure Linux to control its own internal fleet. Randall says internal services ran a variety of distros, making security and consistency hard to enforce; the in-house distribution is now offered as an AKS node option beside Ubuntu, smaller and container-optimized, without displacing partners Canonical, Red Hat, SUSE and Oracle. He calls Azure Hybrid Benefit's license portability "pretty much unique", and says joint support with Red Hat lets a RHEL customer on Azure call either company.
• Microsoft contributes upstream and runs its own CNCF projects. Randall cites kernel work, systemd founder Lennart Poettering on staff, and the cloud-init summit Microsoft hosted in Redmond. His team's Inspektor Gadget packages eBPF programs into gadgets for container- and host-level observability, and Headlamp is an extensible Kubernetes UI, used internally as an AKS portal, that runs as a desktop or web app.
• Flatcar Container Linux is stripped-down and immutable for container hosts. Randall says the Kinvolk-origin distro, a derivative of CoreOS, keeps its OS partition read-only and updates by installing to a second partition and flipping over, or back if the update fails, an approach taken from Chrome OS; it is being moved into the CNCF.

2023-11-27 · open the original ↗

• Zero trust means wrapping applications in layers that frustrate attackers. Jackson, a HashiCorp developer advocate, places Consul on the network side and Vault as the secrets tool; he counts API keys, passwords and cloud credentials as secrets, and also personal data, since a leak of it brings GDPR liability in the EU. Vault's emphasis is granular access, by an application's service principal or a person logging in through LDAP.
• Short-lived dynamic secrets make a leak harmless. Jackson says Vault can generate credentials such as a managed PostgreSQL login or an Azure account with a short time to live; when he accidentally committed Kubernetes credentials to GitHub the week before, he killed the lease in Vault and the exposed credentials became useless. He says HashiCorp's acquisition of BluBracket aims to find committed secrets before attackers do and revoke them automatically.
• Most applications consume Vault through templates, not the API. Jackson says Vault Agent authenticates with the machine or Kubernetes service-account identity and writes secrets into a config file; on Kubernetes, an injector templates secrets into pods, or the Vault operator syncs them into native Kubernetes secrets and can restart pods. The goal is minimal, ideally zero, application changes.
• Azure Key Vault suffices for static secrets in one cloud. Jackson says Vault earns its place with dynamic database credentials, generating Azure credentials for Terraform, and hybrid or multi-cloud estates where a security team wants one workflow for all secrets.
• Run Vault managed or via Helm, and treat it as critical. Jackson says the single binary gives a dev setup in 30 seconds but not a production one; HashiCorp's cloud service, a single-tenant cluster it patches and backs up in Azure, or the Helm chart get you production-ready, after which you must manage the unseal key and storage, now simpler with built-in Raft. If Vault is down the application is down, so he describes active-standby clustering, an enterprise standby-cluster option and performance replication for heavy encryption loads.

2023-11-21 · open the original ↗

• TicketFalcon exists because the twins resented existing platforms' fees. Ashton Clark describes it as an online event registration and management platform for general admission and reserved-seating events with direct payouts, built by him and his identical twin Ryan as "technologists and also businessmen".
• A slow site costs as much as a down one. Ashton says availability and speed have to be balanced, and both come down to server capacity. Extra capacity for a big event is planned in advance, not added 10 minutes before. Planned downtime goes in the early morning, and customers are told beforehand, which he says they appreciate.
• Growing makes them a target, so they defend in layers. Ashton cites server patching, enterprise-level tools using machine learning to stop attacks early, and DDoS attempts they have seen from servers "all across the world" and through partners' services. He says a third-party failure "a couple of weeks ago", which hit millions of sites, disrupted them for a few minutes, and that they use a payment partner because running their own processing would earn more revenue but carry more risk.
• Websites scale the business without scaling the staff. The brothers trace this to raking leaves and shovelling snow at about nine or 10, taking a percentage from other kids working other blocks, and to selling sneakers for $100–150 at 16. Ryan says thousands can buy tickets at once without 1,000 people running the site. They scale cloud compute up only for events and back down, both to save money and to avoid wasting energy.
• The name came from family pushback, not the founder's favourite. Ashton had bought Tixboss.com and its other extensions, for maybe $15, but his then-girlfriend, now wife, and family rejected it because he could not say it 10 times fast. She proposed "falcon" in a Houston hotel-room brainstorm. He says businesses should not be built in a vacuum, and adds that domain names take far more creativity than when they built a sneaker site around 2006.

2023-11-12 · open the original ↗

• A private pilot certificate is the first step for any pilot. Shepherd, a software consultant, started training in January after waiting a decade since an introductory flight, and was due to take his checkride the week after recording; the certificate (he stresses it is not a "license") lets him fly solo, at night and with passengers. He says his training took about 11 months and around $20,000, against perhaps $12,000–15,000 over a couple of months for someone flying only the 40-hour minimum in good weather, and his advice to beginners is to book a local flight school's free introductory flight.
• A wing generates lift as one half of a Venturi. Shepherd explains that air over the wing's hump speeds up, leaving lower pressure above than below, and the difference pushes the plane up; he says that with enough speed, almost anything can be made to rise regardless of weight or shape.
• Flying is nothing like driving. Shepherd says a plane moves in three dimensions about three axes and asks the pilot to track about 30 things against a car's six to eight; on the ground you steer with your feet on the rudder pedals, and hands and feet stay busy with the yoke, throttle and fuel-air mixture of a piston engine.
• Instruments demand fast reading of delayed data. Shepherd says the altimeter works as a barometer and the attitude indicator, formerly the artificial horizon, shows the plane relative to the horizon; Garmin's glass cockpits now render these on dense screens, and the vertical speed reading lags six to eight seconds. He says flying takes a mix of courage and calm.
• Visual-flight rules and air traffic control govern when and where. Shepherd says a new private pilot flies VFR only, keeping set distances from clouds such as 500 feet below and 1,000 feet above, and his airport in a river bend often waits for morning fog to burn off. Controllers handle each stage of a flight, airspace below about 1,200 feet is generally uncontrolled class G, most US airports have no tower, and an emergency overrides every rule. Owning is costly: he says his trainer, a 1969 Cessna 172, still costs over $100,000, so most pilots rent, share or lease back.

2023-10-30 · open the original ↗

• Microsoft partnership comes in several distinct business models. Swanson, a Microsoft Partner Technology Strategist focused on co-selling, lists independent software vendors (ISVs), managed service providers, distributors and resellers, system integrators and consultancies, hardware OEMs, and builders of Xbox games and Windows apps. All of them start by joining the Microsoft AI Cloud Partner Program (MCPP).
• Co-selling with Microsoft requires a published solution, not just membership. She says a partner must be in the program, hold a solution designation and have published a solution; it can then submit leads that are routed to Microsoft account teams, and Microsoft sends leads back. Microsoft's tech team helps get there through an architecture design session and then a "build with" plan; solutions are published through Partner Center to either Azure Marketplace (software that runs in Azure) or AppSource (consulting offers, modern work and business applications).
• Benefits grow in tiers as the partnership deepens. By her account, signing up gives Partner Center access. Partners then buy an action pack (software licences) and/or qualify for a solution designation, which comes with fees and gives advisory hours through technical pre-sales and deployment services. Partners that co-sell more can become managed partners, managed by geography or globally, and advanced specializations require an audit by a third party.
• Certifications belong to the employee, so partners must retain staff. Swanson says this is often misunderstood: an exam she passes stays with her if she changes jobs, and at the annual renewal a partner must show the certified people are still on staff to keep its designations. She has seen partners use bonuses, parties and time-limited non-competes, and says keeping employees is probably cheaper than hiring new ones.
• Partners underuse Microsoft's architects and pre-sales roadmap discussions. She says a roadmap conversation can reveal changes coming in about three months. In a hypothetical she says she made up, a partner building on the latest SQL could ship with an upcoming feature built in, instead of publishing the week before it lands. Her starting points are partner.microsoft.com ("Become a partner") and learn.microsoft.com for exam prep and Partner Center guidance.

2023-10-18 · open the original ↗

• Good leaders' first job is making people feel safe. Andrews draws on Stephen Porges's "neuroception", the sense of safety or danger, and Daniel Siegel's hand model of the brain: under threat we "flip our lid", and the midbrain takes over (fight or flight) or the hindbrain does (freeze and shutdown, dorsal vagal in polyvagal theory). His case is that cooperation and productivity come only from the prefrontal and cerebral cortex, so threats such as rolling layoffs hurt the work itself.
• His ten-dimension model gives ten interconnected leadership principles. The dimensions are safety, identity, messages, agency, positive social connection, environment, mission and purpose, body and brain, human needs, and strengths, and he says all are important and linked. His evidence is his own life: diagnosed autistic at 33, he had no friends until high school, and a strength in computers led him to the Philly .NET user group, speaking and the MVP award, and through them to community, purpose and income.
• Organizations should plan around capabilities rather than fixed roles. Andrews argues that junior/mid/senior developer ladders assume everyone moves toward big-picture work. A progression along detail work, or keeping a strong individual contributor out of management they don't want, would avoid the Peter principle.
• Leaders set the team's emotional tone through how they communicate. He holds up Fred Rogers's care over the messages children receive. A panicky or yelling boss unsettles staff's nervous systems, and "managers know, leaders listen and learn"; feedback framed as "a great start, here's how we can do it better" lands better than "do better". Giard adds that he wants fast feedback on mistakes, as in agile.
• Hiring for "culture fit" is inherently discriminatory. Andrews calls this view possibly controversial: culture fit looks for the workplace equivalent of genetic uniformity and is easily swayed by unconscious bias. A manager who says he can tell fit in 30 seconds is judging on gut instinct before the cortex engages, and he cites visual AI products that failed on black skin because the teams lacked diversity.

2023-10-14 · open the original ↗

• Generative AI still needs human curation, even at scale. Turner, VP of data at the consultancy Kin and Carta, says predictive and generative AI overlap but differ in their maths: generative AI becomes part of the product and can surprise with new combinations. One client is letting it generate output for a million products, and he says that cannot be done without human curation; he prefers to treat "hallucinations" as wrong best guesses from probabilities.
• Projects should start from a shared data foundation, not a model. He says the work begins with listening to the client, then building a data platform that many solutions can use. That means agreed definitions (what is a customer, when a sale counts, what the geographies are), a data dictionary, stewardship, governance and quality checks. About 90% of the time goes on cleansing and preparation, and the product on top is then a much lighter lift.
• Waiting for clean data is a mistake, because it never arrives. Turner says the bigger and more successful the company, the more embarrassed it is by its data, and the stock consultant answer is two years of preparation. His answer is that acquisitions and new sources keep adding mess, so build governance to manage it. Data literacy matters too: one data point challenged in an executive meeting with no provenance can taint the whole data programme.
• AI feedback loops push organizations toward more of the same. Once a model is deployed it changes the system that produces its training data, so over-reliance narrows toward a single optimum. He argues that organizations need deliberate exploration of options the data does not suggest, such as a geography with no data yet, or they will miss the other "mountaintops".
• Security inside Azure is the headline for enterprise generative AI. Kin and Carta has been a Microsoft partner from the start, and Turner says running OpenAI and Azure models in a secure Azure environment is table stakes, because the model may see every document. If you load every Word document and PowerPoint into an LLM, he warns, you may learn things about your organization you didn't know. He says AI is not right for every problem, but cloud access gives an opening even to a mom-and-pop shop.

2023-10-11 · open the original ↗

• Automating Zoom's clicks made the technology disappear from worship. After the church's first Zoom service on Easter Day 2020, Skeet found Zoom had an SDK and had an alpha of "Zoom and Enhance" running by the next Sunday: one double-click spotlights a person, mutes everyone else and stops any video, or starts the screen share and plays a video. He says the aim of all his work since is that no one notices the technology, with no five-second pause between sermon and hymn.
• The church is its people, so remote worshippers must not be dropped. Skeet planned for stages from April 2020: 10–20% of people in the building, then about 50%, then 80–90% with 10–20% still remote. He argues the pandemic was a wake-up call: churches had been failing the housebound, the ill and those away for centuries, could only have fixed it in the decade or so before, and should now stop.
• He only bought hardware his own software could control. The old analog Allen & Heath mixer had 14 channels and about 150 knobs and buttons, and intimidated volunteers. Skeet replaced it with a digital mixer (audio over USB, control over Ethernet) and pan-tilt-zoom cameras, ruling out proprietary protocols without an SDK, because he found no off-the-shelf system that even controlled a mixer and showed hymn words. The resulting app, "At Your Service", has since gained DMX lighting (red and orange on the reader at Pentecost) and, at the request of another church with Iranian refugees, live transcription through Google Cloud Translate, read on phones with a five-to-ten-second delay.
• His biggest challenge was giving each user everything needed and nothing else. Services are prepared in advance, for example from home, and uploaded to Google Cloud Storage, so the person at the desk on Sunday only syncs and presents. A Stream Deck XL (32 buttons that are also small screens) and a Behringer X-Touch Mini give a glanceable mute panel; both talk only to his software, never to the mixer directly.
• The system fits his own church and does not yet scale. No other church uses it live yet; two are interested and two more are planning AV revamps he will advise on. It is C# and WPF in a private GitHub repo, configured by JSON files with no GUI, and he would like to open-source it if he retires, "give me 10 years". He wrote his own small MVVM framework to learn how WPF works, and says he would use a tested off-the-shelf framework for commercial work.

2023-10-05 · open the original ↗

• Microsoft's OpenAI partnership long predates this year's product announcements. Lussier, who works with ISVs in Microsoft's Global Partner Solutions group (as does the host), traces it from OpenAI's founding in 2015 to CTO Kevin Scott, ex-LinkedIn, introducing Satya Nadella to OpenAI's CEO, then a first big investment in 2019 with an exclusivity agreement putting OpenAI on Azure. In 2020 Microsoft built OpenAI an AI supercomputer with 285,000 CPUs and 10,000 GPUs, top five in the world then but no longer, he says.
• Microsoft's own AI ran in parallel and is available now. Lussier dates Cognitive Services to 2016, when Project Oxford was rebranded, and says an "AI at Scale" division formed in 2020 also worked on large language models, partly with NVIDIA. He hopes OpenAI interest opens conversations about that full suite, noting that Azure OpenAI access is coming in staged rollouts while Cognitive Services need no wait list.
• Copilots over business data will change how users interact with systems. Lussier expects asking a system for "the top customer accounts in the last quarter" in conversation to be transformative, and says partners he works with are building their own copilots and adding roles such as prompt engineer.
• Adopting AI needs organizational change and a responsible-AI framework. Against the CEO who reads a magazine on a plane and wants it in weeks (the host's image), Lussier calls for change management, new skills and architectures, and legal teams rethinking terms. He cites Microsoft's framework of fairness, reliability and safety, privacy and security, inclusiveness, transparency and accountability, and on bias gives an AI image set of how Europeans see Americans in which every person depicted was white.
• The meaningful uses go beyond novelty demos. MediaValet, a Canadian digital asset management company, used Microsoft's facial recognition to identify individual chimpanzees across decades of the Jane Goodall foundation's images and videos. Microsoft added Inuktitut to its translation service with the government of Nunavut to help preserve languages, and Lussier points developers to Microsoft Learn's AI tracks and the Azure ChatGPT project on GitHub.

2023-09-28 · open the original ↗

• Schools should ask when to adopt AI, not whether. Rexach, who works on Microsoft's Philanthropies team in Chicago and taught secondary school through Teach for America, expects AI to change society as the dot-com era did, and argues that withholding it from students does them a disservice because the workplace they enter will not be free of it. She likens the resistance to the early pushback against Texas Instruments calculators; Giard adds internet search engines to the comparison.
• Responsible use means using AI to sharpen students' own thinking. Against the concerns she has read about (academic dishonesty, students skipping the think time of the writing process, data privacy), she offers a Hispanic Heritage Month unit: students draft their own questions for an imagined interview with Cesar Chavez, then compare them with what ChatGPT or Bing Chat suggests, to practise "the art of powerful questions".
• AI fits cross-disciplinary projects ending in a capstone artifact. Her example compares fan engagement for the Cubs and White Sox, combining math analytics with social-science research on neighbourhood demographics and transit, while teaching students to vet the sources behind a claim.
• AI use will become another citation, policed by plagiarism tools. She points to Turnitin-style tools schools already buy and supposes they may now filter for ChatGPT or Bing Chat output; she expects citing AI use to sit alongside MLA or APA references, as is already discussed for images made with Bing Image Creator.
• Teacher buy-in depends on professional development and hands-on time. She wants teachers trained through summer and institute-day sessions and given time to "play in the sandbox" with the tools against their unit plans, and argues AI can also take rote work off teachers; Giard's example is drafting a parent newsletter.

2023-09-25 · open the original ↗

• Platform engineering complements DevOps rather than replacing it. Leonard, a partner solution architect at Microsoft and Giard's colleague, says that once an organization scales past one DevOps team, team A may build on Jenkins while team B picks Azure DevOps, leaving separate stacks that do the same job; platform engineering gives developers one unified platform instead.
• One platform team ends duplicated effort and uneven tooling expertise. That team supplies CI/CD, runtime (Kubernetes or otherwise), monitoring and observability consistently, so compliance and security fixes are applied once; in his role before Microsoft he saw security staff going from DevOps team to DevOps team with the same issues. Standardizing on one tool instead of GitLab, GitHub and Azure DevOps side by side saves cost. Asked by Giard whether one team can scale across a large enterprise, he says no single person or team can do it all, so the group's responsibilities must be defined up front and kept to.
• Self-service templates let anyone deploy a standard Kubernetes cluster. In a previous role his team wrote infrastructure-as-code templates behind a custom self-service portal, where developers could request a cluster, its version and add-on features, tweak it within set limits, and get it deployed without knowing how to deploy Kubernetes. He says they built it themselves a few years ago because nothing on the market did this.
• The approach is not limited to Kubernetes. He says the published discussion ties it to Kubernetes because of containers and microservices, but the same narrowing applies to event handling or databases: trimming a catalog of perhaps 50 database providers to around five that meet business requirements. He points to a CNCF white paper on platform engineering as a starting resource.
• Start nimble with one slice, not a big-bang rollout. He argues that imposing too much change at once makes enemies; begin with, for example, the CI/CD pipeline with security injected on top so teams no longer handle it, show the value, then expand.

2023-09-23 · open the original ↗

• Vector databases search by meaning and similarity, not exact content. Ekpo, a Microsoft partner solution architect covering data and AI workloads, says they convert text, images, audio or video into numbers, enabling image search on e-commerce sites and copyright detection on music services. For text, keyword search (the BM25 algorithm used by Lucene, Solr and Elasticsearch) misses "David left to get a meal" when the query says "food", whereas vector search matches the meaning.
• The index format depends on accuracy needs and available memory. Exact matching needs a sequential, non-approximating scan, as in facial recognition for passports or criminal investigations; inverted file indexes split data into buckets for memory-limited devices like phones; HNSW (hierarchical navigable small world) uses much memory but retrieves fastest, which he likens to zooming out of a map from Seattle and back in to a Florida street.
• At very large scale, use inner product on normalized vectors. He says Euclidean distance suits grouping similar items, while cosine similarity and inner product cover most cases; for scans across billions of records, normalizing vectors lets inner product reach the same result in fewer computational steps than cosine similarity.
• Production builds should use managed vector stores, not self-hosted ones. He names four first-party Azure options: Azure Cognitive Search (his first choice, offering hybrid keyword and vector search over HNSW), Cosmos DB's MongoDB API, its PostgreSQL-based API using the pgvector index, and Azure Cache for Redis. Partners including Elastic, MongoDB Atlas, Astra DB, SingleStore, Solr and Pinecone also offer one; he says self-hosting suits a proof of concept but diverts a production team from its business.
• His "RSVP" mnemonic describes retrieval-augmented generation. Reasoning engine, input signal, vector database, prompt template: the question is vectorized, matching chunks are retrieved into the prompt, and the model answers from facts it was never trained on, such as a partner's private insurance plans. His example is a rule allowing exercise only below 70 degrees, which the model can apply only once it is told it is 45 degrees.

2023-09-17 · open the original ↗

• Communication, not raw technical skill, sets technologists apart. Woodruff, in the field more than 28 years since 1995, says speaking and writing separate people in tech, calls himself not a particularly smart developer, and says he honed communication in consulting in Atlanta in the late 1990s. He argues everyone is a salesperson, selling themselves in interviews, to clients and to their own teams to build trust, and prefers "human skills" to "soft skills"; he says the heads-down "lone wolf" developer flourished in the 1970s–80s but agile and the emphasis on teams forced that type to change.
• Get involved in the tech community early. He says his first regret is joining late: he started a .NET user group in Lexington, Kentucky around 2005, at 35. He began speaking after seeing Mark Miller at a Delphi user group in Atlanta, despite a childhood speech impediment, speech therapy until 13, and avoiding public speaking until about 30.
• Go deep on something likely to last 20 years. Recalling career talks with a Michigan State computer-science freshman, he says that as a first-generation college student he had no model for a post-college career, and advises students to talk to people about career paths and find an area they genuinely care about. He warns that Silverlight experts saw it gone in five years; Giard counters that they still learned XAML, and that his own FoxPro start taught him SQL and relational databases.
• Pick three new things to learn every January. Past picks include F#, which he learned but has not really used, and speaking practice; this year (2023) they are Rust and the Mac operating system on a new Mac Studio, and he could not recall the third. He also urges attending conferences without speaking and reading business books and biographies, having just finished one of J. Robert Oppenheimer.
• Never be the smartest person in the room. He says he sits in the lower half of most rooms of developers, so associating with developers he looks up to elevates him; in turn, those who received help climbing should share what they learn and help the people coming behind them.

2023-09-10 · open the original ↗

• Easy AI APIs tempt partners to skip production architecture. Richter, a Microsoft partner solution architect and Giard's colleague, says engagements come in two steps: deciding what capability, model and prompts to build, then making it secure and well-architected for production, which is his team's part. Calling the OpenAI API directly works, he says, but is not the best long-term choice for cost, security and reliability.
• Security spans data, application and network layers. He says data sent to Azure OpenAI is not used to train the model and the model is not shared with other customers; applications can connect through managed identities so no keys or passwords are handled; and the service can be locked to VNets.
• Not every AI problem should go to a large language model. Guessing a name's gender or other simple classification can go to Azure Cognitive Services or a domain model, repeated prompts can be cached, and API Management can route requests and give cheaper models to free or bronze tiers. A partner asking OpenAI to approve loans should instead train a machine-learning model on its own approved and rejected loans to get a confidence score.
• Reliability and scale require endpoints spread across Azure regions. Because the app depends on someone else's API, he recommends redundant endpoints in active-active or active-passive setups via API Management, Traffic Manager or Front Door, with failover automated. He says scale limits apply at regional level, so four or five services in one region share them.
• The hardest part is choosing a use case that repays the cost. He calls going to production not too difficult if the well-architected framework is followed, but says adding AI is expensive, so the use case and its ROI come first. He puts API Management in front of the model partly because Azure OpenAI's logs omit the prompt text, and capturing prompts shows how users actually use the feature.

2023-09-04 · open the original ↗

• Fabric unifies the whole analytics chain as one SaaS product. Llovet de Casso, a Microsoft partner solution architect in data analytics and Giard's teammate, describes the offering, in public preview since its announcement in May, as covering ingestion, storage, transformation, warehousing, data science and reporting without wiring together Data Factory, Synapse Analytics, Azure Machine Learning and Cognitive Services. Giard notes it is unrelated to Azure Service Fabric.
• It goes beyond bundling existing services, he says. Giard summarizes Fabric as connecting existing tools; the guest calls that "mostly right" but says the services are also optimized to work together and share one interface, so a user can move from data factory to data science without learning new menus.
• Fabric is built on the Power BI web service. Users sign in with their existing Power BI account and can start a free trial during the preview; he says it is meant to feel familiar both to Power BI users and to those who know Data Factory and Azure ML concepts.
• Low-code comes through visual pipelines now, Copilot later. Transformations normally written in SQL, such as aggregates and group-bys, can be done by selecting icons; natural-language Copilot help that suggests SQL queries has been announced but was not yet available at recording.
• OneLake keeps a single Parquet copy usable by any engine. SQL, Spark and Power BI all read and write the same Parquet files, so data is neither duplicated nor locked to one compute engine; shortcuts point at data in S3 buckets or existing Azure Data Lake storage without copying it. He says the new Direct Lake mode, reading straight from the lake rather than importing or querying a source, made filters and visuals respond quickly in his own test on a dataset he puts at about 50 million rows.

2023-07-26 · open the original ↗

• Migrate legacy ASP.NET web apps to ASP.NET Core gradually, not all at once. Tower, an owner of the consultancy Trailhead Technology Partners, says locking a team away until a big project is rewritten is a waterfall approach and less successful; web projects need the most manual work because the two frameworks differ in configuration, dependency injection, startup and a pipeline the old one ties heavily to IIS. He frames the approach as the Strangler Fig pattern, after a vine that grows around a tree until it displaces it.
• Retarget shared class libraries to .NET Standard so both apps use them. Tower says .NET Standard gets little attention now that Microsoft talks about "one .NET", but it lets a single copy of a library run under both .NET Framework and modern .NET during the migration. Newtonsoft.Json (JSON.NET) is compiled against it, so legacy serialization code can keep using it even though ASP.NET Core defaults to the built-in System serializer.
• Put the reverse proxy inside the modern app itself. Rather than a separate hardware or virtual proxy in front of the legacy and modern apps, Tower prefers two pieces: the modern app is exposed to the internet and decides whether to handle each request or forward it to the legacy app. YARP ("Yet Another Reverse Proxy") is a NuGet library, and Microsoft's .NET Upgrade Assistant extension for Visual Studio creates a new modern project with YARP already installed and configured.
• YARP is driven by configuration, with an API for unusual cases. Tower says per-environment settings in appsettings.json can cover routing, multiple servers and load balancing, and YARP supports the HTTP versions ASP.NET Core does (up to "version 3, I think") including WebSockets. Asked by Giard about encryption, DoS throttling and caching, he agrees these are not built in and says an off-the-shelf product like Cloudflare or a firewall would suit them better than writing them on YARP.
• A Microsoft adapter library covers code broken by System.Web's removal. Tower says System.Web was dropped from ASP.NET Core because it was tied to IIS, breaking code that uses request, response, session state, authentication or HttpContext; a .NET Standard NuGet library he calls the "system.web extensions" forwards the most commonly used, though not all, of those APIs to the right framework. He says it can also share session state and the legacy app's authentication between the two apps, and points to a YARP team video series on Microsoft's YouTube channel from around May or June 2023.

2023-07-19 · open the original ↗

• Tell learners what to build, not how to build it. Laudati, a Microsoft cloud solution architect on Giard's team, co-created the format with colleague Gino Filicetti in April 2017 for a three-day ARM-template workshop with a shared customer in Austin; a list of tasks with experts in the room avoided authoring a 20-page, 100-step lab whose screenshots go stale.
• Small teams with a coach who answers questions with questions. Laudati says attendees work in groups of three to five, where rarely everyone is stuck at once, and a coach lets them spin their wheels "on purpose for a little bit" before offering a leading question rather than the answer.
• The format scaled from one rushed internal event to a catalog. For Microsoft's July 2017 Las Vegas conference, managers asked for a hack for about 500 people with roughly three weeks' notice; four parallel hacks drew about 300 people despite a 7:30 am Friday slot, and Tony Surma, now chief architect in the partner org, named it What The Hack. Laudati says 60 hacks are published, with 65 to 70 expected in a couple of months; Kubernetes remains the most requested, Synapse and infrastructure-as-code (ARM, Bicep, Terraform, Ansible) and DevOps are popular, and two AI hacks were due around end of July or August.
• Inconsistent early content led to guides, templates and a volunteer team. Early hacks arrived as PDFs, Word documents or Markdown, and users complained about uneven quality, so the founders wrote an author's guide and a hosting guide. After Filicetti left Microsoft, Laudati formed a "V team" (volunteer, he says, not virtual) of five or six curators, and member Jordan Bean built a GitHub Action that scaffolds a new hack's Markdown files with the author's guide rules inline.
• The website shows student guides; the coach guides sit in the repo. Authors must now write a coach's guide listing common blockers (such as Cosmos DB costs if left running) so a new coach can stay "two steps ahead" after three days' preparation. Laudati promotes the GitHub Pages site at aka.ms/WTH rather than the repo so students do not find the answers, and says the content is open source and can be run outside Microsoft, though he often does not know where it is used; most contributions come from inside Microsoft, with some partners co-authoring hacks on their Azure solutions.

2023-07-18 · open the original ↗

• UX is how something works; UI is how it looks. Janelle, a UX and UI designer at Amazon working on the internal tool sellers use to enter SKU and storage information, says the skills are not interchangeable: visual design moved easily into UI, but UX adds the psychology of why people use things, research plans and reports, and strategic mapping of navigation. She says UX skills make for a better UI designer, for example knowing two adjacent buttons should not share a colour because the eye clicks before reading.
• Good UX rests on being user-centred, accessible and usable. Janelle says designers must remove themselves even when they use the product, which is hard to learn; accessibility gets too little attention, citing grandparents who had the internet "forced onto them" for doctor's appointments. Usability is checked by testing designs with various people and iterating before money is spent building, and she says UX applies beyond digital products, to restaurants or concerts.
• Usually design one product simple enough for everyone. Asked by Giard how to serve different audiences, Janelle says a doctor's office will not build separate apps, so a broad user pool demands more testing and knowledge of users; toggleable features such as dark mode, haptics, or Apple's pared-down home screen are the exceptions that serve specific groups.
• A bootcamp filters the material that self-teaching leaves to you. Janelle took a roughly 10-week General Assembly bootcamp to add UX skills to her visual design background because it gave set dates, a portfolio and help with networking and landing roles; she says the self-taught route through articles, videos and $9–$20 courses takes longer.
• A portfolio needs to be good enough, not perfect. Preparing hers for a role at Caterpillar, where she worked five years, before joining Amazon about a year and a half ago, Janelle was overwhelmed by the long case studies, since working designers rarely document projects as they go. A UX designer friend told her it only has to demonstrate skills and problem-solving with a sound format; Giard extends this to almost everything: "if nobody sees it, it's worthless."

2023-07-16 · open the original ↗

• Build a course on a problem you have already solved. Shoemaker, a Pluralsight author for about 15 years with about 15 active courses, warns against picking a topic to learn and then teach; instead check Reddit, Facebook and technology groups for people asking the question, then ask contacts for an hour to walk through your solution, keeping it low fidelity and "ruthlessly" applying the feedback. He says negative feedback is even better than validation, because it shows you are solving the wrong problem or solving it the wrong way. Giard compares the process to agile and lean software development, and Shoemaker accepts the comparison.
• Pre-sell a live beta before producing the recorded course. After testing ideas on three to five "pioneers", Shoemaker announces a discounted live course of three or four weeks that buyers help shape. The pioneers show whether the idea solves a real problem; the pre-sale answers whether people will pay, which he calls product-market fit. Slides or a Google Doc outline are enough at this stage, because a finished video is hard to edit.
• A launch is a campaign, not a link in your bio. Shoemaker says independent creators fail by simply announcing a course; you should warm the audience, build a wait list and keep giving value before opening the cart. A large following can be a false positive: when he repositioned his Twitter account from programming to course building, many followers left, and only a fraction of followers see any post anyway.
• Teach new concepts through metaphors for things people know. Talking to his child's fourth- or fifth-grade class, he explained strings with a letter-by-letter happy birthday banner, variables with an Amazon box and arrays with Boba Fett figurines. He says reusing these in his web development fundamentals course drew the most feedback he has had, because adults respond to them as well as children do. He now prompts ChatGPT to play a sixth grader who questions his lessons, and recalls Paul Sheriff's advice that the real demand is for beginner content, since everyone is a beginner at something.
• He now teaches course creation because technology courses age fast. Shoemaker says tech courses have a shorter shelf life than ever, so he chose an evergreen subject: helping subject-matter experts and entrepreneurs build and sell information products. He also hosts a podcast, Leverage Three, in which each guest ends with three actionable tactics.

2023-07-14 · open the original ↗

• Long-lived projects need structures that throwaway projects can skip. Eini, who founded RavenDB in 2008 and has run it for close to 15 years, contrasts a roughly six-month Israeli project around 2005 to move phone numbers from nine to ten digits, where unmaintainable code was fine because it was discarded. He says typical industry projects last three to five years before a rewrite because the maintenance burden grows, and he credits early asynchronous, email-only open-source work and Michael Feathers' Working Effectively with Legacy Code for making him spell out how features are built and verified.
• Hitting architectural limits forced a multi-year rewrite of the core. Eini says unit tests and a proper design did not stop the original code writing itself into a corner: too many uncontrollable allocations put a hard cap on performance. The RavenDB rebuild took close to two or three years and, backed by a design document, a proof of concept and tests, has held five or six years and three major releases later.
• Competitive performance demands ugly code, so the team is organised around it. Eini says SIMD instructions can give 10 to 20 times the speed but are "utterly unreadable", and cites a recent access violation from unaligned AVX access on an old build server. His answers include specialists by area, one engineer "whose sole job is to make code ugly" with about ten lines of comments explaining why, debug assertions throughout, shallow layers from HTTP endpoint to disk, extending rather than modifying code, and a single process rather than microservices, whose interactions he finds harder to follow; new hires take six to nine months to pay for themselves, and most of his team has been there five years or more.
• Test through the client API, not internal units. Eini says unit tests hinder change by locking in implementation details, as when buffering and sorting once broke every test written for a sorted list, and that writing tests first can commit you to the wrong approach. RavenDB's roughly 25,000–26,000 tests use the client API with in-memory infrastructure that can spin up a five-node cluster in three lines, which lets customer reproductions drop straight into the test project; Giard pushes back that a failing unit test pinpoints where a fault is.
• Keep the feedback loop short by removing friction continuously. Eini says he expected RavenDB to fail and built its infrastructure gradually by automating each repeated step; pairing with a stuck developer, he first writes enough code to reach the failing scenario with one F5. When the fast test suite reaches five minutes, the slowest tests move to the slow suite (3–6 hours) to bring it back to one or two, which he says happens about yearly.

2023-07-11 · open the original ↗

• Juneteenth Conf showcases Black technologists on deep technical topics. Brown, who works at Microsoft, started it in 2020, during the pandemic and the events around George Floyd. He was marking his first year at Microsoft, and he framed Juneteenth as a time to celebrate a milestone while work remains. He contrasts it with conferences that have one or two Black speakers, often talking about DEI; his roster was all Black and covered topics from AI to UX/UI design and IP law. Giard notes it also had non-technical talks, including a keynote by Tim Banks, who described it as a conference for Black people in technology.
• The goal is to refute the "pipeline isn't there" narrative. Brown says people wrongly conflate affirmative action with lowered standards, and he calls that misinformation deliberate. He offers his own case: from a low-income, single-parent home in Chicago, he scored around the 98th percentile on standardized tests, was about third in his class and went to an elite Massachusetts liberal arts college (Williams College, which Giard finds on his LinkedIn).
• Diversity is a trailing indicator of inclusion, not a goal. Brown compares it to weight loss, which follows from a healthier lifestyle. His advice to organizers and recruiters is to be welcoming and "walk in their spaces", just as tech recruiters go to meetups. Calling around for Black speakers the week before a conference, he says, seems disingenuous.
• After three virtual years, it went in person this year. Brown kept it virtual while he did not want it to be a spreader event, and moved it to a hybrid in-person event in Chicago now that people take precautions and many are vaccinated, valuing the hallway conversations. Next year it will be on the Friday after Juneteenth, avoiding Father's Day; Giard works out that this is 21 June 2024. Brown says it will be in person and in Chicago again.
• Funding is donations and Microsoft's time-based matching. Brown says much of the money comes from Microsoft's matching program, which matches volunteers' hours as well as dollars, plus donations from attendees and partners; he hopes for corporate sponsors next year and says some have approached him. The organization is incorporated as a nonprofit in Washington with a 501(c)(3) fiscal host. Its main planned programme is a paid internship for high school students covering programming, UX design and project management, to show the range of tech careers.

2023-07-09 · open the original ↗

• HyperCLI is a curl alternative with session memory. Amundsen, an author on hypermedia and web APIs, says he built it after finding himself writing bash scripts around curl's "gnarly" syntax; it does what curl does, including headers and authorization, but can run scripts. Every successful response goes on an in-memory stack, so ten requests leave ten responses whose data can be read and then written to another site.
• HyperLang is deliberately verbose, modelled on early conversational languages. Amundsen says it is inspired by COBOL and its predecessor FLOW-MATIC. Against the trend toward terse, general languages, Amundsen designed an API-specific one whose scripts read like sentences ("call… with… using this form"), which he says can mean less typing than curl and a "conversation" with a remote server. HyperCLI is written in Node.js and is currently the only tool that runs HyperLang.
• The tool lets you explore an API without reading its documentation. Amundsen says commands such as "show links" and "show forms" list a response's links and forms and their arguments, and the tool reads the media type (HTML, Collection+JSON, HAL, Uber, Mason and others) to know where links sit in each. Plugins add industry vocabularies he names, such as PSD2 for banking, HL7 for health and ACORD for insurance, so a script could ask for health records from a given doctor.
• It grew incrementally over about a year and is now open source. Amundsen says it started as a simple read-evaluate loop that he extended use case by use case and then split into plugins; it is under the MIT licence or a variant, installs through npm under his GitHub name (mamund), and needs Node.js. He gets several downloads a day and a plugin or two from others, finds maintaining it a challenge, and plans a general library that could be ported to C# or other languages.
• He points newcomers to a written introduction and a conference talk. The Substack article is titled "Programming the Web with HyperLang and HyperCLI" and links his GOTO Chicago talk and slides; a GitHub Pages site carries the README tutorial, and a Twitter account he named showed nothing during recording. Amundsen says he is focused on updating his API design book rather than speaking.

2023-07-03 · open the original ↗

• Developers treat monitoring as an afterthought, yet it serves two purposes. Giard admits to adding monitoring only after a problem occurs. Desir, a solutions engineer at Datadog for almost two years, says her software engineering boot camp never mentioned it and that many newcomers do not know it matters. Its reactive purpose is to find what broke, when, where and from whose code change, so the change can be rolled back; its proactive purpose is to use the data to project and adjust the business.
• Logs are one part of monitoring and should be structured. Desir describes a log as a payload about an event, such as a timestamp, environment and service. She says it should reach the monitoring service as a JSON object of key-value pairs rather than raw text, so it is easier to read and to parse.
• Log only what matters to your business, not everything. Faced with all the options in Azure, such as activity logs and platform logs, Desir says logging everything is expensive. What to log depends on how it affects your business, and the list will change over time.
• Almost anything can be turned into a metric. Desir defines a metric as a data point with values or tags, for example a count recorded each time she turns on a light; Giard offers page views. She lists system, log, application and tracing metrics.
• Use monitors for urgent alerts and dashboards for awareness. A monitor alerts at a threshold, for instance 100 page views, through Slack, PagerDuty, email or a phone call. For things that are not urgent, Desir suggests tracking logs and building reports, or a dashboard: a single-pane view with no alerting. She adds that serverless functions such as AWS Lambdas and Azure Functions can be monitored too, for example to catch a slow start, and points to Datadog's Learning Center (learn.datadoghq.com), which Giard reports has full courses.

2023-06-30 · open the original ↗

• Take back ownership of your own validation and worth. Banks's keynote, "Solace of You" (named after a Living Colour song), argues that people in tech look for worth in jobs, salaries, reviews and awards, none of which they control. He says this is harder for Black people, who also carry stereotypes and expectations projected on them from outside.
• Developers need a life away from the screen. Banks rejects the view, which he sees mostly among developers, that a good developer must make coding a passion and lifestyle. He says open-source work still counts as career work, and that people need boundaries around work and some other outlet: his is Brazilian jiu-jitsu, where he is a brown belt.
• Bias and societal burdens drain capacity, and the effects compound. Banks says Black employees arrive already carrying institutional racism, health-care access, lack of generational wealth and mortgage barriers, lose more to bias at work, and are then measured against peers who carry none of it. He adds his own ADHD, anxiety, RSD and major depressive disorder as further drains. Giard compares it to his own months-long back pain; Banks agrees the difference is that it is constant.
• Those with seniority should make it safe to ask for help. With 26-plus years in the industry, Banks says he can take a day off for depression, but someone two or three years in, especially from a marginalized identity, may not feel safe to, so the senior and privileged should model it and offer time or moved deadlines without career fallout. His advice to juniors is to find a trusted mentor, build a "group chat slash back channel" network, and use communities such as employee resource groups, meetups and conference birds-of-a-feather sessions.
• When handed a microphone or platform, take it and keep it. Banks says representation matters because he never saw a Black leader in tech coming up: once you have keynoted, you are a keynote speaker, and you lift others onto the platform without ever giving it up. He frames lending privilege as handing someone the mic. Giard, who calls himself white, straight, Christian and upper middle class, says he took that message as aimed at himself too.

2023-06-05 · open the original ↗

• Each added nine of uptime cuts downtime tenfold, at rising cost. Huang puts 99.9% at roughly eight hours of downtime a year, 99.99% at 52 minutes and 99.999% at about five minutes. He says higher targets are complex and expensive because they mean more zones, regions and instances, so the target should fit the business: an education app might take its downtime when school is out.
• Resilience comes from distributing, retrying, queuing and scaling horizontally. Huang, a cloud solution architect on Giard's team, describes running the application in several regions behind Azure Front Door so traffic can be rerouted if one region fails (East US to West US). He adds retries, message queues, and horizontal scale-out with VM scale sets or Azure Functions for spikes such as Super Bowl Sunday, Black Friday or a "Reddit hug of death".
• Load and chaos testing should run like experiments, not at maximum. Huang says to state a hypothesis and step up from normal load, for example a usual 10,000 users a day, then 20,000, watching whether performance holds. Azure Chaos Studio, an Azure service he calls "our", injects faults such as Chaos Mesh pod failures, CPU pressure, killed processes or denied Key Vault access. Mature teams can "shift right" and test in production, which he does not recommend on day one.
• An application should degrade gracefully rather than fail outright. Giard raises the idea and his consulting work for an electronics retailer whose stores had to take the customer's money even with no connection to the data center. Huang agrees, ranking checkout and add-to-cart above a wish list, and says an unbearably slow site feels down to users.
• Testing needs monitoring to show what actually happened. Huang says monitoring is how you know whether injected faults are causing problems, and lets you compare performance with a week ago, a month ago or the previous release. Giard adds that customers report things "feel slower", and that measures such as page load time are what let you fix it.

2023-05-26 · open the original ↗

• Cycle.io built its own container orchestrator rather than building on Kubernetes. Mattoni, Cycle's co-founder and head of engineering, likens Kubernetes to a car's engine that still needs many other tools and decisions to be production-ready. He says Cycle is vertically integrated, with no Docker or Kubernetes underneath and networking, storage and orchestration built to work together, so a developer can deploy without deep DevOps knowledge. It runs any OCI-compliant (Open Container Initiative) image.
• Customers own the cloud servers, and Cycle keeps them maintained. Cycle takes the customer's API key for AWS, Azure, Google Cloud or others, installs its own operating system on the servers and keeps the kernel and platform software current. He has done this "about five years since like 2017, 2018" (he first said eight, then corrected himself). He grounds the case in a Datadog study from "about a year and a half, two years ago" that he says found the average Kubernetes install about 18 months out of date. An infrastructure abstraction layer, released in the last few months, lets on-prem or colo hardware stand in for a cloud through an endpoint of about 10 API calls.
• Deploying means creating an environment and pressing start. Mattoni says each environment is an encrypted private network spanning clouds and clusters, where containers reach each other by hostname. Cycle deploys a load balancer, a DNS discovery service and a VPN into each one automatically. Images come from direct upload, Docker registries, or a "stack file" like a Helm chart or Docker Compose file. Cycle covers only the CD half of CI/CD, through webhook-triggered pipelines, and leaves testing to CI tools such as GitHub Actions. At recording, a revamped portal was due in about a month and a CLI in the next couple of months.
• Pricing goes by servers managed and number of users. The free tier gives one server and one user. Mattoni says the light plan starts at "like $300 a month", the business plan covers 10-plus servers and 10-plus users, and paid tiers can add servers for a small cost. Enterprise customers can have a whole Cycle core deployed on their own infrastructure.
• He says companies tired of self-managed Kubernetes drove Cycle's recent growth. He and co-founder Jake Warner started in 2015 as a dev shop in Toledo, Ohio, writing custom deployments for each client. Around DockerCon 2015 they decided to build their own orchestrator, and they dropped the dev-shop work by late 2016. Early on, most prospects did not know what a container was. He says the company has grown 10x in the last year and a half as firms found Kubernetes "a lot more management burden than it's worth". The name comes from a roughly 15-minute loop in which the platform checks deployments against its internal state.

2023-05-25 · open the original ↗

• Video Indexer extracts AI insights from media, but face identification is restricted. Conley, a Microsoft cloud solution architect who has used it for four to five years, describes it as Cognitive Services applied to video, audio, or both: object detection, speech-to-text, translation, keywords and topic inference. She says government agencies cannot use face identification professionally, and the upload form makes users confirm they will not share with police; organizations other than defense or police can apply for an exemption.
• It works only on prerecorded video, not live streams. Conley says Endemol Shine uses it to pick scenes for Big Brother's three-weekly episodes from cameras running around the clock, and education platforms use it for search, clipping and audience personalization. Giard's security-camera example fits only after the fact; she has got a "pseudo live" result by sub-clipping about 30 seconds at a time, but says other tools suit live video better.
• Faces you name once are recognized in later videos. In the demo she renames an unknown face, and it goes into a people model applied to later indexing; celebrities found in IMDb, Wikipedia or Bing are recognized without that. Clicking a face, topic or keyword jumps to each place it appears. The player panels are widgets you can embed, insights download as JSON, and a developer portal lists the APIs with a "try it" console. She also shows a Logic App that fetches captions in a chosen language when indexing completes, and advises naming a video's primary language.
• Cost depends mainly on the video's file formats. Conley says prices were cut 40% in February and change often. The factors she lists are input resolution (SD, HD or UHD), output streaming format (adaptive or single bit rate), standard versus advanced analysis, and audio-only, charged per minute. The free trial gives most features but limits custom models.
• Use the newer ARM version, not the classic one. After first calling the new version "non-ARM", she corrects herself: in classic, assets sat in the customer's storage account and egress was billed, while the ARM version serves those large JSON files through API calls with an ARM token, making it "more of a PaaS service". She points newcomers to Microsoft's Video Indexer learning pages and warns that some samples are for the legacy version.

2023-04-28 · open the original ↗

• The first career choice is hands-on technology versus sales. Rodriguez, a Microsoft cloud solution architect since 2015 and at the company since 1999, says technology work is predictable if you work at it hard enough, while sales means persuading decision makers who often just want the cheapest thing that works; he says that skill has real value and does not treat "sales" as a bad word. Within technology the next choice is developer or infrastructure; Giard argues from his own career that the split is not binary, and Rodriguez agrees it is better to know both.
• Short engagements demand credibility fast; assigned accounts bring pressure. In roles like his current partner team or the Microsoft Technology Center, Rodriguez says you may see a customer for a few hours and must prove your expertise immediately. As an account technology strategist with assigned accounts he could build relationships, but when one customer began considering a move to Google he was on weekly calls with VP-level people, which he describes as stressful; Giard says he avoids quota roles partly because no quota lets him speak candidly about competitors.
• Higher pay usually buys more pressure and less balance. Rodriguez suggests Glassdoor or LinkedIn for salary ranges, says better-paid roles often trade away job happiness, and says he would not be happy in an 80-hour-a-week job because he sits on the boards of several orchestras. He cites friends who joined a new Microsoft partner and were paid about $5 million when it was bought out, against another whose paychecks bounced; Giard adds that he once took a significant pay cut to stop travelling 100% of the time while his children were young.
• He stayed 24 years because Microsoft itself kept changing. Rodriguez contrasts a company that once mocked Linux with one that now backs open source, Linux, Postgres and MySQL, and says it treats employees better than competitors he sees as treating staff as disposable. He says friends at competitors make "100 to 200 more" than he does, a trade he doubts he would take, and that adjusting to another company's culture, such as locked-down machines without admin rights, would take longer than learning its technology.
• Change jobs when your current one won't give you growth. Rodriguez advises raising it with your manager first, and looking outside the company only if the opportunity is not there, while planning how to get from, say, Exchange administration to AI work. He says his two years as an account technology strategist were valuable because they showed him how consulting, support, licensing, account teams and partners fit together around a customer.

2023-04-24 · open the original ↗

• A "feature complete" blog engine fell behind a web that kept moving. Downie says Clemens Vasters wrote it in the early 2000s, soon after ASP.NET appeared, as one of Microsoft's first open source projects, and Scott Hanselman and others carried it on; Downie, a Microsoft principal program manager on Visual Studio production diagnostics, picked it up around 2014, when it was abandoned. His first fix was letting a post set its own Open Graph header data, which until then meant editing the code; Giard recalls Hanselman saying there were no new features "because all the features are already there."
• The .NET Core port kept most of the original code running unchanged. Starting around 2015, Downie set out to make DasBlog Core run on Windows or Linux, in a new GitHub repository separate from Hanselman's ASP.NET classic version. The hard part was Windows assumptions baked in, such as time-zone data read from the registry; the Web Forms UI was almost entirely replaced with a new MVC layer over an abstraction that talks to the old code, while the code for saving a post is "almost unchanged" and now runs on Linux, Windows and the cloud.
• Storing posts as plain XML files means the author owns their words. Downie says avoiding a proprietary database was DasBlog's distinctive idea: posts are XML files dated by creation, so backup or moving servers is just copying files, and leaving means writing a program "in an afternoon" to convert them. Giard, who has used DasBlog for his blog for over 20 years, values the same portability but doubts he could write that converter in half a day.
• Migration is designed to preserve every old URL. Downie says users of the old version can copy their content folder (XML files and images) into DasBlog Core, and old .aspx addresses redirect with a 301/302 to the new hyphenated canonical URLs; the project wiki covers a one-click Azure free-tier setup contributed by a community member, migration, security and Open Live Writer, and he answers questions through GitHub issues, using them to improve the documentation. Giard migrated by hand over FTP and found links between his own posts broke, which he fixed by searching the downloaded XML files; Downie broke links moving his blog from popstring.com to popstring.com/blog and wrote a program to find and replace them.
• A blog could act as its own node in the Fediverse. Downie asks whether a blog could act as an independent node in the federated network that others subscribe to, much as they subscribe to RSS, and says he has already made his blog discoverable there, identifying him by his Fediverse handle. He presents it as ongoing exploration that he and Vasters, who has recently returned to contributing to the project, are both thinking about.

2023-04-18 · open the original ↗

• The Azure Marketplace is where third-party software is bought. Falgout, a Microsoft cloud solution architect who helps partners onto the marketplace, contrasts it with the portal's "plus" button for Microsoft's own services. The partners are mainly independent software vendors, who write software, and system integrators, who implement solutions and may themselves use an ISV's product.
• Publishing starts with becoming a Microsoft partner. Falgout says a company creates a Partner Center account at partner.microsoft.com and publishes an "offer" there, which then appears in the marketplace. For technical guides and labs on building a SaaS offer he recommends "Mastering the Marketplace" on GitHub, and he points to his own slide deck.
• Kubernetes apps put partner software into customers' clusters. The partner packages its offer as a Helm chart, Microsoft runs security checks, and the customer installs it with a click; any charge appears as a line item on the customer's Azure bill, so the vendor avoids purchase orders and procurement. At recording this was in public preview, which Falgout says to treat like a beta, with general availability coming "very soon" at an unstated date.
• Vetted marketplace spend counts against customers' Azure commitments. Falgout says large enterprises sign a Microsoft Azure commitment contract (a "MAC") to spend millions on Azure. For transactable containers and Kubernetes apps that Microsoft has validated, which is part of his and Giard's job, the customer's payments to the partner decrement that commitment, which he calls a big draw for expensive software.

2023-04-04 · open the original ↗

• ngrok exposes a local app to the world, then layers controls. Casey, who has worked in ngrok's product marketing and developer advocacy for about a year and a half, says a local agent opens a tunnel via reverse proxy to ngrok's cloud and puts a URL in front of your port, handling TLS, DNS and NAT traversal. On top he lists identity providers, OAuth, basic auth, IP restrictions, mutual TLS, load balancing, circuit breaking and webhook verification, and says a Kubernetes ingress controller was launching the week after recording.
• Webhooks are message passing between systems over HTTP and JSON. Casey explains them as object-oriented state-change notification across the wire, such as a card payment moving from confirmed to paid, and says their unrealized power is that they work with any stack. He says ngrok gets about 4,500 sign-ups a day, most of them doing something with webhooks, because many providers' webhook guides start by telling you to create an ngrok account.
• Every webhook provider invented its own verification scheme. Casey says the first 50 providers they surveyed had 50 different methods, with duplicates appearing only around 120–130, often differing in small details such as parameter case or ordering. Of about 100 they collected, ngrok implemented 50, and he and a colleague published the research as webhooks.fyi, free on GitHub, lightly ngrok-branded and open to pull requests, with best practices for both providers and consumers.
• Match the verification method to the security you need. Casey calls a shared secret, like Twilio's auth token, sufficient for low-security cases and best when you control both endpoints. He puts HMAC at the higher end for broadcasting to endpoints you don't control, so you need not publish a secret, and warns that even internal webhooks need verification because success brings outside customers or partners onto the system.
• Providers routinely omit sample code and sample payloads. Casey says most providers give a bulleted list of steps instead of working verification code they surely wrote to test it, and that probably half of those surveyed had no sample payload. He says the site supplies field data to standardization efforts, naming an IETF working group and the OpenID Foundation's Shared Signals and Events work, which thanked them, though he does not know whether it uses the data.

2023-03-16 · open the original ↗

• REST's contribution was standardizing services within HTTP's own constraints. Woodruff traces web services from 1990s RPC through SOAP to sites like Facebook and Twitter making up their own HTTP calls, such as a GET carrying "insert" in its body; his point is that developers should build within the environment they are in, HTTP, rather than from the ground up.
• You need HTTP's working vocabulary, not the whole specification. He shows the HTTP 1.1 spec in his talk and says not to read it; what matters is that requests and responses each carry headers and a body, with headers for client type, content type and the format wanted back (JSON, XML, HTML, binary), plus the request's verb and the response's status code.
• Status codes are a language the API and consumer agree on. In his convention 200 means success with a response body and 204 success with none, as after a DELETE; the 400s blame the client and the 500s the server. He returns 405 for verbs his read-only APIs refuse, 410 for a resource no longer at that address, 429 for rate limiting on paid or abuse-prone APIs, and 503 when a client requests an API version that has been retired.
• REST, as he sees it, is resources, addresses and verbs. A resource is any digital thing, made unique by its URL even if identical copies exist elsewhere; GET, POST, PUT and DELETE change its state and map onto create-read-update-delete, with PATCH increasingly used for partial updates. He says others may disagree with this framing.
• Hypermedia lets responses tell clients where related resources live. Of Roy Fielding's constraints (client-server, stateless, caching, uniform interface, layered system, code on demand) he dwells on HATEOAS: a list of Beatles albums should carry a URL per track so a music-store client can buy one without knowing addresses in advance. He says he has never seen code on demand used and does not fully understand it; Giard notes it needs a lot of trust.

2023-03-16 · open the original ↗

• Azure's many messaging services each fit a different scenario. Grootenboer, Microsoft's program manager for Azure Service Bus, describes Storage Queues as simple, high-throughput queuing. Service Bus is advanced enterprise queuing in the line of IBM MQ, with sessions for in-order processing, auto-forwarding, dead-lettering and scheduled delivery. Event Hubs is for streaming and offers a Kafka protocol, and Event Grid is for events ("something happened"), as opposed to messages ("do something for me"). He says many customers use several side by side.
• Service Bus offers at-least-once or at-most-once delivery, not exactly-once. Peek-lock gives at-least-once and receive-and-delete gives at-most-once. Exactly-once needs client-side logic: a log of processed messages, and of the steps within each, so that work resumes at the right step. Transactions are limited to moving messages between queues in one namespace, never spanning a database. Poison messages go to a dead-letter queue after 10 retries by default, and duplicate detection drops repeats of an ID such as an order number within a time window.
• Tier sets message size, pricing model and scale. Basic and Standard run on shared infrastructure, priced per million messages, which he says suits bursty serverless loads. Premium gets dedicated CPU and memory, priced per hour, with no hard message limit. Messages can be up to 256 KB on Standard and 100 MB on Premium, and he says messages near 100 MB mean you are doing data transfer, not messaging. Premium scales to 16 messaging units per partition, a new partitions feature then allowed 4 partitions (64 units), and he says GA could allow, for example, 16 partitions of 16 units each (256 units).
• Geo-disaster recovery will replicate messages, not just metadata. As of the March 2023 recording, Geo-DR copied only entities such as queues and topics. A private preview "in the coming weeks" was to replicate the whole namespace, data included. Synchronous mode gives an RPO of zero at the cost of cross-region latency. Asynchronous mode lets you set an allowed RPO, such as 10 minutes, and throttles senders once replication lag reaches it. He gave no timeline beyond private preview.
• Durable terminus will keep message locks across dropped connections. Today a broken AMQP connection, from container churn, client faults or Microsoft's own infrastructure upgrades, loses the lock, so the message goes to another consumer and may be processed twice. A new lock mode, tentatively "durable lock", lets a reconnecting client get its message state back from the service. He says Service Bus will be the first broker to implement this part of the AMQP spec, and it too was headed to private preview soon.

2023-03-09 · open the original ↗

• Tooling and T-SQL habits are a SQL Server developer's main hurdles. Booz, after about 15 years on SQL Server and .NET, joined a company that had moved to Postgres in the month before he arrived. Postgres runs SQL closer to the ANSI standard, so things like variables mid-script need its procedural language, PL/pgSQL, inside a function. There is no single official IDE: he names pgAdmin and uses DBeaver, the closest he has found to SSMS. He says Postgres's protocol has become the standard for connecting, used even by databases such as CockroachDB and YugabyteDB.
• Extensibility is the feature Postgres has that SQL Server lacks. Booz says that over a decade ago Postgres added hooks letting extensions change query planning, on-disk storage, index types and backup. His examples are Timescale, his former employer, which adds compression and managed partitioning; Citus, bought by Microsoft for horizontal scaling; and HypoPG, which tests whether the planner would use a hypothetical index. Beyond B-tree, Postgres has hash indexes and the GIN and GiST types that grew out of PostGIS, which handle nearest-neighbour searches and overlapping ranges.
• Query tuning is weaker than in SQL Server. Booz says the complaint he hears most is that Postgres query plans are text-only, with fewer node types, and hard to parse next to SQL Server's graphical plans. Second is the lack of a built-in equivalent to Query Store for seeing how a query used to run. Third-party tools and startups are working on both, including his employer, Redgate.
• A permissive licence means no lock-in to a vendor's core. Booz says Postgres is entirely free under a very short licence, which is why AWS could fork it to build Redshift. Any vendor's Postgres must offer the full core, so vendors differ only in which extensions they allow. Some extensions carry their own licences, and procedural-language extensions without a "trusted" layer could break out onto the server, so not every provider supports them.
• AWS's Babelfish could start moving SQL Server shops to Postgres. AWS, which Booz calls the biggest provider of Postgres services through RDS and Aurora, announced Babelfish about three years before the recording. It is an open-source fork that translates T-SQL so SQL Server tools and .NET apps can connect, and he says AWS hopes to merge it into mainline Postgres. He says Redgate sees .NET and SQL Server shops of 15–20 years asking about Postgres, and he expects more developers to be asked to migrate, though he does not know how fast.

2023-02-25 · open the original ↗

• Power Platform is one piece of a larger architecture, not all-or-nothing. Grossnicklaus, who runs a software development company building .NET, Azure, Angular and Kubernetes systems, says his teams typically combine two or three of Power Apps, Power BI, Power Automate, Power Pages and Power Virtual Agents alongside custom Angular and .NET code; if he can get 90% done in a week and spend a month on the other 10%, the project is still shorter and cheaper.
• It fits internal enterprise data apps, not public-scale products. He would not build "the next Twitter" on it, but a division of 50 people searching, reporting on and entering data is a good fit; Microsoft licenses it per user or per app, and its Dataverse database lives behind an API with no data center to choose. He says governance and security (who can publish, what data apps reach) are built in, though some client companies made it "the Wild West" by ignoring them.
• Owning the bottom line is what converted him. As a developer he chose technology with "someone else's money"; as a business owner he weighs eight months of a development team against hiring someone part-time to do the task manually. He says Power Automate lets him offer small businesses that have done things by hand for years a two-day automation engagement.
• A COVID vaccination tracker went live in about two weeks. Five or six St. Louis hospitals pooling doses for weekend events in underserved areas needed state-reportable tracking within two weeks, against the eight months he estimates for traditional development; his team built an Angular/.NET registration site on Azure feeding Dynamics, an iPad check-in Power App and a Power BI report to the state, finished in four or five days with a week of testing. He says he fixed bugs on site in real time, and the system was archived after roughly 12 months of use.
• In his experience the adopters are developers, not citizen developers. Grossnicklaus says Microsoft's marketing targets non-technical users, but everyone he has seen adopt the platform had a deep technical background, and about 99% of his conference audiences are developers. Inside his own company he evangelizes it top-down, steering small internal admin screens to Power Apps so developers focus on public-facing work.

2023-02-23 · open the original ↗

• Software-defined radio moves tuning and demodulation from circuitry into software. Royse, a developer advocate at Redis, shows a USB dongle costing $25–30 on Amazon that covers from below AM up to about 2 GHz and sends a wide swath of bandwidth to the computer to decode; it needs an antenna suited to each frequency.
• A cheap setup reaches across the world and the local airwaves. With a loop antenna at his dining-room window in Columbus, Ohio, he picked up a shortwave station broadcasting from Lhasa, Tibet. On camera he uses SDR Angel, which he calls full-featured but steep to learn, with a two-metre/70-centimetre antenna to tune 162.55 MHz, Columbus's NOAA weather radio, through a narrowband FM demodulator.
• Ham radio's APRS carries data as well as audio. On 144.39 MHz, stations broadcast location, weather and tracking packets in AX.25, based on X.25 with call signs in place of MAC addresses and the same encoding as 1200-baud modems. iGates relay packets to and from the internet, enabling SMS gateways and weather lookups, and a repeater on the International Space Station can relay a message from the wilderness.
• Many everyday devices broadcast readable data in the clear. He lists aircraft positions and flights, ships (he tracked boats on the Ohio River at an event in Louisville), gas and water meter readings (he matched his own meter's ID) and tyre-pressure sensors reporting pressure and temperature. His talk "Tracking Aircraft with Redis and Software Defined Radio" puts aircraft data into an event stream feeding a map app.
• Unencrypted pagers leak medical information. Royse says doctors are the most common remaining text-pager users, so HIPAA violations with patient names and room numbers occur "every minute". His understanding of US law, revised mid-conversation and offered as not legal advice, is that listening to clear broadcasts is legal but sharing communications intended to be private is not, and breaking encryption counts as illegal hacking.

2023-02-22 · open the original ↗

• Fluent Migrator versions schema changes as ordered, reversible C# classes. Groves, who works at Couchbase, describes an imperative approach inspired by Rails migrations: each numbered class overrides Up (create table, add column) and Down (drop, remove), and a runner applies the ones not yet run; he has had 50 or 60 in smaller projects, and tags or parameters can restrict migrations to dev or test environments. He credits its fluent syntax with making features discoverable through IntelliSense.
• Stored procedures, views and triggers fit it awkwardly. Fluent Migrator can run a checked-in SQL script, but changing it means either editing the file and losing the version history or adding a "Matt Sproc 2" copy, a source-control history inside source control. Groves prefers to keep business logic out of the database anyway.
• Broad database support means lagging database-specific features. It supports SQL Server back to 2000, Postgres, MySQL, Oracle, Access via the Jet engine and DB2, but a new feature in, say, Postgres may not be available right away.
• DBAs may want to see the SQL before production. The command-line runner can run in a CI/CD pipeline for fully automated deployment, but it abstracts away the generated SQL; an output option Groves only recently learned of writes a full SQL script that a DBA can review, tweak and run against test or staging first.
• He has started a separate NoSQL Migrator project. Fluent Migrator is relational-only, and talks with its organizer about NoSQL support ran into big differences between NoSQL APIs, so Groves built an unaffiliated, early-stage tool at github.com/mgroves/nosqlmigrator; he argues schemaless databases still have structure that teams should track in source control.

2023-02-21 · open the original ↗

• Dapr's building blocks abstract microservice plumbing behind configuration. Rutz, a cloud solution architect on Microsoft's app innovation team, cites service invocation with service discovery and mTLS handled for you, and a simple key-value state API whose backing store, such as Redis or Cosmos DB, is set in component configuration outside the code; the same code can use RabbitMQ or Redis locally, Service Bus in the cloud, or different middleware at an edge site such as a smart factory.
• Bindings bring event-driven triggers to containers. Rather than writing code to read from an Event Hub and track its position in the stream, Rutz says the developer configures a binding and Dapr invokes the configured method for each event; the host compares this to Azure Functions, which he puts at about half a dozen triggers.
• Actors give stateful objects sequential processing while the system scales out. Rutz's example is IoT, with thousands or millions of devices sending telemetry processed concurrently, where each device's events must be handled in order. He also lists observability traces aligned with OpenTelemetry, and secrets and configuration through a generic API, so that Key Vault in the cloud can be environment variables locally without an SDK.
• The sidecar model makes Dapr language-agnostic. Dapr runs beside the application and is called over HTTP, or gRPC for higher performance, so any language that can make HTTP calls can use it; Rutz says it is Linux-container oriented and he was unsure whether Windows containers were yet supported.
• Adoption is opt-in, one building block or one service at a time. An existing application can take a single feature and delete its own code; Rutz says .NET developers can use the optional SDK's client or simply point an HTTP call at localhost on the Dapr port with the target service's name, after installing Dapr locally and writing component files.

2023-02-20 · open the original ↗

• Data warehouses required knowing reporting needs before loading. Shelton, a cloud data specialist on the host's team at Microsoft, describes warehouses as offloading transactional data through extract, transform and load into a fixed relational schema, easy for business users but hard to scale as volumes grew despite massively parallel processing; data with no column defined for it was simply not used.
• Data lakes stored everything raw but were hard to query. Lakes, often on Hadoop's distributed file system and compute, took text, social media, images and video without a schema up front, but Shelton says business users struggled to use them, some called them a "data swamp", and organizations ended up duplicating data into a warehouse for query performance that MapReduce did not provide.
• A lakehouse combines both on one platform with many compute engines. He credits Databricks with coining or evolving the term; raw data lands in an object store and remains a single representation that engines such as Spark or SQL can reach, serving Power BI reporting alongside machine learning on raw text or image recognition.
• Data is refined through bronze, silver and gold tiers. Shelton describes a common pattern of raw files in a bronze layer, cleaned and curated data, often in compressed columnar Parquet, in silver, and reporting-ready data in gold; because all the raw data is kept, a new attribute for reporting means extending the refinement rather than going back to the transactional system.
• On Azure, separate services fill each lakehouse role. He names Azure Data Lake Store as the object store, Azure Synapse Analytics for Spark transformation and serverless or dedicated SQL querying, and Databricks against the same data; he calls the area emerging and says an analytics platform can grow into it incrementally.

2023-02-19 · open the original ↗

• Layered onion architecture broke down on a 1,000-screen application. Bogard describes a 2008–2009 ASP.NET MVC project where a rigid project hierarchy enforced inward dependencies; adding one field to a screen meant changes across the code base, and per-entity "layer god objects" such as a customer repository and customer manager became contention points for many developers and coupled unrelated actions through shared methods.
• Pretending the ORM did not exist produced inefficient data access. Because business logic could not couple to the ORM, the team relied on lazy loading and lowest-common-denominator features. Friction got bad enough that one Friday the tech lead had all projects collapsed into one by Monday, keeping the layers as folders; Bogard says that project also gave rise to AutoMapper and other now-common MVC patterns.
• Start with no patterns and abstract only when it hurts. On the next large project he and a few senior leads spent about the first month using tools directly, data access in controllers included, to see which problems actually emerged, because abstraction adds complexity that must buy something.
• Organize code by what changes together, not by layer type. In his "feature folders", now vertical slices, each request's input object, handler, response, validation, view, JavaScript and styling sit in one place on disk, with only controllers left where routing required them; he keeps one project and splits only when two applications need shared logic. He says other ecosystems reached the same conclusion independently, citing Angular's move away from AngularJS's organize-by-kind layout.
• MediatR grew out of copying the same 100 lines into six projects. Single-method services like "approve invoice" and "reject invoice" became a request–handler–response pattern; routing requests through a mediator gives each controller one dependency instead of one per action, and lets logging, transactions and auditing wrap every handler without DI-container decorators or proxies. Bogard says the name was a nod to SignalR and has no correct pronunciation.

2023-02-18 · open the original ↗

• Containers virtualize the operating system kernel, not the hardware. Richardson, a developer advocate at Shoreline, contrasts virtual machines, which specify bus, RAM and CPU and install a guest operating system, with containers that share the host's kernel, so they start fast enough to spin up per request, scale to demand and hand resources back to the cloud afterwards.
• Containers are identical, short-lived cattle, with state kept in volumes. Every instance of an image is the same apart from host name and IP, so two, five or 25 web servers behind a load balancer make a durable site; durable data goes in a volume mapped into the container from a SAN, Azure Files or S3, which the application sees as an ordinary folder.
• One image runs the same locally, on premises and in the cloud. Configuration such as the database is injected through environment variables without rebuilding, which he says removes "works on my machine"; the caveat is that the kernel must match, so Linux containers need a Linux host, and locally developers usually run them inside a small Linux virtual machine.
• Docker builds containers and an orchestrator such as Kubernetes runs them. Richardson says the two are used together rather than one replacing the other: images are built with Docker on developer machines and build agents, pushed to a registry, and an orchestrator told, for example, to keep three instances across availability zones chooses machines and moves workloads when one is taken out for updates.
• New versions deploy by shifting traffic, not upgrading servers. He describes starting version two alongside version one, moving 10%, 20%, 50% and then all traffic, and terminating the old containers; the pipeline's artifact is an image holding the application and dependencies such as a PDF generator or SDK, the Dockerfile lives in Git with the source, and images go to a separate image repository.

2023-02-06 · open the original ↗

• Low code pairs subject experts with pro developers in hybrid architectures. Soderstrom, a Microsoft engineer on a Power Platform team for about a year, describes building rapidly on the platform's services while adding high-code components where needed, with citizen developers such as accountants or project managers building alongside, or sometimes without, pro developers. Rather than listing what the platform is wrong for, she looks for pieces to incorporate: an MLOps pipeline stays on Azure Machine Learning, but can draw on Dataverse.
• Built-in security and privacy is the platform's biggest selling point. She calls both moving targets that the platform handles, leaving teams to configure access controls; she says security left until late in a project can block it and cost days, and possibly thousands of hours, of development time.
• Extend through connectors, custom code and existing patterns. Soderstrom points to hundreds of out-of-the-box connectors such as SharePoint and Adobe Sign, custom connectors to any API, as she built on a recent project for a client's middleware team, custom JavaScript, HTML and CSS, and portal access for external identity providers; she advises first searching for a pattern someone in the same industry has already built.
• Solutions fit standard CI/CD as diffable configuration files. The Power Platform CLI pulls a solution of Dataverse tables, flows and connectors down as XML and YAML that can go into source control and through validation, CI and CD pipelines, with checks available as Azure DevOps tasks or from the CLI; she says the files are harder to read than code but show changes between versions, and Dataverse is also backed up automatically.
• She found Playwright workable for end-to-end testing of portals. In a spike eight or nine months earlier, where Selenium was not built in for portals, she says Playwright offered built-in video, screenshots and code generation from clicking through the browser, and could be swapped in and out of her testing pipelines to verify that a flow updated a status in a given row.

2023-02-01 · open the original ↗

• C# developers no longer have to switch to Python for machine learning. Korzynski says that around 2020 he had to choose between C# and machine learning and went to Python, but now does both: ML.NET has matured since 2017, and C# wrappers or ports exist for TensorFlow, Keras, NumPy, Pandas and PyTorch. NumPy.NET wraps the real Python library with all its features, while NumSharp is a native port with about 98% of them.
• ONNX lets data scientists and application developers each use their own tools. He asks his modelers for an ONNX file, built in whatever framework they prefer, and runs it in C# without Python dependencies, in ML.NET, or hosted in Azure Machine Learning or AWS SageMaker; he describes it as a common format for a neural network's weighted graph, created in about 2017 by Microsoft and Facebook. His reason is that Python's ecosystem suits modeling but its tooling for dependency injection, project structure and UIs does not suit enterprise applications.
• GPU inference comes from adding a single NuGet package. Some of his document extraction models are large enough to need a GPU even at prediction time, as can vision models like YOLO; he says the ONNX runtime's GPU package brings CUDA and optimizers such as TensorRT without setting up CUDA himself.
• Building the model is the easy part; data and integration are hard. Korzynski says getting well-labeled data and fitting a model into a C# codebase are the difficult stages, and a cloud-hosted model called over REST simplifies integration; latency matters less than expected because most workloads are not real-time, as with a 5,000-page document where OCR alone takes at least about a second per page.
• Deploying many models multiplies infrastructure beyond an ordinary app. On premises, he says, an application with 50 models could need 50 Docker containers, several instances of each under Kubernetes, and custom routing between them; his company digitizes microfilm and microfiche, and a project he just finished processed about 2 billion documents, requiring models run across Hadoop. He says some companies chase ML as a buzzword when they do not need it.

2023-01-26 · open the original ↗

• Capture should be frictionless, but it is not hoarding. Miller presents Tiago Forte's CODE method (Capture, Organize, Distill, Express) from the book Building a Second Brain, which he taught as a Codemash workshop; at capture the point is to get an idea from email, articles or podcasts into a notes app before it evaporates, though he now asks whether he will really benefit from it, having hoarded in the past.
• Organize notes for actionability, not by subject. Forte's PARA sorts everything into Projects (a goal and an end date), Areas of responsibility (an ongoing quality standard such as health or finances), Resources (reference and hobby material) and Archives (kept but out of the way); Miller says projects usually stem from areas, the same item can fall in different buckets depending on your role, and he has applied the scheme beyond his notes app to OneDrive, Google Drive and Outlook.
• Distill in layers, each time you return to a note. Under Forte's "progressive summarization", the first read bolds whatever stands out, the next pass reads only the bold and highlights within it, and a later pass adds your own summary at the top; Miller says only the material that keeps energizing you gets the later passes, and each one saves your future self time.
• Build output from your own stored pieces, choosing them before ordering them. Miller cites Forte's aim of starting no project he is not already 80% done with from prior "intermediate packets", and his advice not to go to Google when it is time to write; Forte's "archipelago of ideas" splits the work into selecting the pieces and then sequencing them in a separate pass, which Miller says he finds hard to do at once.
• Software can resurface what you read and capture podcast moments. Miller says Readwise, a paid service, pulls in Kindle highlights and shows five a day by default, and he was on a roughly 300-day review streak at recording; Snipd, a free podcast app, clips and transcribes the moment around a triple-tap on his earbuds and sends it to Readwise and Notion (he uses Notion's free tier, with Evernote kept as an archive).

2023-01-25 · open the original ↗

• A team should agree one word per meaning and record it. Ritchie, a software architect, says using update, change and modify interchangeably creates ambiguity, so a team might fix "change" to mean replacing an entity and "modify" to mean altering its attributes; he wants decisions kept somewhere such as SharePoint or GitHub, in the style of architectural decision records, with a domain vocabulary that defines each term, and for teams of teams a weekly or bi-weekly meeting to air them.
• An "and" in a method name signals it does too much. Ritchie says a long name is fine if it is the correct term in context, but a name that needs "and" usually means the method should be split, which then gives shorter names.
• Start with placeholder names and rename as understanding grows. He warns against analysis paralysis over perfect names: "test method one" is fine to begin with, so long as names are refactored, or things split into several, as the team's understanding of the problem improves.
• An interface name should describe a behavior, usually as an adjective. Rather than prefixing a class name with "I", Ritchie suggests turning the verb into an adjective, his example being "transmit" into "transmissive", because the interface should say what something does, not just provide a point for injection.
• Code should use the business's own language, not a technical one. Ritchie draws on domain-driven design's "ubiquitous language": one vocabulary shared with the business avoids mapping between technical and business terms, which he says introduces ambiguity; understanding the technical vision narrows the words needed, and since customers often cannot say what they want, names will change as feedback comes in. He collects his material in a GitHub repo, which he says holds far more than his hour-long talk.

2022-12-30 · open the original ↗

• Browser internals are learnable, and you need not start with source. Lawrence, who says he has worked on browsers or web technology for about 25 years (IE, Fiddler, Chrome, Edge), points to bug trackers, design docs, blogs and documentation as ways in, and argues that reading C++ is much easier than writing it; Chromium's code is fairly straightforward to read, unlike IE's older network stack. He says he joined the IE team largely to see why Office's "clip of the day" would not change, printed the network stack's source, and found about six bugs, with about 100 other suspect spots circled.
• The decade's main browser fight is over becoming a full app platform. Lawrence says one camp wants the web to match native capability, while security and privacy are why the web succeeded; his view is that it has to be both, or the web stays a second-class citizen. He cites the rule that iOS browsers must use WebKit, which he says has shortcomings against Blink and Gecko, as a restriction the European Union is now questioning.
• IE's complexity lay in its compatibility ecosystem, not just its code. He says IE carried decades-old hacks (one for a CompuServe 1.0 beta) that nobody dared remove in case a line-of-business app relied on them. The day after he returned to Microsoft from the Chrome team he was asked whether to re-platform on Chromium, and he backed it; he puts a modern browser at about 12 million lines of C++ plus about as much test code.
• Chromium's layering keeps work simple, except for cross-cutting changes. Lawrence describes "content" (the base for building a multi-process browser), "Chrome" (the browser UI around it) and optional "components" such as the spell checker; Edge took the Chrome layer too, because Microsoft had no Win32 browser front end since IE. His hardest change carried one Boolean (whether a user had edited a form field on an HTTP page) across about 48 files, and he credits the modularity with making Electron and clean testing with fakes and mocks possible.
• Search revenue funds browsers and explains many of their decisions. Citing public figures from Mozilla and others, Lawrence says one point of browser market share is worth roughly $100–200 million a year, and that Google reportedly pays Apple about $12 billion a year to be the iPhone's search engine. He infers Chrome is worth tens of billions to Google, which is why browsers carry huge teams and why each defaults to its payer's search engine.

2022-12-14 · open the original ↗

• Build reliability first, then performance on top of it. Rao starts with failure mode analysis and the business cost of each failure, derives availability targets (SLA, RTO, RPO) and compares them with what the cloud guarantees, such as 99.99%. He then builds high availability into every tier: paired servers across Azure availability zones (at least three in most regions, each with its own power, cooling and network), clustering, database replication such as SQL Server Always On or Oracle Data Guard, plus disaster recovery and continuous monitoring.
• Performance design starts from a capacity model of business requirements. Rao lists content types, user base and locations, and targets such as a one- to two-second load time, then sizes resources against them. For SAP he uses SAP's Quick Sizer, which turns concurrent users and data size into a platform-neutral benchmark that he uses to shop for matching VMs.
• Close the user-to-cloud gap with proximity and private links. He moves compute or content near users via regions, CDN and Redis caching, and says site-to-site or point-to-site VPN mainly helps security rather than speed. For bulk loads, such as one terabyte of SAP data in a four-hour cutover window, he uses ExpressRoute, with committed bandwidth from 1–2 Gbps up to 100 Gbps (10 Gbps common); he says 7 or 8 of 10 large performance-oriented enterprise workloads use it, and nearly all of SAP.
• Horizontal scaling suits massive loads, with cloud autoscaling doing the work. Rao prefers adding nodes over enlarging one machine, though he notes most people still scale SQL Server and Oracle vertically; Giard adds the caveat, which Rao accepts, that the code and database must handle parallel requests or sharding. He recommends VM scale sets with thresholds (for example CPU above 90%) and the built-in autoscaling of AKS, Container Instances and Container Apps.
• Storage design is king for business-critical workloads. Rao says that in about seven of ten performance escalations he is pulled into, the fix is in storage design. He weighs IOPS, throughput and above all latency: 15,000 or 60,000 IOPS is no use at 7–8 ms when a database log drive such as SAP HANA's needs sub-millisecond. His tools are Ultra Disk, Premium SSD v2, Azure NetApp Files' ultra tier, the free Write Accelerator, striping data files across disks, and proximity placement groups to keep application and database servers physically close.

2022-12-09 · open the original ↗

• Leadership rests on influence, with or without formal authority. Humphreys, who leads a team of cross-solution architects in Microsoft's U.S. Global Partner Solutions organization, says that as an individual contributor managing the technical relationship with one global customer she had to align Microsoft's internal teams and the customer's teams on a shared goal, and create clarity on why each was being asked to act. She cites a panel of Microsoft distinguished engineers and technical fellows, one of whom called "leading with authority" a myth, and agrees: managers at every level still get things done by understanding what motivates people and what "give-gets" are on offer.
• Asking others for help is a leadership skill, not cheating. Early on she felt she was cheating when she posted customer questions in Microsoft's internal MCS architect communities; a Microsoft leadership program taught her that pulling people in gives them a chance to have impact and broadens what you can do. She frames admitting what you don't know as courage, since knowing everything is as impossible as being perfect.
• Technical people are motivated by recognition, learning and room to fail. Humphreys says she has only ever managed technical teams and treats that as a requirement when considering a role, because as a former technical person she knows the motive is often not money. Her first management job was a "triple whammy": first-time manager, at Microsoft, leading her former peers as account technology strategists, which changed the relationship because she now affected their pay, promotion and career; she learned to ask each person what motivates them.
• You must find and own your mentoring relationships yourself. She kept a network of peer mentors inside and outside her organization, and does "speed mentorship," asking someone with a strength she lacks to walk her through how they think; she says going in with a stated purpose is the mentee's responsibility, and Giard adds that he once waited for mentors to come to him. As a manager, she assigns new team members peer mentors who can show them "what good looks like."
• Learn leadership from people you recognize as good leaders. Asked where to start, she recommends the book Radical Candor, by Kim Malone Scott, for being clear about feedback while also encouraging people. Mostly she learns by approaching people she sees as great leaders, whether managers, distinguished engineers or early-career staff, and through Microsoft's internal leadership programs and communities.