Technology and Friends

2022-12-04 · open the original ↗

• Microsoft's targets are too ambitious to meet without its partners. Benhamron, a Microsoft industry cloud architect for sustainability, uses the term to mean carbon measurement under the Greenhouse Gas Protocol. She gives Microsoft's commitments as carbon negative, zero waste and water positive by 2030, and removal of all emissions since its founding by 2050, which she says is why it built tools for its ecosystem.
• Carbon accounting is a data problem spanning the whole value chain. She says emissions must be counted upstream (business travel, commuting, purchased goods, capital goods) and downstream, such as an Xbox drawing power in a customer's home, which requires data sharing with suppliers and customers. Measurement comes first because without a baseline an organization cannot know whether its investments move it toward its goals.
• Sustainability Manager is a Power App acting as an emissions CRM/ERP. Benhamron says Microsoft Cloud for Sustainability is vertical offerings inside Azure, Dynamics and Microsoft 365, not a separate data center, on a sustainability data model in Dataverse. Sustainability Manager has data capture through Power Query and connectors, a calculation service from raw consumption to emissions, and reporting against goals; Azure and Microsoft 365 emissions have their own dashboards, with an Azure emissions API announced at Ignite.
• Customer demand far exceeds supply, because sustainability cuts across every industry. She says she is triple or quadruple booked and that more people are needed in her role. Customers already want to act but do not know how, and account teams that budgeted an hour find customers wanting a whole day; her own job is teaching partners carbon accounting and how to extend the product.
• Unified data must come before Microsoft's other three priority scenarios. Benhamron's four are unifying data intelligence, green IT (cloud migration and workload efficiency, backed by sustainability guidance for the Well-Architected Framework released at Ignite), a transparent value chain, and optimizing operations through energy management and smart facilities. She says the first must be tackled before the rest.

2022-11-18 · open the original ↗

• Most AI projects fail, often for reasons that are not technical. Dhall shows a slide quoting 83–92% failure rates and a Gartner prediction that 85% of AI implementations would fail by 2022, which he reads as projects not delivering rather than models misfiring. He claims his own consultancy has a 100% success rate on AI projects because it tests feasibility and sets expectations up front. Giard adds that on his own AI projects the customer was told at the start that the data might not support any prediction.
• No cloud won outright on handwriting recognition, and results drift. In Dhall's firm's May 2020 tests, Microsoft had 12 errors overall, Google 20 and Amazon 37, though Amazon did not then support handwriting. On neat cursive Google had 15 times Microsoft's errors, on French Microsoft had about five times Google's, and only Google recognized two pasted-together images as separate. In an October 2022 retest Google's word accuracy improved but it made a structural error, so under his weighting (5 for structure, 2 for word accuracy) it scored worse, and he says users have to keep track of where their cloud is going.
• Pick a form-recognition service by whether speed or accuracy matters. In May 2020 Microsoft Form Recognizer trained in about five seconds where Amazon Textract and Google Document AI took about an hour, and it was then the only one returning bounding boxes with the OCR. Google reached 100% accuracy on 10 samples. Dhall's firm still adds a human review UI, which he says turns a 200-person job into a three-person one. On receipts, none of the three read "lb", and he ranks Amazon above Google because Google made three structural errors to Amazon's one.
• The goal is real-time action, not just real-time analysis. In Dhall's hypothetical, a fast-food chain's bot reads a rival's 20%-off ad with computer vision and automatically posts a deal 5% better. Where approval is required, he would have everything ready for a human to approve with one click.
• Using more than one cloud for AI APIs is "a no-brainer." Dhall says enterprises expect multi-cloud to cost 70–80% more when data has to move, but an AI service is just an API call, so at least two of the three clouds should be used. He would pipeline them and add domain-specific rules, such as correcting "1B" to "lb". Customers barred from the cloud by compliance may have to train their own models instead.

2022-11-12 · open the original ↗

• Database security fundamentals are slipping as the threat grows. Woody says newer data professionals have had more done for them and are stretched across BI, machine learning and AI, while data now sits in far more places and sophisticated nation-state attack tools have leaked to cybercriminals.
• Do at least the basics; you need not do everything. Woody says most attackers are script kiddies trying doors, so patching, upgrading and strong, changed passwords will send them to the next target, though a nation-state that wants your data will likely get it. He cites one shop with 2,500 custom applications against one server, which made testing a patch hard, and a customer still being upgraded from SQL Server 2005, 17 years of security patches behind; he would encrypt sensitive columns rather than the whole database. Giard frames it as making the cost of a breach exceed the data's value, and offers his own guess that cheap measures protect 90% of the data.
• Zero trust is the "how" of defense in depth. Woody says defense in depth layers protection from the building and OS (down to driver patches) to row, column, at-rest and in-transit encryption built into SQL Server, and zero trust says how: verify explicitly at each step, and assume breach, for example by checking logs for logins from countries where you have no users. His free, self-paced, hands-on course on GitHub, aka.ms/SQLSecurity101 (all his courses at aka.ms/SQLWorkshops), carries a defense-in-depth checklist and ends with a post-breach after-action report; he also runs it module by module monthly at the Tampa SQL Server user group.
• Applications that log in as one super-user are the worst pattern. Woody says it is very common for an app to keep its own users and permissions and act in the database through one privileged login, so whoever gets that password has everything. Nearly every customer environment he reviews still lists users who left, one five years earlier.
• People, not technology, are the weakest link. In Woody's account of the Uber breach, attackers texted an employee posing as IT, got her MFA code, then sent IT a screenshot carrying a Trojan that spread through an administrator to the whole company — social engineering, not tech. He calls the state of database security "good but in peril", because security is a tax that does not sell products and IT staff are being laid off.

2022-10-19 · open the original ↗

• Teams Premium is a paid add-on that removes nothing. Rose, a senior product marketing manager for Teams at Microsoft, says it was announced at the previous week's Ignite as a separate service beyond E3 or E5, due "next spring", covering personalization, intelligence and security. He says it sits on top of existing Teams; the one feature moving into it is live translation, which some advanced preview customers had already been using.
• Intelligent Recap is meant to replace re-watching a missed meeting. Rose says it will send a summary after a transcribed meeting with each mention of you or your project and any action items assigned to you, so someone booked into three meetings at once can catch up on the two they missed.
• Premium lets IT set meeting security by department. Rose describes per-meeting controls: no forwarding, named attendees only, no recording, and a watermark carrying a unique code so a photographed screen can be traced back to its meeting. Meeting templates let IT make, for example, HR meetings restrictive by default while sales meetings stay open.
• Share decks with PowerPoint Live rather than screen sharing. Rose says the presenter keeps control of the deck, sees speaker notes and attendees, and viewers can click links or pop the content out. He puts the bandwidth at about 20% of a full screen share because only changed pixels redraw. Excel Live brings the same to spreadsheets, where each viewer can zoom or filter without changing anyone else's view.
• Work hours and location in calendars restore chance office encounters. Rose says marking which days you are in the office lets colleagues book in-person time on those days, recovering the "water cooler moments" lost to remote work. He goes in on Thursdays and will add a day if people he wants to see are in, so that a commute is not wasted on an empty office.

2022-10-10 · open the original ↗

• Memory is physically trainable, like a muscle. Aldan, who describes her evidence as largely anecdotal, says the brain stores data in chunks across six memory subsystems, and that left-brain/right-brain works only as a metaphor. Repetition strengthens neural pathways through thicker myelin sheaths and more protein synthesis. She recommends practising one technique for three months before moving to the next.
• Bilateral stimulation while holding a thought aids recall. Her "shoot the thumb" exercise moves the thumbs back and forth while you hold a memory in mind, which she says works both hemispheres and speeds transfer between them. She stresses it does nothing unless you are actively thinking of the thing.
• The brain remembers patterns but rejects overload. Aldan, a brand strategist, says cadence, tone and repetition make things stick, as with phone numbers read in the familiar 3-3-4 grouping. She says about five or more simultaneous stimuli overwhelm people, which is why she steers clients away from busy websites.
• Association anchors new information to what you already know. Her workshop ends with an hour building a Sherlock Holmes-style "mind palace". She also advises taking a test in the same conditions you studied in, down to the music or the lucky hoodie.
• Interruptions are the number one reason people forget. Aldan says a developer juggling layers of work drops them all at "can I have five minutes?" and needs about an hour to recover. Her fix is to set boundaries ("just a moment, let me finish this"), including with yourself against phone and social-media distractions.

2022-10-05 · open the original ↗

• LinkedIn Live went from an application process to a self-serve switch. Rey says that when he started, about a year before recording, you had to apply and wait for LinkedIn's approval; now you turn on "creator mode" on your profile, which also unlocks audio-only events, and he believes a profile or company page needs about 150 followers or connections. LinkedIn has no built-in streaming software, so he first tested with StreamYard on a colleague's profile, Mark Steele's, which had access before his own did, and ended up with about a minute of unexplained silent video on Steele's feed.
• Rey picks his streaming tool on price against the channels he needs. StreamYard's licence limited him to three simultaneous destinations, so within about three months he moved to Restream.io, which allowed unlimited channels for the same price or about $5 a month more; he used it for over a year until a July licensing change made extra channels over twice StreamYard's price, and he went back to StreamYard. He also says he favoured Restream for a long time because a Microsoft viewer told him in a live comment that it runs on Azure while StreamYard runs on AWS.
• Rey streams to LinkedIn and Twitter, then one topic-dependent third channel. LinkedIn is his main presence and Twitter his second-largest network at over 10,000 followers; the third might be his Tip Tuesday YouTube channel, which he says has no fixed schedule and had last gone live about a month earlier because it earns him nothing. Both StreamYard and Restream run entirely in the browser, and he says the recordings stay viewable after the live event for people who missed it.
• Streaming public events raises consent and copyright questions. Rey went live from a Sergio Mendes concert and from the DeKalb Corn Classic 10K without asking the mayor, the anthem singer or attendees; he notes some events carry a disclaimer that attendance grants use of your likeness, and says this matters more when streaming for or on behalf of a larger company.
• A Teams meeting can go live directly using a stream URL and key. Rey demonstrated copying the stream URL and key from LinkedIn's go-live page into a Teams meeting's custom streaming setting, so the meeting is recorded and broadcast at once; on the version of Teams they tried, he concluded it streams to only one destination at a time, though stopping the stream unlocks the fields to switch to another. He also says StreamYard's custom RTMP output can feed a production into a Teams live event.

2022-09-29 · open the original ↗

• Flink's exactly-once guarantee scales where other engines' does not. Scherr, developer advocate at Ververica, says Flink's checkpoints and savepoints, delineated by watermarks, let it reread only the section since the last checkpoint without stopping the stream, so nothing is duplicated; she says other engines reread or store data differently and build up backlog. Because small proofs of concept show similar latency and throughput across engines, she urges testing with masses of generated data (DataGen, Faker).
• Its commonest use is fintech fraud and anomaly detection. Scherr puts that at perhaps "30% or 40% or 50%" of use cases, the rest being unusually varied, because it needs near-real-time results with no duplicates (no double charge, no anomaly flagged twice); machine learning and analytics are also big. Flink is stateful and keeps snapshot metadata locally or externally for rollbacks, but the data itself sits in external databases reached through built-in or third-party connectors.
• Newcomers should start with Flink SQL, not Java, Scala or PyFlink. She says Flink SQL abstracts much of the complexity, is language agnostic and suits DevOps people, though Java 8 or 11 must still be installed because parts of it use the Java heap. Installation was local at recording, a roughly three-step download she has live-coded in about five minutes or less; she hinted at unannounced changes to that answer.
• Flink itself is free; Ververica earns from an enterprise platform. Flink is licensed through the Apache Software Foundation like any Apache project, while Ververica, which wrote and maintains it, sells the Ververica Platform for deployment, integration with other tooling, analytics and production support, with a free community edition and paid tiers.
• The open-source community is what drew her to Flink. At a previous employer new to stream processing, Scherr says a patch she submitted for an odd use case was approved within a couple of days; she calls Flink's mailing list one of the most active in Apache. She recommends meetups, where she says the founders and engineers from Netflix and Apple give talks.

2022-09-28 · open the original ↗

• KC7 generates realistic fake security data so anyone can practise. Kakpovi says learners need realistic data that no one will hand over for privacy and secrecy reasons, so the game simulates a fictitious company's employees sending email and clicking links, 98–99% of it benign, with adversaries mixing in credential-harvesting and phishing links for the player to find.
• Players pivot from a single tip to an actor's whole pattern. A game starts from a tip, such as a fake tweet naming a suspicious domain, and players weigh how confidently related senders and domains are malicious; Schloemer says modelled actors reuse themed keywords (Viking words like "Norse" in email addresses). All querying is in Azure Data Explorer with KQL, the tools the two use daily as threat analysts, on a free Kusto cluster loaded by a script from their GitHub page.
• Each game can be regenerated, so answers cannot be memorised. Kakpovi built a small manual dataset almost four years earlier at a professor's request; now a button produces a new company, adversaries and TTPs. The name refers to the seventh, final stage of the Lockheed Martin cyber kill chain, and they intend the full game to cover all seven phases, claiming that anyone who can play it can work in cyber.
• Business students with no technical background asked how to make it a career. During a Microsoft Hackathon team of over 100 people, they ran the game at Montgomery College in Maryland and a teammate took it to Florida Memorial University, described as South Florida's only HBCU. About an hour to an hour and a half in, a student asked how to do it for a living, and several gave similar feedback.
• They blame cybersecurity's lack of diversity on access, not skill. Schloemer describes a cycle in which you need data to get the job and the job to get the data; Kakpovi, a Howard University alumnus, recalls a Lockheed Martin Cyber Analyst Challenge with four Black people in a room of 100, himself and three co-workers. KC7 is free and open source, and the two, analysts rather than developers, ask for contributions by pull request.

2022-09-24 · open the original ↗

• Infrastructure as code buys repeatability and enforceable governance. Benkovich says clicking through the portal is not repeatable, while templates can apply one naming and tagging formula on any cloud or on-premises, and take per-environment parameters, such as large Kubernetes node VMs in production and smaller ones in dev or test.
• Deploy infrastructure once, and the app's code many times. Benkovich treats the IaC deployment as building the environment the code runs in, with a separate continuous delivery pipeline shipping the code afterwards; Giard adds that in practice it would run from a script or CI/CD tool rather than a right-click in Visual Studio.
• VS Code beats Visual Studio for authoring ARM templates. Benkovich says Visual Studio's resource group project gives a starter template (web app plus SQL) but weak IntelliSense on parameters, while VS Code with the ARM extension, snippets and multi-line editing handles his concat-based naming variables better. In his demo he swaps a plain-text password in the parameter file for a Key Vault secret.
• Bicep is a more readable language that compiles to ARM. Benkovich calls it an ARM transpiler: az bicep decompile turned his verbose JSON template into a cleaner Bicep file, and some people liken its format to Terraform's.
• Choose Bicep or Terraform by how you manage state and clouds. Benkovich says ARM/Bicep are Azure-only and record each deployment in Azure, while Terraform works across Azure, AWS, Google and more and keeps its own .tfstate file; his Terraform-built resources left no entry in the portal's deployment history because it went through the REST API.

2022-09-17 · open the original ↗

• Queues and hubs decouple the front end from the back end. Gorman says users can submit data as fast as they like without the UI bogging down, while the database scales or stays small and, if processing is not urgent, catches up overnight.
• Event Hub and Event Grid are separate services, not companions. Gorman says Event Hub ingests big data and streaming telemetry at millions of records per minute, with up to 32 partitions (around four for a typical workload) and consumer groups that can each replay events, which opens the door to duplicate reads. Event Grid responds to one-off events, such as those logged by Azure Monitor, and fans them out to filtered subscribers; IoT Hub is a lighter subset of Event Hub.
• An event only says something happened; a message carries the payload. Gorman's example is a blob-upload event whose data is just the blob's URL, while a Service Bus message can carry a serialized object. Service Bus queues guarantee first-in-first-out order, and topics give pub-sub, as in his demo that loads 17 or so movies once and serves R-rated, family and all-movies subscribers separately.
• Storage Queue is the cheaper, lighter option with fewer guarantees. Gorman says it cannot guarantee order, returns an item to the queue after 60 seconds unless the lease is renewed, purges after seven days by default, and holds over 80 GB but with a smaller message size. Service Bus has no automatic purge, though he thinks a time-to-live can be set.
• Pick Service Bus when you need to know a message was handled. Gorman credits an attendee named Barry at DevUp in St. Louis with the deciding question: does someone need to acknowledge it? Event Hub and Event Grid don't care whether an event was consumed, while Service Bus has dead-letter queues. He also advises beginners not to start with custom Event Grid events, using Storage Queue or Service Bus instead.

2022-09-11 · open the original ↗

• Leaders grow people; managers direct tasks. Guadagno, a director over several teams at Rocket Mortgage, says the word "manager" is frowned upon there; he contrasts a meme of a manager in a cart whipping staff forward with a leader in front helping pull, and a manager assigning a report by a date with a leader growing the person.
• Leadership can partly be taught but rests on traits. He names compassion, wanting to grow and putting others first, and ties his own to having trained as a high school math teacher and a philosophy of leaving the world better than he found it.
• He hires for fit with the team over top technical skill. Across his five teams he weighs communication against engineering skill, and rather than turning everyone into a leader he tries to grow each person toward what they want to be "when they grow up"; he spots leadership potential in those who raise flags and ask what-if questions.
• Knowing each person individually is why he says turnover stays low. He holds one-on-ones, bans calling people "resources", and tailors how he talks to and praises each one, from a quick Teams thank-you to a public award. Of 55 people over four years, he says about two have quit, against an industry where people change jobs every two or three years; Giard adds that the empathy has to be sincere.
• Humour eases pressure during outages and deadlines. His teams are known for bad jokes and did costume and Zoom-background days after going remote; he deliberately throws in a joke when an outage has people circling.

2022-09-09 · open the original ↗

• Headless CMS separates content editing from a custom-built front end. Miller says his agency uses WordPress only as a database and admin portal for non-developers, pulls the content via GraphQL or the REST API, and renders it with Next.js into static pages hosted on Netlify behind Cloudflare. The page is rebuilt when a post is saved, so no database call happens when a visitor opens it.
• Google's page-speed demands are what make plain WordPress a problem. Miller says Google's 2021 algorithm change around Core Web Vitals wants pages to load on mobile in about a second. A WYSIWYG builder like Elementor is convenient for a quick personal site, but its generated code makes that hard for bigger companies that depend on SEO or paid advertising.
• Moving the front end into code brings a real development lifecycle. Miller says changes now live in GitHub and go through pull requests, so a breakage can be traced back and rolled back. Netlify builds a preview URL for each pull request for clients to approve before merging, and A/B testing is possible but rarely done because it is a lot of work.
• Serving cached static copies improves security and scalability. Miller says Cloudflare copies the rendered site to locations worldwide, so an attacker, including in a DDoS attack, hits a static copy with no server or database behind it. He stresses he would never call it unhackable.
• Headless takes developers, not WordPress developers. Miller says retraining his WordPress staff from CSS and PHP into JavaScript front-end work was one of the largest challenges. He knows of no prepackaged offering that avoids custom development, and says that at his talks four of five attendees don't know what headless is.

2022-08-29 · open the original ↗

• The newer Yarn is a ground-up rewrite, not an incremental release. Richardson, a software engineer at Kroger Technology, says the lead maintainer rewrote Yarn's code base because he felt the project needed a different direction; it shipped as Yarn 2, then 3, with 4 "coming out soon", and Richardson uses "Berry" for every version after 1. He describes Yarn as fully free open source with no pricing model, and says the lead maintainer's employer, Datadog, supports his work because it uses Yarn itself.
• Berry's developer-experience gains are coded CLI output and stronger workspaces. Richardson says every line the command line prints carries a code that can be looked up for detail on the message, warning or error. Workspaces, which Yarn was among the first to introduce, group several packages or projects (he likens them to a .NET solution) so they can import each other, which he says makes managing a monorepo cleaner.
• Pinning the Yarn version per project removes cross-developer inconsistency. With yarn set version, Yarn downloads the chosen version into the repository, it is committed to source control, and everyone running Yarn in that project uses it, so lock files stop changing between people. He recommends it even to teams staying on Yarn 1 and says it has been "hugely helpful" at Kroger.
• Plug and play replaces node_modules with zipped packages read on demand. Yarn keeps each package as a zip in a cache folder and hooks into Node, extracting a file only when Node requests it. Richardson says the performance testing he has seen and done shows no significant overhead, citing a prior job where reading smaller zipped files proved faster than reading uncompressed ones. Because the zips can be committed, a freshly cloned repo is ready almost immediately; Kroger uses this "zero install" strategy in some projects.
• Migrating from the old version is easy unless you adopt plug and play. Richardson says that coming from Yarn 1, less complex projects upgrade "essentially seamless[ly]", complex ones may hit a few small issues, and the move to plug and play is where migration gets more complicated; migration docs are at yarnpkg.com. He agrees with Giard that greenfield projects should start on the latest version.

2022-08-10 · open the original ↗

• His site turns photo albums into shareable 3D virtual galleries. Scherotter, a technical program manager at Microsoft, built it during a sabbatical because his 30 years of illustrated travel journals do not exhibit well in physical galleries; he scanned them into Adobe Photoshop Lightroom, and Adobe's opening of API access to Lightroom data during the pandemic made the site possible. He says Adobe's fund for design gave him a grant after he applied, and he launched in December 2021.
• The stack is TypeScript end to end on Azure, with Stripe billing. He describes Azure App Service running Node.js, TypeScript on client and server, Babylon.js for 3D in the browser, and WebXR so galleries can be viewed in a VR headset. Stripe runs recurring subscriptions, the cheapest at $3.99 a month, and he says that income pays for his Azure consumption.
• Free users get one gallery; subscribers get links and customization. Anyone with an Adobe ID and a Lightroom album can create one free gallery, set public, link-only or private. Subscribers can attach links to each work, such as a making-of video, an NFT or their own shop; he says he does no commerce on their behalf. He reports almost 500 people have created galleries, including schools in Indonesia and Trinidad and Tobago.
• Shipping fast without tests caused instability that unit tests cured. Scherotter calls managing complexity the biggest challenge: he built rapidly, saw stability issues, then wrote hundreds of unit tests on the Node code while isolating with COVID earlier this year. He says the tests uncovered errors, crashes stopped, and he is now more confident adding features as the sole engineer.
• Next he wants analytics showing how visitors walk through a gallery. He has no formal roadmap, takes feature requests in a GitHub repo, and now works on the site evenings and weekends. He wants to show gallery owners what visitors linger on and click, something he says a physical gallery cannot do well.

2022-08-09 · open the original ↗

• Small nonprofits lag on technology, and technologists can volunteer to close it. Hogan, who says his passion is empowering the Black community in North America, finds that small agencies living on donations lack awareness of newer technology or the resources to adopt it, unlike large charities with IT budgets. He suggests starting with your company's benefits or community-giving coordinator, or asking contacts in your tech community, and says he has never offered help and been refused.
• His project moved a nonprofit's hard-to-maintain site into the cloud. The organization, a not-for-profit that helps other not-for-profits (Hogan confirms its site as givinggap.org), keeps a central database of Black-founded or Black-focused organizations where visitors can learn about them and donate. Hogan says the site was not scalable and the group had no real DevOps capability, so the work grew from a site rebuild into cloud hosting that frees office staff for fundraising.
• No free cloud credits came, so the design fit their budget. Hogan says the cloud providers they checked had no program they could use right away, partly because the organization was still working on its 501(c)(3) designation. It could carry light hosting costs, and the solution was built to land within those constraints.
• Resistance to change is overcome by earning trust. Hogan says a working solution makes any change look like a gigantic risk to non-technical staff. His answer is to show you understand the technology, show why it benefits the organization, and build relationships with its administrators until they are confident you can deliver.
• Volunteer-built solutions must be sustainable after the volunteer leaves. Hogan says skilled tech volunteers are scarce and usually "fly in, do what you can do, and fly out", so the next person will likely arrive blind. He contrasts for-profits, which he calls more hierarchical and mission-driven in adopting technology, with small nonprofits, where the aim is better day-to-day operation and the leader signing the check may not understand the technology at all.

2022-08-03 · open the original ↗

• The November .NET Conf is a launch festival for .NET 7. Fritz, now executive producer of the .NET Conf events, says the series has run online for 11 years. He describes an eight-hour focus event on .NET MAUI on 9 August and a three-day November 2022 event (Giard gives the dates as 8–10 November) announcing .NET 7, C# 11, and updates to .NET MAUI and Blazor, with more one-day focus events planned but not yet chosen.
• .NET releases no longer move in lockstep with Windows. Giard likens the event to Microsoft's old combined product launches. Fritz says those were driven by each new Windows needing new tools and a new .NET Framework, while open-source .NET (Core, then .NET 6 and 7) can now ship on its own schedule, with a production-ready release supported for three years; in 2021 Visual Studio 2022 launched on the Monday and .NET 6 on the Tuesday.
• Two Microsoft days hand off to 24 hours of community speakers. Day one is the announcement and day two covers other Microsoft technologies such as Power Platform, Teams, Windows and Azure, each a nine-to-five day. From 5 p.m. on day two the community takes over around the world for 48 sessions ending at 5 p.m. on day three; Fritz cites past talks on .NET running a hot tub and Cam Soper's barbecue.
• Microsoft and community speakers go through the same open call. Submissions go through Sessionize from the conference website, closing 8 September, though Fritz advises treating it as 7 September. Sessions are 25 minutes plus five minutes of Q&A and mostly live, with some pre-recorded content; each event has about 80 sessions, all archived on the .NET YouTube channel within days.
• Publishing regularly builds an audience, even before the content is good. Fritz says that by October 2017 he was worn out writing blog posts as a Microsoft community manager; Carl and Richard suggested podcasting, and a colleague a week later pointed him to live coding on Twitch, which he says changed his life. He now streams twice a week and says his goal is people learning and advancing their careers, not being internet famous.

2022-08-01 · open the original ↗

• Reinforcement learning trains an agent by rewarding good actions. Mishal, a Microsoft technical trainer, describes an agent exploring an environment, such as a game or driving a car, and trying to maximize its score at every step. He says training must simulate the bad cases too, losing points for leaving the road and gaining them for stopping at a stop sign, or the agent learns only one way and fails when something goes wrong.
• The cloud has made the required compute affordable outside research centres. Training deep neural networks, especially on images for autonomous driving, needs powerful GPU and CPU environments that Mishal says once only universities and big research centres had. On Azure the trade-off becomes how long you can wait versus how large a compute cluster you reserve; setup still takes several steps (a machine learning workspace, compute clusters, Jupyter notebooks) and a framework he describes as mainly Python.
• Recommendation systems are another use, trained actively or passively. Mishal cites a personalizer that recommends movies and is rewarded when the viewer likes them. The agent can learn actively from the user's live choices starting from nothing, or passively from simulated learning such as a year of viewing history.
• An agent will maximize reward even when the result is useless. Giard brings the examples: a bot trained on tweets that became racist and was shut down, and a robot from the book "You Look Like a Thing and I Love You" that learned to fall over to reach a goal fastest. Mishal's remedy is monitoring how the model is rewarded under responsible AI, and in a generative adversarial setup controlling the discriminator with safeguards, such as giving inappropriate output negative or no reward.
• Multi-agent learning requires agents to learn cooperation. Mishal's current project trains multiple agents to navigate terrain from point A to point B while maximizing each other's reward; with two doors, uncoordinated agents may each head for the far door and collide. He points learners to Microsoft Learn's machine learning modules, including a demo that trains an agent to play Pong.

2022-07-24 · open the original ↗

• You cannot scan an application into being secure. McKee, global developer security program manager at Trimble, says static and dynamic analysis tools catch some classes well, such as SQL injection, cross-site scripting and command injection, but miss broken authentication, encryption issues and business-logic flaws. He argues that focusing on the application misses how the bugs get in, and that educating developers closes that loop.
• Developers belong inside the security model, not beside it. He cites the InfoSec colour wheel from a post a couple of years earlier: red team attackers, blue team operations, purple where they combine, plus a yellow team of builders and architects. He places himself on the orange team between red and yellow, whose job is to educate developers and "remove all of the magic" from what attackers do.
• Start by learning the OWASP Top 10 hands-on. He recommends deliberately vulnerable open-source apps (DVWA, OWASP Juice Shop, bWAPP) that let developers run the attacks and then read the source to see where each flaw entered. When he asks conference audiences who has heard of the Top 10, at best about half the room has, which he puts down to businesses prioritising features over security.
• Threat modelling can be reduced to four questions. What are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job. He frames "what can go wrong" around confidentiality, integrity and availability, so a tripped-over power cord or a lightning strike that takes out data-centre cooling counts as a security risk alongside attackers.
• Developer-centric security means helping teams do things safely. Citing the DevSecOps manifesto, he says he has no power to tell a team no, so his job is to make what they want safe. He prefers feeding tool output and CISA's lists of most-exploited vulnerabilities back to teams as trends over enforcing checklists, which he says lull teams into false comfort. He also argues that how you react to an incident matters more than the incident, and turns each one into a lessons-learned document shared with other groups.

2022-07-22 · open the original ↗

• Leverage in tech employment has shifted from employers to employees. Brown, CIO of Union Bank and Trust (Lincoln, Nebraska; about $40 billion under management), says the pandemic accelerated trends already under way, citing friends who are partners at consulting and law firms losing junior staff "left, right, and center" to jobs that fit their values. He calls it a mass grassroots shift with no organized labor movement behind it, and links it to tight supply and high demand for tech labor that pushed up pay in 2021. As of late July 2022 he says tech unemployment is still very low, was "almost a perfectly flat line" through the 2020 dip, and he does not expect even a recession to hit it badly, while saying he could be proven wrong within a month.
• Work from home is likely to stick, and is worth advocating. Brown, who publicly advocates it, believes most companies would have liked everyone back in the office but are ceding ground, and he predicts MBA programs will start teaching work-from-home management within a couple of years. He cites a Pricewaterhouse study finding even more employers than employees thought it was working, and says his own productivity numbers went up. His figures on preference: about 20–25% want full-time remote, closer to 10% full-time office, and the remaining roughly 65% hybrid. Whether it survives the next recession is open in his view; he expects office-space savings to lock companies in, pointing to a former consulting employer with over 700 staff that has never had an office in over 20 years, including 2008–09.
• The flexibility people want is mostly child care, not RV travel. Brown says headlines favour stories like his friend who bought an RV in April 2020 and toured America for a year, but the data show child care is what people mean. He puts child care for a tech employee at roughly "70-some thousand a year", which against a $100,000 salary is a disincentive to work at all.
• Training and integrating junior staff remotely is the lasting problem. Brown says new graduates in particular need to be around experienced people who review their work and whom they can overhear, and that his former fully remote firm lost hires it left waiting at home for an engagement. Culture comes up in every CIO peer discussion of remote work he joins; he says companies coasted on existing culture through the pandemic but must maintain it deliberately, citing GitLab's public employee handbook as an example of a fully remote company doing so.
• Leaders deciding the future of work suffer from survivorship bias. Brown argues senior leaders rose by thriving in the old office environment, so they are unconsciously inclined to value it, even though many people succeed in other arrangements. His remedy is panels of junior and mid-level staff advising on return-to-work policy; he says he has sought input from all levels of his own organization, since no one at any level has much experience with this situation.

2022-06-24 · open the original ↗

• Content shared in web meetings is largely inaccessible to blind attendees. Jones, of Microsoft's commercial software engineering team, says shared screens arrive as a video stream that strips the document's structure, so screen readers cannot follow it in real time. VocalScreen was the idea of a former colleague, Hassan, an engineer blind from birth; volunteer crews have iterated on it in one-week projects for more than two years.
• Presenters will only use assistive tools that start in seconds. The first version was a Windows desktop app built on Windows APIs, but Jones says nobody can hold up a meeting five or ten minutes to install software. The latest version is an Edge and Chrome extension for the presenter, who posts a unique session link in the chat; listeners need only a web browser, with an optional extension for extra features.
• Streaming the whole HTML DOM preserves what screen readers need. Jones says sending only the text would lose navigation and the relationships between elements, so it sends the DOM with ARIA labels and H1/H2 headers intact. He cites a recent Starbucks accessibility project where ARIA labels announced events a sighted user sees, such as a settings menu opening.
• Less structured content would get machine-generated structure. On the roadmap, Jones lists an Office extension (PowerPoint being perhaps the most shared content), eventually Teams, and cloud OCR that would use text size and position to generate ARIA-style labels with machine learning. It is an internal "hack for good" project, not public as of recording; the hope is to feed the features to the Teams product group, and it may be open-sourced someday.
• People with disabilities are some of the best problem solvers around. Jones traces his involvement to a lunch with Microsoft's chief accessibility officer that he bid on in the company's annual Give campaign. He urges technologists to get involved, calling accessibility both a human cause and a place to work with cutting-edge technology.

2022-06-19 · open the original ↗

• Data engineers still protect data lakes by hand-copying data. Polak, who runs developer experience at the company behind LakeFS, says pipelines on object stores such as S3 or Azure Blob are transformed while consumers are already reading them, so engineers copy and snapshot petabytes manually. Her example: copy 32 tables, and statistically about two of them get messed up, leaving the business to explain corrupted data.
• LakeFS applies Git's branch, merge and rollback to data. Engineers branch off production data to experiment or debug against its real volume and variety, then merge back or roll back, and can travel to a past timestamp across the repository. She stresses, against the host's framing that it "sits on top of" the store, that it tracks only metadata about what changed rather than piping the data itself, and works on binary files, so any format (Parquet, Avro, CSV, images, video) is supported.
• Pre-merge hooks let teams enforce data quality programmatically. Modelled on GitHub Actions, a hook can block a data branch from merging until checks pass. Her example: a data scientist sets an expected gender distribution, so an ETL that silently dropped "corrupted" records, which turned out to be all the female records, gets caught before biased data reaches analytics or machine learning.
• The open-source version is complete; the paid product is management. Polak says the core engine, UI, CLI and SDK are free under Apache 2.0 with no functionality withheld, and the commercial LakeFS Cloud, then launching, sells a managed, scalable deployment to companies that don't want to run a distributed system themselves. She claims more than 1,000 companies use it and more than 4,000 community members; docs and community are at lakefs.io.
• Data lakes lack lifecycle management that databases have long had. She says her team is working on content and an architecture for managing production data over object stores in a scalable, secure way. She also points to a 2022 data-engineering landscape article written with other companies.

2022-06-17 · open the original ↗

• ADX ran Microsoft's own telemetry for years before customers got it. Rauch, a product manager on the team since 2019, says it began about 10 years ago as a four-person startup in Israel built to handle Power BI log and telemetry data ("Kusto"), and opened to external customers in February 2019. He claims about 99.9% of Microsoft's log and telemetry data lives in it, that it ingests more than 100 petabytes a day, and that clusters hold about 8 exabytes in total; Azure Monitor, Sentinel and IoT Central are built on it.
• Dropping transactions buys ingest speed and scale. ADX is an append-only analytical database with no ACID guarantees, which Rauch says allows higher ingest bandwidth. Lauzon cites the tagline "billion queries over a billion records under 1 second," says customers typically arrive after another database broke or became too expensive at scale, and describes clusters of up to 1,000 nodes with predictive autoscaling that uses machine learning to scale before peaks. Both say it is wrong for media storage, transactional backends, model training (it only scores imported models) and long ETL, and queries have a hard one-hour cap.
• Time series handling is the feature that turned customers. Rauch describes per-table retention periods, a "hot" window cached on local SSDs over Azure storage, and automatic partitioning by ingestion time. The make-series operator returns vectors rather than rows, enabling interpolation of missing IoT readings, forecasting, anomaly detection and regression without deploying a machine learning model; he calls this the point where users saw it as more than cheap log storage.
• Getting started needs only a Microsoft identity. Lauzon says to load data and start querying: a free cluster requires no Azure subscription or credit card, and one-click ingestion infers schema and mapping from Parquet, CSV or Avro files. Connectors cover Event Hub, IoT Hub, Kafka, Spark and Logstash, and each cluster exposes a T-SQL endpoint (port 1433, Rauch thinks) that translates SQL into KQL, which Giard says helped him learn KQL.
• The roadmap extends ADX toward graphs, geospatial work and local development. As of recording, Lauzon says a Docker-based Kusto emulator for local development and CI testing arrives "next week" and Cosmos DB sync is in limited private preview. Rauch lists a new L v3 VM SKU made for Kusto, graph-query syntax in KQL, geospatial clustering (geohash, S2, H3) on top of about 40 geo functions, dashboards going GA, and customer-managed keys per database rather than per cluster, with up to 10,000 databases per cluster.

2022-06-11 · open the original ↗

• A prolonged sense of danger drove pandemic burnout. Sexton says she withdrew even from virtual contact, and points to psychologists' later articles arguing that fight-or-flight sustained for two years causes burnout, brain fog and an inability to answer messages. Giard adds his own view that virtual contact maintains relationships but real ones happen in person.
• A game gave her a break from what she couldn't control. Calling herself an empath who felt the weight of the world's suffering, Sexton says advice to "focus on what you can control" made her feel powerless when she wanted to fight politically and socially. She used Animal Crossing: New Horizons, released on the Nintendo Switch at the start of the pandemic, to recentre herself.
• The game's real-time clock rebuilt her relationship with time. Because the game follows the device's clock and some events are locked by Nintendo, missed days are really missed; she now knows her daily routine there takes about half an hour, which she says helped her time management. Its villagers notice when you stop playing, and two years of keeping up with them, she says, helped her get over a fear of commitment.
• Shared avatars make conversation easier than a bare phone call. Friends fly to her island over the internet while they talk on speakerphone, walk around, or sit in the in-game coffee shop; she finds audio-only calls harder to parse and more awkward. She believes up to about eight people can gather on one island.
• A mild case after vaccination made her less afraid of COVID. Sexton says catching it a couple of weeks before recording felt like a cold thanks to vaccines and boosters, though she still masks outdoors when she can. Giard says he also had a mild case after four shots and manages risk rather than eliminating it; he also describes remote therapy with a therapist in Nevada, and Sexton says therapy should be "really just a requirement."

2022-05-26 · open the original ↗

• Interviewers pick questions by assigned competency and the candidate's resume. Zhang, a former Amazon software engineer who says he conducted a couple dozen coding interviews, describes a 10–15 minute introduction, one or two technical questions from a pool (a second only if the first goes well), then a few minutes of Q&A. Design interviews are different: talking- and drawing-heavy, judged on what the candidate says and asks while producing a scalable, highly available distributed design.
• Follow-up questions expose candidates who only memorized practice problems. After the code is written, usually in a plain editor and never run, he asks why a variable or approach was chosen; drilled candidates "typically don't know what to answer". A struggling candidate gets hints, and he expects a good developer to reach the answer with them; questions are sometimes left deliberately vague so the candidate will ask clarifying questions.
• Cultural-fit answers need concrete, real examples. He asks how candidates handle conflict or a missed deadline and checks the answer against company values; vague examples, when probed, reveal themselves as made up. Giard offers his own conflict answer, that two people who disagree can both be right and not every dispute is "a hill I want to die on".
• Never ask the interviewer for the answer to the last question. Zhang says it makes things awkward and that interviewers are legally not allowed to tell, since revealing it and then rejecting the candidate could cause trouble. Better questions for the closing minutes are about the interviewer's day-to-day and what they like or dislike about the job.
• Preparation is a muscle built over time, not in a week. He recommends practising the widely published data-structure and algorithm questions on leetcode.com and doing mock interviews with friends to practise explaining code, since perfect code you cannot explain does not make a good interview. He distrusts online offers to prepare you in a week or a day.

2022-05-25 · open the original ↗

• Logs alone cannot trace one request across a distributed system. Wijesiriwardena, six weeks into Microsoft's CSE team after Microsoft consultancy, says not every system feeds one log aggregator, and filtering out a single request needs a correlation ID, neither of which is trivial in production. Distributed tracing isolates one request from possibly millions, with its context and dependencies.
• OpenTelemetry is a set of standards, SDKs and tools. The standard defines a trace ID with bytes reserved for parent and child, which keeps dependency relationships as a request moves through the system, and builds on the W3C trace context headers for context propagation. HTTP is not required: popular libraries are already instrumented, but over a custom protocol or a message queue you insert and extract the trace context and "baggage" yourself.
• Its job ends at delivering telemetry to your ops team's tool. A collector runs in-process or as a sidecar and forwards data, through an exporter, to an endpoint such as Azure Monitor, Jaeger or Prometheus; OpenTelemetry says nothing about querying or reporting. He argues the richer data it supplies is what is driving new query and visualization features in those tools.
• Third-party libraries can opt in rather than stay black boxes. He says a SQL Server driver or the .NET HTTP client can be told to emit its internal telemetry the OpenTelemetry way. To learn, he points to the OpenTelemetry GitHub's per-language SDK samples, including custom instrumentation for RabbitMQ, and the CNCF Slack's OpenTelemetry channel; documentation is where he sees most scope for contribution.
• Observability matters in 2022 because of a second cloud-migration wave. He reports what he hears in the industry: ten years ago applications were moved whole onto VMs, and now they are being broken into distributed systems owned by many teams on mixed technology stacks, so a single view of telemetry is needed to diagnose problems quickly.

2022-05-10 · open the original ↗

• Python is better supported than .NET in parts of Azure. Starnes, a technical author for Pluralsight and Real Python and a Microsoft MVP, names Azure Machine Learning and Azure Databricks, and ties it to Python's strength among data scientists, who he believes are "math geeks first, and software engineers second". He says someone who knows another language can become "dangerous in a weekend and useful in a week", and notes Microsoft sponsored and sent a speaker to a Python conference as early as 2011.
• Few things are off-limits to Python on Azure. Asked for gaps, he names the SignalR service as ASP.NET-only and GUI applications as local-only, though he calls the latter a stretch since Windows GUI apps cannot run on Azure either outside a Windows VM. Everything he has needed to do, he says, he has been able to do.
• Azure's free tier lets user-group members experiment at little cost. He started his "Taming Snakes in the Microsoft Cloud" talk about a year earlier, during the pandemic, to get speakers for his Python user group. He describes $200 for 30 days, a year of generous quotas for databases and VMs, then some services free forever, enough in theory to run small applications indefinitely.
• VS Code's value is its extensions, led by Python ones. He calls it boring out of the box but counts over 30,000 extensions, with three of the top four Python-related: the Python extension at over 40 million downloads, Jupyter notebooks and Pylance. Extension sync carries his setup between Windows and Mac; WSL on Windows 11, which finally got him to upgrade about six weeks earlier, gives each Linux instance its own extension set to avoid conflicts; and a devcontainer.json file preconfigures a GitHub Codespace.
• FastAPI is built for REST APIs, where Django's DRF is a bolt-on. He has just published a Real Python course on the framework, which he says dates from about 2018 and is async from the start. Django, by contrast, is opinionated toward forms-over-data applications, and DRF forces APIs into that style.

2022-04-19 · open the original ↗

• Workload Identity Federation removes the stored secret from outside-Azure deployments. Kuehn, a senior program manager on Microsoft's identity advocacy team, says managed identities only help workloads hosted on Azure. With federation you tell the Azure application to trust an external system such as GitHub, so the repo holds only the client ID, subscription ID and tenant ID. Her case for it is that rotating a password or secret is what breaks automated workflows, and with no secret there is nothing to rotate.
• Setup is a federated credential on the service principal. She says you create the service principal in the portal or with the Azure CLI or PowerShell, then use a new Federated Identity section under its Secrets tab, scoped to a specific scenario such as a PR. The three IDs are then referenced from the GitHub Actions YAML. She points to an Azure CLI and GitHub CLI script by Microsoft engineer Jon Gallant that automates the whole trust setup, and to his video walking through the token flow.
• It is a young preview with no known production users. Kuehn says it reached public preview around late November and covers GitHub Actions, Google Cloud, Kubernetes and compute platforms outside Azure; she has worked mainly on the GitHub side. She does not know the GA date and guesses "probably this calendar year", without official knowledge.
• She expects it to carry Azure identity security into hybrid and multi-cloud. She reads the "compute platforms outside of Azure" support as implying on-premises use, but says she has not yet read that documentation closely. Her view is that because full cloud adoption is "a ways off", extending the same identity controls beyond Azure is what will help customers adopt it.

2022-04-15 · open the original ↗

• Pulsar is one platform for streaming, queuing and stream processing. Grygleski, a streaming developer advocate at DataStax, describes Apache Pulsar as a unified, event-driven messaging platform that does pub/sub streaming and message queuing at once, plus message transformation and processing. She says Yahoo built it around 2014–2015 for workloads such as Yahoo Finance and Mail, donated it to the Apache Software Foundation in 2016, and it became a top-level project in 2018.
• Its typical use is change data capture feeding a pipeline into sinks. She describes Pulsar listening for database changes, transforming them and depositing them in a "sink" through connectors: Elasticsearch, MongoDB, Kafka, email, or back into a database. Her argument for the event-driven approach is that independent pieces hook together "like Lego pieces", and the broker-based pub/sub model scales easily across one-to-many and many-to-many flows.
• It runs as a managed service or locally in Docker. Grygleski, who says she does not mean to be marketing her employer, points to DataStax's Astra Streaming, with a free tier and $25 credit, hosted on Azure, AWS or Google Cloud, with more providers planned. The alternatives she gives are installing the binary and managing topics yourself, or running the Docker image.
• Basic flows need no code; custom processing uses Pulsar Functions. She says simple sinks and data flows can be configured in the cloud console, but filtering, transformation and external connectors use serverless Pulsar Functions written against its APIs. She lists Java, JavaScript, Ruby, Python, Go, C++ and C# as supported, with community support for other JVM languages such as Scala.

2022-04-13 · open the original ↗

• FlaUI sees the app's real controls, which Appium could not. Kunk, at a consulting company working on a client's commercial WPF application, says their first Appium-based tool saw only what was on screen, so data-grid rows that were off screen were invisible and the tests were fragile. FlaUI, an MIT-licensed NuGet library wrapping the Windows accessibility API, exposes native controls with click, type and expand commands, plus whether an element is visible or enabled. You install FlaUI.Core plus UIA2 (for WinForms) or UIA3 (for WPF and Store apps). He says it succeeds TestStack.White, deprecated in December 2019.
• He writes every test by hand in C#, without a test framework. The suite is a separate .NET Framework 4.7.2 project with no recorder: he finds each element's XPath with Microsoft's WinAppDriver UI Recorder (out since 2018) and codes against it. He skips NUnit for flexibility. Each test stages a preconfigured file, then repeats act, read back, fail immediately, because "a click doesn't tell me if it clicked".
• Keep every test fully independent, even at the cost of duplication. Kunk says having one test call another made failures too hard to untangle. Reuse now lives only in a shared library of "interactions" (one click or keystroke) and "actions" (a login made of several interactions). He calls timing his biggest challenge, such as logging in before the login screen appears. Nightly runs can take 30 minutes, but runs on his development machine must be faster.
• Results come from parsing the log, plus screenshots and a tracking database. Several dozen tests run nightly and log every step to a text file. A second pass parses that log to build the email to business users and developers, so the email is accurate because it comes from the log. A "test tracker database" records each test's duration and result for planned Power BI trend analysis, and Snagit takes a screenshot at the moment of any failure.
• Manual testers now feed the suite, and a support tool is planned. The roadmap so far has been silent install, builds pulled from an FTP server, happy-path tests, then regression tests that manual testers specify with staging files. He says automation "never completely eliminates manual testers and shouldn't." Still planned are DevOps pipeline integration and a developer smoke-test subset. The last goal is a tool where support staff pick a version and a test, and a server installs that version, runs the test and sends them a video.

2022-04-10 · open the original ↗

• The framework's value is completeness and a shared vocabulary with customers. Tataran, whose company does Azure consulting and custom development, says it works as a template that forces you through every aspect so nothing is forgotten. Because it comes from Microsoft, it also ends arguments with clients over why his team does things a certain way. He uses the well-architected review as a conversation opener: expert on-premises IT staff who doubt his team answer "no" to many of its questions. He thinks it appeared about two years ago, and says a new version is due in a few months.
• Reliability means choosing targets and trading them against cost. His example is a multi-tenant ISV promising enterprise customers an RTO of one hour while standard customers get less. He tells clients that 99.95% availability with a good disaster-recovery procedure and small RTO and RPO is often enough, since beyond a point uptime costs too much for what it gains. Giard sums up the framework as asking the questions rather than giving the answers. Tataran adds that its docs separate cost-driven non-production environments from production.
• Cost control is the problem his cloud-adopting customers most often lack. He guesses cost is its own pillar because on-premises capex is fixed and known, while cloud self-service lets people create too many, too large or forgotten resources. Customers already in Azure, he says, can often see their costs but have no mechanism to bring them down. A prospective customer with 2,000 developers had a good operations manual written by on-premises experts, which lacked "the lens of cloud".
• Operational excellence forces developers to think past deployment. He says developers usually ignore how an app will be run in production. This pillar makes them consider updates, versioning and monolith versus microservices. It also covers modern CI/CD, automating deployments, failovers, backups and testing, Azure-specific monitoring, and above all infrastructure as code.
• Every production workload should use it; only extreme urgency excuses skipping it. Tataran says the motive for migrating decides which pillars matter: leaving a data centre whose contract is expiring calls for speed and a lift and shift, while a goal of faster time to market makes performance and scalability central. Teams in a rush may defer the framework but should come back to it. Sandboxes and proofs of concept are exempt. He would like the technology-specific guidance, such as for containers and AKS, to grow into decision trees across Azure's many hosting options.

2022-04-04 · open the original ↗

• Episode 700 is a montage of guest clips, not an interview. Dozens of past guests, mostly unnamed in the captions, each give a short message on the show's title theme; most say the developer community is where they found their friends, and the clips span COVID lockdowns ("stuck at home", the "downward slide of the Omicron variant") through in-person KCDC and CodeMash.
• During lockdown, guests credit technology with keeping friendships alive. Several describe reconnecting remotely, one with childhood friends, and missing conference hallway time. One speaker says they flew home from Europe on 13 March, two hours before the travel ban, and started a blog series on what technology meant in earlier decades as a lockdown project.
• One guest argues technology helps friendship but cannot create it. The guest contrasts social-media "friends" never met with people who show up at 2 a.m. when the power is out, citing a friend who drove 45 minutes with a chainsaw to clear a fallen tree from the guest's driveway. Another guest says industry friendships are built on games, places and food away from the screen, not on shared technology.
• Several guests turn "friends don't let friends" into technical advice. One says friends don't let friends right-click publish, whatever is being deployed: an application, a database or a predictive model. Another says friends don't let friends use slow Wi-Fi, and urges viewers to help friends set up good Wi-Fi remotely, not in person.
• Some guests say technologists should build for, and do good by, people. One challenges developers to weigh their work's effect on humanity or seek side projects that do good; another asks the industry to make technology more equitable "for our friends that don't look like us". A third builds as if demoing to a friend, because friends will ask why a part is so complicated.

2022-03-22 · open the original ↗

• JavaScript is strange because of the web and its "lure". Lange set out to answer boot-camp students' question "why is it this way?" and landed on two answers: it grew up inseparably from the web, and it was built to lure in non-professionals ("you too can do this"). Only gradually did it get wrapped in conventions and frameworks.
• Despite its quirks, JavaScript is everywhere. Lange cites it as the most popular programming language every year since 2012 (checked through 2021, not yet 2022) and in use on 97.5% of websites, and argues the history explains how something so "screwy" got there.
• The language changed in fits and starts, with libraries filling gaps. Lange dates it to 1995 at Netscape, written in 10 days and named by marketing to ride on Java. ECMAScript is the standard and JavaScript an implementation of it, named apart to avoid more Java confusion. Releases bunched early, then in 2009 and a big one in 2015. In the long gap, which Lange puts down to people working out what the web was for, jQuery supplied new functionality and smoothed over browser differences. Much of it later went into the language. Node.js and Electron took it off the browser, and Lange sees WebAssembly as the first big change in about 25 years.
• JavaScript was shaped by everyone, not by a central owner. Unlike Ruby or C#, Lange says, standards bodies, open-source authors and companies such as Microsoft all contributed, and this helped its popularity. Lange describes TypeScript, from Microsoft, as the second lasting implementation of ECMAScript, transpiled into JavaScript to add compile-time checking while still running anywhere.
• Pick a JavaScript framework by why and for whom it was built. Lange calls JavaScript itself a reasonable choice and says frameworks should be judged like any tool, on quality attributes, resources and rate of change. React came from Facebook, where many teams work on one app, so its components update independently. Angular came from Google, built for something more uniform like Gmail, though Lange says they are not sure of that origin.

2022-03-11 · open the original ↗

• Drone apps have taken over his mobile-development consultancy. Nolan says about 75–80% of his firm's work is now drones, a niche it picked up more than five years ago through its habit of trying three new things each quarter to see what sticks. Clients such as drone-software vendors (he names Skyward, Measure, Mapware and DroneDeploy) want custom apps instead of the manufacturer's own app. The firm was founded in 1998, has about 60 people in Troy, Michigan, and he started a Canadian arm last year, he says purely to widen recruiting; drones make it easier to recruit developers and interns, whom the firm keeps for two or three years and converts to employees.
• Machine learning on drones is the next stage, automating boring jobs. He calls today's work "level one": capturing images, sending them to the cloud for 2D or 3D stitching, and live streaming. Three or four years ago the firm combined TensorFlow with the drone SDK to count sheep and cows in real time on a phone with TensorFlow Lite, then stitched images in the cloud with OpenCV or OpenDroneMap for a total count; interns train models by counting cars in parking lots because friendly farmers are scarce. Uses he names include spotting trees near power lines in storm-prone Michigan, reading container text at ports, detecting intruders, and a weed-detection app for a group in Virginia that he calls small-scale so far.
• The drone SDK is a headless version of the manufacturer's app. Nolan says almost anything the DJI app does can be done through the SDK in Kotlin or Swift, added like any other library: Gradle in Android Studio, a pod install in Xcode, plus a Windows SDK. His firm converted about a dozen DJI Java examples to Kotlin and the Objective-C ones to Swift; the entry-level DJI Mini that Giard owns runs the basic examples, but automated flights are harder on small drones than on a Mavic Pro or Parrot Anafi.
• Most, but not all, drone vendors offer an SDK. He says DJI, the market leader, supports iOS, Android and Windows; Parrot supports iOS and Android and gives away much of its code; Autel's works much like DJI's; and open-source PixHawk controllers can be programmed through QGroundControl or directly over the MAVLink protocol. Skydio, which he calls one of the big drones, has no SDK now, though it had one in the past and he hopes it returns this year or next.
• Regulation, not technology, holds back drone delivery. Nolan says the rule against flying beyond visual line of sight means a pilot must watch a delivery drone the whole way, defeating the point of automating it; he expects regulators to catch up and cites a former schoolmate's delivery business in Ireland. Regulation does not block his own projects: near airports (within five miles, he says) flights need FAA approval, and his firm has built the LAANC authorization APIs into client apps so pilots can get it without calling the tower or leaving the app.

2022-03-04 · open the original ↗

• Blockchain's value is an immutable, distributed ledger. Fustino, a developer advocate at Algorand for almost three years, describes a ledger anyone can copy by running a node, where recorded transactions cannot be changed, which leaves a clean audit trail. A block is a span of time, such as five seconds, holding that period's transactions. Fustino pitches blockchain as a remedy for ransomware attacks on centralized data stores.
• Consensus methods differ in cost, speed and attack risk. Fustino counts over 2,000 blockchains. Proof of work (Bitcoin and Ethereum, as he describes them) uses expensive machines and a lot of electricity, at over 10 minutes per block. Delegated proof of stake exposes delegates known in advance to denial-of-service attacks. Bonded proof of stake fails when cheating pays more than the bond, for example a million dollars staked against a trillion to gain. Fustino says pure proof of stake has no denial-of-service exposure.
• Uses go well beyond decentralized finance. Fustino names DeFi as the biggest market (Circle, Yieldly, Tinyman), saying it opens banks' financial tools to anyone. Other uses he names are global copyrights held as NFTs (publishers have posted thousands, by his account), tracking charity donations, tamper-proof voting, patient-controlled health records and car-wear sensors. An NFT is identified by a unique asset ID and points to a file on storage such as IPFS. Asked whether NFTs would hold up in court, Fustino says that depends on the evidence checked when they are created, and Giard adds that neither of them is a lawyer.
• Algorand development runs through SDKs, with private keys never sent over REST. Algorand provides SDKs for Java, Go, Python and JavaScript, and the community adds C#/.NET, Dart, PHP, Rust, Swift, Unity and others. Anything involving a private key goes through an SDK, not the REST API. A smart contract is a logic signature that signs only if its program returns true, and it runs on the Algorand Virtual Machine as TEAL bytecode. Reach, a partner company's tool, compiles one codebase for Algorand or Ethereum, which Fustino compares to Xamarin.
• The big smart-contract risk is crypto locked away for good. In Fustino's example, a contract funded with 1,000 algos from escrow that ends holding 500 has stranded them, because its private key cannot be reached once the contract has executed. Fustino says Reach checks for this with mathematical proofs, and otherwise you should hire an auditor. Fustino points beginners to developer.algorand.org and Algorand's Discord community.

2022-02-25 · open the original ↗

• Learning is active practice, not knowledge poured in by lecture. Eland, who teaches C#, JavaScript and SQL at Tech Elevator, a 14-week boot camp in Columbus, Ohio, says students can memorize what a for loop is and still be unable to write a program, because applying, troubleshooting and fitting pieces together are separate skills. He tells students who "understand it in lecture" but stall on homework that coding is a muscle built by practice, ideally with someone experienced as a safety net.
• Accumulated language features burden new learners with too many choices. Eland says C# now has something like 12 ways to declare a property, and beginners stall on which one is right. He credits Microsoft with making learners a focus of major .NET 6 initiatives, while saying there is a long way to go.
• Stepping away puts the brain in diffuse mode and breaks fixation. Eland contrasts focus mode, for executing a specific task, with diffuse mode, where big-picture thinking happens; he says he has solved many bugs in the shower or driving to lunch. His boot camp hands students actual rubber ducks, because explaining a problem aloud strips away confirmation bias.
• Actively try to break your own code before moving on. Spending 15 minutes doing so was his rule when he managed a development team, because a developer who has finished a feature hopes it passes and wants to move on. At best you find the bug before someone else does; at worst you lose 15 minutes and gain confidence.
• Restate your understanding so others can correct it. Eland advises learners to note only a few key points per lecture (maybe five) and to ask questions, including "can I try to explain it to you?" He does the same on joining a team, drawing a diagram of the systems as he understands them so colleagues can name ones he missed; Giard adds that offering what you know makes the correction specific.

2022-02-18 · open the original ↗

• Cloud skills are the single biggest area of demand. Judd, CTO and partner at Manifest Solutions, bases this on 150 open positions across 14 client companies and 75–100 interviews a year, and says his Columbus, Ohio base may make it regional. AWS and Azure dominate and only one client uses Google Cloud; demand spans serverless, VMs, CI/CD, AWS CDK, Terraform, DynamoDB, Cosmos DB and Kafka, and he recommends cloud certifications because they currently carry weight and those without them are "behind the eight ball."
• Beyond cloud, demand concentrates on a stable, mainstream stack. He lists React and Angular (jQuery still hanging on, little call for Vue.js), Docker and Git as table stakes, Kafka and RabbitMQ, and GraphQL newly catching on next to REST. Also in demand: Spring Boot, Maven, Gradle and JUnit for Java; C#, .NET 5, .NET Core, SQL Server and Entity Framework; Jenkins, Azure DevOps and GitHub Actions; Jira; and Scala for ETL. Mobile demand comes from one client and has been slowing for a couple of years.
• Hiring follows the hype curve's slope of enlightenment, not the hype. None of the 150 openings is in AI or ML and only one, a data-science role, asks for Python, which he attributes to his firm doing little data science. He argues most jobs arrive after the trough of disillusionment, so that is the time to apply; Giard adds the catch that you must upskill beforehand, which Judd says is what conferences are for.
• The firm grows its own talent through a paid boot camp. Manifest takes recent computer-science graduates "from 20 to 60 miles an hour" in a six-week Java or .NET full-stack program, run about four times a year for 11 years. Judd says graduates have gone on to Microsoft, AWS, NASDAQ and Google, and that a client said this week one graduate, three months in, was outpacing its senior people; the firm also ran a two-week version twice for a bank team moving from .NET to Java.
• Let target employers' job postings choose what you learn. Judd advises picking five to ten companies you would like to work for, finding the technologies common to their requirements, and using them in a pet project you can discuss at interview. He also recommends contributing to open-source projects in those technologies, since answering "have you used X?" with "I've contributed to it" is the strongest answer.

2022-02-11 · open the original ↗

• Pick the database you already know and stick with it. Ozar, a SQL Server performance consultant, says learning a new database for each project leads to botched basic implementation decisions and slower shipping. He says it does not matter whether that is SQL Server, Azure SQL DB, MySQL, Postgres or SQLite.
• Base architecture on your data-size tier, not famous sites. He sorts databases into 1–10 GB (architecture barely matters), 10–100 GB and 100 GB–1 TB, and says his advice differs by tier, so copying Stack Overflow, a top-50 website, is copying a different problem. He calls the biggest early decision whether to put each client in its own database, which he favours: one shared database is easier to develop but harder to tune as it grows.
• Keep data you never join out of the relational database. Ozar compares relational databases to Ferraris: fast but expensive to run and maintain with specialists. Caches, queues, files, and XML or JSON data can go to cheap cloud file and queuing services, which scale far more easily than relational servers.
• Query rate sets how careful you must be. He sorts load into 1–10, 10–100 and 100–1,000 queries per second: at the low end even SQLite is fine, while from 100–1,000 a single bad query can take the database down, so that is the point to cache in the front end or in Redis. He says relational databases can go far higher, citing a client running over 100,000 queries per second.
• Lean on managed services for work that doesn't make money. Ozar says developers must know early which regulations their data falls under, since some databases make compliance easier; in his view quickly built NoSQL databases such as MongoDB lack the compliance and security features of enterprise databases. In 2022, he argues, the default should be a database someone else manages and patches; though a DBA of over two decades, he uses hosted cloud databases for his own applications.

2022-02-10 · open the original ↗

• Changing system state twice in one execution context cannot be reliable. Stahl calls this the dual-write anti-pattern, e.g. a Web API call that both sends an email and updates a database; distributed transactions would fix it but "absolutely destroy scalability". He says wrapping the email send inside an open SQL transaction makes things worse, since the transaction can fail after the email has gone, and even sending the email first (it is the less reliable step, roughly "three nines") leaves an inconsistent state whenever the database write then fails, with no compensating action possible for an email.
• Split the steps from the start rather than patching failures afterwards. A side process that retries only the failed second step duplicates that step's code and runs only under rare conditions, so Stahl argues it atrophies; since that separate service is needed anyway, he would chain both steps as separate services from the beginning.
• Streaming, Outbox and change data capture all persist first, then act downstream. Stahl prefers streaming: push the message to a topic (Kafka, Azure Service Bus, Redis streams), return a GUID or token to the caller once it is on disk, then fan out to consumers that retry until eventually consistent, coordinated either by a saga orchestrator or by choreography where each service consumes, transforms and republishes. He discourages Outbox (two records written in one database transaction) because it uses the database as a queue, and praises Cosmos DB's change feed for CDC; he says SQL Server supports CDC in many SKUs but not the Azure cloud instance. Giard adds that dropping a message on a bus also frees the client quickly, which Stahl accepts as a speed and scalability benefit alongside safety.
• Making downstream actions idempotent lets a failed process simply retry. Stahl contrasts an email send, which produces a second copy if repeated, with a database upsert given the same data, which ends in the same state; if the first step is idempotent, the whole process can be rolled back and rerun safely. He ties this to maintainability, since every unknown state and separate failure path makes troubleshooting harder.
• Never add a new requirement onto an existing execution context. Bolting an email onto a working database-write API is the simplest thing that could work, but Stahl says the inconsistent states grow exponentially as steps reach five, six or seven; instead, subscribe to an event that already exists. He says this fits the single responsibility principle and lets each piece be deployed and scaled independently, e.g. when one is far more CPU-intensive.

2022-01-23 · open the original ↗

• Future assistants will act on your behalf without being asked. Blankenburg, who joined the Amazon Alexa team just over five years ago, says the Star Trek computer analogy is too narrow and compares the future to a human assistant who brings the coffee before the 10 o'clock meeting unprompted. His example is a notification that a dental appointment is booked for Tuesday at 9 a.m., because the system knows your calendar, the dentist's, the six-month interval and your healthcare provider; he says all of this is possible today and the obstacle is context.
• Companies hoarding data in walled gardens will make this hard. Blankenburg says firms keep data and APIs to themselves because "data is king". A grocery chain told him it has the store-layout data to sort a shopping list into walking order but will not share it, because it wants shoppers to get lost and find products they would not otherwise buy.
• An assistant could manage finances, not just pay bills. Blankenburg imagines it moving money to savings, a 401k and IRAs first, deciding which bill can wait for the next paycheck, and reporting that it refinanced your mortgage and saved $80 a month; he leaves open whether a person or an AI drawing on thousands of others' outcomes decides better. Giard says he already automates most of this but sets the rules in advance and keeps changes, such as a bonus, as his own decision.
• Trust is foundational, and he argues users should own their data. At a healthcare startup before Amazon, Blankenburg built a medical record system around a single patient-owned record, shared selectively (a psychologist need not see unrelated conditions), and he proposes extending that model to all personal data. Giard raises privacy and an employer seeing a past cancer diagnosis; Blankenburg argues that, as with cell phones, people accept tracking once utility outweighs the concern, and concedes to Giard that it happens gradually, not instantly.
• Amazon builds around things customers will never ask for. Blankenburg cites Jeff Bezos's "absolute truths": no one asks for slower delivery or longer checkout, which he says led to fast delivery and Amazon Go stores. He says his team raced to buy a sandwich, snack and drink in under 10 seconds, and his attempts to fool the system by hiding products in his coat or moving them around the store failed; he has heard unconfirmed stories, "not internally", of the technology going into full grocery stores.

2022-01-21 · open the original ↗

• Receiving feedback is the neglected half of the skill. Doler says manager training concentrates on giving feedback and "shoving" it at people, so his eight-hour CodeMash workshop centres on how brains receive it, which he argues also makes people better at giving it. He works at Aviture, a software consulting firm in Omaha, Nebraska, coming up on eight years in March.
• Coaching feedback drowns out appreciation, so the feedback sandwich backfires. Doler separates appreciation (which must be sincere, specific, and in a form the person values; calling a stage-shy person up at an all-hands is a punishment), coaching, and evaluation, and says each is "louder" than the one before. Wrapping coaching in praise means the praise is not heard, and employees learn to brace for a hit whenever they are appreciated.
• Deliver the evaluation first and discuss it days later. Doler says a score is the loudest feedback, so coaching given in the same meeting goes unheard while the employee chews on the rating. He suggests emailing the evaluation and meeting about two days later, once the person has had the argument in their own head.
• Feedback labels like "be more assertive" must be unpacked into behaviours. Doler says words such as assertive are categories each person builds differently, so someone can act on their own idea of assertiveness and go the wrong way. Ask what the giver means and drill down to the data behind the label, such as a salesperson handing over a card, mentioning the 30-day guarantee and asking for the sale, rather than cornering the customer.
• Truth, relationship and identity triggers block feedback from landing. Doler says people discount feedback by finding fault with it or the giver (a manager who does not know React, a jerk's tone), fixate on what it says about the relationship, or let it flood a self-image built on being a good developer. He recommends a sturdier self-story ("a developer who tries hard" rather than "smart"), and in the workshop he deliberately manipulates the Lego-building instructions so partners' feedback provokes these triggers in a safe setting.

2022-01-18 · open the original ↗

• Web accessibility covers everybody, not only blind or deaf users. DeMars lists partial vision loss and colour blindness, partial deafness, cognitive disabilities such as dyslexia and autism, mobility conditions such as cerebral palsy, arthritis and MS, temporary injuries, and hidden ones such as his own diagnosed health anxiety. He argues anyone with a hand in a web or software application, back-end developers and VPs included, should care; his own motivation came from a Marcy Sutton talk and from his mother, who has multiple disabilities.
• Colour contrast and alt text are the low-hanging fruit. DeMars says light grey on white fails an audit, and a larger font can make it pass while the contrast is still poor. Alt text should describe the image specifically (which car, which dog) without running to a paragraph; a decorative image needs no text, but the alt attribute must still be present, as an empty string, or automated audits flag it.
• Never remove the focus ring without restyling it back in. DeMars says designers and marketing often ask to remove the browser's default ring as ugly, which breaks the experience for keyboard-only users, such as someone with an injured hand, and for screen-reader users who are told which element has focus. Restyle it to match the brand rather than dropping it.
• Captions serve hearing loss; plain language and font choice serve cognition. DeMars says audio and video without captions or transcripts are unusable to deaf users, and auto-generated captions are better than nothing. For cognitive disabilities he advises avoiding long technical jargon, and says dyslexic users read slanted or slightly wavy fonts more easily, which makes Comic Sans a good fit.
• Automated tools catch only part of the errors, so test manually too. DeMars uses axe from Deque, available in CI/CD as axe-core and as a free browser extension, which he puts at catching 20% to 50% of automated accessibility errors; the rest needs screen readers, keyboard-only navigation and contrast simulators. Lighthouse runs axe-core underneath and gives a score out of 100, and he warns that its results can differ from the extension's where enterprises pin browsers several versions behind.

2022-01-15 · open the original ↗

• The CodeMash Makerspace began as an experiment and will continue. It started at the 2020 conference. Huber, an IT director at agricultural supply-chain company The Andersons and a CodeMash volunteer for about 10 years, says the space returned for its second year after good feedback. He argues that, as IoT and operational technology converge with software, companies want people who mix electronics with software, which makes it a skill worth learning even if less mainstream than the latest JavaScript library.
• Soldering mistakes become lessons in desoldering. Jamie Hampton runs a guided or self-paced learn-to-solder session on a beginner kit that blinks LEDs; Huber says attendees who put transistors in backwards or resistors in the wrong place are then taught to desolder or use hot-air rework. His daughter, on staff for the first time, built the beginner kit one day and the advanced UFO board, with its surface-mount decade counter and 555 timer, the next.
• A conference demo can start a child on a years-long path. Huber tells of Andrew Fuller, who at about nine saw Bill Steele printing chess sets on a 3D printer at CodeMash, later got a printer, learned CAD, and at 19 exhibited a Portal 2-inspired piece and gave a kids' session on 3D printing.
• A tightly constrained hobby-built printer prints far faster. Huber says his Voron 0.1 prints roughly two to three times faster than his other printers at high quality, against about three and a half hours for a controller case on a stock machine. He describes the workflow as designing in CAD, slicing layer by layer, and sending G-code that the printer processes in real time.

2021-12-13 · open the original ↗

• Companies knew remote work was possible but not at this scale. Damian says sending whole staffs home at once strained internet links, data-centre bandwidth and the devices handling secure traffic, and companies licensed for a set number of concurrent VPN connections had to buy more; IT staff also had to support people using home Wi-Fi and home setups for the first time.
• Attackers used COVID as a ready-made pretext for phishing. From March–May 2020 Damian saw phishing themed on the pandemic, such as links about doing groceries under lockdown or claiming April COVID benefits; he argues the fear was already built in, so attackers barely had to work on the message, and the more personal or serious the hook, the more people click.
• State-sponsored supply-chain attacks grew in size and complexity. Damian says from about the second half of 2020 attackers targeted security vendors and software used by managed service providers, gaining access to every customer at once; he cites NotPetya, spread through the update mechanism of a Ukrainian accounting package, infecting perhaps 80% of its SMB customers within hours (he says he does not recall exact numbers). IT staff working from home added hours or days to incidents needing someone on site.
• The pandemic pushed adoption of zero trust and "assume breach." Damian describes zero trust as explicitly verifying identity, location, device health and the workload requested, flagging anomalies (an Excel user at 3 p.m. Wednesday versus two terabytes downloaded at 2 a.m. Saturday) and granting just-in-time, just-enough access that is revoked automatically. He says attackers on average keep access for six to nine months before detection because organisations are not looking for signs of breach, so they should plan how to detect, block and remediate one. He also says companies that adapted quickly survived, often by compressing digital-transformation plans from months or years into weeks.
• Security work is shifting from reactive to proactive. Damian describes three waves of GDPR demand: panic in the six months before it took effect, renewed requests once the first large fines hit, and a third driven by remote access to data; he argues the principles should apply to all data, not just personal data. He says roughly 90–95% of security requests used to follow a breach, customer demand or compliance requirement, and he now sees more companies coming proactively. Giard frames this as companies finally treating the risk seriously rather than checking boxes after a cookie-banner first wave.

2021-11-21 · open the original ↗

• The bot gathers details first so humans only confirm them. Kwiatkowski, telecom and converged engineer at Michigan State University, says the university's hospital clinics came to his team with wait times that were too long and trouble hiring qualified staff. Booking an appointment took five to six minutes on the phone; with Dialogflow CX collecting the data in conversation and handing it to the agent for a sanity check, he puts the call at about a minute and a half. He reports that the system misroutes calls "very, very rarely", and that callers' frustration is mostly with talking to any computer system at all.
• Non-programmers get most of the way; conditionals and integrations need developers. In the browser console you type 10–15 different phrasings of a question ("when are you open?", "what are your hours?") and the machine learning builds the intent from them. He says someone with no coding background gets about 80% of the way, and his analysts, among them a psychologist and a former telephone-wiring worker, built intents this way. If-then routing logic and REST calls out to systems such as an appointment database are where programming knowledge or a developer comes in.
• Per-minute pricing costs far less than the staff it relieves. Billing is by minutes of audio and response, effectively per transaction. For the hospital system's 14 clinics, at close to 100,000 interactions a month, he puts the bill at "a few thousand dollars a month"; the host suggests nurses' salaries for staffing phones would cost far more, and Kwiatkowski agrees.
• Done well, the same tools improve service rather than just cut cost. His team's next iteration for the hospital is outbound calls that give a patient a test result, explain in conversation what a high number means, and escalate to a nurse if needed. He describes a Michigan automotive manufacturer using the product as "agent assist": it listens to a live call and puts help articles in front of the agent without them typing. He also describes a system that drafts FAQs and help articles from a senior engineer's calls. He warns that a bot used only as a front door, after which callers repeat everything to a human, "doesn't make anybody happy."
• Novices should start with Dialogflow ES before CX. He says ES suits one question leading one way, such as a simple menu or decision tree. CX handles "multi-turn" conversations: filling a form of, say, six required items without re-asking ones already given, and keeping context, so a caller who mentioned sports medicine is not asked about radiology. The host proposes that a novice start with ES and move to CX, and he agrees.

2021-11-11 · open the original ↗

• High-school computer science access is unequal, and it shapes careers. Hartnett, who works for the TEALS program at Microsoft Philanthropies, says a student who takes computer science in high school is six to eight times more likely to major in it in college. She puts the share of high schools offering it at a little over 50% early on, and later at "a little bit less than like 50%", citing new Code.org numbers she has not memorized. Enrolled students tend to be white suburban males. TEALS targets inner-city schools, where she says the first college-educated person most students meet is their teacher, and rural schools with no computing professional nearby.
• Volunteers team-teach until the teacher can teach alone. TEALS pairs industry volunteers with a school's teacher, who learns alongside them; a volunteer commits for one academic year, but the program usually takes a couple of years. After that the teacher joins the alumni network and teaches on their own. She gives about 500 schools in the US and British Columbia, plus four in Juárez, Mexico, and about 1,200 volunteers. Microsoft, as the sponsor, is the largest source of volunteers, but they come from across the industry, including bootcamp graduates.
• The Chicago launch went to west and south side schools. She is based in Kansas City and covers Chicago, St. Louis and Kansas City. TEALS launched in Chicago this year (2021) in seven schools, six of them Chicago Public Schools, mostly Black or Hispanic. In one school the volunteers called every parent on the roster and invited them to an October open house. In another, a volunteer with a gaming background is building up the school's e-sports center and a 3D printer and tying them to classwork.
• Computer science should be required as basic literacy. She would like it to be a required course, not just an offered one, because technology will be part of everyone's life. Giard argues that knowing what machine learning is helps even non-programmers. She adds polling and extrapolated data, computerized voting and who programs it, misinformation, and what phones track as reasons the knowledge matters.
• Her measure of success is teachers who outgrow the program. In her four years she has mostly seen teachers rather than students succeed, since for privacy reasons staff spend little time in classrooms. Every teacher she worked with in her first year is now an alumnus, adding coursework and sending students to AP exams, which she treats as a measure of how students are doing. Volunteers apply at microsoft.com/TEALS, where she says applications usually open in February; schools can apply now.

2021-10-19 · open the original ↗

• Learn why Git works the way it does before learning commands. Rael, who ran a Git workshop at KCDC, recommends Tom Preston-Werner's blog post "The Git Parable", which tells the story of keeping a version history as a series of saved snapshots; it won't teach you to use Git but explains its design. For depth he points to the book Pro Git, "a bit of a dry read" that covers everything.
• Git is a version control system built on a content-addressable file system. Rael says the .git directory stores commits, trees and blobs, and each SHA is a hash of a snapshot's content that serves as its address. He says Git is fast because it stores snapshots rather than deltas and because everything is local except interaction with remotes.
• A clone puts the entire repository and history on your machine. Rael defines a remote as just a reference to another repository, which can even be another directory on the same machine, and a repository can have zero or more of them. He finds it ironic that a distributed system is usually used with one canonical central repository on GitHub, GitLab or Azure DevOps.
• A branch in Git is a pointer to a commit, nothing more. Pushing sends your commits and their referenced objects plus that pointer to the server. Rael says pull requests (GitLab's merge requests), code review and browser editing are features the providers built on top of Git, not Git itself, and that is the difference between Git and GitHub. He favours one canonical mainline, with feature branches or committing straight to it.
• Git merges distant edits itself and asks a human about close ones. Rael says changes to different functions in the same file merge automatically, while changes to the same or nearby lines produce a merge conflict that needs a person to decide which version to keep, keep both, or combine them. He says resolving conflicts takes learning, and he has seen developers, himself included, do it wrong many times.

2021-10-14 · open the original ↗

• Probabilistic data structures trade accuracy for space and time. Royse, a developer advocate at Redis, says that besides the usual time/space trade-off you can accept a structure that "sometimes lies to you": his illustration is cutting space and time by three orders of magnitude in exchange for a wrong answer 2% of the time. He compares it to JPEG's lossy compression, and Giard adds that whether it is worth it depends on the cost of a wrong answer.
• A Bloom filter answers "no" or "probably" to membership. In Royse's example, a site with a billion users checks whether a username is taken without querying the users table; the filter guarantees no name collisions at the cost of some free names never being issued. He says Bloom filters also suit deduplication, the example in his talk "Understanding Probabilistic Data Structures with 112,092 UFO Sightings".
• HyperLogLog counts unique items in about 12 kilobytes. Royse says it can count trillions of unique things, is accurate at low counts and approximate at high ones, and would suit counting unique viewers of a video. He stresses he does not know how YouTube does it. HyperLogLog ships with open-source Redis by default, using a command he believes is PFADD.
• The RedisBloom module adds further probabilistic types and commands. He lists Bloom filters, Count-Min Sketch, Top-K, Heavy Keepers and cuckoo filters. Royse says Top-K ranks the most frequently submitted items fairly reliably even though its underlying counts are inaccurate, which is enough when only the rank matters.

2021-10-14 · open the original ↗

• Only SpaceX among the billionaire ventures has proven an orbital rocket. Campbell calls Virgin Galactic's and Blue Origin's New Shepard suborbital hops of a few minutes, past a Kármán line he puts at 100 or 60 km depending on who you ask; orbit means reaching about 17,500 mph, which is why the 20 m New Shepard is dwarfed by the 70 m Falcon 9. He says Blue Origin's orbital New Glenn shows only mock-ups and test articles, and that United Launch Alliance's replacement for Delta IV and Atlas V, Vulcan, is exposed because it depends on Blue Origin's BE-4 engine, which is behind schedule.
• Paying NASA's contracts per kilogram drove launch costs down. Campbell puts Falcon 9 at around $1,900 a kilogram to orbit, against almost $65,000 for the shuttle (development plus 135 flights), $15,000–20,000 for government-paid rockets and about $9,000 for Falcon 9 at its start. He credits the space station resupply contracts, paid per kilogram delivered rather than the usual cost-plus that discourages innovation, plus first-stage landing, which he says SpaceX has now done about a hundred times.
• Crew Dragon has opened orbital space tourism. After the shuttle retired in 2011 the US bought Soyuz seats at about $80 million each; Campbell says a crewed Falcon 9 flight is about $100 million, or $25 million a seat. At recording, the first dedicated tourist flight was in orbit: four people for a week at about 500 km under a dome replacing the docking port, financed by a billionaire commander alongside a $100 million donation to St. Jude, with seats for science communicator Sian Proctor, a St. Jude doctor and bone cancer survivor, and a raffle winner's friend. He sees falling costs leading toward multimillionaire customers and perhaps a space hotel.
• Starship's full reuse could cut cargo costs roughly tenfold. Campbell says a fully reusable vehicle, paying only for fuel and maintenance, would take cargo from about $2,000 to under $200 a kilogram, putting a seat to orbit near a first-class 777 fare. At recording it had not reached orbit; the planned test would boost back the Super Heavy and fly Starship from Texas around the globe to land in the ocean near Hawaii, and he credits SpaceX's public, fail-fast testing, with the next prototype ready within a day or two of a loss.
• Commercial space is repeating how the airline industry was built. Campbell compares NASA's commercial contracts to the government airmail contracts that matured aircraft into airliners. He argues Apollo skewed perceptions because it was essentially military: all but one of the astronauts who went to the Moon were military test pilots, and the program was wound down quickly as too dangerous, whereas 2020s technology can make spaceflight safe, reliable and reusable enough to become an industry; he says he is optimistic.

2021-10-08 · open the original ↗

• Cognitive Services put AI behind a plain web API call. Nasr, a developer since 1995, says Microsoft has "democratized" these services so developers need no machine learning expertise. He was drawn to them by a 2016 Microsoft conference video of a blind Microsoft developer using a phone app built on them to read menus and describe the people around him.
• Custom Vision detects objects you train it on. Nasr groups the services into four categories: decision, speech, vision and language. He separates computer vision (image and spatial analysis) from custom vision (image classification and object detection), which can learn objects outside Microsoft's pre-built domains. His example is an oil filter a customer holds up at a kiosk instead of naming the part.
• Chaining services turns an app into a voice conversation. Nasr's pattern runs speech-to-text, then LUIS, then a database query, then text-to-speech. LUIS, once trained, maps differently worded sentences ("I want to buy a car", "can you sell me a car") to one intent token, and separates buying from servicing. He also describes QnA Maker answering from an FAQ document, sentiment analysis that can catch sarcasm in social-media monitoring, and the decision category's Personalizer, Content Moderator and Anomaly Detector.
• Shapes beat numerals for reading rail cars in dust and heat. Nasr describes a customer site too dusty, dirty and hot for barcode scanners, where high-definition cameras identify cars on rails from a distance. They recognize custom-designed objects instead of painted numbers, whose curves would fill with dust and become unreadable. Another customer of his uses speech-to-text and text-to-speech to talk to an application.
• Latency is small, but setup spans two portals. Nasr says calls are asynchronous and typically fast, and pricing comes in tiers, including free testing. For LUIS and Custom Vision you create the resource in the Azure portal, then build the model at a separate site (luis.ai, customvision.ai) and link the two with the resource's keys.

2021-09-28 · open the original ↗

• Ethical hacking is the attacker's knowledge put to protective use. Damian, a certified ethical hacker who says companies pay him to hack them, argues the ethical hacker needs more than the attacker does: how to get in, and also how to prevent and respond to it. The knowledge is a tool like a hammer, and the ethics lie in how it is used: telling the owner their door is open rather than walking in.
• Password attacks have shifted technique, not target. Damian says people reuse one password and make it pass complexity rules in predictable ways ("Bob", then "Bob1", then "Bob1!", then a 02 on the end). Many breaches came from credentials stolen from a weaker site and reused elsewhere, not from a hack of the system itself. He says breach statistics show 1–2% of users (one in 50) use 123456, which drives password spraying: one or two common passwords tried across every account, to stay under lockouts that trigger after three to five failures.
• The ethical hacker's job is education, technology fixes and penetration tests. Damian recommends multi-factor authentication and a password manager with a random password per site, and splits the advice between those running a site and its users. In a penetration test he attacks the way a black-hat hacker would, so the company finds the hole before automated tools left running overnight do, then either implements the fixes or teaches the client's team to.
• He chose the CEH because it sounds good and explains itself. Damian says the EC-Council exam ran about four hours, and the council runs background checks on candidates who score suspiciously high (a 97% from someone very young) to catch answer brain dumps. The certification renews every three years on proof of conference talks, attendance and articles, and a higher licensed pen tester level gives two weeks to attack an environment, followed by a report defended before licensed pen testers. He calls other certifications, such as CompTIA's, technically just as good and more often sought for compliance.
• The pandemic moved security risk onto remote workers and absent IT staff. Damian lists VPNs that could not take the whole workforce overnight, phishing themed on pandemic news, and attacks timed for when home-based IT staff are off hours and not watching. His argument is that people protect company data once they understand how security affects them personally, because what they know they cannot ignore at work or at home.

2021-09-14 · open the original ↗

• Kusto over Application Insights turns "the website is broken" into evidence. Potter, technical strategist at Aptera Software (recently acquired by CoreBTS), calls Kusto one of the biggest quality-of-life gains of his last three or four years as a developer. App Insights is cheap enough that his team logs heavily, and with a username he can query the pages a user hit in the two minutes before an exception, server response times and web-server memory load, often enough to reproduce the bug.
• Kusto queries traced one outage to a VPN change by Monday lunch. After a new release of a WPF desktop app, about five users reported errors. Potter filtered events to those users and found the exceptions were all on larger queries, App Insights' IP geolocation put them all in one tri-state area, and averaging query times showed them measurably slower, to the millisecond, than everyone else on the same database. The client's infrastructure team had done maintenance over the weekend on one office's VPN tunnel. The same data turned up affected users who had not emailed, and the team contacted them.
• Azure alerts built on Kusto kept a Black Friday site up. For a client expecting 10 to 30 times normal traffic, Potter's team set alerts on average page load time and web-app memory over windows such as 10 minutes. The alerts went to a 24/7 support team that could move the app to the next performance tier, and he says the site did not crash.
• Saved queries and dashboards answer product owners in real time. Potter saves queries of 15 lines or more for business events, such as how often something was cancelled, and pins charts to custom Azure portal dashboards. Because users on old versions of a desktop app were among the largest sources of errors, one dashboard showed the share of users on the latest version at each manufacturing facility, so the product owner knew which site to call when it sat at 50%.
• Potter prefers Kusto to SQL and works entirely in the portal. He finds the editor at portal.azure.com strong, with IntelliSense, tooltips and good error messages, and believes but cannot prove that it is the Monaco editor. He calls the Kusto docs on docs.microsoft.com first rate, with good examples from the start. Giard read in the project's readme that Kusto is open source and can query data beyond App Insights; Potter has used it only briefly with Azure Data Explorer.

2021-09-10 · open the original ↗

• Teach engineering fundamentals on a kata before the real domain. Presley, a senior team lead at SolarWinds whose team is former interns hired as associate engineers, pairs new hires through the Mars Rover kata in a fresh repo: git init, automated tests, frequent commits with good messages, pull requests, and code reviews by other engineers treated as real work. They then go into the production code base already knowing about 80% of the tooling, so the focus can move to the domain, such as what a deadlock is in performance monitoring, and they have relationships with other engineers to call on.
• New engineers learn best where mistakes cannot break anything. Presley traces this to his own internship, in a shop without source control, where an accidental rm -rf took down the production web application on his third or fourth day. When one of his engineers struggled with CI, he had them put the kata under an Azure DevOps YAML pipeline, so they learned the fundamentals without touching the real build.
• The kata got interns contributing about three weeks in. Presley developed it in an earlier role making a large enterprise's developers more effective, where pairing with every engineer eight hours a day for three weeks did not scale. He says it went engineering-wide in summer 2019 and interns on a 10-week internship produced real production value about three weeks in, against five or six weeks before. He picked Mars Rover for being just complex enough and vague: he plays product owner with new requirements to see how an engineer thinks, and it is tied to no stack or paradigm.
• Student feedback shifted his approach from technology toward process. Presley says he first threw technology at the problem and committed straight to the main branch, then found mentees could not create pull requests, so he built PRs in. He now covers requirements, code review and deployment as well as coding. Giard adds his own decade-old blog post concluding that his job was solving business problems, not writing code, and Presley says his own bio leads with "problem solver" for the same reason.
• After the kata, stretch work with safeguards builds experts who teach. Presley gauges what each engineer is drawn to and assigns real work to match. One engineer moved the team's entire Azure DevOps pipeline from the GUI to YAML, with the old pipeline left in place so he could not fail, and ended up tired of pipelines; Presley counts that as expertise he can pass to the next cohort. He blogs on the approach at blog.thesoftwarementor.com.

2021-09-08 · open the original ↗

• Couchbase pairs a NoSQL document store with a full SQL language. Groves, who has worked at Couchbase for almost six years, describes it as a clustered JSON database that scales out horizontally, with memory-first caching built in, and a query language (N1QL) he says is full ANSI SQL with joins, MERGE and CTEs rather than a SQL look-alike. Version 7 had gone generally available "a few weeks back" after a public beta.
• The new release adds two levels of organization within a bucket. Groves says a collection is roughly a table without a predefined schema, and a scope, which holds collections, is roughly a SQL Server schema; scopes are aimed at microservices (a people service and a payroll service each with their own data) and multi-tenancy, with security and permissions definable at each level. Giard compares this to containers in Cosmos DB, which he thinks of as folders in a file system.
• Distributed ACID transactions arrive alongside relational-style query features. Groves says transactions are coordinated across potentially dozens or hundreds of machines, are available from the SDKs (.NET, Java and others), and can be written in N1QL as BEGIN/COMMIT/ROLLBACK. N1QL also gains user-defined functions and a cost-based optimizer, "cost" meaning compute resources, not money.
• He built an experimental SQL Server-to-Couchbase migration library. After moving from developer advocacy to product marketing management, Groves pitched a tool to ease relational users across, and his boss told him to build it; it is an open-source .NET library on NuGet, under his GitHub ID mgroves, with a console example using AdventureWorks. It maps SQL Server schemas to scopes and tables to collections, copies data, approximates indexes, recreates users, and does rudimentary denormalization, such as folding a shopping cart table and its items table into one document with an array.
• User issues, even complaints, drive the project's features. Groves says he has had no pull requests yet but welcomes issues; the pipelines and filters feature, which transforms data in flight to redact sensitive fields or limit it to, say, a year's worth, came from one such request.

2021-09-01 · open the original ↗

• .NET MAUI is the next Xamarin.Forms, rebuilt to fix its pain points. Basu, a developer advocate at Progress Software, says Xamarin.Forms sits at its 5.0 release after about five years, and the team is using the restart to speed up the inner loop, ease deployment to devices, simplify code organization and reach more platforms. It was scheduled to ship with .NET 6 in November 2021; at recording it was at preview 7 (August), with an RC expected likely in October.
• Desktop support becomes first-class, built on existing platform bridges. Basu says MAUI starts with four platforms, iOS, Android, Mac and Windows, where Windows and Mac renderers for Xamarin.Forms had existed only as community efforts developers did not trust. Rather than reinvent the wheel, it uses Apple's Mac Catalyst to run UIKit apps on macOS and WinUI 3 as the native Windows UI stack.
• One project replaces a project per platform. Basu says fonts and images no longer need per-platform handling because the build system works that out, and one drop-down lists every simulator or device to deploy to; on Windows this requires Visual Studio 2022, while on a Mac the command-line tools work. The mobile workload still pulls in dependencies such as Xcode and the Android emulator, which cannot be avoided.
• Existing apps and controls get an upgrade path and compatibility mode. Basu says a .NET upgrade assistant, still being worked on, will move Xamarin.Forms apps over, handling changed namespaces, classes and project structure, and the team promises a painless migration; older Xamarin.Forms UI can run on MAUI in a compatibility mode, but less efficiently, so Progress is redoing its Xamarin.Forms suite for MAUI. He says Xamarin.iOS and Xamarin.Android continue as .NET for iOS and .NET for Android for single-platform C# developers, while MAUI's gain is a single shared UI stack.
• Controls are opened up as interfaces for other UI frameworks. Basu says the underlying architecture now exposes controls such as a button as an interface, so frameworks like Fabulous (F#) and Comet (Model-View-Update rather than MVVM) can render native controls on every platform through it. He points newcomers to the dotnet/maui GitHub repo as the "one place of truth".

2021-08-27 · open the original ↗

• Music and software both demand holding a complex abstract model in mind. Franklin agrees with Giard that good developers are often musicians, but adds that you need not be a good musician to be a good developer. His explanation is that code and a piece of music both live in the mind as abstractions, an object being "a metaphor", which are then expressed outward as an application or a performance.
• Both crafts require zooming between the whole work and its technical detail. Franklin likens a developer tracing a feature from a button click down into "dirty details" to a pianist drilling scales and hard passages while still presenting a whole piece. He adds timing as a shared concern: an interface that shows something too fast fails to communicate, just as notes depend on the intervals between them.
• Practice builds muscle memory, and most learners quit before reaching it. Franklin says beginners think hard while playing and assume fluent players are geniuses, but practising and correcting mistakes eventually lets the fingers move by themselves, and that "feels like magic". Giard raises Malcolm Gladwell's 10,000 hours. Franklin urges developers to take up an instrument even with little time: borrow a guitar, learn one chord, and value the instant feedback.
• People move from music into software because software is a stable career. Franklin says that is why he did it himself. Five or six years earlier he steered a high-school intern away from the studio business, telling him studios were closing because cheap, good gear lets everyone, James Taylor included, record at home. He had him build a space-shooter game from a Unity 3D walkthrough in four hours, then gave him free tuition for a nine-week boot camp that Franklin got in exchange for its advertising on .NET Rocks. Franklin says the intern graduated, got a job running IT at a local company, and is "going gangbusters".
• Good recordings need every voice on its own isolated track. Franklin keeps instruments apart in his studio to avoid bleed, and says a single recorder on a table makes a podcast sound "like they're in a bathroom". He says .NET Rocks has recorded each participant separately since 2002, and now uses Zencastr, a paid web app built on the browser audio and video APIs. It records each person locally and gives the host in-sync MP3s, and optionally MP4s, when recording stops. He blames its earlier unreliability on browser implementations of those APIs, which he says improved over the last three or four years.

2021-08-21 · open the original ↗

• SQLPlus.net is an ORM that works with SQL rather than abstracting it. Kunk, an application architect in Lansing, Michigan, describes it as an alternative to Entity Framework, Dapper or ADO.NET: you annotate stored procedures with --+ comments, and a Visual Studio VSIX plug-in generates strongly typed services, input classes, output classes and validations. He calls this DBA-friendly, since a DBA can help debug plain SQL without knowing LINQ or Entity Framework; Giard adds that Entity Framework can hit a wall when you need to dig into slow SQL.
• Annotations in the SQL drive generated validation and result handling. Kunk's examples include marking a parameter required, expecting a single row (it errors otherwise), and mapping a row count of zero to a "not found" enum in the output class. Built-in validations cover credit-card format (not the card itself, as Giard confirms), email, HTML, string lengths, passwords, postal codes and custom regexes, and a failed validation never reaches the database.
• Everything goes through stored procedures or file-based "concrete queries". Kunk says ad hoc queries are not available because the code is generated, but where getting a procedure past the DBA is hard, a concrete query stored as a file in the C# project is read the same way. For new databases the product supplies procedures that generate CRUD routines for every table, and generated classes are partial so they can be extended.
• Generation also produces enums, static data and multi-result outputs. Kunk lists enum lists generated from a query, static classes for rarely changing lists so the app skips database trips, multi-row, JSON and XML returns, MARS (multiple active result sets) into one output class, transactions, and a generated interface for handling transient connection errors, for example in mobile apps. Snippets for the annotations are available in SQL Server Management Studio.
• It is free except for corporate developers, who pay yearly. The fee is $99 per developer per year; Kunk says it follows Visual Studio Community Edition terms: free and full-featured for small companies, education, research and independent developers, with paid and free editions identical "at this time". He says it currently supports only SQL Server, .NET clients and, he believes, C# only; the vendor is in Pennsylvania and keeps sample code on GitHub.

2021-08-11 · open the original ↗

• Azure Arc is a universal remote for hybrid and multi-cloud servers. Chowdhuri, who works at Microsoft, says it gives a "single pane of glass" over machines in data centers, under a desk, or in Google Cloud and AWS. He says the documentation currently covers Windows and Linux servers, SQL and PostgreSQL databases, and Kubernetes clusters in any environment.
• Machines are connected by running an agent script on them, not from the portal. Chowdhuri describes creating a resource group in the Azure portal, downloading a generated script and running it on, say, a Windows server in Google Cloud to enable the Arc agent. Authentication can be your own Azure CLI login or, more cleanly, a service principal, after which it is mostly "set it and forget it"; from Azure you can then monitor, push updates and extensions (including web server), scale databases and apply Azure Policy.
• It is aimed at infrastructure, not other clouds' platform services. Giard frames it as IaaS-focused, and Chowdhuri agrees that services such as Amazon S3 or Cognitive Services stay in their own cloud's portal. Extending his remote analogy, he says there is "really no point" in using Arc if you are not in a hybrid or multi-cloud situation.
• Pricing is left to the calculator; resources still bill where they run. Chowdhuri does not know Arc's own cost offhand and points to the pricing calculator; he says creating resource groups and metadata is free while logging and monitoring add cost. Giard's own calculator check showed $0 for one Kubernetes configuration and $132 a month for six cores over 200 hours with licence included, which both flag as an estimate as of recording.
• Start with the Jumpstart scenarios on Docs and GitHub. Chowdhuri points there for getting started and for feature additions, along with the Azure Architecture Center's hybrid multi-cloud Kubernetes designs. He notes Arc can be driven from the portal, the Azure CLI or the REST API, says Microsoft customers he will not name use it in production though he does not, and recommends Visual Studio Dev Essentials' Azure credits to non-Microsoft viewers.

2021-08-04 · open the original ↗

• Companies open-source code for outside ideas, reuse and fresh eyes. Faris, technical community manager at Rocket Mortgage, says open projects draw innovative ideas and stop teams reinventing the wheel internally, while outside users catch missing features and bugs, so it is "mutually beneficial". She says Rocket surveyed its technology division on attitudes to open source, interviewed staff who proposed projects, and is now working out how to release and promote them under a regulated financial company's restrictions.
• Running an open source project is mainly managing communication. At her previous job, a Python-based SecOps/DevOps project with a paid enterprise version, she was hired because open source contributors felt unheard. She describes triage and testing teams, engineers answering contributor questions on Slack, weekly meetings and Twitch streams walking people through testing and triage, and a wiki of getting-started information; managing the community "is not really about the code".
• Contributors need not be developers; documentation is the usual gap. Faris says the biggest complaint about every open source project is poor documentation, which Scrum Masters and BAs she worked with have contributed to, and which she says pushes would-be contributors away. For finding projects she suggests GitHub search and company open source pages such as Spotify's and Netflix's, then reading the readme, wiki and code of conduct before picking up issues.
• Rocket open-sources only what reveals none of its "secret sauce". Faris says anything released must clear legal and public relations, and the company uses the MIT license. Its Spark Design System, a consistent UI across company websites worked on by developer advocate Chris DeMars, qualifies because it is design-only; she also mentions a podcast management platform and analytics and test-reporting tools.
• To launch your own project, start with people rather than resources. Her step one is putting it on GitHub, then asking individuals you know to contribute and sharing it on social media; even without a broad network, a co-worker on a lunch break is a start. She adds that open source contributes to learning and to jobs that weigh contributions, and that she has found the community mostly friendly and collaborative, while acknowledging not everyone's experience has been positive.

2021-07-20 · open the original ↗

• Gaudet owns the publishing process, not the technology behind it. She works on Microsoft's Commercial Marketplace enablement team (formerly operations) covering infrastructure offers — virtual machines, Azure Apps (solution templates, a subset of ARM templates) and container images from Azure Container Registry, with IoT Edge about to be added — and owns metadata certification, checking titles, descriptions and links against hundreds of policies.
• Publishing runs through Partner Center and two parallel certification workflows. She describes getting an MPN ID, being vetted (a physical business location is required, as she remembers it), choosing Commercial Marketplace and one of 16 offer types, entering metadata and uploading; after automated checks such as malware scanning, content and technical validation run in parallel, about 95% automated and taking a couple of hours, and a passing offer goes to preview and is in Marketplace within 24 hours. Sovereign clouds such as China are handled separately, and VM extensions still have to be submitted by email.
• Certification is being automated, but multi-image offers made it painful. Until about six months before recording, VM certification was manual, and a publisher with 20 to 100 images on one offer had to publish them one at a time while she chased the certification team for each approval; VMs now go through in a couple of hours, and the aim is to automate as much certification as possible within the next year. Subjective checks remain, such as blurry logos, which she attributes to one upload being resized into three logo sizes without a set DPI.
• Listings must not read as if the product is Microsoft's. She says "monkey application on Windows" passes where "monkey application Windows 8" fails, for Microsoft IP and legal reasons, and logo use is restricted; the publisher agreement lets Microsoft remove insecure or policy-violating offers, and apps may not collect customer data without telling the customer. Her closing advice is to read all the policies and terms before starting.
• SolarWinds showed how much the process depended on her. She spent a weekend on the incident checking whether any Marketplace offer was affected and waking people across teams because she lacked access to parts of the infrastructure; the offer in question was not affected because its publisher had fixed it over the summer. She wants a process that works without her as the bottleneck, and asks publishers to use Marketplace support (aka.ms/marketplacesupport) rather than email her, since her inbox starts at about 300 messages.

2021-07-14 · open the original ↗

• D3 generates interactive SVGs and does the placement math for you. Dowden explains that SVG is function-based rather than raster, so it scales without limit and can carry clickable, animated elements. D3 is a JavaScript library for building SVGs on the fly. It runs anywhere JavaScript does, including an Angular project she is working on.
• D3 is usually overkill but pays off for complex visualizations. For ordinary charts she finds Charts.js perfectly fine. For a tabletop-RPG project she gives D3 a list of nodes and connections, and it draws a "spider web" of rooms, traps, enemies and treasure without overlaps; she swapped its circles for her brand's hexagons. That took "an afternoon of fiddling," against a lot of work without D3. She also built a spinning globe of the countries she has visited and spoken in from a JSON map of the world.
• SVG's fixed positions make data refresh an implementation decision. Unlike HTML, an added element does not push its neighbours aside, so the developer must work out how much to recalculate. She redraws her whole node web on refresh. In a nested-circle view (castle, levels, rooms) she redraws only the circle that changed.
• D3 wants pre-shaped JSON in memory; data volume governs speed. Her Angular services turn Firebase data into the JSON a given D3 function expects, much like old jQuery UI plugins. She expects about 5,000 nodes to lag, because rendering is client-side and the DOM has limits. Speed can also come from tighter data transformation, such as looping once instead of three times. She computes her statistics before handing the data to D3, though she does not say D3 cannot do it.
• Getting started is importing D3 and writing DOM-style JavaScript. It is available from npm or a CDN, and using it feels like "back to the good old DOM manipulation days." She recommends the D3 Graph Gallery for examples with their code, and warns that it assumes you already know JavaScript well.

2021-07-09 · open the original ↗

• High code coverage does not prove the tests are good. Bock, a developer advocate at Rocket Mortgage, notes that tests with no assertions still raise coverage. Good tests naturally produce high coverage, but the reverse does not hold. Mutation testing answers "who watches the watchers": it alters the code, for example changing an add's plus to a minus, and expects some test to fail. Each failure "kills the mutant." He says the idea dates from the 1960s or 70s and spread only recently because it is computationally expensive.
• Stryker automates mutation testing; installing it and running dotnet stryker is enough. It is open source and available for .NET, Scala and JavaScript; Giard found its site, stryker-mutator.io, and that the .NET version arrived in 2018. Bock believes it mutates the source in memory rather than the bytecode. A run is slow, like BenchmarkDotNet, and ends in a report that links to each file and marks which mutants survived. He asks companies that use open-source tools like it to contribute back.
• A surviving mutant flags a possible problem; a human must decide. Stryker applies a fixed list of mutations, including arithmetic operators, string literals and LINQ (Take becomes Skip). In his own code, changing < to <= broke no test, and he judged that acceptable. Blanking an exception message also broke no test. He changed his tests to assert the message, on the principle that code exists for a reason and should be tested.
• Adopt Stryker early, not years into a codebase. He sympathizes with teams under deadline pressure. Adding it six months to two years in can be overwhelming, so he advises bringing it in as soon as code is written. A Rocket colleague is looking at building it into their continuous integration.
• A fresh explanation can make a familiar concept click. Bock had heard of mutation testing for years, but it only clicked in a lightning talk on Stryker at a group run by Dan Clark in Oxford, as mocking had once clicked for him through one framework. So he urges people to blog or record videos on topics others have already covered.

2021-07-09 · open the original ↗

• A looping system automates what a type 1 diabetic otherwise does by hand. Withee's device takes the last 15 minutes or so of readings from her continuous glucose monitor, which reports every five minutes over Bluetooth, factors in recent food and insulin, predicts whether she will need more or less, and sets temporary rates on her insulin pump over the 400 or 900 MHz bands. She says it still needs occasional intervention but cuts a constant, mentally taxing workload of carb counting and dose correction down to a periodic glance at her phone.
• The open-source stack costs almost nothing beyond the device. She runs OpenAPS (github.com/openaps) on an Intel Edison, or alternatively a Raspberry Pi Zero, with an open-source Explorer board, running Debian Linux; LoopKit (github.com/loopkit) does the calculations on an iPhone through a RileyLink bridge but must be compiled and installed by the user. Nightscout collects the data on a free Heroku instance backed by a free MongoDB Atlas cluster; after three years she is still under the 500 MB limit. The glucose sensors and insulin pumps themselves are not open source.
• Withee trusts the code because of its research and its many eyes. She credits Dana Lewis with the original research, testing dosing algorithms against collected blood-sugar data, combined with others' reverse engineering of pumps and sensors; OpenAPS, LoopKit and AndroidAPS share much of the same technology. She says the repos are so actively maintained that she had to turn off notifications, and estimates at least 2,000 people run such systems.
• The FDA leaves self-built systems alone but not store apps. She says the FDA treats a do-it-yourself pancreas as a single-person experiment it does not regulate, but would have to review an app sold through the Play Store or App Store, a hurdle she thinks med tech companies avoided until the open-source community's success pushed them to build closed systems. Tidepool Loop, a non-profit bridging open-source software and closed-source devices, filed with the FDA in May of the previous year and, last she heard, was still pending.
• She argues hacking the device would cost far more than it gains. An attacker would have to find and break into her phone's hotspot, then the device's Linux, and the pump beeps at every message and doses slowly through thin tubing, so alarms would let her correct a low; altering Nightscout values would be overwritten by new readings. Giard adds the principle that a breach should cost more than it is worth.

2021-07-02 · open the original ↗

• Firebase is a whole app platform, not just a database. Dowden runs Andromeda, which builds its own and clients' products mostly on Firebase. It covers database, serverless functions, analytics, crash reporting, ads and A/B testing, under one SDK and one web console. His team adopted it for a database that needed no servers, since operations was not a skill the team had, and they used more of it as the platform grew. Their parking-management app has run on it for about six years.
• Firebase offers two databases, and Firestore suits real-time apps at scale. The original Realtime Database is a pure JSON store read by path, and it can import and export JSON files at any location. Firestore is a document database of collections and sub-collections, and collections with the same name can be queried as one group. He says Firestore supports up to 1 million concurrent listeners and pushes changes to all of them within milliseconds over a WebSocket SDK, so a live page needs no extra code.
• Cloud Functions' strength is event triggers, not HTTP endpoints. Functions created in Firebase also appear in Google Cloud Platform, where more customization is available. He writes them in TypeScript; Firebase supports Node.js with TypeScript or JavaScript. Triggers include database changes, file uploads, new users, schedules and Pub/Sub topics, and Google scales instances out under load.
• Its operational tools are mobile-first, and web has nearly caught up. Analytics is Google Analytics underneath. Crashlytics is mobile-only, so his team uses TrackJS for web crash reporting. Cloud Messaging (FCM) handles push notifications, AdMob serves ads, and Remote Config acts as segmentable feature flags that combine with A/B testing.
• He recommends starting with Firebase static hosting. He calls it "ridiculously fast": firebase deploy publishes atomically with no downtime, versions automatically, and allows one-click rollback in the console. It adds a CDN and HTTPS certificates, and the free plan covers a lot of traffic. He uses it instead of GitHub hosting. For server-side rendering such as Angular Universal, the CLI can deploy to a cloud function instead. To learn, he points to the docs at firebase.google.com/docs and Firebase's YouTube series.

2021-06-24 · open the original ↗

• SonarQube combines a server, a code scanner and an IDE linter. Bauman, a few months into using it, describes the SonarQube server that receives scans, SonarScanner that analyses the code base, and SonarLint, a free IDE extension (he uses it in Visual Studio) that flags code smells and security vulnerabilities as you type and links to a plain-English explanation, such as socket exhaustion from an HttpClient held as a singleton in .NET. The server can be bought as a hosted service or self-hosted on an Azure or AWS VM, supports over 25 languages (the host later checks: 27, including COBOL), and SonarLint can run in a connected mode that pulls the team's own rules from it.
• Quality gates let a tech lead decide what code gets in. The default rules are rigid and follow each language's governing body, linking to Microsoft docs for C# and to PEPs for Python; a lead can set thresholds such as the number of code smells allowed per commit, or tolerate old code's faults while holding new code clean. Repositories and new commits get A–F grades, which Bauman says has helped on a mixed client team where some developers come from Java and bring its casing conventions.
• A failed Sonar scan fails the pipeline and blocks the merge. His Azure DevOps pipeline runs build, unit tests and a Sonar scan on each pull request, with SonarScanner run as a CLI in a bash task and flags used to, for example, skip JavaScript files. By default the scanner passes and the repository's health simply declines; it only fails the pipeline if told to wait on the quality gate.
• The free Community edition breaks down on larger teams. The team uses Community, which covers CI integration, bugs and vulnerabilities but only the main branch and a subset of languages; Developer edition adds multi-branch and pull-request analysis. The drawback he has hit is that the dashboard shows only the most recent scan, so a teammate's run hides why your own pipeline failed; he advises starting on Community and upgrading later.
• Teams need some automated quality gate, not necessarily SonarQube. Bauman's take-home is that larger teams should put a barrier between the programmer and the code base to validate quality. He says it could equally be StyleCop or a GitHub Super-Linter if the connected server isn't wanted.

2021-06-18 · open the original ↗

• A shebang line turns a script into an executable-like tool. Shobokshi says a #! line naming the interpreter at the top of a file means it no longer has to be run through the bash keyword or carry a .sh extension, so a file called foo can be invoked like any executable; he uses this for small helper utilities and calls one of the shebang forms more portable than the others.
• Split long scripts into files and source them as libraries. His team's install script for a custom framework grew to 3,000 lines as it had to behave differently per cloud and work stream, and he now breaks even small scripts into files pulled in with the source keyword so the pieces can be reused. He points to Gruntwork's bash-commons and to an argument-parsing library of his own on GitHub (the captions render it as "sh arg"), written because parsing input is something he and others look up every time.
• Bash scripts deserve unit tests too, and ShellSpec makes that workable. ShellSpec is a BDD-style framework with a Gherkin-like DSL that exercises real bash, supports setup and teardown, and can mock bash functions. He mocks a function that fetches an API token so tests use a fake value, and says the tests have found edge cases in the team's more advanced scripts.
• Structure scripts as functions, with main invoked at the bottom. Shobokshi says this makes scripts easier to test and read than a flat list of commands. The catch is that return only gives back an integer status code, so strings are returned by echoing them inside the function and capturing the output into a variable at the call site.
• Turn on set -e and set -u in every script. With -e the script stops when a subcommand such as Terraform exits non-zero, where bash would otherwise carry on; he allows there are edge cases where that isn't wanted. With -u an undeclared variable, typically a typo that bash would silently create, causes an exit; the host likens it to Visual Basic's Option Explicit.

2021-06-08 · open the original ↗

• Scherotter coaches technologists who want creativity in their work. Trained as an architect at the University of Arizona before a software career, he began mentoring informally, partly through Microsoft programs, and this year put up techcreativecoaching.com, a WordPress site whose only cost was the domain. He coaches people in India, Ireland and Africa from his home office, does not charge, and is exploring it as a future possibility while staying at Microsoft.
• Creativity is a muscle he exercises by keeping sketchbooks. He has filled leather-bound journals for 30 years with drawings, paintings and anything flat, and says this "paintbrush creativity" keeps him in shape for solving problems creatively as a program manager. Much of that is spotting metaphors, since in his view few problems are absolutely new.
• A career is a series of jobs converging on what you love. He frames a tech career on three axes: the technology (blockchain, machine learning, creative tools), the type of work (coding, UI design, program management, testing) and the domain (financial services, public sector, his own media and communications). Each job should bring what you are good at and what you like closer together, and he says early-career people get frustrated expecting to have all of it at once.
• Show your creativity openly, in a way that is authentically yours. He tells people to use their own imagery in presentations instead of stock photos or clip art, and points to the 3D printer behind him, which he actually builds with. Most people keep it hidden for fear of critique, which he counts as part of growth: without feedback it is "just a little art project on the side."
• He gets new ideas by combining things not combined before. When the pandemic stopped his travel and his journaling stalled, he flew Microsoft's new Flight Simulator to New York, Sydney Harbour, Giza and San Francisco, paused it and painted the scene, which he calls virtual flight sketching. On a freelance project he built a virtual gallery of Hebru Brantley's work, called Solus, in Babylon.js for an auction house show in Hong Kong, adding the navigation and interactivity to a supplied model over a couple of weeks.

2021-06-02 · open the original ↗

• Abilities are mostly built by practice, not fixed at birth. Rosenbaum, now a senior manager at Red Hat, explains Carol Dweck's growth mindset against the fixed mindset that treats capability as inborn, and says Microsoft adopted it under Satya Nadella because he saw learning as the key skill for people and organizations. She read Dweck's book Mindset at about 30, wishes she had at 13, and gives an unsponsored talk on it because technologists have to learn every day and that is a struggle under a fixed mindset.
• Labels and "you're so smart" praise create fixed mindsets. She cites a study in which teachers told that randomly chosen students were superstars got superstar results, and Dweck's study (on four-year-olds, she thinks) where children praised as smart rather than hardworking gave up on hard puzzles, lied about their scores and then did worse on easy ones. She recognises herself: praised as smart, she could solve any "problem" but froze at a "riddle", skated through high school, and was miserable studying computer science in college while a friend simply reread and asked for help until he understood.
• The payoff is a better life experience, not necessarily more achievement. Her route is to read the book, then talk yourself through each hard problem that seems to prove you aren't smart enough; she says it takes a couple of years and rests on research, not just her say-so. She likens it to cognitive behavioural therapy's graded exposure, after Giard describes building public speaking as a muscle.
• Talent exists but is overrated, and practice works best with feedback. Answering Giard's Serenity Prayer question, she grants that a short person probably won't make it in basketball, but says most people quit after a week or a month, many prodigies fail when they reach a hard problem, and Michael Jordan is remembered as gifted rather than as the most practised player. Practice helps most in "kind" domains with feedback, like public speaking, and least in "wicked" ones, like a doctor who never learns whether a prescription worked.
• Growth mindset may free women and minorities from internalized stereotypes. She cites findings that reminding women of their gender before a math test lowers their scores while reminding Asian students raises theirs, and argues that not being defined by what you were born with also means not being defined by gender. She flags that research here is thin and calls it her opinion, adding that it does not replace fixing stereotypes or investing in diversity.

2021-05-25 · open the original ↗

• Microsoft went from refusing contributions to embracing GitHub. Wilcox recalls the Silverlight Toolkit on CodePlex publishing its code but accepting no pull requests, and the Azure SDK team needing executive approval to be among the first teams to take contributions on GitHub; he puts Microsoft employees on GitHub today at over 30,000. He credits the cloud's interoperability (Linux or Windows containers, Redis run locally, on AWS or Azure) and engineers' wish to use what everyone else uses, such as React and Kubernetes.
• Every Microsoft build automatically inventories its open-source components. Wilcox, who works in Microsoft's Open Source Programs Office (OSPO), says a Node project with 800 npm dependencies gets recorded at build time, so the company can later trace which builds used a given version when a vulnerability surfaces. The same record checks license compliance and raises alerts where a license carries obligations such as publishing source code.
• Microsoft releases under MIT and accepts obligations from others' licenses. Wilcox says the company is fine using almost any license provided it meets the requirements, citing the large body of source it must publish for the Edge browser. He notes it is often the same lawyers as five years earlier who have since changed their stance and reduced the burden.
• A network of "open source champs" scales the small OSPO team. Wilcox says champions sit in organizations across the company so that, for example, someone on Windows has a nearby person who has done it before; his team otherwise acts as "highly paid network routers". Much of the job is reassuring teams that they may start a project in the open before it is polished.
• Engineers are being encouraged to contribute back, including outside Microsoft. Wilcox says recent hires treat fixing a bug or docs via pull request as second nature, while older staff were unsure whether they needed approval. He says contributing to, say, a Linux Foundation or Google project is easy, and that Microsoft also sometimes sponsors outside projects financially.

2021-05-22 · open the original ↗

• "Mindful AI" is preferable to "ethical AI". Sampson, an adjunct professor at DePaul University, says ethics is loaded and contextual, so stamping one group's ethics on a universal technology is a problem; mindful means being deliberate in designing machine-learning products. She uses design as a verb, after Victor Papanek's "purposeful application of meaning and order to chaos", which implies action and responsibility.
• AI should be designed as human-machine symbiosis, not human replacement. Sampson draws on J.C.R. Licklider's "Man-Computer Symbiosis" paper and treats AI as a design tool rather than a technology foisted on people. She argues the 1956 Dartmouth founders made AI more rational than humans will ever be, so a self-driving car would only beat human drivers if there were no humans around, and that automation bias means people trust a machine that is right nine times in ten.
• Released models keep learning from people their builders never chose. Sampson tells students their model is not trained only by them once it is out, which she says is what happened to the Microsoft chatbot the host raised, racist within 24 hours. She cites an IDEO principle of listening for unintended consequences and says good data scientists iterate on models rather than setting and forgetting them.
• Bias enters through what data is collected, used and ignored. Sampson's examples are a zip code classified as a low-income neighbourhood, car facial recognition she says was trained on Stanford students and misses darker skin, and Kodak's "Shirley cards", a white model's image used for colour balancing that she says still shapes sensors such as automatic faucets. She argues mindful AI starts in model making, with diverse people asking about training data and preferring an interpretable regression to an unauditable neural network.
• Facial recognition and predictive policing are risky AI use cases. Sampson says unless everyone was in the training data the software will make mistakes, citing a Detroit man suing the Detroit police department. She describes Chicago's "strategic subjects list", which she says flagged people such as Robert McDaniel through their social networks without any crime, was released only after people sued, and was disproportionately Black and Latino.

2021-05-11 · open the original ↗

• Synapse is an umbrella over three processing engines. Cochran describes dedicated SQL pools (the former Azure SQL Data Warehouse), serverless SQL and Spark, all sharing one data lake. The dedicated pool is a massively parallel system of 60 SQL Servers behind a controller node; version one (around 2014–2015) supported only clustered columnstore indexes, and version two's clustered indexes enabled the row-level joins his work needs.
• Three-year reserved pricing cuts dedicated-pool cost to about a third. Cochran's firm runs production at 500 DWUs, roughly $5,000 a month, against a top end of 30,000; he would not recommend 100 and says around 300 performs decently. He says the commitment breaks even after the first year, so even 18 months to two years of use saves money.
• Serverless SQL queries data-lake files directly, paying only per query. Cochran can drop a customer's CSV into Azure Data Lake Storage, right-click and query it with no loading, ETL or schema, and says two new Synapse environments took about 45 minutes to set up. His firm writes large data sets out as Parquet and puts views over the OPENROWSET syntax so analysts see ordinary tables.
• Spark notebooks mix Python, Scala, SQL and C# cell by cell. R was not supported at recording, which Cochran expects to change. He says PySpark is the default but everything executes as Scala at runtime, that pools autoscale between set minimum and maximum nodes on consumption pricing, and that each pool can carry its own PyPI libraries; serverless SQL can query Spark tables.
• Cochran predicts Synapse will replace Databricks in Azure. He cites built-in Azure Data Factory pipelines, native Power BI connectors and Azure Purview for governance. He says Data Factory lets him, often the only data engineer at Causeway Solutions, a New Orleans analytics firm holding data on every US adult, automate an outsized amount of work.

2021-05-05 · open the original ↗

• Cheap cloud analytics turned manufacturers' old data collection into IoT. Diaz, on Microsoft's IoT global black belt team for about five years, says manufacturers long fed plant data into historians but found it too expensive to use; now almost every manufacturer he talks to has an IoT initiative. He cites a Microsoft investment of $5 billion over five years and Azure Digital Twins, newly GA, for modelling a factory, building or vehicle digitally.
• Latency and bandwidth push AI decisions to the edge. Diaz says about 70% of IoT deployments will include AI at the edge within a couple of years, a forecast. A drill that must stop on a reading cannot wait for a cloud round trip, and video for people counting or licence plates is too costly to send up.
• IoT Edge runs Docker containers deployed to fleets from the cloud. Diaz says devices can be provisioned zero-touch with the Device Provisioning Service, then a manifest pushes modules to one device, a subset or the whole fleet. A teammate is automating the retrain-and-redeploy loop so a new model reaches the edge about monthly without hands-on work.
• Azure Percept bundles reference hardware with low-code model deployment. Diaz describes a dev kit built by Asus to Microsoft's reference design, with a camera and optional microphone array, running IoT Edge, plus Percept Studio for prebuilt models or custom TensorFlow or ONNX ones. In his demo a model swap was just a zip delivered via the module twin, and he notes camera angle and zoom matter; Percept was not offered under "create a resource" in the portal and had to be reached from the docs.
• Percept's voice side reuses Microsoft's existing speech services. Diaz shows command sets for inventory and hotel use woken by the keyword "assistant", aimed at uses like a hospital patient calling a nurse, though his demo did not display the response. He values that Percept builds on IoT Edge and Cognitive Services rather than reinventing them, and says his pre-sales team engages at no charge through a company's Microsoft account team.

2021-04-25 · open the original ↗

• Founders should invest in a product manager, not lean on developers. Walker, director of product delivery at the agency Kin + Carta, says cost-conscious founders treat their tech leads as a substitute for good product work, requirements and validated assumptions; she wants someone who knows tech but is not coding, as the voice of the product.
• Overloading a product with features hurts it. She describes founders adding features on the word of one person met at a conference; too many features confuse users and pull money from the core problem, so she advises shipping the one thing that solves it, watching the reaction and building from there.
• Founders skip user research, believing they already know their users. Walker says founders are often on the right track but blindsided by what users actually say, and that users tell founders what they want to hear; she recommends combining surveys, A/B testing and beta-tester interviews, run by a neutral party, and validating again after release.
• Agency rescues often start with core functionality that doesn't work. When her firm takes over a product built without upfront product or research investment, she says it is typically feature-heavy and architecturally weak, and users report that "half of the functionality doesn't work", so the first job is fixing the core and re-releasing.
• Walker thinks the best time to start is now. Asked in early 2021, coming out of the pandemic, she says it is probably easier than two years earlier because people are open to new ideas, though she notes she is not an economist; even a simple web form can start validating an idea. On marketing she disclaims expertise and suggests leaning on the community the product serves.

2021-04-21 · open the original ↗

• Titletown Tech uses Microsoft philanthropy to build Green Bay startups. Adamczyk, Microsoft's technologist-in-residence there, says it was co-founded about a year and a half earlier with the Green Bay Packers under Microsoft's TechSpark initiative, which works in six mostly rural or mid-sized US communities. It pairs a studio taking early-stage founders from proof of concept to MVP with a venture fund for mostly Wisconsin companies.
• The fund is for-profit, though Microsoft recycles its returns. He says the $25 million fund came $5 million from Microsoft, $5 million from the Packers and $15 million from mostly local corporates, as capital for equity; Microsoft has pledged to roll its returns back into philanthropic work. The other investors are deliberately corporates so startups can tap their market networks.
• Its "connected capital" model pairs money with mentorship and connections. Adamczyk describes a "one-size-fits-one" approach with about two dozen companies, no cohorts and weekly investment decisions. Jason Zander, EVP of Azure, serves as chief technology advisor, and Brad Smith is executive sponsor.
• Startups that arrive on rival clouds have nearly all moved to Azure. He says Titletown Tech imposes no platform restrictions, but almost every company that came in on a competing cloud chose to build on Microsoft products because of the mentoring and resources; he describes this as "somewhat unintentional".
• Equity League invests in minority-led and social-impact startups. Launched in December, it joins the Packers, Bucks, Brewers and Microsoft and is housed under Titletown Tech as a sixth investment arm; Adamczyk ties it to the summer's racial-justice protests, including the shooting of Jacob Blake in Kenosha. At recording it was two months old, and he frames it as a long-term programmatic structure rather than a one-off check.

2021-04-15 · open the original ↗

• Security design should start from empathy for the people using it. Goerlich, who is writing a blog series drawing security principles from classic designers, cites the mouse: Xerox's cost about $2,000 in today's dollars with weekly engineering upkeep, while Apple's iterated design came to about $70 and, per Steve Jobs, 16 minutes to learn. He applied this to a privileged access management setup that took about 18 steps before anything could run: his team watched the engineers', DevOps and IT staff's workflow, cut the steps, and issued a gaming laptop as the privileged access workstation to make it attractive.
• Ship ugly early iterations instead of waterfall-perfect security specs. Goerlich says security programs over-engineer because practitioners are passionate about getting it right, illustrated by a "delete data" control that escalates to purging memory and degaussing disks. "Minimum viable security" means naming the exact controls needed; his example is his friend Mark Tilden's walking robot, buildable for about $100 from recycled parts, against MIT robots costing the price of a car.
• Name projects so they tell a story people want to join. He says a program called after a vendor product "doesn't go very well"; his own "Outsource Boring" project, which challenged his team to hand off work they disliked to partners, sold better than a "vendor assessment and review process" would have.
• Be prepared to get lucky when circumstances change. Goerlich's example is an acquaintance running a secure-development program whose team moved to GitHub, which he had not heard of; by asking the team lead and then a GitHub expert, he found about a quarter of the controls he expected to buy, build or enforce were already in the product.
• Make security an inside job through paired champions and advocates. In his terms a champion sits in the business and cares about security, and an advocate sits in the security organization and helps that business unit; he wants both in place and working together to cut steps and decision points, as with an operations-side advocate he worked with in financial services.

2021-04-07 · open the original ↗

• Ordinary developers can now solve AI problems with a REST call. Renze says pretrained cloud services from Microsoft, Amazon and Google do the model training for you, so tasks that look like they need a data science team take a few lines of code. His Pluralsight course, the AI Developer's Toolkit, runs from tables through text, audio, images, video and apps to cyber-physical systems; he guesses about 80% of its examples will be new to most developers.
• Analysis reduces complex data while synthesis expands simple input. He defines analysis as turning an image into a label like "cat", and synthesis as the inverse, such as a generative adversarial network drawing a cat from a sentence. Cloud APIs are further along on analysis, which he says is more solved and has more business cases; synthesis needs more compute and has more edge cases.
• Renze already uses a model of his own voice in courses. He says he edits his script and has the model speak a corrected word, and he could not tell the difference; he plans to move to Microsoft's custom voice synthesis in Azure. He predicts near-photorealistic text-to-image within about a year.
• Harder problems combine models in parallel or stacked. Examples include pairing face and voice recognition to identify a speaker, or running object detection and then classifying each bounding box. Between cloud and custom builds he describes transfer learning, such as fine-tuning a stock image classifier to spot a company logo.
• Cyber-physical systems learn in the cloud and act at the edge. He says machines run their decision loop locally to avoid latency while a fleet sends decisions and outcomes up for retraining and receives new models. He predicts human referees will become largely unnecessary within a few years, and that within 10 years no human will drive better than the best AI.

2021-04-03 · open the original ↗

• Professional development should be paid work, not a hobby. Neward contrasts doctors, for whom reading journals and training the next generation is part of the job, with tech's expectation of side projects on GitHub. When Quicken Loans CIO Brian Woodring asked what would happen if he paid Neward to do the mentoring and interviewing work he was already drifting into, a Technology Culture team was formed in March, focused on the "people" of people, process and technology.
• The canonical whiteboard interview tests the wrong thing under pressure. Neward argues only a single-digit percentage of developers need to write algorithms like a red-black tree, and the whiteboard strips away tools such as Stack Overflow. He cites a study Microsoft took part in, with what he thinks was the University of North Carolina, where leaving the candidate alone in the room raised success from 50% to 100%; his team is reworking interviews toward on-the-job work and away from unconscious bias, as part of the company's diversity and inclusion effort.
• Mentoring programs fizzle without someone dedicated to running them. Neward has hired a technology team leader to build one across the 2,000 people in Rocket Technology; its open questions include how mentees are found, whether the mentor has the skills sought, how much time is allowed (he contrasts a place happy with five one-hour mentees a week against one capping it at an hour), and coaching for pairs who do not know what to ask. It is to slot into the HR group's non-technical programs rather than duplicate them.
• A support team can clear important-but-not-urgent friction for developers. Neward credits internal support with getting laptops and hardware to all 30,000 people across Dan Gilbert's companies in about a week with no disruption, but says developer tools needing admin rights still take days or weeks. His team "greases the rails", such as talks with O'Reilly on Safari subscriptions, acting as a force multiplier against the tyranny of the urgent.
• Where a company spends time and energy shows what it values. Neward contrasts companies that say employees come first but fund no programs for them with Quicken Loans' "isms": 20 sayings from Dan Gilbert published as a glossy book and presented at twice-monthly, all-day "isms day" events. He challenges managers to check whether their team's time reflects stated priorities such as training or innovation, and to change it if not.

2021-03-25 · open the original ↗

• Customer identities belong in their own tenant, not the corporate directory. Hoerster, a Microsoft cloud solutions architect, describes Azure AD B2C as an Azure AD tenant with the enterprise features stripped out plus a hidden policy engine on top. That engine holds the configuration for sign-up, sign-in and profile editing: which attributes to collect, which claims to return, and conditional access such as forcing multifactor for users coming from unwelcome locations or a Tor browser.
• Claims carry customer attributes into the app's tokens. In his example, a sporting-goods retailer asks for a favourite sport at sign-up, stores it in the B2C tenant, and returns it in the identity or access token alongside the name, so other parts of the site can offer specials or coupons only to, say, baseball fans.
• Scale is no longer the problem; dead accounts need housekeeping. Giard recalls that early Azure AD did not scale for consumer workloads; Hoerster says B2C now handles millions or billions of users without issue. Pruning is not built in: he suggests a simple job against the Microsoft Graph API that queries a last-login attribute, disables accounts after about two years of inactivity, and deletes them perhaps a year later if nobody complains.
• Legacy logins can migrate without users noticing. One of the two engagement patterns he sees most is moving one or more legacy authentication systems into B2C via "seamless migration": custom policies authenticate the user against the old system first and, if that succeeds, copy the account into B2C, with no new account or password reset; he points to examples in the B2C docs.
• Affiliates managing their own users need delegated user management. For the second pattern, he suggests API Connectors, a feature he says released around October and still in public preview at recording, which let easily configured user flows call a REST API, for instance a delegation service that sets claims tying a user to one affiliate so they see only that affiliate's users.

2021-03-17 · open the original ↗

• Containers scale faster than VMs but need an orchestrator. Farrell, who works on DevOps and Kubernetes at New Signature (since acquired by Cognizant), cites a Tinder engineering write-up: startup went from several minutes for VMs on AWS to under 30 seconds for containers, across about 48,000 containers, too many for people to manage. Kubernetes, an open-source CNCF project under the Linux Foundation that grew out of Google's Borg, has in his view become the de facto orchestrator over rivals such as Mesos.
• The orchestrator's core job is maintaining a declared desired state. If you declare eight instances and one dies, it notices and starts another; the horizontal pod autoscaler can scale on CPU between a floor and a ceiling (eight to 100 in his example). Because CPU misses work such as a long queue, he recommends KEDA, a Microsoft-created project that scales on Azure queue or Kafka topic depth. He believes autoscaling can also follow a schedule but said he would check.
• Deployment runs image, pod, service, then rolling deployment. An image pushed to a registry is a class and containers are its instances; a pod, roughly the Kubernetes equivalent of a VM, runs the containers; a service routes outside traffic to whichever pods exist, since their number is elastic. The deployment resource does rolling updates by default, e.g. replacing 80 pods 10 at a time to avoid downtime.
• Linux containers are far more mature than Windows ones. He puts the smallest Windows container at around 800 MB against about 20 MB for Linux, and says Windows has been in the space one to two years against Linux's five or six. He believes Kubernetes accepted Windows containers from version 1.16, mainly for .NET Framework apps; .NET Core typically ships on Linux.
• Learning Kubernetes in the cloud can get very expensive. He ranks Google's offering first and AKS close behind, with Amazon harder to work with, and warns AKS users to shut down the VM scale sets at day's end. After an Amazon re:Invent EKS lab, his "deleted" cluster self-healed and ran up a $20,000 bill, which Amazon waived; he suggests free single-node local clusters such as Minikube or MicroK8s, plus kubernetes.io and the cncf.io landscape of what he recalls as 200–300 projects.

2021-03-12 · open the original ↗

• Khan Academy is rewriting its back end one field at a time. Genisio, an engineering manager there, describes about a million lines of Python 2.7, which reached end of life and has no backward-compatible path to Python 3, being moved to Go across 27 services that he says are not microservices. They chose Go for type safety, after 10 years of breakage from dynamic typing, and for performance, which ruled out Python 3. The estimate was about 47 person-years; they are roughly halfway, with 41% of fields migrated.
• An Apollo Federation gateway moves each field through test stages. The API had been GraphQL since about 2016 and was about 70% of the way there, so the remaining REST-like endpoints were moved first. A decorator on each new field sets its stage. In "manual" a query parameter routes it to the new service for testing. In "side-by-side" the gateway calls both systems, compares the results and logs mismatches into a next-day report, without the client waiting. In "migrated" the new service serves it, and a configuration change reverts it. Then the Python is deleted. He also runs side-by-side locally to catch differences, such as an http-versus-https URL, before deploying.
• Matching production output counts as correct; unported rules are dead code. Where unit tests exist they port the tests, then the code. Side-by-side then compares real traffic from about 3 million users a day, so he reasons that a business rule not needed to match the output is dead, and a missed edge case would just be a bug. He says edge cases have not been the problem. The problems have been scaling the new architecture on the same Google App Engine infrastructure: a provided Redis caching layer that did not scale, 30-second latencies in the Node-based gateway, and App Engine's new platform APIs.
• The port adds no new behavior and keeps existing bugs. Their guidelines bar new behavior during the move. If the Python returns null where it should return an empty string, the Go does too, because clients may rely on it. New features are built in the new services, which can mean calling back to the monolith or waiting until a service is far enough along.
• A "minimal viable experience" sets the order; some features are dropped. This core of content delivery, user management, teacher tools and assignments covers what must exist if Google stopped running Python 2.7. It still covers 60–70% of the code base, and no team starts on P1 work until it is all done. Some features will not be ported: streaks, which a small group of users loved, are being sunset because Khan Academy's pedagogy does not want to encourage daily use.

2021-03-08 · open the original ↗

• AI can help adults recover the drawing ability they abandon as children. Ashley, an engineer and not a trained illustrator, says children give up drawing around ages seven to nine once perspective gets hard. His new book is a guide for anyone, not just data scientists, to using machine learning to improve their own drawing. He says he made its hundreds of illustrations himself with machine-learning help, and calls them a big step up from the basic drawings in his earlier book on machine learning in sports.
• Treat the model as a partner, usable at any stage. He says you can start from a spoken or typed prompt (his example: a cucumber in a pink outfit walking a dog), from a sketch, or bring AI into only the stage you like least, such as line art or coloring. He goes further and says some models now pass a visual Turing test, meaning a viewer cannot tell their pictures from a human's.
• Style transfer turned his line sketch into a painting. Drawing on research papers about separating a work's style from its content, he moved the style of Vermeer's Girl with a Pearl Earring onto his own sketch and says he touched up little beyond the eyes. The model was trained on anime and manga, which shows in the result. He says face models estimate the head's 3D orientation (the iris is about 11 mm across, and some Google models map 486 facial features), which lets the light source be moved after the fact.
• AI can take over the frame-by-frame labor of animation. In the 1930–1950 golden age at Disney, he says, a lead animator drew frames 1 and 96, about four seconds, and others drew the 94 in between. AI can now animate a character's speech and lip movement from a single image, which he says is useful to professional animators too.
• Zero-setup cloud notebooks keep the method open to non-programmers. Instead of asking readers to install a conda environment with PyTorch and Keras, the book uses cloud notebooks such as Colab that run from a link. He says his wife, a watercolorist, was doing style transfer within 10–15 minutes. On 5 February 2021 he said the book was about 80% done, on Kickstarter, and due in about two months.

2021-02-22 · open the original ↗

• Identity work splits into signing users in and running apps securely. Matskas, a PM on Microsoft Identity's developer advocacy team, says his team is DevRel in practice, teaching both through Twitch streams, podcasts, user groups and conferences.
• The Microsoft Identity Platform is an umbrella, not one product. He places Azure Active Directory at its core for organizational users and resources, and Azure AD B2C at the other end for external customers signing in with a username and password, social logins, or any OpenID Connect provider; B2B, easy auth for web apps, managed identities and service principals also sit under it.
• Getting started takes an app registration plus a library. Registering in Azure AD or B2C yields an application ID and tenant ID that the code uses, and Matskas says developers should not need to think about protocols or flows. Registration is fully API-driven, so teams without portal access can use the Graph API, PowerShell, the Azure CLI or their own wrappers.
• Standards compliance means developers can bring their own library. Because the platform follows OAuth 2 and OpenID Connect, he says an existing app, such as a Node.js app on Passport for three years, can just be pointed at Microsoft's endpoints. For new projects he recommends MSAL, which he says keeps reaching more languages, with a Go library in preview.
• Managed identities let apps run without secrets. Matskas says developers can drop connection strings and secrets from local development for resources like Azure SQL and storage, then move the same code to production unchanged, where managed identity works with the Azure SDKs and Graph.

2021-02-13 · open the original ↗

• EF Core is a from-scratch rewrite, not a renamed EF6. Lerman counts eight versions: EF 1, EF 4 (numbered to match .NET 4), EF5 and EF6, then EF Core 1, 2, 3 and 5, with 4 skipped to align with .NET 5. EF6 is kept alive with small fixes and pull requests because millions of applications use it, and EF Core 5 shipped in November alongside .NET 5 and ASP.NET Core 5.
• The team held back features until they could do them better. Lerman says easy many-to-many existed from the first Entity Framework through EF6, but EF Core left it out because the original had many limitations; it returns in EF Core 5 just as simple to use and with more capabilities. She says features were prioritised by how many people needed them, and EF Core 5 brings it "pretty close" to parity with EF6.
• Logging no longer needs heavy setup. Earlier EF Core extended .NET Core's logging API but took "a lot, a lot" of non-obvious configuration. Lerman says EF Core 5 adds a single LogTo method on the context, such as to the console with filters, while the more elaborate route is still there.
• The inheritance mapping some users badly needed has finally arrived. In Lerman's account of what EF Core 5 adds, the choice is between storing a derived class such as fish (from pet) in one shared table with many empty columns, or splitting common and derived data into separate tables. She swaps the names "table per type" and "table per hierarchy" as she explains, so the text does not settle which name goes with which layout.
• Read the GitHub issue to learn why a feature exists. She counts over 200 new features in EF Core 5, among them changing a DbContext's connection or connection string after it is initialised, which her domain-driven "one context, one database" habit would never call for. To find a use for such features, she goes to the GitHub issues linked from the docs and looks for someone saying "I need this because", then turns to blogs. Her position: knowing why to use a feature matters as much as knowing how.

2021-01-22 · open the original ↗

• Every Microsoft sale flows through one revenue recognition system. Taylor, about 10 months into a job at Microsoft, works on MS Sales, which handles direct and partner transactions, from Surface and Xbox hardware to online purchases. It has run for 20-plus years and has a 24-hour SLA to publish by midnight each day, and company budget and product-strategy decisions rest on its data. The $143 billion 2020 revenue figure is the host's, not Taylor's.
• The migration to Azure is "changing the engine while flying". SQL Server has been the core; part of the processing moved to HDInsight on Azure about six months before Taylor joined, and reporting moved from on-prem hardware to Azure. The on-prem data warehouse is the last piece and is being moved now, in short downtime windows with DNS, connectivity and configuration changes. After that the plan is more PaaS, Synapse, and real-time streaming in place of the daily batch.
• Azure infrastructure is built for each daily run and sized from history. Everything except the reporting platform is spun up for each daily delta run and torn down afterwards. The system sizes it from past volume for that day, day of week or time of month, because load depends on transaction count, not dollar size. Once a week a "restatement" reprocesses everything from the beginning of time, because business rules and revenue recognition rules change.
• Cloud developers can no longer leave infrastructure to IT. Taylor's team of roughly 80 to 100 developers writes the business rules and also the code that builds the infrastructure daily and tears it down, so some of them have had to learn servers, which they struggle with. He has little accounting background, since others own the rules, and he finds the infrastructure side natural because he started out as a network engineer.
• Cloud security is not harder, but on-prem assumptions no longer hold. Two servers in a data center might talk unencrypted because an attacker would have to get physically inside, but resources recreated daily on different underlying hardware cannot be trusted that way. So the team encrypts traffic and data at rest. He calls the cloud a "no-brainer" for most workloads, except where regulation rules it out.

2021-01-21 · open the original ↗

• gRPC is a contract-first remote procedure call system. Pilch, group engineering manager for .NET app frameworks, says messages and parameter types are described in a .proto file that defines the protobuf binary wire format, so a client and server in different stacks (.NET, C++, Go, Java, Rust, Node) interoperate by sharing that file. It came out of Google but the G officially stands for nothing; each release's notes name a new meaning. He likens it to WCF for long-time .NET developers.
• Its advantage over JSON web APIs is efficiency and an explicit contract. Binary serialization compacts messages, and HTTP/2 adds binary headers and bidirectional streaming that HTTP 1.1 lacks; with REST, he says, the schema is usually extracted from code afterwards with Swagger tooling such as Swashbuckle, whereas gRPC starts from a contract shared across stacks.
• Microsoft relies on standard open-source tooling for writing proto files. Visual Studio uses a TextMate grammar for coloring and indentation; the team's own work lets a project add a service reference to a proto file and generate the code. A server typically starts as an ASP.NET Core app with gRPC added as endpoints in startup, and he points to the docs at docs.microsoft.com/aspnet, much of it by James Newton-King of Newtonsoft.Json.
• .NET now has the second-fastest gRPC implementation, he says. Pilch cites his team's benchmarking as of the .NET 5 release: just behind Rust and ahead of Go, C++ and Java.
• gRPC always runs over HTTP, with a fallback for browsers. HTTP/2 is the default, but browsers expose no HTTP/2 APIs to JavaScript, so gRPC-Web downgrades it to run over HTTP 1.1. The host's question on whether HTTP/2 is still used between processes on the same machine gets no answer in the captions.

2021-01-20 · open the original ↗

• TechOlympics is a tech conference for high schoolers, run by high schoolers. Ackels, executive director of the Cincinnati nonprofit Inter Alliance, calls it the nation's largest such conference; she is its only adult employee, and 30 students handle everything from t-shirt design and procurement to the website and speaker recruiting. Normally about 500 students attend three days in person with an overnight hotel stay, for about 80 hours of content; this was its 11th year, she believes.
• The 2021 edition spreads that content virtually across all of February. She says students have had enough of Teams and Zoom, so the event runs in themed weeks, each opened by one of four keynotes, across tracks in art tech, software, cyber, and data and AI, plus career preparation such as GitHub, LinkedIn and resume training. Hands-on workshops rise from about 10 to between 20 and 25, and a hosted Minecraft server and chess competition stand in for the student lounge.
• Going virtual cut the price sharply, and sponsors cover the rest. It drops from the usual $200 to $40, or $10 a week, with generous scholarships on request, and the event is open beyond its usual 50 miles around CVG; a $5,000 Rotary grant paid for free registration for 125 city students. Sponsors include FIS (primary), Anthem Digital and Procter & Gamble, plus Microsoft prizes such as Surface Go raffles, and she says the money goes back to students: over $100 of materials each, including GE Aviation lockpicking kits and temporary Illustrator and Photoshop licences.
• The programs are a direct pipeline into local tech jobs. Inter Alliance places 50 to 75 paid technology interns every summer, internship job descriptions go to TechOlympics students before anyone else, and over 50 business partners have virtual exhibitor booths. About four of this year's sessions are led by alumni, including a Duke student on AI and an advanced GitHub class.
• Representation decides whether a student is interested or inspired. Ackels says having a presenter "who looks and sounds like you" makes that difference, so the group partners each fall on a women-in-technology conference that draws about 300 high school girls and has brought in a consultant to refresh its diversity and inclusion strategy. Her own route in: she was "voluntold" to mentor there from Kroger Technology after maternity leave, and eight years later runs it.

2021-01-14 · open the original ↗

• SignalR lets the server push changes instead of clients polling. Griffin describes it as a wrapper around WebSockets that notifies web pages, mobile, desktop or IoT clients when server state changes. He agrees with the host that it pays off most when data must be current but changes rarely, since most polls return nothing. Polling the database for deltas is the bottleneck he sees most often.
• Replacing a one-second page reload cut server CPU from 100% to under 1%. The client was a nonprofit that aggregates data from many 911 and emergency agencies into dashboards used mainly in firehouses around Ohio, and by scanner enthusiasts. Its ASP.NET Web Forms update panel reloaded a page of at least 1 MB every second for about 600 users. Griffin rebuilt it on full-framework ASP.NET SignalR, sending only deltas: new, updated or resolved incidents. Of about 200 dashboard configurations, each client gets only the updates for the ones it is viewing.
• Griffin says SignalR "can potentially save lives". A firefighter he works with told him of a crew that saw a cardiac-arrest call flash red on the new board and was already pulling out of the firehouse when the dispatcher radioed it. He puts the gap at roughly 20 to 30 seconds.
• Its best uses are small notifications, not big problems. On other client projects Griffin has built a real chat box, site-wide alerts and an administrator-announcement flag tracked per user and synced across all of a user's open tabs. He also pushes progress and errors for import jobs that take more than about 10 to 15 seconds, sent only to the users who care. These replace jQuery timers that hit the server for nothing.
• It is simple to set up and works with many kinds of clients. His demo takes under five minutes, plus TypeScript setup that is not required. Clients can be JavaScript, .NET console, WPF, Universal Windows, iOS or Android, with no server change for each type. Recording on 6 January 2021, he said his course at SignalRMastery.com would launch on 13 January and would walk through the 911 system's architecture.

2021-01-08 · open the original ↗

• WinForms on .NET Core is useless without its drag-and-drop designer. Campbell, an architect in .NET tooling, says WPF developers often write XAML by hand and use the designer as a preview, but WinForms culture is built on the designer; WinForms was ported to .NET Core 3 and the designer, which works in Visual Studio today, has been brought online gradually.
• The designer builds a live, uncompiled form from InitializeComponent. It creates the form's base type, then turns the InitializeComponent code into a CodeDOM model and deserializes that again into real objects through reflection. What the user sees is a real form under a transparent window, the "sneeze guard", that captures clicks for dragging and dropping.
• The designer must run out of process on the target .NET. Visual Studio runs on .NET Framework, so objects created there would miss new .NET Core APIs; the form is created in a separate .NET Core process and its window parented into Visual Studio across processes, which he says invites deadlocks. The team is also making APIs that were synchronous since .NET 1.0 asynchronous, anticipating a possible network boundary with something like GitHub Codespaces.
• Data tooling and third-party controls are the unfinished parts. The data sources window, which loads assemblies and creates instances by reflection, does not work yet, so setting up data binding through it does not either. Control vendors face significant breaking designer API changes: modal editing dialogs must live in Visual Studio while their UI logic runs in the other process, which for Campbell meant refactoring thousands of lines out of click handlers in Microsoft's own dialogs.
• WinForms persists through skill sets, legacy code and sheer ease. Campbell cites about eight years as the only .NET desktop framework before .NET Framework 3 around 2006–2007, its simplicity for quick tools, and XAML being a "mind flip" few even at Microsoft knew. He says Microsoft has built four or five UI frameworks on .NET since he joined, about 14 years ago from DevExpress, while WinForms stayed the fallback shipped with Windows. The host says control vendors tell him they still sell far more WinForms controls than controls for other platforms.

2021-01-05 · open the original ↗

• GitHub Actions is an alternative to Azure DevOps pipelines, tied to GitHub. Benkovich, a consultant who helps clients move applications to Azure, says both script build, test, packaging and deployment steps in YAML; Azure DevOps pipelines can work with code in Bitbucket, GitHub, Team Foundation and elsewhere, while GitHub Actions requires the code to be in GitHub.
• Right-click publish works but is not repeatable. Clicking through the publish dialog, which the host notes has been in Visual Studio for about 10 years, is hard to repeat or hand off. A preview setting in Visual Studio 16.8 or later, "GitHub Actions support in publish", lets the same publish wizard generate a GitHub Actions workflow instead, so every commit to the chosen branch triggers the deployment.
• The generated workflow deploys without the developer writing YAML. In his demo the wizard downloaded the Azure publish profile, stored its credentials as a secret in the GitHub repository, and created an editable workflow file in the repo; after a commit, the build and deploy to Azure ran in about a minute. His point is that "I don't have to be a DevOps engineer to do this"; the feature works only with GitHub today, and he speculates it may someday come to Azure DevOps pipelines.
• The generated workflow can be extended with marketplace actions. He added a third-party replace-tokens step before the build that injects GitHub variables such as run ID, run number and commit SHA into a CSHTML page, and uses the same idea to stamp dates and versions on his documentation. Visual Studio's editor does not connect to the actions marketplace, but editing the workflow file on GitHub offers IntelliSense over marketplace actions.

2021-01-01 · open the original ↗

• .NET Conf exists to hand the community a microphone. Lozano, its executive producer, says it shows .NET through both the product team and the community, and 2020 was its 10th year. It began in 2010 as MVC Conf, became ASP Conf, and was renamed .NET Conf three or four years in at Scott Hunter's suggestion. Day one is product team from 9 to 5 Pacific. From 5 p.m. Pacific on day two, community speakers run around the clock for 24 hours, with hosts taking shifts near each region's time zone; 2020 drew many speakers from Africa and Asia.
• They ran a virtual conference a decade before 2020 made it normal. In 2010 it ran live on Live Meeting, whose rooms were capped at about 1,400 people, a cap they exceeded during a Hanselman keynote. Bandwidth was the main problem until two or three years ago, so speakers also recorded locally with Camtasia, and some sessions, such as one from a speaker in China, were pre-recorded.
• Browser-only streaming makes presenting virtually as easy as on stage. For 2020 Channel 9 produced the event on StreamYard, which uses WebRTC in the browser and needs nothing installed, and restreamed it to YouTube, Channel 9 and other feeds. Lozano's reason is that developers are finicky about installing software, and asking them to configure a tool like OBS raises the bar to present far above plugging into a projector.
• A keynote crashed an under-scaled host, prompting a move to Azure. During a Scott Guthrie keynote, the third-party server hosting the event's web page with the embedded Channel 9 player buckled under the load and returned 503s. It took about 15 minutes to fix with more RAM and a reboot. People already watching kept the stream, but nobody new could get in, and the event moved to Azure the following year.
• Presenters' failures should be met with kindness and preparation. Lozano tells speakers that errors happen and their content can be collected later, because the schedule cannot wait for a fix. After a chaotic 2019, he booked 15-minute tech checks back-to-back on two days, from 7 a.m. to 6 p.m. Central, two to two and a half weeks before the event, plus a day for stragglers, and did 65 of them. He says the conference takes first-time presenters and works with them.

2020-12-23 · open the original ↗

• Unit tests should replace hot-reload checking in Blazor. Charbeneau, a Progress Software developer advocate for Telerik UI for Blazor, calls the design-time loop Blazor's weak point: because the app must recompile, saving a change reloads the whole browser tab rather than re-rendering just the edited component as JavaScript hot reloading can. Developers who check their work by eye in the browser are doing manual tests that are never saved; unit tests give the same fast iteration and also remain as regression tests for the life of the application.
• bUnit tests rendered components by comparing HTML semantically, not as strings. He says whitespace or class attributes in a different order do not fail a test, and the library has helpers for button clicks and for checking single attributes, such as that accessibility attributes are present. The tests run without loading the app in a browser. bUnit covers the UI only, and it can also test several components together, such as cascading dropdowns with a mock behind them.
• The whole test suite can be C#, written in one style. Back-end and shared logic go in xUnit or NUnit, components go in bUnit, and services can be mocked with JustMock, a Progress product with a free option, so no HTTP calls hit a real back end. He contrasts this with Angular or React, where validation written in a C# API is rewritten in JavaScript and tested in TypeScript under Jest and its configuration files.
• bUnit does not remove the need for end-to-end tests. He names Selenium and his employer's Telerik Test Studio, whose recorder lets a QA tester point and click to build functional tests in C#, then run them on Edge, Chrome and Firefox, with screenshot comparison, OCR of rendered PDFs and responsive-design checks. Such tests are slow, so he places them before a release, and xUnit and bUnit during coding; with all three tiers he calls an application "pretty much bulletproof".

2020-12-18 · open the original ↗

• Hand-drawn slides revived his speaking when he felt ineffective. Neal says that around 2015 he was burnt out and thought about taking a year off, because audiences were kind but did not seem to act on his talks. A YouTube talk at Google by Dan Roam, author of Show and Tell, on simple stick-figure illustration led him to draw slides for a new Kanban talk at Orlando Code Camp with a cheap stylus and an old iPad. He says he knew within minutes that it was a game changer: the audience was more engaged.
• Drawing a slide fixes what he will say, so he needs no notes. He likens it to handwritten school notes that bring back more detail than they contain: while drawing he thinks through his points, and when the slide comes up he recalls them, so he uses no bullet points. His workflow is to export each drawing as a transparent PNG onto a plain white PowerPoint slide, mostly in black and white for the best contrast on an unknown projector.
• The drawing app mattered more than the hardware. He uses an iPad Pro and Apple Pencil, though he says any recent iPad now works, with Sketches Pro for slides (its pens improve his poor handwriting) and Procreate, which has a steeper learning curve, for avatars, stickers and swag. He used a Surface Pro for three or four months and found the pen good but the Windows drawing apps far behind at the time; today he would pick Adobe Fresco or Concepts.
• Practice, not natural talent, is what builds the skill. Neal is self-taught and draws 10 to 20 minutes almost daily, as writers write every day, and says his style emerged over time rather than by design. He studies drawings he likes the way a developer reverse-engineers an app, by asking how he would reproduce them with his own techniques. He tells anyone starting a craft that with patience and practice they will be surprised by their progress in six months or a year.
• A pretend Twitter sale turned drawing into a paid side business. Around Christmas 2017 he offered avatars for $20 or $25 as if he normally charged $30 to $40, though no one had paid him before. He was filling orders into early February and refunded some unhappy buyers, and the proceeds bought him a new iPad. Since then he has drawn stickers, t-shirt designs and conference artwork, including work for Connect.Tech in Atlanta used across its venues.

2020-12-14 · open the original ↗

• Data engineering is a new role still being formally defined. Bunting defines it as moving data from disparate sources into a common store, in Azure usually a data lake, then cleaning, transforming and joining it so data scientists and analysts can use it. Hulen says it takes over much of the database administrator's data work, and that he went through a job task analysis with Microsoft the month before to define the role for new training and certification. He grounds the demand in his figures that 90% of today's data is unstructured and 90% of the world's data was accumulated in the last two years, and in the "four Vs": volume, variety, velocity and veracity.
• Synapse Analytics is more than a bundle of existing Azure tools. Hulen describes it as one web-based workspace for data engineers, scientists and analysts. It combines dedicated SQL pools (the successor to Azure Data Warehouse), serverless Spark pools, serverless SQL pools that extend PolyBase from SQL Server 2016, Synapse pipelines built on Azure Data Factory's code, and Power BI. When the host suggests it is a repackaging, Bunting says the tight integration makes it a new product: he can query lake files in T-SQL without a database, and use a dedicated pool for heavy reporting, which can be paused because compute is separate from storage.
• Synapse Link gives analytics on Cosmos DB without spending its resource units. Hulen says heavy analytical queries against Cosmos DB's transactional store can be prohibitively expensive. With Synapse Link, a hidden columnar analytical store in Parquet format is kept automatically, replacing the manual change-feed-to-data-lake approach, and can be queried from Spark or T-SQL. He says this is available only with Synapse.
• Versioning data means keeping a copy of every enrichment stage. Bunting says they almost never work against the source system: they copy raw data into the lake in a format close to the source (XML, CSV, JSON), then write each transformation to its own folder level, with file- and folder-level permissions to keep users out of the raw data. Hulen adds that Synapse Studio had just gained Git integration, which he noticed the week before, so pipelines, notebooks and SQL files can be committed and branched as JSON or YAML artifacts.
• Data engineers should stop using SQL for everything. Hulen says Python and SQL are the main languages, and that Python's open-source libraries can do in one or two lines what takes dozens in SQL; the guests' firm, Solliance, develops Synapse training for Microsoft and stresses this mindset shift. Bunting points to C# in Synapse's Jupyter notebooks for .NET developers, and to notebooks being pre-connected to the data lake, where Databricks needs account keys and configuration first.

2020-12-03 · open the original ↗

• Students get the problems a company would give a new hire. Cooper, who has worked at the Illinois Science and Technology Institute (ISTI) for over six years, says companies in its STEM Challenge, run since the 2013–14 academic year, are asked what a project team hired tomorrow would work on, not what would be fun for students. This year 13 companies across Illinois are each paired with up to four high schools: 20 schools (usually 18 to 25) and about 900 students. Over a semester, company mentors work with students each week on an open, interdisciplinary problem with no right answer, using design thinking, which she says builds communication, teamwork and deadline skills.
• The program values process over product, so mentors flag unworkable ideas. Problems this year include reusing coal ash for an energy company near East St. Louis, medication adherence, safer sensor-equipped construction sites, and challenges from Northrop Grumman and the new partner John Deere. She says students tend to jump to apps, but one team working on the patient journey for adults with Alzheimer's built a board game instead, and students in Williamsfield, near Peoria, worked with a solar company on what is now a solar energy community there.
• The program targets students underrepresented in STEM. Cooper says about 75% of students tell ISTI's yearly evaluation that it is their first ongoing contact with a professional ("you can't be what you can't see"). The end-of-year showcase is not a contest, both because competition was found to put off underrepresented students and because different industries' solutions cannot be compared; one team per school presents.
• Schools wait on a list, and the limit is companies. She says demand from schools exceeds supply, so ISTI recruits companies near schools it wants to reach and in regions it does not yet serve, such as Moline and Rock Island, new this year. Each company commits mentors to weekly contact for a semester. Teachers commit to a year-long process: professional development in the fall, planning, mentor training, then work in earnest from January.
• An existing mentoring platform made the pandemic pivot small. Its Mentor Matching Engine, built in 2012, connects students and background-checked mentors by discussion and video, with a teacher in every project. With it this year's kickoff, company site visit and final presentations, the usual three or more in-person events, went virtual along with training and the showcase. It also runs as a separate program where students pick their own research projects, which she puts at 23 high schools and over a thousand students.

2020-11-23 · open the original ↗

• Treat ADHD as traits to manage, not a yes-or-no diagnosis. Kergosien says the clinical definition dwells on the negative (he cites the DSM-5 as requiring several, he thinks five, areas of impairment for at least six months), whereas his talk asks which tendencies go with this kind of brain and when each helps or hurts. Knowing yourself, and re-checking that as you learn more, lets you choose your situations; if your efforts never fix a struggle such as mundane tasks, he says that can free you to look for a different job or activity.
• The same ADHD traits can be strengths in the right setting. He lists hyperfocus alongside distractibility; an "out of sight, out of mind" form of object permanence that he says could even make losing a loved one less difficult; a fearlessness he says is common among successful entrepreneurs; and a brain that notices more around it, which distracts but also feeds intuition. He suggests some people work late at night simply because there are fewer distractions.
• Lean harder on lists and reminders than most people do. Kergosien says people with strong ADHD often end up using project-management techniques on their own lives, which for him led into leadership roles, and that checking items off supplies a reward that helps build the habit. He was diagnosed borderline as a child and again as an adult, and takes his prescribed medication selectively because it makes him worse at observing his surroundings and switching tasks; he also decides in advance, the way someone with alcoholic tendencies avoids the bar, not to start an absorbing project when he will need to stay alert.
• Rein in perfectionism by defining "done" before starting. He says the urge to make everything 110%, which developers call gold plating, leads him to take on less so as not to spread himself thin. His remedies are breaking work into micro tasks, setting milestones that mark when a task meets its needs, and routine check-ins, such as every few days on a month-long task or every 10 minutes on an hour-long one.
• Explaining the struggle turns a frustrated partner into an ally. Kergosien says he could walk past a full trash can 20 times without once thinking to take it out, which his wife read as not caring. Talking it through did not remove the difficulty, but it let her help rather than assume, and he says both benefited.

2020-11-22 · open the original ↗

• The healthcare cloud bundles existing services around an interoperability standard. Naik, a Microsoft data and AI specialist for health customers, calls Microsoft Cloud for Healthcare the company's first and only industry cloud: Dynamics 365, Power Apps and Teams on the common data model, using Azure's FHIR service as a standard, API-accessed schema so payers, providers and processors can share records. He names Epic as the first customer, using Teams with its application for telehealth; on the host's paraphrase, he agrees that Microsoft supplies the raw tools and partners assemble the solutions for each provider.
• COVID raised hospitals' costs while cutting their main revenue. Naik says elective surgeries, where most hospitals make their money, fell by 70%, while costs rose to treat COVID patients and protect caregivers. He presents the product as Microsoft's answer: better patient engagement, coordination of care teams, and operational insights, within Azure's HIPAA and HITRUST certifications; he also claims Azure has the highest market share in healthcare.
• The health bot already runs a public COVID symptom checker. Naik says the CDC website's symptom-checker bot is built on Microsoft's bot framework. Providers can also use the health bot to schedule patients' next appointments and to work with insurers and payment processors, alongside ready-made Teams apps, portals, dashboards and workflow templates.
• Speech and text analytics aim to cut doctors' charting time. Naik says speech-to-text, sentiment analysis and text analytics from Cognitive Services can let doctors and nurses spend more time listening to patients and less time typing notes. He ties this to patient satisfaction, citing the common complaint that the doctor typed more than listened.
• The product is now generally available as a per-user licence. Naik says it went into preview in May, when it was announced at Ignite, and reached general availability on October 28 as its own licence at $95 per user per month. HealthBot and Cognitive Services are billed separately as metered Azure services, and he refers buyers to their account executive on pricing.

2020-11-02 · open the original ↗

• Cloud projects fail from missing ground rules, not bad code. Hepworth, a cloud consultant at Black Marble, says the projects he is called in to rescue went wrong because the technical solution was disconnected from the business's needs and constraints: a surprise bill that blew the budget, a deployment in Central US when the data must stay in Europe, or a preview service with no SLA. He argues governance can start as a few sentences and grow, like bowling-alley guardrails, and that it runs through operation, disaster recovery and business continuity, not only the start of a project.
• Developers should start governance themselves and draw in the business. He gives technology choice as an example: a team of long-time .NET specialists writing its new cloud app in Go takes on risk it may not be able to debug or deploy. If their organisation has no governance, he urges developers to propose guardrails and ask business owners of compliance, data and budgets to lead, saying this is good for both their careers and the business.
• Published frameworks offer a checklist for a cloud operating model. Hepworth points to the Cloud Adoption Framework, which assesses an organisation's maturity and supplies starter governance documents, and the Well-Architected Framework, which questions an application on backup, DR, resilience, data management and risk. He gives aka.ms/governancedocs as the entry point, "if memory serves", and the host checked that it led to Azure's governance documentation.
• Security should loosen development and lock down production. He recommends separate subscriptions, with a loosely regulated development subscription that alerts rather than blocks, and production that developers cannot touch and only automated tooling deploys to. He also recommends least privilege, just-in-time administration (a manager-approved, audited, time-limited elevation of perhaps a couple of hours), encryption at rest, a ready-made identity provider such as Auth0 or Azure AD rather than one you write yourself, and device management such as Intune.
• Policy tooling lets you show a regulator each rule enforced. Hepworth describes grouping subscriptions under management groups and applying Blueprints, which bundle access rules, ARM-template resources such as Key Vault, and Azure Policies written in JSON, for example blocking deployments outside Central US in production but only alerting in development. The portal then reports compliance across all resources and can remediate some failures; baseline policies, compliance-specific blueprints such as UK OFFICIAL, and samples in the github.com/azure/azure-policy repo (located by the host) give a fast start.

2020-10-05 · open the original ↗

• Productivity comes from intentionality, not more hours. Hanselman says wasting time is fine when chosen, and the problem is losing four to six hours while frustrated at not doing the thing you wanted; his example is time-boxing a newly re-released Super Mario to a half-hour timer, then spending 90 minutes on a YouTube video. Saying no is "the biggest control" you have, and he books himself two-hour "focus time" meetings on his calendar.
• A trusted list frees the mind that undone tasks occupy. He compares unrecorded to-dos to the "System" process using 20% CPU in Task Manager, and says writing them down, on paper when overwhelmed (his "Sync to Paper" article), gives you permission to stop worrying; he also consciously lets go of things like never watching The Wire. In Microsoft To Do he keeps a pool of about 70–76 items and adds three to five to "My Day" rather than 30.
• Turn off every notification that isn't worth an interruption. Hanselman says we granted each app permission to pop a toast and can revoke it per app; anything truly important would come by a phone call, not a toast sitting at the same level as a BuzzFeed item. His phone is on silent, Teams has scheduled quiet hours, and his wife and kids have their own text sounds.
• Multitasking is a lie; people are single-threaded. He says multitasking is just fast context switching with a real if unmeasured overhead per switch, so four 30-minute tasks in two hours go better as four uninterrupted sprints than as 14 switches. The only useful background thread is the subconscious that solves problems in the shower.
• Operationalize or hand off recurring chores to reclaim time. He pays a local kid $20 to mow his lawn, which he says buys back an hour and a half of his weekend, and calls getting an editor for his podcast a "game changer" that lets him focus on content. He concedes the setup cost of a new system often feels bigger than just doing the task yourself, and says to push past it.

2020-09-28 · open the original ↗

• Racism is built into institutions, not just individual hatred. Block, citing Ibram Kendi's How to Be an Antiracist, says there is no middle way and that "I don't see race" denies the problem; he points to redlining as zoning written so Black people could not live in neighbourhoods, which he says produced the segregated Long Island towns he grew up near. He puts denial down to avoided accountability and to privilege, contrasting a Black colleague who teaches his children how to survive a traffic stop with his own assumption that a stop is about a cop's quota.
• The goal is equity, not equality. Block says equality gives everyone the same thing, while equity takes account of different experiences and barriers to access in order to level the field; asked for an example, he and the host settle on workplace jokes that land differently on their target.
• Allyship starts with listening and looking inward, then intentional action. Block's steps are to listen without rushing to judgment, admit you do not know, avoid taking up the airspace, and get to know people who do not look like you outside diversity meetings. He also says to expect mistakes and approach them with a growth mindset, and that good intent does not reduce the harm done.
• Tech's bias shows in hiring, mentoring, referrals and AI. Block cites an interviewer asking to touch a Black woman's hair, callback data on Black-sounding names, people mentoring those who look like them, and his own past referral hiring as structural racism. On AI he cites Amazon shelving a résumé-screening system in 2018 over bias, and an ID-verification service that failed to recognize a dark-skinned Black woman's face.
• Renaming "master" terminology matters because perception outweighs intent. Block says people objecting to master/slave terms and GitHub's move to "main" are what counts, whatever the original authors meant, and he rejects calling the change performative: small changes add up. He notes he works for Microsoft, which owns GitHub, and created his first repo with "main" as its default.

2020-09-25 · open the original ↗

• The Cloud Adoption Framework is a library to draw from, not rules. Martensson describes it as Microsoft's curated guidance from customers running Azure at scale, covering business and organizational change as well as technology. Implemented "A to Z" as written, he says, it fits no one, and a full Azure landing zone as described is probably not what anyone needs at first; the framework itself has a "start small and expand" section.
• Adopting cloud needs anchoring in the organization, not just a boardroom decision. He says a top-down "we have to do this cloud thing" decision causes major internal fallout, with jobs changing and training needed. The framework's planning guidance is meant to address this, and he says teams years into Azure can still find gaps with it.
• Plan access and onboarding early, or unwinding it later hurts. In his experience developers are often given access to everything because it is easier, which within six months leaves unexplained changes and fails any compliance or security audit. Taking access away later upsets people. He says to work out early how a new team gets access and who may deploy to production, and to lay out subscriptions and management groups expecting to change them.
• Start with a small real application in production. Martensson says a sandbox teaches little, whereas a real workload produces monthly bills that can be weighed against business value. Large decisions, such as whether to buy an ExpressRoute dedicated connection at a "hefty price" or connect over the internet, can come later. Giard adds that a first project should avoid the most mission-critical systems because it will make mistakes.
• Bring in experienced help before going far down the wrong road. Martensson, an Azure MVP for over 10 years and a regional director, acknowledges that as a consultant he is promoting his own trade. He says tens of thousands of words of guidance do not tell an inexperienced team what to skip, and he has seen organizations whose late fixes cost far more than early guidance would have.

2020-09-24 · open the original ↗

• William Farr is the unsung statistical hero of COVID-19. Short says Farr, who joined the UK's General Records Office around the 1841 census and died in 1883, began recording cause of death, which lets occupations such as nurses and bus drivers be ranked by risk. Short says the "curve" politicians want to flatten is Farr's Law: infection rises exponentially, then drops quickly once everyone who can be infected has been, giving a sharp bell curve.
• Absolute death counts only give historical context. Short says reported totals, which he reads on air as 174,000 US deaths and 777,000 worldwide after first misreading them, raise questions of trust (Russia's under 16,000) and of the ability to measure (rural India). They cannot compare countries, which requires deaths per million. The one thing they allow, he says, is a comparison such as US COVID deaths having passed US soldiers killed in Vietnam.
• An average mortality rate hides steeply age-dependent risk. Short says the global rate of around 3.5% is an average. Citing UK work, Short says risk is roughly flat up to an age he puts at perhaps 35–40, then doubles every five years, and comorbidities such as obesity and type 2 diabetes raise it further. Young people who feel safe still endanger the people around them, and he praises younger generations for largely "taking one for the team".
• Testing figures are soft evidence; emergency calls and admissions are hard. Short says more tests find more cases without changing prevalence. The positive rate is what matters, and it can be inflated by "case hunting", such as door-to-door testing in the Manchester hotspot. No one knows the tests' false-negative rate, or how the viral load that tests positive compares with the load that infects. Hard evidence is COVID-related 999/911 calls and hospital admissions.
• Saving lives versus the economy is not either/or. Short recalls, without checking, a statistic that each percentage point of US unemployment adds about 10,000 deaths. He argues for local lockdowns, made possible by Farr-style statistics, with financial support for the locked-down areas, because the economy will not survive another six- or seven-month national lockdown. He says individuals who separate information from data make better decisions.