Souk's Notes - Unofficial Summaries

2023-03-06 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2023-03-04 · open the original ↗

• The WiFiMan Wizard adds spectrum scanning iOS does not allow natively. It is a $99 Bluetooth accessory, now out of Early Access, that reads 2.4 and 5 GHz networks through the WiFiMan app (iOS 0.18.0+ or Android 1.15.0+); Ubiquiti claims about 240 minutes of continuous scanning on battery, which the host did not test.
• The scan view is basic and cannot be sorted. It lists SSIDs, channels, signal strength and a Wi-Fi 6 marker (his T-Mobile Home Internet showed channels 9 and 108 at -32 dBm), but the host wants sorting by signal or name and says scanning is all the device does.
• The host says home users should skip it; professionals might not. A home user is better served by an Android phone and its spectrum apps, while a wireless installer gains a compact tool-bag item. Even so, he prefers NetSpot for floor-plan coverage maps, since WiFiMan's maps cannot be saved and ignore multiple floors.

2023-03-03 · open the original ↗

• Cloudflare Tunnel gives remote access without opening firewall ports. A connector inside the LAN dials out to Cloudflare, so the WAN IP is never exposed, it works behind CGNAT such as Starlink and T-Mobile Home Internet, and the free plan covers everything shown. The host predicts this will put a real dent in VPN use over the next few years without ever fully replacing it.
• Cloudflare must manage the domain's DNS before a tunnel works. Beyond a free Cloudflare account, you need a domain whose root nameservers are moved to Cloudflare's; the host used Namecheap, for which he gives a link. Propagation can take five minutes to 24 hours, and his activation email arrived in about 10 minutes.
• The host recommends running the connector in Docker. A full Ubuntu VM worked but wasted CPU and RAM, and a Raspberry Pi forces command-line configuration, whereas Docker is set-and-forget with everything managed in the Zero Trust dashboard. On Synology, use the host network, enable auto-restart and trim Cloudflare's command to "tunnel run --token…", since no-autoupdate is already supplied; a constantly restarting container means that string was edited wrong.
• Each public hostname turns an internal service into valid HTTPS. His Synology NAS on HTTP port 5000 came out on port 443 with a valid certificate. Pitfalls: Pi-hole needs /admin on the URL, an HTTPS origin like his EdgeRouter 4 needs "No TLS Verify" turned on, and Docker services need their mapped port (49158 for OpenSpeedTest).
• Until Cloudflare Access is configured, anyone with the hostname gets in. The host adds a one-time-PIN login method and a wildcard self-hosted application whose policy includes specific emails or a domain, requires a US origin (which he notes a VPN easily bypasses) and can exclude countries or IP ranges. Services with their own login then require two separate authentications.

2023-02-26 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2023-02-26 · open the original ↗

• Azure Spring Apps hosts Java Spring applications without managing infrastructure. Giard describes it as a way to run Spring apps in Azure where Azure handles the hardware, networking, infrastructure and containers. Searching "Azure Spring Apps" under Create a resource turns up two versions, an enterprise one he describes as from a third party and the standard one from Microsoft; he uses the standard one.
• The service is created first; apps are then added inside it. On the Basics tab he creates a new resource group, names the service and picks a region (East US, advising viewers to weigh where users and consumed resources are, to minimize latency). The default tier is Basic, which he keeps; Basic does not allow zone redundancy, which needs a higher tier. Deployment of the service took about six minutes. The service name must be unique across Azure; an app name only within its service, and may not contain spaces.
• Each app takes either a container or a JAR artifact. Under Apps > Create app he chooses the artifact (JAR) route, then sets the runtime (several Java versions, and .NET Core, which he says he has not tried), full or half a virtual CPU, memory of half a gig, one gig or two gig, and an instance count. Raising instances to eight, he says, costs eight times as much per hour for eight times the scalability; he leaves it at one and the defaults elsewhere. Creating the app took about a minute.
• A new app gets a test endpoint; production needs an assigned endpoint. The test URL, which contains the word "test", serves a placeholder getting-started page. Clicking Assign endpoint produces a friendlier URL built from the service name and app name on azuremicroservices.io, and a custom domain can be pointed at it through a DNS record.
• One az spring app deploy command pushes the JAR to the app. Using a sample Spring Boot app cloned from GitHub (needing Git, Java, WSL on Windows, and an IDE such as VS Code), he runs from WSL az spring app deploy with the resource group, service, app name and artifact path to the JAR, copying the names from the portal. The deploy took about two minutes, after which the endpoint returned "Greetings from Spring Boot".

2023-02-26 · open the original ↗

• Channel access is granted per user from YouTube Studio's Permissions page. Giard goes from the profile icon to YouTube Studio, then Settings at the bottom left, then Permissions, where he is the only user, as owner. The Invite button takes the other user's email address and an access role. He says the invitee needs a Gmail account, because YouTube is owned by Google.
• Six roles trade off power, chiefly permissions, deletion and revenue data. As he reads them: Manager is almost an owner; Editor can do everything a Manager can except manage permissions or delete content; Editor (limited) is the same minus viewing revenue data; Subtitle editor adds and removes subtitles; Viewer sees everything, including settings and private files; and Viewer (limited) the same without revenue data. He notes they are not quite in descending order of power, and picks Editor (limited) as the least control that still lets the user upload videos.
• The invite stays pending until the owner saves and the invitee accepts. Clicking Save makes the owner re-enter a password (he has two-factor authentication on), and Google may also send a prompt to his phone. The invitee then gets an email inviting them to access the channel and must accept it. After that, playing the invitee, he uses Switch account to reach the shared channel and upload a video to it.
• Access can be changed or revoked from the same Permissions page. The user's role dropdown lets the owner raise or lower their access, or choose Remove access, which asks for confirmation and may prompt for a password or two-factor check (it did not this time). Once removed, the user's Switch account list no longer includes the channel.

2023-02-26 · open the original ↗

• Knowing one layer beneath your tools makes you better at them. Hanselman argues that Generation X and millennials understand the file system while Generation Z takes it for granted; his 17-year-old does not know what one is because the iPad hides it. He compares it to knowing a stick shift or how to change a tire, and says he is not gatekeeping.
• Cloud drives show files that often aren't really on your computer. In OneDrive a green circle means local and in the cloud, while a bare cloud icon means cloud only ("on-demand files"). He uses the command prompt (cd, dir) to show a 26 MB comic listed in parentheses as a placeholder, then shows it losing the parentheses after "Always keep on this device" and regaining them after "Free up space".
• Deleting files to "free space" is usually tidying mental clutter. He says non-technical people delete things thinking they slow the computer, when on-demand files mostly take no space. The same placeholder behaviour appears in Dropbox, which decides itself whether to keep a downloaded file, and in iCloud, where he shows his Mac desktop mirrored on Windows and on his iPhone with download buttons. He also notes that a file on a cloud website may be only a preview.
• Downloading a cloud document turns it into a separate copy. He saves a Google Sheet as Excel into iCloud Drive, so it is now a copy in another format and no longer the live shared document. He concedes that staying inside the Google Sheets ecosystem is probably smarter, but argues that knowing how to move files between clouds keeps you from being locked in.
• Keep your own copies, because cloud access can vanish. He cites the backup rule of three: three copies, in two formats, one offsite, for example a hard drive, Dropbox, and a DVD or USB key in a safety deposit box or with family. He also treats the headless server in his closet as a "local cloud", and closes that "your phone is lying to you" about what is really on it.

2023-02-25 · open the original ↗

• Power Platform is one piece of a larger architecture, not all-or-nothing. Grossnicklaus, who runs a software development company building .NET, Azure, Angular and Kubernetes systems, says his teams typically combine two or three of Power Apps, Power BI, Power Automate, Power Pages and Power Virtual Agents alongside custom Angular and .NET code; if he can get 90% done in a week and spend a month on the other 10%, the project is still shorter and cheaper.
• It fits internal enterprise data apps, not public-scale products. He would not build "the next Twitter" on it, but a division of 50 people searching, reporting on and entering data is a good fit; Microsoft licenses it per user or per app, and its Dataverse database lives behind an API with no data center to choose. He says governance and security (who can publish, what data apps reach) are built in, though some client companies made it "the Wild West" by ignoring them.
• Owning the bottom line is what converted him. As a developer he chose technology with "someone else's money"; as a business owner he weighs eight months of a development team against hiring someone part-time to do the task manually. He says Power Automate lets him offer small businesses that have done things by hand for years a two-day automation engagement.
• A COVID vaccination tracker went live in about two weeks. Five or six St. Louis hospitals pooling doses for weekend events in underserved areas needed state-reportable tracking within two weeks, against the eight months he estimates for traditional development; his team built an Angular/.NET registration site on Azure feeding Dynamics, an iPad check-in Power App and a Power BI report to the state, finished in four or five days with a week of testing. He says he fixed bugs on site in real time, and the system was archived after roughly 12 months of use.
• In his experience the adopters are developers, not citizen developers. Grossnicklaus says Microsoft's marketing targets non-technical users, but everyone he has seen adopt the platform had a deep technical background, and about 99% of his conference audiences are developers. Inside his own company he evangelizes it top-down, steering small internal admin screens to Power Apps so developers focus on public-facing work.

2023-02-23 · open the original ↗

• Sophy's outreach exists to give underrepresented minorities visible role models. Sophy, a fintech software engineer who posts as Coding by Sophy, is the first tech person in the family. Sophy recalls a fellow member of the National Society of Black Engineers at UC Irvine holding off on wearing a computer-science shirt until sure of finishing, and says Sophy had never seen a Black woman engineer in industry. Messages saying "you got me into coding" are what confirm the impact.
• Tech is hard but possible, and saying so isn't gatekeeping. Hanselman contrasts creators who promise six figures after six months of light study. Sophy says getting there took grind, rejects the "naturally smart, coding since two" image ("I'm not naturally smart, I actually work hard"), and refuses to tell anyone they can't do it. On bootcamps, Sophy holds a four-year degree but is not against them: take the university route if you can, and try a bootcamp if you can't.
• The degree starts the work, and confidence comes in phases. Sophy says college taught "kind of nothing" about being a software engineer, and the first six months in a corporate job brought doubts about whether to ask questions. Confidence grew from hearing others ask the same question, and Sophy measures growth by no longer being nervous in a one-on-one held since internship. Hanselman, at 30-plus years, adds that he spent an hour stuck on C# before a colleague pointed him to the Dockerfile.
• Time-box your struggle, then ask for help. Sophy says stubbornly refusing help hurt their mood and sleep, and it robs you of the helper's thought process, which would make the next instance faster. Sophy now does due diligence first, then asks sooner. Hanselman frames a senior engineer's value as having seen a problem before, and calls life "a way bigger group project" than school.
• Healthy disagreement depends on never questioning someone's right to be there. Sophy has watched senior engineers go at it but has not had heated arguments; recently Sophy nervously defended a solution against a more senior colleague's, and the team adopted it. Hanselman's version is to fight, disagree, then commit without "flipping the bozo bit". Both say tech usually has multiple right answers and nobody knows everything; a former manager once called Sophy the team's expert after two weeks on a project.

2023-02-23 · open the original ↗

• Software-defined radio moves tuning and demodulation from circuitry into software. Royse, a developer advocate at Redis, shows a USB dongle costing $25–30 on Amazon that covers from below AM up to about 2 GHz and sends a wide swath of bandwidth to the computer to decode; it needs an antenna suited to each frequency.
• A cheap setup reaches across the world and the local airwaves. With a loop antenna at his dining-room window in Columbus, Ohio, he picked up a shortwave station broadcasting from Lhasa, Tibet. On camera he uses SDR Angel, which he calls full-featured but steep to learn, with a two-metre/70-centimetre antenna to tune 162.55 MHz, Columbus's NOAA weather radio, through a narrowband FM demodulator.
• Ham radio's APRS carries data as well as audio. On 144.39 MHz, stations broadcast location, weather and tracking packets in AX.25, based on X.25 with call signs in place of MAC addresses and the same encoding as 1200-baud modems. iGates relay packets to and from the internet, enabling SMS gateways and weather lookups, and a repeater on the International Space Station can relay a message from the wilderness.
• Many everyday devices broadcast readable data in the clear. He lists aircraft positions and flights, ships (he tracked boats on the Ohio River at an event in Louisville), gas and water meter readings (he matched his own meter's ID) and tyre-pressure sensors reporting pressure and temperature. His talk "Tracking Aircraft with Redis and Software Defined Radio" puts aircraft data into an event stream feeding a map app.
• Unencrypted pagers leak medical information. Royse says doctors are the most common remaining text-pager users, so HIPAA violations with patient names and room numbers occur "every minute". His understanding of US law, revised mid-conversation and offered as not legal advice, is that listening to clear broadcasts is legal but sharing communications intended to be private is not, and breaking encryption counts as illegal hacking.

2023-02-22 · open the original ↗

• Fluent Migrator versions schema changes as ordered, reversible C# classes. Groves, who works at Couchbase, describes an imperative approach inspired by Rails migrations: each numbered class overrides Up (create table, add column) and Down (drop, remove), and a runner applies the ones not yet run; he has had 50 or 60 in smaller projects, and tags or parameters can restrict migrations to dev or test environments. He credits its fluent syntax with making features discoverable through IntelliSense.
• Stored procedures, views and triggers fit it awkwardly. Fluent Migrator can run a checked-in SQL script, but changing it means either editing the file and losing the version history or adding a "Matt Sproc 2" copy, a source-control history inside source control. Groves prefers to keep business logic out of the database anyway.
• Broad database support means lagging database-specific features. It supports SQL Server back to 2000, Postgres, MySQL, Oracle, Access via the Jet engine and DB2, but a new feature in, say, Postgres may not be available right away.
• DBAs may want to see the SQL before production. The command-line runner can run in a CI/CD pipeline for fully automated deployment, but it abstracts away the generated SQL; an output option Groves only recently learned of writes a full SQL script that a DBA can review, tweak and run against test or staging first.
• He has started a separate NoSQL Migrator project. Fluent Migrator is relational-only, and talks with its organizer about NoSQL support ran into big differences between NoSQL APIs, so Groves built an unaffiliated, early-stage tool at github.com/mgroves/nosqlmigrator; he argues schemaless databases still have structure that teams should track in source control.

2023-02-22 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2023-02-21 · open the original ↗

• Apple IDs can now be secured natively with FIDO security keys. Apple added support with iOS 16.3 for iPhone and iPad and macOS Ventura 13.2, so YubiKeys now work directly; the host demonstrates on a YubiKey 5 NFC (USB-A or USB-C plus NFC) and a YubiKey 5Ci (USB-C and Lightning, no NFC).
• FIDO U2F is the strongest two-factor tier, above TOTP and SMS. The host ranks SMS lowest because phones are lost, stolen or SIM-swapped and the codes get phished; TOTP apps such as Google Authenticator or Authy are better, and TOTP held on a YubiKey better still; FIDO U2F has no code to phish and requires the physical key.
• The host prefers YubiKey 5 series keys because they do both. They handle FIDO U2F where a site supports it and TOTP, through the Yubico Authenticator app, where it does not. He says he has used them for about three years; the video carries affiliate links but is not sponsored or paid for by Yubico.
• Apple requires at least two keys, and setup takes minutes. The path is Settings, your name, Password & Security, Add Security Keys; an NFC key is held to the back of the phone, a Lightning key plugged in and its contact touched, and each is named. The host registers three keys and suggests keeping social-media apps on a separate phone with no personal data.

2023-02-21 · open the original ↗

• Dapr's building blocks abstract microservice plumbing behind configuration. Rutz, a cloud solution architect on Microsoft's app innovation team, cites service invocation with service discovery and mTLS handled for you, and a simple key-value state API whose backing store, such as Redis or Cosmos DB, is set in component configuration outside the code; the same code can use RabbitMQ or Redis locally, Service Bus in the cloud, or different middleware at an edge site such as a smart factory.
• Bindings bring event-driven triggers to containers. Rather than writing code to read from an Event Hub and track its position in the stream, Rutz says the developer configures a binding and Dapr invokes the configured method for each event; the host compares this to Azure Functions, which he puts at about half a dozen triggers.
• Actors give stateful objects sequential processing while the system scales out. Rutz's example is IoT, with thousands or millions of devices sending telemetry processed concurrently, where each device's events must be handled in order. He also lists observability traces aligned with OpenTelemetry, and secrets and configuration through a generic API, so that Key Vault in the cloud can be environment variables locally without an SDK.
• The sidecar model makes Dapr language-agnostic. Dapr runs beside the application and is called over HTTP, or gRPC for higher performance, so any language that can make HTTP calls can use it; Rutz says it is Linux-container oriented and he was unsure whether Windows containers were yet supported.
• Adoption is opt-in, one building block or one service at a time. An existing application can take a single feature and delete its own code; Rutz says .NET developers can use the optional SDK's client or simply point an HTTP call at localhost on the Dapr port with the target service's name, after installing Dapr locally and writing component files.

2023-02-20 · open the original ↗

• Data warehouses required knowing reporting needs before loading. Shelton, a cloud data specialist on the host's team at Microsoft, describes warehouses as offloading transactional data through extract, transform and load into a fixed relational schema, easy for business users but hard to scale as volumes grew despite massively parallel processing; data with no column defined for it was simply not used.
• Data lakes stored everything raw but were hard to query. Lakes, often on Hadoop's distributed file system and compute, took text, social media, images and video without a schema up front, but Shelton says business users struggled to use them, some called them a "data swamp", and organizations ended up duplicating data into a warehouse for query performance that MapReduce did not provide.
• A lakehouse combines both on one platform with many compute engines. He credits Databricks with coining or evolving the term; raw data lands in an object store and remains a single representation that engines such as Spark or SQL can reach, serving Power BI reporting alongside machine learning on raw text or image recognition.
• Data is refined through bronze, silver and gold tiers. Shelton describes a common pattern of raw files in a bronze layer, cleaned and curated data, often in compressed columnar Parquet, in silver, and reporting-ready data in gold; because all the raw data is kept, a new attribute for reporting means extending the refinement rather than going back to the transactional system.
• On Azure, separate services fill each lakehouse role. He names Azure Data Lake Store as the object store, Azure Synapse Analytics for Spark transformation and serverless or dedicated SQL querying, and Databricks against the same data; he calls the area emerging and says an analytics platform can grow into it incrementally.

2023-02-20 · open the original ↗

• A "confirm resubmission" warning on Back signals an architectural flaw. Dodds says sites such as airlines that warn "don't hit the back button" returned HTML in response to a POST, which puts the POST in the history stack. Post/Redirect/Get, redirecting after the POST, would remove both the warning text and the browser dialog.
• Single-page apps dominate what developers actively build, not deployments. Dodds distinguishes time spent developing from sites deployed: a library using the bitwise operator that ships in WordPress could put it on 90% of sites while few developers know it. Dodds admits to not having measured this, but would be "very surprised" if SPAs were not on top by a large margin.
• Preventing browser defaults makes apps re-implement browser behaviour, usually worse. SPAs call preventDefault on links and forms, then route on the client and send JSON with fetch, so they take over the race-condition handling the browser did automatically. Dodds's example is Twitter's optimistic UI: rolling back a favourite on a deleted tweet is tricky, when a full page refresh would simply have shown the truth.
• The next transition is progressively enhanced single-page apps. Dodds's term is PESPA: a baseline app that works with the web's most basic features, enhanced with JavaScript, and avoiding code duplication by running the same UI code on server and client. Dodds, who worked at Remix for about 10 months, calls it the first implementation and says Next.js, SolidStart and SvelteKit are following.
• Non-JavaScript back ends can stay as APIs. Asked about PHP, Ruby or C#, Dodds says to keep the existing back end for logic and shift the front-end UI code slightly onto the server, as PayPal did with a Node middle tier over Java services. Edge and CDN runtimes are constrained (Cloudflare wants a handful of milliseconds), so Dodds hosts a personal site on fly.io, which runs full long-running servers in many regions to be closer to users.

2023-02-19 · open the original ↗

• Layered onion architecture broke down on a 1,000-screen application. Bogard describes a 2008–2009 ASP.NET MVC project where a rigid project hierarchy enforced inward dependencies; adding one field to a screen meant changes across the code base, and per-entity "layer god objects" such as a customer repository and customer manager became contention points for many developers and coupled unrelated actions through shared methods.
• Pretending the ORM did not exist produced inefficient data access. Because business logic could not couple to the ORM, the team relied on lazy loading and lowest-common-denominator features. Friction got bad enough that one Friday the tech lead had all projects collapsed into one by Monday, keeping the layers as folders; Bogard says that project also gave rise to AutoMapper and other now-common MVC patterns.
• Start with no patterns and abstract only when it hurts. On the next large project he and a few senior leads spent about the first month using tools directly, data access in controllers included, to see which problems actually emerged, because abstraction adds complexity that must buy something.
• Organize code by what changes together, not by layer type. In his "feature folders", now vertical slices, each request's input object, handler, response, validation, view, JavaScript and styling sit in one place on disk, with only controllers left where routing required them; he keeps one project and splits only when two applications need shared logic. He says other ecosystems reached the same conclusion independently, citing Angular's move away from AngularJS's organize-by-kind layout.
• MediatR grew out of copying the same 100 lines into six projects. Single-method services like "approve invoice" and "reject invoice" became a request–handler–response pattern; routing requests through a mediator gives each controller one dependency instead of one per action, and lets logging, transactions and auditing wrap every handler without DI-container decorators or proxies. Bogard says the name was a nod to SignalR and has no correct pronunciation.

2023-02-18 · open the original ↗

• Containers virtualize the operating system kernel, not the hardware. Richardson, a developer advocate at Shoreline, contrasts virtual machines, which specify bus, RAM and CPU and install a guest operating system, with containers that share the host's kernel, so they start fast enough to spin up per request, scale to demand and hand resources back to the cloud afterwards.
• Containers are identical, short-lived cattle, with state kept in volumes. Every instance of an image is the same apart from host name and IP, so two, five or 25 web servers behind a load balancer make a durable site; durable data goes in a volume mapped into the container from a SAN, Azure Files or S3, which the application sees as an ordinary folder.
• One image runs the same locally, on premises and in the cloud. Configuration such as the database is injected through environment variables without rebuilding, which he says removes "works on my machine"; the caveat is that the kernel must match, so Linux containers need a Linux host, and locally developers usually run them inside a small Linux virtual machine.
• Docker builds containers and an orchestrator such as Kubernetes runs them. Richardson says the two are used together rather than one replacing the other: images are built with Docker on developer machines and build agents, pushed to a registry, and an orchestrator told, for example, to keep three instances across availability zones chooses machines and moves workloads when one is taken out for updates.
• New versions deploy by shifting traffic, not upgrading servers. He describes starting version two alongside version one, moving 10%, 20%, 50% and then all traffic, and terminating the old containers; the pipeline's artifact is an image holding the application and dependencies such as a PDF generator or SDK, the Dockerfile lives in Git with the source, and images go to a separate image repository.

2023-02-14 · open the original ↗

• T-Mobile Home Internet is cheap, contract-free and easy to start. It cost the host $50 a month ($25 for existing T-Mobile phone customers), with a $100 sign-up rebate, and he walked out of a store with the modem in 30 minutes. He says he has no affiliation with T-Mobile and pays for the service himself; it needs solid local 5G coverage.
• The modem double-NATs and offers no bridge mode or static IP. Plugged into a UniFi UDM Pro's WAN it handed out a private 192.168.x address, and the host found no static-IP option on either the home or small-business service. The UDM Pro at first negotiated at 100 Mbps instead of 1 Gbps, which cleared after swapping the modem's two gigabit ports and rebooting.
• Measured speeds were high and fairly consistent over a month. A wired Raspberry Pi running a speed-test CLI client every 30 minutes, graphed in Grafana, showed up to about 600 Mbps at night and 250–300 Mbps by day; an iPhone 14 on the modem's Wi-Fi 6 regularly saw about 350 Mbps daytime.
• Occasional sluggish spells make it unfit as a business primary. About half a dozen times in a month browsing stalled for a couple of minutes, sending the host back to his Comcast Business 600x40 line at almost $350 a month. He judges double NAT bad for VoIP and other real-time services, and a missing static IP a problem where a business WAN IP cannot be dynamic.
• The host rates it fine for ordinary homes and ideal as backup. For basic browsing and streaming he calls it totally usable, and faster and cheaper than his $110-a-month Starlink at 80–150 Mbps, though Starlink works remotely. He is keeping it as failover on a dual-WAN router, or to carry guest and non-critical traffic.

2023-02-07 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2023-02-06 · open the original ↗

• Low code pairs subject experts with pro developers in hybrid architectures. Soderstrom, a Microsoft engineer on a Power Platform team for about a year, describes building rapidly on the platform's services while adding high-code components where needed, with citizen developers such as accountants or project managers building alongside, or sometimes without, pro developers. Rather than listing what the platform is wrong for, she looks for pieces to incorporate: an MLOps pipeline stays on Azure Machine Learning, but can draw on Dataverse.
• Built-in security and privacy is the platform's biggest selling point. She calls both moving targets that the platform handles, leaving teams to configure access controls; she says security left until late in a project can block it and cost days, and possibly thousands of hours, of development time.
• Extend through connectors, custom code and existing patterns. Soderstrom points to hundreds of out-of-the-box connectors such as SharePoint and Adobe Sign, custom connectors to any API, as she built on a recent project for a client's middleware team, custom JavaScript, HTML and CSS, and portal access for external identity providers; she advises first searching for a pattern someone in the same industry has already built.
• Solutions fit standard CI/CD as diffable configuration files. The Power Platform CLI pulls a solution of Dataverse tables, flows and connectors down as XML and YAML that can go into source control and through validation, CI and CD pipelines, with checks available as Azure DevOps tasks or from the CLI; she says the files are harder to read than code but show changes between versions, and Dataverse is also backed up automatically.
• She found Playwright workable for end-to-end testing of portals. In a spike eight or nine months earlier, where Selenium was not built in for portals, she says Playwright offered built-in video, screenshots and code generation from clicking through the browser, and could be swapped in and out of her testing pipelines to verify that a flow updated a status in a given row.

2023-02-01 · open the original ↗

• C# developers no longer have to switch to Python for machine learning. Korzynski says that around 2020 he had to choose between C# and machine learning and went to Python, but now does both: ML.NET has matured since 2017, and C# wrappers or ports exist for TensorFlow, Keras, NumPy, Pandas and PyTorch. NumPy.NET wraps the real Python library with all its features, while NumSharp is a native port with about 98% of them.
• ONNX lets data scientists and application developers each use their own tools. He asks his modelers for an ONNX file, built in whatever framework they prefer, and runs it in C# without Python dependencies, in ML.NET, or hosted in Azure Machine Learning or AWS SageMaker; he describes it as a common format for a neural network's weighted graph, created in about 2017 by Microsoft and Facebook. His reason is that Python's ecosystem suits modeling but its tooling for dependency injection, project structure and UIs does not suit enterprise applications.
• GPU inference comes from adding a single NuGet package. Some of his document extraction models are large enough to need a GPU even at prediction time, as can vision models like YOLO; he says the ONNX runtime's GPU package brings CUDA and optimizers such as TensorRT without setting up CUDA himself.
• Building the model is the easy part; data and integration are hard. Korzynski says getting well-labeled data and fitting a model into a C# codebase are the difficult stages, and a cloud-hosted model called over REST simplifies integration; latency matters less than expected because most workloads are not real-time, as with a 5,000-page document where OCR alone takes at least about a second per page.
• Deploying many models multiplies infrastructure beyond an ordinary app. On premises, he says, an application with 50 models could need 50 Docker containers, several instances of each under Kubernetes, and custom routing between them; his company digitizes microfilm and microfiche, and a project he just finished processed about 2 billion documents, requiring models run across Hadoop. He says some companies chase ML as a buzzword when they do not need it.

2023-01-30 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2023-01-26 · open the original ↗

• Capture should be frictionless, but it is not hoarding. Miller presents Tiago Forte's CODE method (Capture, Organize, Distill, Express) from the book Building a Second Brain, which he taught as a Codemash workshop; at capture the point is to get an idea from email, articles or podcasts into a notes app before it evaporates, though he now asks whether he will really benefit from it, having hoarded in the past.
• Organize notes for actionability, not by subject. Forte's PARA sorts everything into Projects (a goal and an end date), Areas of responsibility (an ongoing quality standard such as health or finances), Resources (reference and hobby material) and Archives (kept but out of the way); Miller says projects usually stem from areas, the same item can fall in different buckets depending on your role, and he has applied the scheme beyond his notes app to OneDrive, Google Drive and Outlook.
• Distill in layers, each time you return to a note. Under Forte's "progressive summarization", the first read bolds whatever stands out, the next pass reads only the bold and highlights within it, and a later pass adds your own summary at the top; Miller says only the material that keeps energizing you gets the later passes, and each one saves your future self time.
• Build output from your own stored pieces, choosing them before ordering them. Miller cites Forte's aim of starting no project he is not already 80% done with from prior "intermediate packets", and his advice not to go to Google when it is time to write; Forte's "archipelago of ideas" splits the work into selecting the pieces and then sequencing them in a separate pass, which Miller says he finds hard to do at once.
• Software can resurface what you read and capture podcast moments. Miller says Readwise, a paid service, pulls in Kindle highlights and shows five a day by default, and he was on a roughly 300-day review streak at recording; Snipd, a free podcast app, clips and transcribes the moment around a triple-tap on his earbuds and sends it to Readwise and Notion (he uses Notion's free tier, with Evernote kept as an archive).

2023-01-25 · open the original ↗

• A team should agree one word per meaning and record it. Ritchie, a software architect, says using update, change and modify interchangeably creates ambiguity, so a team might fix "change" to mean replacing an entity and "modify" to mean altering its attributes; he wants decisions kept somewhere such as SharePoint or GitHub, in the style of architectural decision records, with a domain vocabulary that defines each term, and for teams of teams a weekly or bi-weekly meeting to air them.
• An "and" in a method name signals it does too much. Ritchie says a long name is fine if it is the correct term in context, but a name that needs "and" usually means the method should be split, which then gives shorter names.
• Start with placeholder names and rename as understanding grows. He warns against analysis paralysis over perfect names: "test method one" is fine to begin with, so long as names are refactored, or things split into several, as the team's understanding of the problem improves.
• An interface name should describe a behavior, usually as an adjective. Rather than prefixing a class name with "I", Ritchie suggests turning the verb into an adjective, his example being "transmit" into "transmissive", because the interface should say what something does, not just provide a point for injection.
• Code should use the business's own language, not a technical one. Ritchie draws on domain-driven design's "ubiquitous language": one vocabulary shared with the business avoids mapping between technical and business terms, which he says introduces ambiguity; understanding the technical vision narrows the words needed, and since customers often cannot say what they want, names will change as feedback comes in. He collects his material in a GitHub repo, which he says holds far more than his hour-long talk.

2023-01-25 · open the original ↗

• Bulk operations replace the one-at-a-time user form at scale. Under Azure Active Directory's Users blade, Bulk operations offers bulk create, bulk invite and bulk delete; Giard says the web form is fine for a few users but not practical for hundreds or thousands. All three work the same three steps: download a template, edit it (and save it, which the page does not say), then upload it.
• The CSV template has a required version line and marked required columns. The create template ("user create template.csv") opens with "version:v1.0" on the first line, which must be present; the second row holds the column headers, and columns marked "required" (name, username, initial password, block sign-in yes/no) must be filled or the row fails. Optional fields such as first and last name, job title, department and location can be added later, though Giard notes they matter if you base conditional access on those properties.
• Upload results are reported per row, with a failure reason. After submitting, a status link shows success and failure counts and, in each row's details, a failure reason beyond the unhelpful "bad request". His demo hit three errors: a username whose domain was not one of the tenant's verified domains (contoso.com and microsoft.com were rejected; only the tenant's initial domain was valid), a leading space before an email address, and a blank line at the end of the file. One row can succeed while another fails, so he removed the user already created before re-uploading.
• Bulk invite and bulk delete need far fewer columns. The invite template uses the same version line and header format, with only the email address and redirection URL required. The delete template needs only the username, which Giard suggests for removing many accounts at once, such as after divesting a company or dropping a contractor firm.
• Giard expects the CSV to come from an automated process. He suggests a nightly batch that exports from another system and transforms the data into the template, then checking the status report for rows that failed. He advises keeping the file as CSV rather than converting it to Excel, and renaming and archiving each file as a history of what was attempted.

2023-01-24 · open the original ↗

• Pi-hole is the easiest project and the one he uses most. The host says it runs in under 30 minutes as a network-wide ad blocker and DNS server; his dashboard shows it blocking over 30% of outbound queries, and he values it most on his IoT network against devices such as a Roku phoning home. He suggests pairing it with a filtering upstream DNS such as Cisco's FamilyShield for malware and adult content.
• PiVPN makes a home VPN server simple to stand up. It builds an OpenVPN or WireGuard server for remote access to home files and servers or to use the home connection while travelling, and generates QR codes to set up clients. The host runs it on his own home network and credits its maintainers with keeping it current and easy.
• OctoPrint is a must-have for anyone with a 3D printer. At its simplest it monitors prints and sends jobs over the network instead of by SD card; plugins add temperature monitors, touchscreen control and Octolapse time-lapses. The host has no tutorial of his own but says the OctoPi image flashes straight from the official Raspberry Pi Imager.
• Home Assistant is the deepest project and can automate almost anything networked. The open-source server auto-detects smart switches, bulbs, thermostats, vacuums and cameras; the host runs his office lighting from one Stream Deck button, his fish-tank lights and air pump, and his 3D printer's smart power strip on it. He has made no videos on it and points to dedicated channels.
• His newest build is a scheduled internet speed-test appliance graphed in Grafana. Built to test T-Mobile Home Internet, it layers the Ookla Speedtest CLI on Raspberry Pi OS, writes timestamped results to InfluxDB and graphs them in Grafana, and can be dropped into any network. He says the Grafana install can monitor other data too, and plans a video on it.

2023-01-24 · open the original ↗

• Security groups carry permissions; Microsoft 365 groups carry messages. Created from Azure Active Directory > Groups > New group, a security group lets permissions assigned to the group flow automatically to its users or devices. Giard describes a Microsoft 365 group as what used to be a distribution list, so one message reaches everyone in it.
• A group can optionally be made assignable to Azure AD roles. Answering yes reveals a roles section for picking which built-in roles the group gets; Giard leaves it at no for the demo.
• Membership is either assigned explicitly or computed by a rule. Assigned, the default, lets you pick users and even other groups as members, plus an owner (Giard says only one owner can be added). Dynamic user and dynamic device membership instead use expressions joined with "and" (meet all criteria) or "or" (meet either), such as city equals Chicago and a given department, or device OS type equals iOS.
• Members can be added after the group exists. Giard creates a security group with three assigned members, finds it by search in the groups list, and adds more people through its Members page.

2023-01-23 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2023-01-23 · open the original ↗

• Inviting brings an outside account in, unlike creating an internal user. Building on creating a user in episode 136, Giard uses Azure Active Directory

  Users > New user > "Invite external user", filling in a name, email address and first and last name. An optional personal message goes into the invitation email, and the user can be pre-placed in groups or a role other than the default user role.

• Block sign-in holds an invited user until they should start. Giard's example is a contractor who does not begin until the first of next month; he sets it to no so access starts immediately.
• Optional profile fields pay off in conditional access policies. Location, job title, department, company name and manager are not required, but Giard says they let policies filter on things like users in the United States.
• Accepting the emailed invitation grants sign-in, not permissions. The email carries an "Accept invitation" link and a consent page; afterwards he signs in at portal.azure.com with his own address but can see almost nothing until an administrator grants access to applications.

2023-01-22 · open the original ↗

• Security defaults are a fast baseline, not complete security. Giard calls them "not perfect" but a good way to get started in a hurry. They are switched on under Azure Active Directory > Properties > "Manage security defaults" at the bottom of the blade, by choosing yes and saving.
• Security defaults cannot coexist with conditional access policies. Any existing conditional access policies must be disabled first, and the security defaults dialog warns you if any remain.
• The defaults force MFA registration and block legacy protocols. Every user must register for multi-factor authentication before using applications; older protocols such as SMTP and POP3 and certain proprietary ones are refused; and MFA is required for high-security areas, his examples being the Azure portal and the Azure CLI.
• Turning them off asks only for a reason. Setting it to no prompts for why, then save. Giard expects people to do this when they want the extra flexibility of conditional access policies.

2023-01-21 · open the original ↗

• Conditional access policies cannot run alongside security defaults. Giard says security defaults must be deactivated before conditional access policies can be used. Policies are created in Azure Active Directory under the Security tab, Conditional access blade, by creating a new policy and giving it a name.
• Assignments say which users and applications a policy covers. Users can be all users, specific users or groups, guests and external users, or directory roles; applications can be all cloud apps or selected ones, with a filter builder that requires custom attributes to be configured. Nearly every choice has include and exclude, so a policy can apply to a selection or to everyone except it, and Giard warns against a policy that locks yourself out.
• Conditions narrow when the policy fires, by risk, device and location. User risk flags a user on a leaked-credential list or behaving strangely; sign-in risk flags unusual activity such as signing in from two distant locations at once, each set to high, medium or low. Other conditions are device platform (e.g. apply to Linux, or to everything except Windows), locations (trusted, selected, or a list of forbidden countries or hostile IP ranges), client app (browser versus mobile app) and a device filter built from expressions on attributes such as device ID or manufacturer.
• Grant either blocks access or adds a required step first. Giard calls the required steps "speed bumps": multi-factor authentication, a password change, or accepting terms of service before access is allowed. The Session settings set how often the step repeats, for example a sign-in frequency of 4 hours, or not again within the same browser session, since he says repeating MFA on every page request would be an inconvenience.
• A policy can be created on, off, or report-only. Off lets an administrator configure a policy ahead of time, such as for the start of a quarter, and switch it on later. Report-only, which Giard finds useful, records who would match the policy without enforcing it, to learn whether it is needed at all.