Souk's Notes - Unofficial Summaries
Crosstalk SolutionsUniFi SmartPower USP-PDU-Pro - Complete Overview!
- The USP-PDU-Pro is a UniFi-managed 2U rack power strip. Its MSRP is $279. It has 16 outlets rated 125 V AC and 15 A, 1,875 W in total: 12 across the top, plus 4 spaced out along the bottom for large power bricks. It also has 4 USB-C ports (2 A per port, 20 W shared), a circuit breaker, and a 1.3-inch touchscreen. The host has run it in his test rack since February, through Early Access.
- Its redundant-WAN ports did nothing in the host's software. Besides a Fast Ethernet management port, it has three gigabit ports for splitting one ISP link across two Dream Machine Pros, the guide's "type B" install. On UniFi OS 1.12.24 and Network 7.2.93, those ports did not appear in UniFi and showed no activity, though traffic did pass through to his UDM Pro. The host expects UniFi to support redundant firewalls eventually but cannot say when.
- Each outlet can be named, switched, metered and power-cycled from UniFi. The host keeps his loud rack fans set to disabled, so they shut off once the PDU connects. A "modem power cycle" option reboots the outlet labelled as the ISP modem when the UDM Pro detects an internet outage. At recording, his rack drew about 91 W.
- The host wants outlet schedules and rates the price as fair. He would like time groups for switching outlets on and off on a schedule. He judges $279 reasonable against 1U and 2U rack PDUs from CyberPower and APC, and asks viewers for an equally capable competitor at that price.
Crosstalk SolutionsUbiquiti vs. Brian Krebs - The Final Chapter
- Krebs has retracted his Ubiquiti breach reporting and apologized. His post "Final thoughts on Ubiquiti" says his sole source, since federally indicted for allegedly giving false information to the press, is no longer credible and that the articles are removed. The host, saying he has not followed the lawsuit, speculates that the terse wording reads like the product of a settlement.
- The original report cost Ubiquiti about a quarter of its share price. Krebs's anonymous-source story came out in April 2021, about the breach the host dates to around December 2020; he shows the stock falling from about $389 on March 26 to about $289 on April 1. It sat near $311 at recording, which he puts down mostly to the market, chip shortages and supply-chain problems.
- The "whistleblower" turned out to be the hacker himself. By December 2021 it emerged that the Ubiquiti security employee feeding Krebs had done the breach, then leaked it posing as an insider when Ubiquiti did not pay a ransom the host recalls as about 60 bitcoin. The host says Krebs had no way to know.
- The host guesses the settlement bought an apology, not damages. Ubiquiti sued Krebs around April 2022. The host reasons that a blogger could never cover the roughly $4 billion of market capitalisation lost, so the suit may have aimed at the concession and deletion, perhaps with legal fees; he stresses this is speculation.
- He blames only the hacker, neither Krebs nor Ubiquiti. In his reading Krebs acted reasonably on a vetted source and had reason to protect it, while Ubiquiti acted in its own interest in not disclosing the breach and then suing. He leaves open how sure a journalist must be before publishing damaging claims.
Technology and FriendsMichael Richardson on Yarn Berry [TECHNOLOGYANDFRIENDS 718]
- The newer Yarn is a ground-up rewrite, not an incremental release. Richardson, a software engineer at Kroger Technology, says the lead maintainer rewrote Yarn's code base because he felt the project needed a different direction; it shipped as Yarn 2, then 3, with 4 "coming out soon", and Richardson uses "Berry" for every version after 1. He describes Yarn as fully free open source with no pricing model, and says the lead maintainer's employer, Datadog, supports his work because it uses Yarn itself.
- Berry's developer-experience gains are coded CLI output and stronger workspaces. Richardson says every line the command line prints carries a code that can be looked up for detail on the message, warning or error. Workspaces, which Yarn was among the first to introduce, group several packages or projects (he likens them to a .NET solution) so they can import each other, which he says makes managing a monorepo cleaner.
- Pinning the Yarn version per project removes cross-developer inconsistency. With
yarn set version, Yarn downloads the chosen version into the repository, it is committed to source control, and everyone running Yarn in that project uses it, so lock files stop changing between people. He recommends it even to teams staying on Yarn 1 and says it has been "hugely helpful" at Kroger. - Plug and play replaces node_modules with zipped packages read on demand. Yarn keeps each package as a zip in a cache folder and hooks into Node, extracting a file only when Node requests it. Richardson says the performance testing he has seen and done shows no significant overhead, citing a prior job where reading smaller zipped files proved faster than reading uncompressed ones. Because the zips can be committed, a freshly cloned repo is ready almost immediately; Kroger uses this "zero install" strategy in some projects.
- Migrating from the old version is easy unless you adopt plug and play. Richardson says that coming from Yarn 1, less complex projects upgrade "essentially seamless[ly]", complex ones may hit a few small issues, and the move to plug and play is where migration gets more complicated; migration docs are at yarnpkg.com. He agrees with Giard that greenfield projects should start on the latest version.
Polis Pandit$The Master of Dark Money Arts, Leonard Leo
- This post includes paid content that is not available publicly. See the original source.
Crosstalk SolutionsWireless Design! Rustic Lodge Cabin Property
- A free equipment-list request became a public design video instead. A Tennessee lodge owner wanted Ubiquiti gear for a four-acre property: 16 cabins 20–30 feet apart, a main building 200–500 feet away, and no trenching allowed. The host says Crosstalk sells design and installation, not Ubiquiti hardware, because there is "zero margin" in it.
- The main building is designed for redundancy because guests expect uptime. Two Netgate 4100 Base firewalls ($599 each, the first Netgate model to support high availability) with dual WAN, so Starlink could back up the line, plus optional TAC Pro support. Inside go three U6 Pro APs at $149 and a Cloud Key Gen2 Plus, chosen because the Gen2 was out of stock.
- Two PoE switches were chosen so either can carry the full load. The host specifies two Switch Lite 16 PoE at $199, eight PoE+ ports each, over two cheaper Switch Lite 8 PoE. Those have only four PoE ports against five PoE devices, so losing one would mean dropping an AP or adding an injector.
- One sector AP reaches all the cabins over clear line of sight. A LiteAP GPS ($99) on the building's north corner feeds NanoBeam 5AC Gen2 stations, about 300 Mbps per link in Ubiquiti's design tool at 40 MHz width. It needs an INS-3AF-I injector, since it runs 24 V passive PoE and the switch only provides 802.3af, plus surge protectors on outdoor units.
- The host rejects the client's AP-in-every-cabin plan as overkill. Instead he puts a Mesh Pro AP ($199) outside about every third building, six satellite sites at almost $2,000 total. Each chains two PoE injectors from the NanoBeam; adding a Switch Lite 8 PoE per site would cost about $774 more across six.
- Crosstalk would bill this as a two-day, two-person install. Main-building equipment comes to about $3,383 before cabling. The host prices labor at about $6,200: four hours of design at $200 an hour, a two-day minimum on site at $1,800 a day including per diem (ideally with two staff), and two travel days at half rate ($900).
Crosstalk SolutionsTesting the U6 Enterprise for Prizes!
- The U6 Enterprise's 6 GHz band buys capacity, not speed. The host explains that this first Wi-Fi 6E AP from Ubiquiti gains less interference and room for 80 and 160 MHz channels in a band about four times the size. Ubiquiti rates it at 10.2 Gbps aggregate (4.8 Gbps on 6 GHz, 4.8 on 5 GHz, 570 Mbps on 2.4 GHz) and 600 clients, on a 2.5 GbE port with PoE+.
- Single-client tests landed around 200–400 Mbps. On a UDM Pro (UniFi OS 1.12.24, Network 7.2.91, the latest stable at recording), with the AP on a 2.5 GbE port of a USW Enterprise 24 PoE, the host's Wi-Fi 6 laptop and iPhone averaged about 350 Mbps down and 350–400 Mbps up to an OpenSpeedTest server on 10 GbE. iPerf gave 200–350 Mbps; he concedes this does not test a 600-client AP.
- A 20-laptop class contest still bottlenecked elsewhere. At the Crosstalk Fundamentals of Networking class in Austin, students raced to download a 2 GB file for a prize of a U6 Enterprise and UDM SE worth about $800. The Windows 11 SMB share on the host's laptop was the weak link, and the winner took about 8 minutes; the AP "didn't break a sweat".
- Wi-Fi 6 access points are hard to load-test without real money. The host had considered a dozen Raspberry Pis running a random-browsing script but notes they are not Wi-Fi 6. He has no cheap capacity test and asks viewers for one.
Polis Pandit$The Pretextual Death of Aleksandr Dugin's Daughter
- This post includes paid content that is not available publicly. See the original source.
Scott HanselmanEmulating a C64 1541 Floppy disk drive with a Raspberry Pi. AMAZING
- Original 1541 drives are the weak point of a restored C64. Hanselman, refurbishing a 40-year-old Commodore 64 still in its original Sears box, says the 5¼-inch 1541 drive has moving parts, heads that drift out of alignment, and is very slow.
- Pi1541 emulates the drive clock-perfectly, so the C64 cannot tell. The open-source project by Stephen White (whom Hanselman says he has donated to) puts a hat on a Raspberry Pi Zero, roughly a $10 board he estimates at three to four thousand times the C64's speed, and serves disk image files picked from an SD card. He stresses that only the drive is emulated, not the C64 itself: "emulation is lying" to the machine.
- Small adapters let real Commodore hardware use modern conveniences. His second example translates between the C64's 1351 mouse and a PS/2 mouse connector, and he argues such devices let him keep original hardware while using modern mice and disk-file loading.
Andrej KarpathyStable diffusion dreams of psychedelic faces
- This post is a wordless visual piece, not a narrated lecture. Its caption track consists only of "[Music]" tags across the full 4-minute runtime, with no spoken or technical content to summarize.
GCastDeploying a Web App to Azure from VS Code [GCast 135]
- VS Code deploys to App Service through Microsoft's Azure extension. Giard installs the Azure App Service extension from Microsoft (about 60 seconds), which adds an Azure icon to the left toolbar; you pick the right subscription, expand App Services and right-click to create a new web app. His demo app is Node, but he says the method applies to any language App Service supports, such as C#, Java or Python.
- The advanced create path asks more questions for more flexibility. Its six questions are a globally unique app name, a new or existing resource group, the runtime stack (he takes the most recent Node), Windows or Linux (both supported; he picks Linux), a region chosen for latency to users and to the resources the app calls (he takes East US), and a new App Service plan with a pricing tier of free, development/test or production. Application Insights is optional and, like much of this, can be changed later in the portal.
- Creating the web app does not deploy the code. A separate Deploy button asks which folder to deploy and whether to always deploy it to this app service (he skips that); it uploads only the files needed to run, such as binaries and views, not all the source. In the demo it took about two minutes, after which "browse website" served the same page that had run locally on port 3000.
Scott HanselmanThe best progamming language to learn in 2022?
- No single best language; success is possible in any. Hanselman names C#, Java, JavaScript, Python, Ruby, Rust and Go, and argues people fixate on language details when they should be thinking about the larger systems languages live within.
- Pick by enjoyment and local jobs, and ignore "this language sucks". His advice is to learn one, see whether it "feeds your spirit", check the job market where you live, and switch if it doesn't suit; he notes your favourite websites are probably written in a language someone else thinks sucks, so success is the better metric.
GCastManaging Microsoft Edge Profiles [GCast 134]
- Edge profiles keep separate settings and accounts in one browser. Giard keeps one for work and one for personal, each tied to a different email address; he says this suits defaulting to different sign-ins, or single sign-on with a customer's account.
- A new profile is added from the profile icon and synced to an account. The icon sits at the top right; "Add profile" then asks you to sign in to sync data with an existing or new email account. Giard suggests giving each profile a different color theme so it is easy to tell which one you are in.
- Rename, repicture or remove a profile under Settings, Profiles. The three dots next to a profile offer edit (a descriptive name in place of the default "Personal 2", and a picture in place of initials) and remove. Any profile but the first can be deleted; there must always be at least one.
Andrej KarpathyStable diffusion dreams of steampunk brains
- This post is a wordless visual piece, not a narrated lecture. Its caption track consists only of "[Music]" and "[Applause]" tags across its roughly 19-minute runtime, with no spoken or technical content to summarize.
Crosstalk SolutionsSnom's Innovative Conference Phone Lineup
- Crosstalk is replacing Yealink with Snom over security concerns. The host, whose firm sells and supports VoIP systems, says Yealink looks headed for the same bucket as Huawei and Hikvision. Crosstalk evaluated several brands and is now selling Snom for its conference and DECT phones, alongside its own Crosstalk-branded desk phones.
- The C520 adds detachable wireless mics for long tables. It lists at $345 MSRP: a full-duplex speakerphone for small to mid-size rooms, with two mics rated 70 hours standby and 12 hours talk that recharge on the base. It also has PoE or a power adapter, G.722, Bluetooth pairing to a cell phone, automatic gain control, a 2-year warranty, and expansion via C52 SP speakers.
- The C620 costs more for a fully wireless phone. At $499 it keeps the wireless mics but drops Bluetooth; the phone itself lifts off a charging base and talks to a separate DECT base, with 12 hours of talk time. The host pitches it for tables with no PoE or power beneath, and it carries a 3-year warranty.
- The host's test call on the C520 sounded clear. He called Crosstalk's main line and judged the quality "really good", noting the call went over his cellular connection rather than an HD voice codec.
Andrej KarpathyStable diffusion dreams of tattoos
- The caption track contains no spoken content to summarize. The 106-second video's captions hold only automatic tags for music, applause and laughter (11 words in all), so nothing it shows or argues can be recovered from the text; the title suggests it is a montage of Stable Diffusion-generated tattoo imagery set to music.
Andrej KarpathyThe spelled-out intro to neural networks and backpropagation: building micrograd
synopsis
Starting from a completely blank notebook, this lecture builds micrograd — a roughly 150-line scalar-valued automatic differentiation engine — from first principles, then uses it to define and train a tiny multi-layer perceptron (three inputs, two hidden layers of four neurons, one output; 41 total parameters) on a four-example toy classification problem until its loss reaches essentially zero and its predictions match the targets almost exactly. The destination isn't the model — it's a complete, ground-up understanding of what every modern deep learning framework (PyTorch included) is actually doing underneath its tensors and GPUs, since he demonstrates throughout that the only difference between micrograd and production frameworks is efficiency: PyTorch does the identical math, just packaged into parallel n-dimensional arrays instead of individual scalars.
What a derivative actually measures. Rather than symbolically differentiating anything, the lecture starts from the raw definition — the limit as h approaches zero of (f(x+h) − f(x))/h — and estimates it numerically on a simple parabola, building the intuition that a derivative just measures how sensitively an output responds to a small nudge in an input, and in which direction. This same numerical-nudge approach is reused throughout as a way to sanity-check every gradient the engine computes analytically, treating agreement between the numerical estimate and the backpropagated value as the truth test for correctness.
Building the Value object and its expression graph. A Value class wraps a single scalar and overloads Python's arithmetic operators (__add__, __mul__, later power, negation, and division derived from those) so that ordinary-looking Python expressions silently construct a full computational graph: every Value remembers which operation produced it and which other Values (its children) fed into that operation. Visualizing this graph directly makes it concrete — feeding two inputs through a chain of additions and multiplications produces a small DAG whose leaves are the original inputs and whose root is the final output, with every intermediate result labeled and inspectable.
Manual backpropagation through a full expression. Working outward from a final output whose gradient with respect to itself is trivially 1, he hand-derives the gradient of every node in a small expression graph by applying the chain rule one node at a time: for any node, the gradient of the final output with respect to that node's inputs equals the node's known "local" derivative (how its output changes with respect to each input, in isolation) multiplied by the gradient already flowing into it from downstream. Working through an addition node and a multiplication node repeatedly, a clean pattern emerges: addition nodes have a local derivative of 1, so they simply copy their incoming gradient unchanged to every child (they "route" gradient); multiplication nodes have a local derivative equal to the other input's value, so they scale the incoming gradient by that value before passing it down. Every manually-derived gradient is cross-checked against a numerical nudge, and they agree.
Backpropagating through a neuron. The same machinery is applied to a biologically-inspired model of a single neuron — a weighted sum of inputs plus a bias, squashed through a tanh nonlinearity — introduced first as one atomic operation (since its forward value and derivative, 1 − tanh(x)², are both known from calculus) and later reimplemented from raw exponentiation, addition, and division primitives to prove the two approaches give bit-for-bit identical forward outputs and gradients. This demonstrates a general principle he states explicitly: the graph doesn't care whether a node represents an atomic operation like addition or an arbitrarily complex composite function — all that matters for backpropagation is that you can compute the node's output and its local derivative, a principle mirrored directly in how PyTorch lets users register entirely custom autograd functions.
Automating the backward pass. Rather than manually propagating gradients node by node, each Value gains a private _backward closure that knows how to push its own output gradient into its children according to its specific operation, and calling .backward() on the final node performs a topological sort of the graph — ensuring no node's gradient is finalized before every node that depends on it has already propagated its contribution — then walks the sorted list in reverse, invoking every node's _backward in the correct order. Along the way, a subtle and consequential bug surfaces: when a value is reused multiple times in an expression (as simple as b = a + a), naively setting a child's gradient during each backward call overwrites earlier contributions instead of combining them, giving a wrong answer (a gradient of 1 instead of the correct 2). The fix, motivated by the multivariable chain rule's requirement to sum contributions across every path from a variable to the output, is to accumulate gradients with += rather than assign them with = — a one-character difference that determines correctness anywhere a value or a set of shared weights gets used more than once, which describes essentially every real neural network.
Confirming the engine against PyTorch. The same small expression, rebuilt using real PyTorch tensors (wrapped as single-element double-precision tensors with requires_grad=True), produces identical forward values and identical gradients once .backward() is called — establishing that micrograd, despite operating on individual Python scalars instead of parallel tensor arrays, is mathematically doing exactly what a production framework does, just without the efficiency of batched, hardware-accelerated array operations.
From engine to neural network library. On top of the roughly 100-line autograd engine, an entire neural network library is built in about 50 more lines: a Neuron computes a weighted sum of its inputs plus a bias and passes it through tanh; a Layer is simply a list of independently-evaluated neurons; and a Multi-Layer Perceptron (MLP) chains layers sequentially, mirroring PyTorch's own nn.Module API closely enough that a shared parameters() method can gather every weight and bias across the whole network for updating. A four-example toy dataset (each example a 3-dimensional input paired with a target of +1 or −1) is used to define a mean-squared-error loss — a single number summarizing how far every prediction is from its target, engineered so that lower is always better and zero means perfect predictions.
Training via gradient descent, bugs and all. Calling .backward() on the loss back-propagates through all four forward passes simultaneously, populating a .grad on every one of the network's 41 parameters; nudging each parameter a small step in the negative direction of its gradient (since the gradient points toward increasing loss, and the goal is to decrease it) measurably lowers the loss on the next forward pass, and repeating this forward-backward-update cycle is gradient descent itself. Choosing a learning rate is shown to be delicate first-hand: too small converges too slowly, too large risks destabilizing or exploding the loss, though in one case the model overshoots and by luck rapidly lands in a very good spot anyway. Left deliberately uncut is a real, on-camera bug: because each .backward() call accumulates gradients onto whatever a parameter's .grad already holds rather than resetting it, omitting an explicit "zero the gradients" step before each backward pass caused gradients to compound step over step, artificially inflating the effective step size — the network still converged, but only because the toy problem was trivially easy; with anything harder, the same one-line omission (a mistake he notes he's made many times, on camera, over a career) would have derailed training entirely. The closing framing ties it all together: a neural network, no matter how large, is just a mathematical expression connecting data and parameters to a loss through additions, multiplications, and nonlinearities; gradient descent is simply following that expression's local slope downhill; and the same principles — differing only in scale, nonlinearity choice, and loss function — extend unchanged from a 41-parameter toy classifier all the way to language models with hundreds of billions of parameters.
- Backpropagation is just the chain rule applied recursively, and each operation has a distinctive way of passing gradient backward. An addition node's local derivative is always 1, so it simply routes its output gradient unchanged to both children; a multiplication node's local derivative is the other operand's value, so it scales the incoming gradient by that value before passing it on — demonstrated by manually computing every intermediate gradient in a small expression and confirming each against a numerical estimate.
- When a value is used more than once in an expression, its gradient contributions from every use must be summed, not overwritten. Building
b = a + aand calling backward revealed a bug: naively settinga.gradeach time a child is visited leaves it at 1 instead of the correct 2, because the multivariate chain rule requires accumulating (+=) gradients flowing in from every path, not assigning them. - Forgetting to zero out gradients between training steps is a classic, easy-to-miss bug that silently inflates the effective learning rate. Caught live: because each
.backward()call accumulates onto existing.gradvalues rather than resetting them, an omittedzero_grad-equivalent step caused gradients to build up across iterations, making a tiny network converge deceptively fast only because the toy problem was trivial — with a harder problem, the same bug would have stalled training. - Any function can be a node in the computational graph, atomic or composite, as long as its forward output and local derivative are both known. Implementing tanh two different ways — as one direct operation, and by decomposing it into exponentiation, addition, and division primitives — produces identical forward values and identical gradients either way, which is the same principle PyTorch uses to let users register arbitrary custom autograd functions as new building blocks.
Andrej KarpathyStable diffusion dreams of "blueberry spaghetti" for one night
- This post has no transcript content to summarize. The transcript file for this roughly 5-minute video is empty; the title indicates an AI-generated visual sequence ("blueberry spaghetti") rather than a narrated lecture.
Crosstalk SolutionsUniFi Teleport - Easy Setup VPN
- Teleport is remote access into your own network, not a privacy VPN. The host describes Ubiquiti's one-click VPN as reaching home or office resources from somewhere like a hotel, unlike site-to-site VPN or services like NordVPN. It is built on WireGuard, which Ubiquiti says stores no data, and needs a Dream Machine, Dream Machine Pro, Pro SE or Dream Router, UniFi Network 7.1 or later, and the WiFiman app.
- Issue one invitation link per user so each can be revoked. Under Settings, Teleport & VPN, you generate a link, which Ubiquiti says is single-user, and send it to the person, whose WiFiman app opens it and builds the tunnel. The invitation history shows each link's status and lets you revoke one user without affecting others.
- The Teleport client subnet cannot be changed. In the host's test on UniFi OS 1.12.24 and Network 7.2.91, the phone got 192.168.3.1 and appeared as a Teleport client. He says the subnet is fixed for now and has heard this may change.
- Test from a different network, or the result proves nothing. The host's first ping to his TrueNAS ran while his phone was still on the same Wi-Fi. After switching SSIDs, the tunnel reconnected and he could ping the server and load its web interface.
Andrej KarpathyStable diffusion dreams of steam punk neural networks
- This post has no transcript content to summarize. The transcript file for this roughly 2.5-minute video is empty, with no spoken or technical content to extract.
GCastConfiguring an Azure App Service Identity Provider [GCast 133]
- An App Service gets sign-in from its Authentication blade. "Add identity provider" offers Microsoft (Azure Active Directory and Microsoft accounts) and third parties such as Apple, Facebook and GitHub; Giard notes the third parties require you to register with them first.
- The supported account types decide who can sign in. Choosing Microsoft and a new app registration, the options are a single tenant, multiple Azure tenants, personal Microsoft accounts (Outlook.com, Hotmail, Live.com), or both Azure AD and personal accounts, which he picks for flexibility. He requires authentication and sets the HTTP code returned when it fails.
- Setup creates an app registration in Azure Active Directory. It appears under App registrations, easiest found by filtering to owned applications and sorting by created date. Giard is an owner of it, which is why he can still reach the now-protected site.
- Other users get in through a Reader role assignment. On the app service's access control blade he adds a role assignment; he calls Reader the common choice for people who use the app, and Contributor for those who manage it. Members can include guest accounts in the directory, and a Hotmail guest he assigns could then open the site.
Polis Pandit$We Must Enforce the Rule of Law While Risking Another Trump Presidency
- This post includes paid content that is not available publicly. See the original source.
Scott HanselmanDon’t you miss copying your code directly from a magazine to play a game?
- Magazines once delivered C64 games as code you typed in. Hanselman recalls that besides cassette, disk or radio, games came as printed listings in mailed magazines; a friend paid in Skittles would read the 6502 assembly aloud while he typed, and later issues added features until you had a playable game. He calls it "the coolest thing ever", and notes the channel is not a Commodore 64 channel, just his interest that week.
Crosstalk SolutionsUniFi Protect AI Theta Cameras Announced!
- AI Theta splits the lens from the camera's electronics. Per Ubiquiti's announcement, a lens with a 22 mm footprint sits flush in a wall or ceiling and connects by USB-C, up to 30 meters away, to a PoE body holding the compute. Lenses range from 360-degree to telephoto, and the early-access kit, which hit the store the day of recording, ships with a 360 lens and an 8 MP standard lens.
- Two-way audio needs a separate optional module. The speaker and microphone array is an add-on, resembling the Smart Chime in form, that plugs into the body; there is also an articulating mount. The host likes that this lets a camera watch from above a door while the speaker sits at mouth level.
- The host suspects "AI" cameras will get analytics the G4 line won't. The announcement shows people-counting over time. He guesses AI-branded models will get such features while G4 cameras stay limited to smart detections, which he says would explain the AI Bullet's $399 price against $199 for a G4 Bullet with similar lens specs. He labels this speculation.
- Expect the software to lag the hardware at launch. From past Ubiquiti releases, the host expects basic features at general availability that improve over time. Ubiquiti claims high-frame-rate 4K, lens dewarping and high dynamic range.
Scott HanselmanDid you know Ctrl-Shift-A lets you search your open tabs?!?
- Ctrl-Shift-A searches across all open browser tabs. Hanselman's tip for having too many tabs open: press it and start typing to find a tab. The video does not name the browser.
Technology and FriendsMichael Scherotter on Galeryst [TECHNOLOGYANDFRIENDS 717]
- His site turns photo albums into shareable 3D virtual galleries. Scherotter, a technical program manager at Microsoft, built it during a sabbatical because his 30 years of illustrated travel journals do not exhibit well in physical galleries; he scanned them into Adobe Photoshop Lightroom, and Adobe's opening of API access to Lightroom data during the pandemic made the site possible. He says Adobe's fund for design gave him a grant after he applied, and he launched in December 2021.
- The stack is TypeScript end to end on Azure, with Stripe billing. He describes Azure App Service running Node.js, TypeScript on client and server, Babylon.js for 3D in the browser, and WebXR so galleries can be viewed in a VR headset. Stripe runs recurring subscriptions, the cheapest at $3.99 a month, and he says that income pays for his Azure consumption.
- Free users get one gallery; subscribers get links and customization. Anyone with an Adobe ID and a Lightroom album can create one free gallery, set public, link-only or private. Subscribers can attach links to each work, such as a making-of video, an NFT or their own shop; he says he does no commerce on their behalf. He reports almost 500 people have created galleries, including schools in Indonesia and Trinidad and Tobago.
- Shipping fast without tests caused instability that unit tests cured. Scherotter calls managing complexity the biggest challenge: he built rapidly, saw stability issues, then wrote hundreds of unit tests on the Node code while isolating with COVID earlier this year. He says the tests uncovered errors, crashes stopped, and he is now more confident adding features as the sole engineer.
- Next he wants analytics showing how visitors walk through a gallery. He has no formal roadmap, takes feature requests in a GitHub repo, and now works on the site evenings and weekends. He wants to show gallery owners what visitors linger on and click, something he says a physical gallery cannot do well.
Technology and FriendsDarryl Hogan on Accelerating Technologies for Nonprofits [TECHNOLOGYANDFRIENDS 716]
- Small nonprofits lag on technology, and technologists can volunteer to close it. Hogan, who says his passion is empowering the Black community in North America, finds that small agencies living on donations lack awareness of newer technology or the resources to adopt it, unlike large charities with IT budgets. He suggests starting with your company's benefits or community-giving coordinator, or asking contacts in your tech community, and says he has never offered help and been refused.
- His project moved a nonprofit's hard-to-maintain site into the cloud. The organization, a not-for-profit that helps other not-for-profits (Hogan confirms its site as givinggap.org), keeps a central database of Black-founded or Black-focused organizations where visitors can learn about them and donate. Hogan says the site was not scalable and the group had no real DevOps capability, so the work grew from a site rebuild into cloud hosting that frees office staff for fundraising.
- No free cloud credits came, so the design fit their budget. Hogan says the cloud providers they checked had no program they could use right away, partly because the organization was still working on its 501(c)(3) designation. It could carry light hosting costs, and the solution was built to land within those constraints.
- Resistance to change is overcome by earning trust. Hogan says a working solution makes any change look like a gigantic risk to non-technical staff. His answer is to show you understand the technology, show why it benefits the organization, and build relationships with its administrators until they are confident you can deliver.
- Volunteer-built solutions must be sustainable after the volunteer leaves. Hogan says skilled tech volunteers are scarce and usually "fly in, do what you can do, and fly out", so the next person will likely arrive blind. He contrasts for-profits, which he calls more hierarchical and mission-driven in adopting technology, with small nonprofits, where the aim is better day-to-day operation and the leader signing the check may not understand the technology at all.
Polis Pandit$Trains, Climate Change, and the Week In Politics
- This post includes paid content that is not available publicly. See the original source.
GCastManaging Azure Key Vault Secrets from a .NET App [GCast 132 ]
- The app needs its own Azure AD identity with a client secret. After creating the vault (episode 130), Giard registers an application under Azure Active Directory, App registrations, keeping the single-tenant default and no redirect URI, then adds a client secret under Certificates and Secrets set to renew every six months. He stresses that creation is the only chance to copy the secret's value, and also notes the client ID and tenant ID.
- A vault access policy grants that registration's principal its permissions. The app runs as the registration's principal, not as the vault's creator, so he adds a policy using the Secret Management template (all secret permissions, no keys or certificates) plus purge. He warns it is easy to forget the final Save, without which the change is lost.
- DefaultAzureCredential reads the identity from environment variables. He sets Azure client ID, client secret and tenant ID as environment variables, then restarts Visual Studio because they are read on startup.
- SecretClient covers listing, setting, soft-deleting and purging secrets. Pointed at the vault's vault.azure.net URI, it lists non-deleted secrets via get-properties-of-secrets and sets them with SetSecretAsync. StartDeleteSecret only begins a deletion that may take about 30 seconds, so his code polls the returned operation until HasCompleted; the result is a soft delete, recoverable until purged (90 days by default), and PurgeDeletedSecret removes it for good. In the demo the soft-deleted secret showed under Manage deleted secrets and the purged one did not.
- Giard publishes the demo code on his GitHub. It is in a repository named Azure Key Vault demo, with the code in program.cs; users must set the environment variables and change the vault name to their own.
Technology and FriendsJeff Fritz on .NET Conf [TECHNOLOGYANDFRIENDS 715]
- The November .NET Conf is a launch festival for .NET 7. Fritz, now executive producer of the .NET Conf events, says the series has run online for 11 years. He describes an eight-hour focus event on .NET MAUI on 9 August and a three-day November 2022 event (Giard gives the dates as 8–10 November) announcing .NET 7, C# 11, and updates to .NET MAUI and Blazor, with more one-day focus events planned but not yet chosen.
- .NET releases no longer move in lockstep with Windows. Giard likens the event to Microsoft's old combined product launches. Fritz says those were driven by each new Windows needing new tools and a new .NET Framework, while open-source .NET (Core, then .NET 6 and 7) can now ship on its own schedule, with a production-ready release supported for three years; in 2021 Visual Studio 2022 launched on the Monday and .NET 6 on the Tuesday.
- Two Microsoft days hand off to 24 hours of community speakers. Day one is the announcement and day two covers other Microsoft technologies such as Power Platform, Teams, Windows and Azure, each a nine-to-five day. From 5 p.m. on day two the community takes over around the world for 48 sessions ending at 5 p.m. on day three; Fritz cites past talks on .NET running a hot tub and Cam Soper's barbecue.
- Microsoft and community speakers go through the same open call. Submissions go through Sessionize from the conference website, closing 8 September, though Fritz advises treating it as 7 September. Sessions are 25 minutes plus five minutes of Q&A and mostly live, with some pre-recorded content; each event has about 80 sessions, all archived on the .NET YouTube channel within days.
- Publishing regularly builds an audience, even before the content is good. Fritz says that by October 2017 he was worn out writing blog posts as a Microsoft community manager; Carl and Richard suggested podcasting, and a colleague a week later pointed him to live coding on Twitch, which he says changed his life. He now streams twice a week and says his goal is people learning and advancing their careers, not being internet famous.
GCastManaging Secrets in an Azure Key Vault [GCast 131]
- A secret is a name-value pair kept out of code and config. Giard suggests connection strings or passwords that should not be checked into source control or put in a config file; the app is told where the vault is and given permission to it. New secrets are created on the Secrets blade with Generate/Import, using the Manual option, since importing certificates has moved to its own blade and the certificate option there is deprecated.
- Optional fields label secrets and limit when they are usable. Content type is free-form text and tags are metadata for reporting, such as by user or department. A secret can be set to enabled "no", or given an activation and expiration date, outside which applications and users cannot access it.
- Saving a new value creates a version and keeps the history. "New version" replaced the demo value while the old version stayed listed alongside it.
- Deleting a secret soft-deletes it, recoverable until purged. Deletion takes about 30 seconds to complete; under Manage deleted secrets you can recover the secret (it came back with its versions) or purge it permanently. By default it is purged automatically after 90 days, which is configurable when the vault is set up.
- Missing buttons or errors usually mean missing access-policy permissions. The vault's creator appears under Access policies with eight secret permissions selected by default; Giard says an unchecked box, such as purge, is the likely cause if an action is unavailable.
Crosstalk SolutionsSnom M-KLE DECT Cordless Handsets - w/Shared Line Appearance!
- Crosstalk is moving its DECT recommendation from Yealink to Snom. The host cites security concerns at Yealink like those around Huawei and Hikvision. These handsets are now what Crosstalk recommends and sells for both its FreePBX-based PBX systems and its Crosstalk Cloud PBX.
- The M-KLE line is VTech's own design, not rebranded RTX hardware. The older Snom M series was rebranded RTX equipment, while the M-KLE series came after VTech acquired Snom. The M100 KLE base ($99 MSRP, DECT 6.0, PoE or adapter) supports 10 handsets and six concurrent calls; an M18 KLE desktop DECT phone serves desks without Ethernet.
- The rugged handset costs over twice the standard one. The M10 KLE is $89 and the M10R KLE $189, the latter shockproof and water-resistant with a locking battery. Both offer G.722, 7 days' standby, 9 hours' talk and a 3-year warranty. The host gives range as about 500 feet in open space, less through walls, and the host has no dead spots on his property.
- Shared line appearance recreates key-system behaviour on cordless phones. Line buttons for up to four shared lines show a held or in-use call on every handset. In the host's demo a call was put on hold on extension 201 and picked up on 202, and paging lets staff announce the line; he says other DECT handsets may lack this, suiting restaurants and dealerships.
Technology and FriendsMichael Mishal on Reinforcement Learning [TECHNOLOGYANDFRIENDS 714]
- Reinforcement learning trains an agent by rewarding good actions. Mishal, a Microsoft technical trainer, describes an agent exploring an environment, such as a game or driving a car, and trying to maximize its score at every step. He says training must simulate the bad cases too, losing points for leaving the road and gaining them for stopping at a stop sign, or the agent learns only one way and fails when something goes wrong.
- The cloud has made the required compute affordable outside research centres. Training deep neural networks, especially on images for autonomous driving, needs powerful GPU and CPU environments that Mishal says once only universities and big research centres had. On Azure the trade-off becomes how long you can wait versus how large a compute cluster you reserve; setup still takes several steps (a machine learning workspace, compute clusters, Jupyter notebooks) and a framework he describes as mainly Python.
- Recommendation systems are another use, trained actively or passively. Mishal cites a personalizer that recommends movies and is rewarded when the viewer likes them. The agent can learn actively from the user's live choices starting from nothing, or passively from simulated learning such as a year of viewing history.
- An agent will maximize reward even when the result is useless. Giard brings the examples: a bot trained on tweets that became racist and was shut down, and a robot from the book "You Look Like a Thing and I Love You" that learned to fall over to reach a goal fastest. Mishal's remedy is monitoring how the model is rewarded under responsible AI, and in a generative adversarial setup controlling the discriminator with safeguards, such as giving inappropriate output negative or no reward.
- Multi-agent learning requires agents to learn cooperation. Mishal's current project trains multiple agents to navigate terrain from point A to point B while maximizing each other's reward; with two doors, uncoordinated agents may each head for the far door and collide. He points learners to Microsoft Learn's machine learning modules, including a demo that trains an agent to play Pong.
GCastCreating an Azure Key Vault [GCast 130]
- Key Vault stores secure data only specified identities can reach. Giard lists certificates, encryption keys and secrets (name-value pairs such as a connection string or password), accessible only to the applications, user accounts and services you specify.
- Only the Basics tab is required to create a vault. From Create resource, the dialog also has access policy, networking (public and private networks) and tags tabs, which he skips. Basics takes a resource group, a name and a region chosen to minimize latency for whoever reads the vault. The pricing tier is standard (the default and cheaper) or premium, whose main difference is support for HSM keys.
- Deleted objects are soft-deleted and recoverable for a retention period. The default period is 90 days and can be changed (he cites 7 or 30 days); after it, items are purged permanently. Items can also be purged early by hand unless purge protection is enabled, which he leaves off.
- Review and create validates before deploying. The button is enabled only when nothing is missing or inconsistent, and deployment took about 30 seconds in the demo.
Polis Pandit$Climate Change, Authoritarians and Autocrats, Justice Alito and Theocracy, and Nancy Pelosi Trading as an Insider
- This post includes paid content that is not available publicly. See the original source.
Scott HanselmanWriting C# on a IoT Microcontroller with .NET and the Wilderness Labs Meadow Project Lab Board
- Meadow brings plain C# and .NET to a microcontroller. Hanselman demos Wilderness Labs' Meadow F7 Feather (version two) on its Project Lab board, an expander with a screen, buttons, relays and sensor buses that removes the wiring a bare developer kit needs. He discloses that he is an investor in Wilderness Labs, says the video is not paid, and says he did not tell the company he was making it.
- The sample weather app shows how readable the code stays. In the Project Lab samples cloned from the Wilderness Labs GitHub, he shows Wi-Fi joined in one line of C#, an onboard barometric sensor read through the Meadow Foundation sensors namespace, an OpenWeatherMap REST call deserialized straight into a typed object with async/await, and a view-model pattern for the colour screen. The app updates indoor and outdoor temperature at the top of each minute.
- A microcontroller runs one program, not an operating system. He contrasts it with a Raspberry Pi, which runs a full Linux desktop and lasts hours on battery, while a microcontroller boots into a single program and can run for days.
- WSL can take over USB flashing that is awkward on Windows. Flashing STM32-family devices from Windows tends to fail when they drop into DFU mode, and he shows that happening. Using Andrew Leach's WSL USB GUI, a wrapper over the command-line tools, he detaches the STM bootloader from Windows and attaches it to Ubuntu by tunnelling USB over IP, so it can be flashed from Linux without installing drivers.
- His next project is the blood sugar display, in C#. He calls blood sugar his "hello world" and plans to rebuild his CircuitPython glucose display on the Meadow's screen, which he estimates will take "maybe an hour or two this weekend."
Crosstalk SolutionsBest Practice pfSense Initial Setup w/Netgate 4100
synopsis
The video ends with the base pfSense build Crosstalk gives a small business: a secure LAN, plus a guest VLAN that can reach the internet and the router but no private subnet, including ones created later. Dave Barger, Crosstalk's in-house pfSense engineer, configures a Netgate 4100 while the host asks questions. The video also promotes Crosstalk's in-person networking course, which uses Netgate appliances.
The appliance. The 4100 is $599 MSRP, fanless, and can be wall- or rack-mounted. It is the lowest Netgate model with high availability, which is why the host favours it where uptime matters. It runs a dual-core Atom at 1.8 GHz with 4 GB RAM, has two RJ45/SFP WAN ports, and bridges four ports as the LAN.
The wizard. Logins are admin/pfsense, and the LAN defaults to 192.168.1.1. Barger sets Google DNS with Cloudflare as backup. He unblocks RFC 1918 on the WAN only for a double-NATed ISP. The host's early Starlink dish gets a public IP. The first update check failed because "GMT-8" meant eight hours ahead. Picking America/Los_Angeles fixed it, and the box went from 22.01 to 22.05.
Packages and backup. Barger installs the OpenVPN client export wizard, Snort and WireGuard. He often runs both VPNs for different kinds of client. Netgate's auto config backup uploads on every change and keeps up to 50, encrypted with a long password; the device key goes into a password manager.
Guest network. VLAN 10 gets a static 192.168.10.1/24 and DHCP. pfSense applies rules on the inbound side, and the new interface has no allow rule. The rules, top-down, allow the guest interface address, block an RFC 1918 alias, then allow all. Barger adds that the access point must isolate guest clients from each other.
PBX. For a locally hosted PBX, an outbound NAT rule with static port stops rewriting that breaks RTP. Outbound NAT goes to hybrid. QoS, dynamic DNS and VPN setup are left for later.
- The Netgate 4100 is the cheapest Netgate appliance that does high availability. At $599 MSRP (support tiers extra) it pairs two units over a heartbeat port, a setup the host says Crosstalk, which installs pfSense for business clients, builds repeatedly. It has an Intel Atom C3338R dual-core at 1.8 GHz, 4 GB DDR4, two WAN ports that take RJ45 or 1 Gb SFP, and four ports bridged as the LAN switch.
- Set the time zone by city, not by GMT offset. Dave Barger, the Crosstalk pfSense engineer, sets DNS to 8.8.8.8 with 1.1.1.1 as backup, and unticks the WAN's RFC 1918 block only behind a double-NATed ISP. The host's first-generation Starlink dish hands over a public IP, so he left it on. Choosing "GMT-8" put the clock eight hours ahead and the update check failed until he switched to America/Los_Angeles. Updating 22.01 to 22.05 takes about five minutes, but Barger books an hour with clients.
- Barger installs the same VPN, IDS and backup tools on every pfSense box. He adds the OpenVPN client export wizard, Snort (needs a free community key) and WireGuard. He often runs both VPNs: WireGuard for lightweight devices, OpenVPN for Windows machines. He turns on Netgate's auto config backup, which uploads on every change and keeps up to 50, protected by a long encryption password; the device key on the Restore tab goes into a password manager.
- A guest VLAN needs its own allow rule, under two higher rules. The wizard only creates allow-all for the main LAN. On guest VLAN 10 (192.168.10.1/24, DHCP .2–.254) the rules run top-down: allow traffic to the guest interface address, block an RFC 1918 alias (10/8, 172.16/12, 192.168/16), then allow all. The alias also covers subnets added later. Client isolation has to be enabled on the access point, because same-subnet traffic never reaches the router.
- Stop pfSense rewriting the ports of a locally hosted PBX. Outbound connections always get their ports rewritten, which Barger says is fine for everything except RTP streams. His fix is an outbound NAT rule with the PBX as a /32 source and static port ticked, with outbound NAT switched from automatic to hybrid. Anything beyond that depends on the PBX provider.
Scott HanselmanHacking on an AdaFruit M4 Matrix Display with CircuitPython to show my Blood Sugar using Nightscout
- Displaying his blood sugar is his test for any new device. Hanselman, who is type 1 diabetic and wears a Dexcom sensor, pulls his last five readings from his cloud-hosted Nightscout instance onto Adafruit's Matrix Portal M4 driving a 64×32 LED matrix. He says it covers HTTP with SSL, JSON parsing, multiple data types, a trend direction, and drawing on a tiny display.
- CircuitPython's mount-as-a-drive workflow is ideal for learners. The board shows up as a disk drive, and saving
code.pyreboots it and runs the code. It also exposes a COM port for debug output, which a VS Code CircuitPython extension (by Joe DeVivo, by his account) can monitor. - GitHub Copilot sped up writing a language he does not know. He admits he does not speak Python. Copilot guessed the next colour after "red green yellow", filled in the full set of arrow glyphs once he started on them, and wrote the "from epoch" comment for a timestamp field, which he calls "creepy".
- The real question is how much of borrowed code you must understand. He takes an Adafruit moon-phase sample's accelerometer maths, which uses an arc tangent plus pi, and tries values in a Python REPL: (0, −10) gave 270 and (10, 10) gave 180. He decides it is enough to know it yields a 0/90/180/270 rotation, but says knowing why bitmap fonts load only the glyphs you need (device memory is tight) does matter.
- Working code is not idiomatic code, and he shows his own shortcuts. He could not find a way to turn the label red above 200 once its colour was set, and he maps strings like "flat" to arrow glyphs crudely. He catches every error and retries after a minute, and he spots a five-second sleep he meant to be five minutes, which raises whether to loop tightly for a clock or sleep to save power. He compares it to speaking a new language: first you make yourself understood, then you learn to sound like a native.
Scott HanselmanMoving 17 years of old legacy code and websites into the Cloud - Scott Hanselman at NDC Porto 2022
synopsis
In this NDC Porto 2022 talk, Hanselman recounts moving hanselman.com, his podcast site and his DasBlog blog off a dying physical server and onto Azure platform as a service without anyone noticing. He ends up with all of it on .NET 6, running on Linux or Windows from a single cheap App Service plan, with nearly everything held in memory. His closing argument is that the cloud's tooling, not individual brilliance, is what lets one person run like a team.
The server under the desk. As an MVP he was given what he believed was a free virtual machine. When disk-full errors began, the host, since sold to a Quebec company, found it was a physical mini-tower once kept under an employee's desk. It ran Windows Server 2003 on a 30 GB spinning drive, could not do TLS 1.3, and was 19 years old against a five-to-seven-year mean time before failure. He backed everything up first, but he no longer trusted that he could rebuild the sites.
Choosing the target. He dismisses lift-and-shift, imaging the disk with disk2vhd and running it in the cloud, as keeping a dying machine alive in the matrix. IaaS is "free like a puppy", since you still maintain the kernel. PaaS lets him care only about the runtime version.
Porting, easiest first. He moved the brochure site, then the podcast site, then the blog, from .NET 2 and 4 to .NET 6, building on both Windows and Ubuntu under WSL. The only bugs were hard-coded backslash paths. Running on Linux opened hosting about 30% cheaper and allowed Docker, where a multi-stage build compiles in a roughly 300 MB SDK image and ships a roughly 100 MB runtime image. He recommends running a personal site as the way to learn production, since only the owner carries the pager.
Making it better, not just moved. Cloud machines are slower but rich in RAM, so DasBlog's 4,964 XML files (about 384 MB for 20 years of posts) load into memory at startup. Images sit on a CDN on a separate subdomain for parallel DNS lookups, and podcast art is named by show number instead of being stored in a database. Sponsors are a text file he edits on Thursdays. Four sites share one $35 plan at about 12% CPU and 65% memory, which he says is fine to run hot in the cloud.
Tools as the 10x. Application Insights produces a dashboard showing about 5 ms average response time. Each footer links the runtime version, live commit and build log. An Azure Front Door reverse proxy split traffic 50/50 between the Quebec box and the cloud before an IP swap. He notes that load balancing, once a consultant's job, is now a checkbox.
Questions. About 70% of DasBlog was .NET Standard and recompiled unchanged, while its Web Forms templates were rewritten as Razor Pages. He says WinForms apps moved to .NET 6 run 30–50% faster and can ship as a single self-contained executable, which tree trimming shrinks to about 118 MB.
- His "free virtual machine" was a forgotten physical PC. The host that gave Hanselman, then an MVP, a server for hanselman.com had been sold to a Quebec company. When he ran out of disk, it turned out to be a physical mini-tower once under an employee's desk, running Windows Server 2003 with a 30 GB spinning drive and no TLS 1.3. He calls the 19-year-old drive his deadline: if it stopped spinning, it would never start again.
- He rejected lift-and-shift and moved to platform as a service. Imaging the disk into the cloud with Sysinternals' disk2vhd would be "a bandage on cancer", and IaaS is "free like a puppy" because you still patch the kernel. He ported the brochure site, podcast site and DasBlog from .NET 2/4 to .NET 6 on both Windows and Linux. The only bugs were hard-coded backslashes in paths, and Linux hosting was about 30% cheaper.
- Docker multi-stage builds keep the compiler out of production. The build runs in a roughly 300 MB SDK container, and only the published output is copied into a runtime image of about 100 MB. He had previously been shipping the whole SDK.
- Cloud-native, to him, means spending cheap RAM instead of databases. DasBlog stores 20 years of posts as 4,964 XML files, about 384 MB, which he loads entirely into memory for sub-millisecond reads. Images go to a CDN on a separate subdomain so browsers can parallelize the lookups, and sponsors live in a text file. He argues most apps over-engineer (YAGNI): cache for five to ten minutes, because "real time" rarely needs to be real time.
- Cloud tooling, not genius, makes a "10x developer". He runs four sites, including Azure Friday, on one $35 App Service plan (about 12% CPU, 65% memory), arguing cloud machines can run hot. Each site's footer shows the runtime version, the live commit and its build log. He cut over through a reverse proxy (Azure Front Door), splitting traffic 50/50 with the old server before swapping, and says this once took a team.
Polis Pandit$Charging Donald Trump and Destroying the Western World Order
- This post includes paid content that is not available publicly. See the original source.