Souk's Notes - Unofficial Summaries

2021-12-20 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2021-12-16 · open the original ↗

• Use a queue when calls outnumber agents; otherwise a ring group. Both distribute calls to several people, but queues add ring strategies, agent login and pausing, and capacity and timing limits; the host builds a sales queue (5050) and a customer service queue (5051), each failing over to its department's voicemail with the unavailable greeting.
• Turn on autofill so later callers don't wait on the first. With autofill off, a second caller sits until the first is connected, even while the first rings agent after agent; with it on, each waiting call rings the next agent in the round-robin-with-memory order. Skip busy agents is set to "queue calls only" so personal or internal calls don't block queue calls.
• Static agents always ring; dynamic agents log in, with priorities. A dynamic agent such as a manager can join only for overflow, and priority 1 agents get calls only when every priority 0 agent is busy, paused or unavailable. The host sets a 10-second agent timeout with 5-second retry, 10-second wrap-up, and auto-pause so an absent agent stops adding 15 seconds per caller.
• Timing and capacity rules decide when callers hit failover. Max wait (e.g. 5 minutes, strict or loose), max callers (e.g. 10, then the 11th goes straight to voicemail), and the host's usual join-when-empty no, leave-when-empty yes keep calls from stranding; position and hold-time announcements, an IVR breakout and an SLA service level for reports are also available. He declines iSymphony over its licensing.
• BLF keys beat feature codes for agent login and pause. 45 logs in or out (optionally 45extqueue) and *46 pauses, but users struggle to learn them; a BLF key using the __SIP_USER_1__ template variable shows status by colour. The host, whose firm sells them, says this variable works only on Crosstalk/Clearly IP phones, not Yealink, and cites it as why he promotes them.

2021-12-13 · open the original ↗

• Companies knew remote work was possible but not at this scale. Damian says sending whole staffs home at once strained internet links, data-centre bandwidth and the devices handling secure traffic, and companies licensed for a set number of concurrent VPN connections had to buy more; IT staff also had to support people using home Wi-Fi and home setups for the first time.
• Attackers used COVID as a ready-made pretext for phishing. From March–May 2020 Damian saw phishing themed on the pandemic, such as links about doing groceries under lockdown or claiming April COVID benefits; he argues the fear was already built in, so attackers barely had to work on the message, and the more personal or serious the hook, the more people click.
• State-sponsored supply-chain attacks grew in size and complexity. Damian says from about the second half of 2020 attackers targeted security vendors and software used by managed service providers, gaining access to every customer at once; he cites NotPetya, spread through the update mechanism of a Ukrainian accounting package, infecting perhaps 80% of its SMB customers within hours (he says he does not recall exact numbers). IT staff working from home added hours or days to incidents needing someone on site.
• The pandemic pushed adoption of zero trust and "assume breach." Damian describes zero trust as explicitly verifying identity, location, device health and the workload requested, flagging anomalies (an Excel user at 3 p.m. Wednesday versus two terabytes downloaded at 2 a.m. Saturday) and granting just-in-time, just-enough access that is revoked automatically. He says attackers on average keep access for six to nine months before detection because organisations are not looking for signs of breach, so they should plan how to detect, block and remediate one. He also says companies that adapted quickly survived, often by compressing digital-transformation plans from months or years into weeks.
• Security work is shifting from reactive to proactive. Damian describes three waves of GDPR demand: panic in the six months before it took effect, renewed requests once the first large fines hit, and a third driven by remote access to data; he argues the principles should apply to all data, not just personal data. He says roughly 90–95% of security requests used to follow a breach, customer demand or compliance requirement, and he now sees more companies coming proactively. Giard frames this as companies finally treating the risk seriously rather than checking boxes after a cookie-banner first wave.

2021-12-10 · open the original ↗

• USB devices can now be used inside WSL through a third-party project. Loewen, the WSL product manager, says the open-source usbipd-win, with contributions from a Visual Studio team intern, unblocks USB workflows now, while better-integrated USB support in WSL itself is "longer term". Hanselman discloses that he sponsors the project's maintainer, who is based in the Netherlands, on GitHub.
• It tunnels USB traffic over IP without leaving the machine. The tool wraps USB packets in IP and unpacks them in a Hyper-V guest or WSL2, and Hanselman calls it "a wormhole for USB". Loewen explains that WSL depends only on the Virtual Machine Platform component, a subset of Hyper-V, which Hanselman notes means it runs on Windows Home.
• Linux flashing instructions now work without fighting Windows drivers. Hanselman shows a Wilderness Labs Meadow board, an STM32 microcontroller, in DFU bootloader mode with no driver installed. usbipd wsl list showed it at bus ID 9-4, and usbipd wsl attach asked for a sudo password and handed it to Ubuntu, where lsusb saw it. meadow flash os then succeeded once it was run under sudo with its full path. He says the setup took him about five minutes.
• Serial COM ports remain unsupported, so that work stays in Windows. When the flashed board rebooted it came back as a USB serial device on COM9 in Windows, and Ubuntu lost it. Hanselman went back to Visual Studio in Windows for the app, and both speakers raise COM port support only as a possibility for the future.
• The subsystem now ships separately from Windows, for faster updates. Loewen says WSL is available in the Microsoft Store, with a new logo. It is the same runtime and works the same way, and coming through the Store means it gets updates faster and more easily.

2021-12-09 · open the original ↗

• Ring groups suit lines where answerers outnumber calls. The host's rule of thumb: a receptionist or accounting group that gets occasional calls should ring everyone at once, while a call centre with more callers than agents needs a queue. Anything beyond the ring-all strategy, he says, usually means you want a queue.
• Every ring group needs a failover destination so calls aren't stranded. His reception group (5000) rings two extensions for 20 seconds (about four rings at roughly 5 seconds each), then goes to the general voicemail's unavailable greeting. Accounting (5001) goes to an announcement and then to a voicemail box with instructions only. A test showed that with no members registered, calls skip straight to failover.
• Callers to a front desk should hear ringing, not hold music. For a small organization whose receptionist answers every inbound call, hold music sounds wrong to callers on first contact. Queues can use hold music while callers wait.
• Caller-ID prefixes and alert info tell staff which group rang. A prefix such as "GEN" marks ring-group calls. Alert info sets a distinct ringtone on Sangoma, Crosstalk, Clearly IP and Digium phones. The host typically uses separate internal and external ringtones, and a ringer volume override is also available.
• The host usually enables "ignore call forwarding settings". Otherwise a receptionist at lunch with Find Me/Follow Me on would have group calls forwarded out to them. Skip busy agent is situational. With it on, a third caller while both receptionists are busy goes to failover. He thinks receptionists should be able to put a caller on hold and pick up the second call instead.

2021-12-09 · open the original ↗

• An announcement plays a recording, then moves on without caller input. Unlike an IVR, the caller cannot press keys to skip or choose. The host builds weather, holiday and general closure announcements, each sending callers to the general voicemail box (6000), leaving the other options at their defaults.
• Pair an announcement with "instructions only" voicemail to replace a personal greeting. The accounting no-answer announcement drops callers into an individual's mailbox with instructions only. Callers hear the department message plus the standard "leave a message after the tone" prompt, not that user's own outgoing greeting. The other choices are the busy greeting, the unavailable greeting, or no message.
• Announcements suit messages callers must not bypass. The host's example is "your call may be recorded for quality assurance purposes" before a queue. He describes this as serving as two-party consent where call recording requires it.

2021-12-09 · open the original ↗

• Going deep into crypto cures financial ignorance as a side effect. He argues that a serious crypto learner picks up far more than technology, platforms or some coding. Without meaning to, they also learn finance and close what he calls a "huge chasm" of financial ignorance.
• Making money fast forces a reckoning with wasted time. Once someone has learned finance and has stable income coming in, he says, they realize how much time they wasted on stocks or "deadbeat jobs". That leads them to ask what else they are doing poorly and could educate themselves on. He says this step applies beyond crypto.

2021-12-03 · open the original ↗

• An upstream API migration broke his site's single-call episode feed. Channel 9 has joined Microsoft Learn. Hanselman's azurefriday.com loaded every Azure Friday episode (about 700) in one call from the old Channel 9 API. The replacement docs hierarchy service pages results at a maximum of 30 and carries no media. Thumbnails and the rest need a second, batch call keyed on entry IDs, which turns one GET into "cascading calls".
• Probe the API's edge cases before writing code. They found that an oversized page size returns a clear error, that a page past the end returns an empty array (so that is the stop signal), and that there are no next-page links. The batch endpoint accepted 30 and 31 IDs without removing duplicates. Around 300 IDs drew an HTML bad request, then a 404, and Hanselman suspects Azure Front Door blocked him. The reported total was 351 rather than 700; his guess is that older episodes were cut off.
• Every design is a set of trade-offs, so limit the scope. Edwards frames the first choice as fanning out per request versus building the data periodically, and says the second raises cache invalidation and the question of who runs the job. A startup worker writing to disk raises further questions: write access, containers, redeploys, concurrency and scale-out. Edwards argues the step from one instance to two changes the most. Hanselman answers growth to 200 with "that's a great problem to have" and YAGNI. His plan is a console app for now, later an Azure Function or cron job writing a JSON file to storage.
• Senior judgment is remembered failure, and public content hides iteration. Edwards says you learn from failure over time, and what you need to retain is the failure modes you have hit, not the APIs. Hanselman worries that "you poser" comments drive early-career people out of tech. Edwards replies that published code hides the iteration everyone relies on, and that what is correct today can be wrong after a 10x traffic spike.
• Navigate loosely with JsonNode, then deserialize into a record. In a .NET 6 console app, Edwards says HttpClient is still the default answer but that servers have to manage its lifetime and DNS caching. An interpolated string is evaluated when it is created, so a string.Format placeholder suited the page number. They walked the response with System.Text.Json.Nodes and an explicit cast to int, then handed each episode to JsonSerializer.Deserialize into a Show record whose property names match the JSON. Edwards would have started from JsonDocument or a typed response instead. The run printed titles; the paging fan-out and the batch call were left for a follow-up, and the code is not yet defensive about nulls.

2021-12-02 · open the original ↗

• The DOJ says the 2021 Ubiquiti "whistleblower" was the attacker. Citing BleepingComputer and a Southern District of New York indictment, the host reports that former senior developer Nickolas Sharp was charged with stealing data using his own cloud-admin credentials. The indictment alleges Sharp then posed first as an anonymous hacker and then as a whistleblower; he faces four counts carrying a maximum of 37 years if convicted on all.
• The indictment says an internet outage exposed his home IP address. The alleged sequence: he cloned about 155 GitHub repositories over SSH in December 2020 through Surfshark VPN, but one clone command came from his home IP in Portland, Oregon right after his internet went down. The host blames a missing VPN kill switch and recommends Private Internet Access for having one.
• The indictment alleges he covered his tracks and lied to investigators. He set a one-day log-retention policy on AWS, joined Ubiquiti's own incident-response team, and denied using Surfshark. His ransom email asked 25 bitcoin for the data plus 25 for a "backdoor"; the host puts the 50 at about $1.9 million. Sharp then lied to the FBI after its March 24, 2021 search.
• His planted stories allegedly cost Ubiquiti over $4 billion in a day. Per the reporting, the stock fell roughly 20%, from $349 on March 30 to $290 on April 1, 2021, after the Krebs on Security story. Sharp's claim that Ubiquiti kept no logs was, by the indictment's account, a result of his own tampering.
• The host retracts his April 2021 criticism of Ubiquiti and apologizes. He says he fell for the story "hook, line and sinker" because Krebs on Security is a trusted source. His advice on resetting credentials and MFA still stands, but he calls everything else in that video baseless.

2021-12-01 · open the original ↗

• A general voicemail box is a virtual extension shared by a group. The host creates virtual extensions that never SIP-register: 6000 for general/after-hours, 6001 for sales and 6002 for customer service. Each has voicemail enabled, a password matching the extension so the first dial-in runs the setup wizard, and email notification with the WAV file attached.
• *97 checks your own mailbox; *98 checks any other. *97 assumes the calling extension, like the envelope button, while *98 prompts for which mailbox. Dialing * plus an extension (*6000) goes straight to that mailbox to leave a message.
• A BLF key on *98+mailbox lights when messages wait. The host sets a template line key to BLF with value *986000, which turns green when the box is empty and red when it holds messages. Because it lives in the phone template, every phone using that template gets the shared indicator, and he suggests separate templates for receptionist, sales or service phones.
• Test voicemails shorter than 5 seconds aren't kept. The host warns that a quick "test test" message never appears because the system ignores recordings under 5 seconds, which he says has tripped people up.

2021-12-01 · open the original ↗

• A system recording is a reusable audio entity. One recording, such as the main IVR greeting, can be used in many places across the PBX. The host makes five for his design: main IVR, closed general, closed weather, closed holiday, and an accounting no-answer message. He concedes a single "closed" recording would serve.
• Recordings can be made in three ways. You can call an extension and record over the phone, which must then be named and saved. You can record in the browser, which needs a valid HTTPS certificate such as Let's Encrypt for microphone access. Or you can upload a WAV or MP3 file. For customer systems the host records with a good microphone in Audacity, trimming the silence at each end.
• Linking a recording to a feature code lets staff re-record without the admin GUI. In the host's example, *291 re-records the main IVR. This suits often-changed weather or holiday messages, with a printed sheet of codes by the responsible person's phone. A feature-code password stops accidental or unauthorized re-recording.
• An announcement in front of a mailbox replaces the personal greeting. Unanswered accounting calls get a department message first. They then drop into an individual's mailbox with no outgoing greeting. The host notes Allison Smith, the voice of Asterisk's prompts, can be hired so custom recordings match the system voice.

2021-11-30 · open the original ↗

• Inbound calls pass a manual weather toggle before anything else. The host's design for the fictional Dunder Mifflin starts with a call flow control (a feature code, *280, flips it) that, when switched, sends every call to a closed-due-to-weather announcement and then the general voicemail box.
• Two time conditions follow: holidays first, then business hours. A holiday match plays a holiday announcement; outside Monday–Friday 8 am–5 pm and Saturday 8 am–12 pm a closed announcement plays. Both end in the general voicemail box, and only open-hours calls reach the main IVR.
• Each IVR option ends in its own fallback voicemail. Pressing 0, timing out or pressing an invalid digit rings the receptionist ring group, then general voicemail; 1 rings the sales queue, then a sales voicemail; 2 a customer service queue and its voicemail; 3 an accounting ring group, a no-answer announcement, then one named person's voicemail.
• The design is deliberately broader than most real IVRs. The host built it to touch many FreePBX features and will implement it over roughly the next ten videos, starting with system recordings; he says it mirrors what Crosstalk builds live with customers as part of its turnkey installation service, and offers the diagram as a PDF download.

2021-11-29 · open the original ↗

• Backup YubiKeys must all be enrolled in the same setup. The host says you cannot add TOTP to one key and add backups later; you disable 2FA on the site (here the Ubiquiti account at account.ui.com), re-enable it, and scan the one QR code into Yubico Authenticator on every key before confirming with a code.
• Generate fresh backup codes after re-enrolling. The host treats the site's backup codes as the final fail-safe if every key and phone is lost, so you are not left begging the company to restore access; he stores them somewhere safe.
• The host splits codes between YubiKeys and Google Authenticator. He prefers hardware keys because switching from an iPhone 8 to a new iPhone carried the Google Authenticator app over but none of its codes; he puts daily-use codes on his YubiKey 5 NFC and 5Ci keys and rarely used ones on the phone, while noting apps like Authy do sync across devices.
• A keychain YubiKey has held up for over a year. The host reports no durability problems from daily pocket carry, and mentions a new Yubico protective sleeve for those worried; product links in the video are affiliate links, he says.

2021-11-28 · open the original ↗

• The G4 Instant's case rests on lens, weatherproofing and smart detection. Ubiquiti lists it at $99 in early access (already sold out) against $29 for the G3 Instant; it moves from 1080p to 2K at up to 30 fps, though Ubiquiti's video says 4 megapixels and its product page 5, and it adds IPX5 weatherproofing.
• Smart detection is the host's assumption, not Ubiquiti's claim. G4 cameras generally detect people and vehicles and G3 ones do not, so he expects it here, but the launch video never says so; the field of view also narrows from 133° to 102.4°, still wide angle in his view.
• It is still not battery powered. It joins the network over Wi-Fi but needs power, likely USB-C like the G3 Instant, the host suspects; he puts little stock in its two-way audio, which he found not very usable on earlier UniFi cameras.
• Buy the cheaper G3 Instant indoors, the G4 outdoors. The host uses his $29 G3 Instant in his garage to see whether a car is there and thinks it ideal for that; he would pay $99 only for an outdoor camera, and warns availability is unknown given chip shortages, with the G3 itself long out of stock.

2021-11-27 · open the original ↗

• This post includes paid content that is not available publicly. See the original source.

2021-11-23 · open the original ↗

• A prompt segment can replace a background service for live data. Hanselman, who is diabetic, wanted his Nightscout blood sugar in his Oh My Posh prompt; his earlier approach with a friend, a Windows service or cron job writing to a text file, was a hassle he kept forgetting to run. De Dobbeleer, Oh My Posh's creator, says it fits the existing weather segment's pattern: call an API, cache the result, display it.
• Nothing may slow the prompt, so calls time out and cache. The default HTTP timeout is 20 ms, after which the segment is simply hidden; they had to raise it for Nightscout. The cache is set to five minutes because the glucose sensor only reports that often, and a cache-key mismatch between get and set was the bug that kept it from caching. A 1,200–1,500 ms lag turned out, via the debug output, to be the git segment over a dev-container volume mount, with Nightscout at zero from cache.
• Segments stay dumb; display logic belongs in user templates. De Dobbeleer explains a segment is an interface (an enabled check, a string output) with all I/O behind an environment interface that tests can mock, and that colour logic was recently pulled out of segments into background and foreground templates. Hanselman's thresholds went in the theme config: yellow above 150, red below 60. He also chose to take the user's full Nightscout URL with token rather than build URLs in code.
• Configurable icon properties with defaults beat templates or hard-coding. For the seven trend directions, De Dobbeleer rejected a long template switch evaluated every render and chose icon properties with defaults set in a Go switch, mirroring the git segment's upstream icons. His rule: if a default is right 99% of the time, ship it and let people override.
• Dev containers and Live Share made the remote pairing workable. Hanselman argues few people use them enough: setup took him five minutes and they edited one file across nine time zones. The session still ran 2 hours 10 minutes against his 30-minute estimate, partly on a broken build task because the container's PowerShell profile loads the module's binary; De Dobbeleer says a segment normally takes him about 20 minutes plus tests. Units (mg/dL against mmol/L), staleness, tests, docs and the PR were left for later.

2021-11-23 · open the original ↗

• Report even attempted scams to the FBI. Within four hours of the earlier video an agent from the FBI's Oregon Cyber Task Force in Portland asked the host to file at IC3.gov, which he did without hearing back; the agent wrote that aggregated complaints tie cases to rings, and that Oregon business email compromise losses this year were $1.2 million from just 15 reports, likely about three times higher.
• A tracking link exposed only a VPN exit and the browser. The host sent the scammer a Grabify link, which logs a visitor's details before redirecting; it showed a Los Angeles VPN or proxy, Windows 10 and Chrome. He warns scammers use the same tool.
• Reporting the domain early cost him contact with the scammer. Namecheap took down the fake clemsonedu.school domain after the host emailed abuse@namecheap.com, and the scammer stopped responding; he calls this premature because he had hoped to keep the scammer engaged.
• An AirTag parcel stalled at the reshipper. Sewn into a Clemson stuffed animal and mailed 13 October 2021, it went via Portland and Dallas–Fort Worth to Newark on 16 October and a reshipping company in Sayreville, New Jersey on 18 October. As of 18 November it had not moved, with about 80% battery left.

2021-11-21 · open the original ↗

• The bot gathers details first so humans only confirm them. Kwiatkowski, telecom and converged engineer at Michigan State University, says the university's hospital clinics came to his team with wait times that were too long and trouble hiring qualified staff. Booking an appointment took five to six minutes on the phone; with Dialogflow CX collecting the data in conversation and handing it to the agent for a sanity check, he puts the call at about a minute and a half. He reports that the system misroutes calls "very, very rarely", and that callers' frustration is mostly with talking to any computer system at all.
• Non-programmers get most of the way; conditionals and integrations need developers. In the browser console you type 10–15 different phrasings of a question ("when are you open?", "what are your hours?") and the machine learning builds the intent from them. He says someone with no coding background gets about 80% of the way, and his analysts, among them a psychologist and a former telephone-wiring worker, built intents this way. If-then routing logic and REST calls out to systems such as an appointment database are where programming knowledge or a developer comes in.
• Per-minute pricing costs far less than the staff it relieves. Billing is by minutes of audio and response, effectively per transaction. For the hospital system's 14 clinics, at close to 100,000 interactions a month, he puts the bill at "a few thousand dollars a month"; the host suggests nurses' salaries for staffing phones would cost far more, and Kwiatkowski agrees.
• Done well, the same tools improve service rather than just cut cost. His team's next iteration for the hospital is outbound calls that give a patient a test result, explain in conversation what a high number means, and escalate to a nurse if needed. He describes a Michigan automotive manufacturer using the product as "agent assist": it listens to a live call and puts help articles in front of the agent without them typing. He also describes a system that drafts FAQs and help articles from a senior engineer's calls. He warns that a bot used only as a front door, after which callers repeat everything to a human, "doesn't make anybody happy."
• Novices should start with Dialogflow ES before CX. He says ES suits one question leading one way, such as a simple menu or decision tree. CX handles "multi-turn" conversations: filling a form of, say, six required items without re-asking ones already given, and keeping context, so a caller who mentioned sports medicine is not asked about radiology. The host proposes that a novice start with ES and move to CX, and he agrees.

2021-11-19 · open the original ↗

• The CPU cutoff balances security, performance and reliability, not speed. Weston, partner director of OS security at Microsoft, says a machine like Hanselman's 7th-gen Intel gaming PC is fast and has the security features but fails on drivers and published reliability data; the line was drawn from crash and performance analytics across millions of machines, with silicon vendors agreeing. He says Windows 10 remains supported with driver updates, and personally advises against registry hacks to install 11 on unsupported hardware.
• Windows 11 makes on-by-default what Windows 10 left optional. Weston argues optional security is "exclusive", like requiring overclocking to game, since most people assume what Microsoft didn't enable shouldn't be touched. The TPM is not new: Windows 10 logo systems required one from 2015, announced around 2012, and most Intel and AMD chips have had it for a decade, so the $14 add-on TPMs scalpers pushed to $100 were mostly unnecessary. Users staying on 10 can enable core isolation, memory integrity and secure boot in Windows Security.
• Early-boot integrity is the foundation every other defence depends on. Secure boot checks signatures on boot components; trusted (measured) boot adds TPM measurements, which is why a changed component triggers the BitLocker recovery screen. Weston says attackers, state actors included, take the easiest path such as phishing or macros, and go to firmware only for stealth against well-defended targets, because "whoever boots their code first wins" — his red teams prefer it for that reason.
• Virtualization-based security keeps admin compromise from being game over. The hypervisor creates a "ring minus one" secure kernel that controls page tables, MSRs and I/O and applies policy, such as requiring signed code, before granting access. Weston says it is the same hypervisor technology Microsoft built for multi-tenant cloud, shrunk to the client, and it lets Windows curate which kernel drivers run — relevant to supply-chain attacks, for which he cites UltraEdit's compromise.
• DMA attacks are now cheap, and the IOMMU blocks them when locked. Weston says a PCILeech-style device costs under $100 with code from GitHub; on Microsoft Mechanics he used one to patch the biometric process to "return true". Windows uses the IOMMU to cut off DMA to new devices while the machine is locked, and enhanced sign-in security moves biometric matching inside the VBS boundary; he says he wants to overturn the old law that a machine out of your possession is no longer yours, as Xbox already has.

2021-11-18 · open the original ↗

• A plausible billing email fooled the host into clicking. The "problem authorizing your payment method" message claimed to be WordPress with a WooCommerce Subscriptions logo, matching his site and store; the only visual clue was a small, low-resolution, off-centre logo, and he clicked without hovering over the link.
• His password manager's silence was the first real warning. LastPass offered no saved login on the page, which it would for a genuine WordPress site, and every link, even "back to wordpress.com", led to the same unfamiliar domain.
• The link domain's age was the strongest lookup clue. The domain the link first resolved to passed scam-checker sites and blacklists and dated from 2014 behind Cloudflare privacy; the one it redirected to by filming was registered about two months earlier, which the host calls typical of scams.
• The hidden sender address settled it. His ticketing system showed only "WordPress" until expanded, revealing an unrelated, apparently compromised business address; the host's only remedy is to delete it and mark it spam.
• Such campaigns can target any WordPress-WooCommerce site. The host reasons that attackers can scrape sites using both platforms plus a public email address, and harvest logins from the share who click; user education is his answer.

2021-11-16 · open the original ↗

• Caller ID follows a hierarchy across extension, route and trunk. An extension's caller ID overrides the outbound route's, which overrides the trunk's, unless the route's "override extension" is set; trunks in a route's sequence are tried in order, failing over to the next.
• The host normalizes every dialed number to 11 digits. Using the wizard's 7-, 10- and 11-digit patterns (N for 2–9, X for 0–9), he prepends 1272 to seven-digit dials and 1 to ten-digit ones, and adds a +1 pattern because some Yealink phones, at least historically, redialed from history with a plus and would otherwise fail.
• Toll-free callers need their own route with a local caller ID. Most US toll-free providers will not accept calls from another toll-free number, so a company whose outbound ID is toll-free needs a route matching 800, 888, 877, 866, 855, 844 and 833 placed above the default, since the first matching route wins.
• The emergency route is what the host calls the series' most important step. Under Kari's Law and RAY BAUM'S Act every extension must reach 911, and he says the company or even the installer could be held responsible otherwise; flagged as emergency, the route uses each extension's own emergency caller ID, so a home worker's 911 call carries their home E911 address.
• The host's emergency route also covers 933, 988, alerts and recording. It matches 911 variants, 933 (which reads back the provisioned E911 address on Crosstalk SIP, his own firm's trunk service, and other good providers), and 988 for the suicide hotline. It sits at the top of the route list, emails a group on each match, and forces recording, though he notes he is no lawyer on consent rules.

2021-11-11 · open the original ↗

• Azure Data Explorer starts with a cluster of virtual machines. Giard describes ADX as an Azure service for managing very large amounts of structured, unstructured or semi-structured data at scale and analyzing it in real time. In the portal it is created through Create a Resource; the cluster belongs to a resource group, which he creates new for the demo. Deploying his cluster took about 13 minutes, and he expects larger clusters to take longer.
• The workload choice sets the cluster's scale and isolation. The categories are development, standard and specialized. Development is a single virtual machine, which Giard calls good for learning but not very scalable and maybe not right for production, and it offers only two machine sizes. Standard options are weighted toward storage, computation or heavy computation. The specialized "isolated compute" option guarantees that only your data runs on the machine. He picks the cheapest dev/test option.
• Availability zones protect against one data center failing. Giard explains that the zones are isolated from shared points of failure and physically far enough apart that a flood or earthquake should not hit more than one, so another data center can take over and reduce downtime. He uses a single zone for the demo. Review and Create validates the settings before deployment.
• Each database sets how long data is retained and cached. Retention defaults to one year (365 days) and can be set to any period or to forever. Cached data is served without reading from disk, so queries run faster; the cache period defaults to 31 days and can also be set to forever. Giard keeps both defaults, and the database is created in a few seconds.
• Ingesting a CSV creates a table with an inferred schema. From "ingest new data", Giard names a new table, then picks a source: Azure Blob Storage, a container or a local file. He uploads a 5,000-row sample sales CSV that he found online. ADX takes column names from the header row and infers data types, and each one can be renamed or retyped, such as changing an ID column from long to string. It detects that the file is an uncompressed CSV and shows a preview of the data before import.

2021-11-11 · open the original ↗

• High-school computer science access is unequal, and it shapes careers. Hartnett, who works for the TEALS program at Microsoft Philanthropies, says a student who takes computer science in high school is six to eight times more likely to major in it in college. She puts the share of high schools offering it at a little over 50% early on, and later at "a little bit less than like 50%", citing new Code.org numbers she has not memorized. Enrolled students tend to be white suburban males. TEALS targets inner-city schools, where she says the first college-educated person most students meet is their teacher, and rural schools with no computing professional nearby.
• Volunteers team-teach until the teacher can teach alone. TEALS pairs industry volunteers with a school's teacher, who learns alongside them; a volunteer commits for one academic year, but the program usually takes a couple of years. After that the teacher joins the alumni network and teaches on their own. She gives about 500 schools in the US and British Columbia, plus four in Juárez, Mexico, and about 1,200 volunteers. Microsoft, as the sponsor, is the largest source of volunteers, but they come from across the industry, including bootcamp graduates.
• The Chicago launch went to west and south side schools. She is based in Kansas City and covers Chicago, St. Louis and Kansas City. TEALS launched in Chicago this year (2021) in seven schools, six of them Chicago Public Schools, mostly Black or Hispanic. In one school the volunteers called every parent on the roster and invited them to an October open house. In another, a volunteer with a gaming background is building up the school's e-sports center and a 3D printer and tying them to classwork.
• Computer science should be required as basic literacy. She would like it to be a required course, not just an offered one, because technology will be part of everyone's life. Giard argues that knowing what machine learning is helps even non-programmers. She adds polling and extrapolated data, computerized voting and who programs it, misinformation, and what phones track as reasons the knowledge matters.
• Her measure of success is teachers who outgrow the program. In her four years she has mostly seen teachers rather than students succeed, since for privacy reasons staff spend little time in classrooms. Every teacher she worked with in her first year is now an alumnus, adding coursework and sending students to AP exams, which she treats as a measure of how students are doing. Volunteers apply at microsoft.com/TEALS, where she says applications usually open in February; schools can apply now.

2021-11-09 · open the original ↗

• Start every PBX with a blank catch-all inbound route. Leaving both DID number and caller ID number empty matches any call, making it the route of last resort; more specific routes, by dialed DID or by the caller's number (say, sending VIP clients to a priority queue), take precedence.
• Match the DID in the format your carrier sends. Crosstalk SIP, the host's own firm's trunk service, sends 11-digit numbers by default, so a 10-digit DID will not match; his second route matches 12727700266 and sends it to Jim Halpert's extension while the main number falls to the catch-all.
• Inbound routes can tell staff what kind of call is ringing. Alert info sets distinct ringtones on Clearly, Sangoma and Digium phones (the host defaults to one for internal calls, another for outside ones), ring volume override forces levels 1–14, and a caller ID name prefix like "Sales:" shows which line was dialed.
• Privacy manager stops robocalls with blank caller ID. It intercepts calls without caller ID and asks for a number of up to 10 digits; automated calls never answer, while a human should. External caller ID lookups, such as CRM names, are possible but out of scope.

2021-11-04 · open the original ↗

• The host rates the floodlight a worthwhile Protect add-on. The $99 UP-FloodLight has 550 lumens, motion detection to 5 m (16 ft), 802.3af PoE power and an IPX5 housing; at night it lit his roughly 21 ft (6.5 m) side yard easily, and he estimates effective range at about double that.
• A paired camera's motion also switches the light on. The host did not expect this: his paired camera saw passing cars and lit the floodlight, which he fixed with a motion zone from the fence top down; setup on UniFi OS 2.2.10 and Protect 1.19.2, latest stable at recording, also set a 15-second auto-off and on-motion-when-dark.
• Installation is easier than a camera and drains water clear. The upward-facing PoE port, an overlapping mount lip and a bottom cable channel keep water off the connection, the host says; an angle mount suits siding. Ubiquiti never explains when to use the included diffused cover, which he did not test.
• The host wants three software changes from Ubiquiti. A dim-until-motion mode at about 20–25%, an option to ignore the paired camera's motion, and, most important, a light toggle in the paired camera's live view, missing from both the app and browser at recording.

2021-11-03 · open the original ↗

• Hot reload patches the running process instead of restarting it. In a .NET 5 folder pinned by global.json, dotnet watch run exits, recompiles and relaunches on save, which Hanselman shows by printing the process ID and watching it change; under .NET 6 the same command reports "hot reload enabled" and the PID stays the same across edits.
• The static entry point cannot be hot-reloaded, so move code out. .NET 6 console apps hide Main and add implicit usings (no using System.Threading needed), but that entry point still exists and cannot be rewritten live; he moves the output into a separate Utils class so changes to it reload. Ctrl+R restarts the app when a full restart is needed.
• It is editor-agnostic, not a Visual Studio feature. He edits the .NET 6 app from the command line in Notepad and it reloads the same way; in Visual Studio 2022 (free Community edition, he notes) there is a "hot reload on save" option and a button to force a reload when that is off.
• Web apps update in the browser without pressing refresh. On a Razor Pages app under dotnet watch run, edits to both the .cshtml markup and the C# code-behind (a logger call) appear immediately; view source shows an ASP.NET Core browser-refresh script injected at development time doing it. He dates .NET 6's release to "next week or this week", with .NET Conf running November 9–11.

2021-10-28 · open the original ↗

• The YubiKey Bio adds a fingerprint factor the 5 Series lacks. With a YubiKey 5, someone holding your password and your key can still get in by touching it; with the Bio they also need your fingerprint. Yubico sent the host the USB-A YubiKey Bio ($80 MSRP) and the USB-C YubiKey C Bio ($85), both labelled "FIDO Edition" and supporting FIDO2/WebAuthn and U2F.
• The Bio cannot do one-time codes, so it rarely covers everything. Unlike the 5 Series with Yubico Authenticator, it has no TOTP support, so services without FIDO2 need a phone authenticator app or a second YubiKey. Per Yubico's compatibility list, Google, AWS, Coinbase, GitHub, 1Password and Bitwarden support FIDO2, but LastPass supports only Yubico OTP.
• Enrolment requires a PIN before any fingerprint can be added. It can be done in Windows 10 version 1903 or later, any Windows 11, Chrome 90 or later on macOS, Linux and ChromeOS, or Yubico Authenticator 5.1. The PIN runs 4 to 128 characters; the key stores up to five fingerprints, and the host enrols both index fingers and both thumbs.
• The Bio cannot provide passwordless login to ordinary Windows machines. FIDO2 Windows login works only on clients joined to Azure Active Directory. Yubico Login for Windows uses challenge-response, so it works with the 5 Series but not the Bio, and Windows Hello accepts only TPM-based authenticators. The Bio does work for signing into a Microsoft account on the web.
• The host rates the 5 Series the better value for most people. He sees the Bio as a key for organizations using Azure AD, or for users whose specific apps support FIDO2, and advises checking compatibility before buying. He would like an all-in-one key with TOTP, but suspects it would need a thicker body. The product links are affiliate links.

2021-10-26 · open the original ↗

• The host uses ClearlyIP for complex deployments because of its E911 tools. It is one of Crosstalk's three recommended SIP providers, alongside voip.ms and Crosstalk's own Crosstalk SIP. He picks it for schools and hospitals, praising its uptime and call quality and calling its E911 setup (callback profiles, dispatchable locations, 911 notifications) far better than any he has seen.
• ClearlyIP sets itself up in FreePBX from one key code. You paste the location's key code from the trunking.clearlyip.com portal into Connectivity > Clearly Trunking. This creates four redundant trunks, two in US Central and two in the East, and can auto-configure outbound routes and, if ClearlyIP is your only trunk, inbound routes too.
• Redundancy across carriers works for outbound calls, not inbound. The host recommends several outbound SIP providers, especially when one is metered (billed only per minute used). Inbound numbers cannot really be load-balanced across carriers because one carrier owns each number, though call forwarding offers some workarounds.
• Adjust ClearlyIP's auto-generated dial patterns before going live. The defaults already include 988, the suicide prevention line. The host prepends 1 plus the area code to seven-digit dialling, prepends 1 to ten-digit dialling, and adds a +1 NXXNXXXXXX pattern for phones that redial numbers with a leading plus.

2021-10-26 · open the original ↗

• Crosstalk SIP, the firm's own trunking service, sells US channel bundles. By the company's own figures, five channels cost $69.99 a month with 4,000 minutes and ten channels $129.99 a month with 8,500 minutes. It claims Kari's Law and RAY BAUM'S Act E911 compliance and charges a one-time $50 setup fee, waived if you mention this video. The video carries an ad read for Crosstalk SIP.
• Crosstalk SIP uses IP-based authentication over five redundant paths. Trunks use chan_pjsip, not the deprecated chan_sip, with authentication set to none. The inbound trunk points to 64.136.174.30 and lists the other four IPs under match permit, with port 5060 the default. Status can be checked with asterisk -rvvv and pjsip show endpoints, or in Reports > Asterisk Info > Peers.
• Whitelisting the provider IPs is optional, but the host does it anyway. FreePBX already trusts IPs used by a PJSIP trunk. As a safety net, he adds all five to the firewall's Local zone rather than Trusted, because Local already covers SIP, and also whitelists them under intrusion detection.
• Emergency routes need a correct per-extension 911 caller ID. The emergency route tries the five outbound trunks in order. Ticking "emergency" makes it use each extension's emergency caller ID, so a home worker's 911 call sends responders to the house, not the office. The host's patterns cover 911, the 933 address test, 9-prefixed misdials and 988, and he always forces call recording on this route.
• The default outbound route normalizes every common dialling format. Seven-digit numbers get 1 plus the local area code prepended, ten-digit numbers get a 1, and eleven-digit numbers pass unchanged. The host also adds a leading-plus eleven-digit pattern, because some phones redial with a plus, and uses this by default on all Crosstalk setups.

2021-10-21 · open the original ↗

• A device needs a brain to count as IoT. Walker rules out Hanselman's 3D-printed Tony Stark heart kit, which takes USB power only to light up and does nothing else. The hello world of IoT, she says, is making an LED blink.
• Microprocessors run a full OS; microcontrollers keep everything on-chip. In Walker's account an MPU runs embedded Linux or Windows with external flash and buses and truly multitasks, like Hanselman's Raspberry Pi 4. An MCU holds RAM, storage and peripherals on one chip (8-bit to 32-bit, a few 64-bit, where 1 MB "is huge") and runs a real-time OS such as Azure RTOS, FreeRTOS or Zephyr, which switches tasks fast enough to look concurrent. She takes up Hanselman's juggler analogy for this. In her desk quiz, boards with a screen, Ethernet and an SD slot were still microcontrollers, the printed circuit board being "along for the ride", while an open-source RISC-V board running embedded Linux was a microprocessor.
• Single-purpose, low-power devices belong on a microcontroller. Walker says a thermostat should run an RTOS because it does one job, must respond quickly and should draw little power. She still recommends a Raspberry Pi for learning, since RTOS work means C/C++ or Rust and knowledge of registers and architecture. She calls Hanselman's Pi taped to his garage door (it texts him through Twilio when the door has been open five minutes) overkill for what a microcontroller and an accelerometer could do.
• Sensors sense the world; actuators act on it. Walker says sensors such as buttons, temperature, motion, soil-moisture and GPS report patterns of high and low voltage that code interprets as values. Motor drivers, relays, screens and LEDs are actuators. Her own plant-watering project used a soil-moisture sensor to trigger a relay that ran a pump from a bowl of water.
• Connecting devices to the cloud is the next step. Walker works on Azure IoT, which she describes as linking thousands of devices rather than one board and its sensors. The two propose a "cloud hello world" for a later episode: a button pressed in Atlanta lights an LED in Hanselman's house. Both recommend Adafruit's subscription boxes, and Walker says she has no tie to Adafruit beyond being a fan.

2021-10-21 · open the original ↗

• Android apps reached Windows 11 Insiders through an Amazon store-within-a-store. As of October 20 (his date), the Beta channel shows an "Amazon Appstore Preview" inside the Microsoft Store. Searching the Store for an app such as Kindle deep-links into it, and the selection is a small group of apps with more promised later.
• Installed Android apps behave like ordinary Windows apps. He shows them appearing in the Start menu, resizing, maximizing and working with Snap Assist. Subway Surfers took keyboard input because it already supports Bluetooth keyboards on Android. A joystick did not register in an Android game, where the mouse acted as touch, and one app glitched while moving between his 1080p and 4K monitors.
• The subsystem runs as a VM, much like WSL. By his reading of the announcement it is built on the Android Open Source Project version 11. An Android settings app lets the subsystem run only when needed or continuously, and it can be shut off.
• Android, Linux and Win32 apps all paint to one surface. He drags a transparent Windows Terminal over an Android game, Word and a Linux image editor to show them rendering through the same acrylic layer. The Xbox cloud game he runs alongside is browser streaming, as he notes, not part of the Android feature.

2021-10-19 · open the original ↗

• Vim's startup speed beats VS Code's, the clip argues. The speaker times VS Code at five to ten seconds to open on a 2018 MacBook Pro with an Intel Core i7, against Vim opening instantly. Their claim is that terminal-based editors will always have better performance and better integration with existing Unix tools.

2021-10-19 · open the original ↗

• Learn why Git works the way it does before learning commands. Rael, who ran a Git workshop at KCDC, recommends Tom Preston-Werner's blog post "The Git Parable", which tells the story of keeping a version history as a series of saved snapshots; it won't teach you to use Git but explains its design. For depth he points to the book Pro Git, "a bit of a dry read" that covers everything.
• Git is a version control system built on a content-addressable file system. Rael says the .git directory stores commits, trees and blobs, and each SHA is a hash of a snapshot's content that serves as its address. He says Git is fast because it stores snapshots rather than deltas and because everything is local except interaction with remotes.
• A clone puts the entire repository and history on your machine. Rael defines a remote as just a reference to another repository, which can even be another directory on the same machine, and a repository can have zero or more of them. He finds it ironic that a distributed system is usually used with one canonical central repository on GitHub, GitLab or Azure DevOps.
• A branch in Git is a pointer to a commit, nothing more. Pushing sends your commits and their referenced objects plus that pointer to the server. Rael says pull requests (GitLab's merge requests), code review and browser editing are features the providers built on top of Git, not Git itself, and that is the difference between Git and GitHub. He favours one canonical mainline, with feature branches or committing straight to it.
• Git merges distant edits itself and asks a human about close ones. Rael says changes to different functions in the same file merge automatically, while changes to the same or nearby lines produce a merge conflict that needs a person to decide which version to keep, keep both, or combine them. He says resolving conflicts takes learning, and he has seen developers, himself included, do it wrong many times.

2021-10-18 · open the original ↗

• A decompile made 3D Pinball run natively on Linux. Hanselman credits a developer on Twitter, whose handle the captions garble, with decompiling the original 32-bit Windows executable of the roughly 25-year-old game. The project recompiles the code against SDL2 and SDL2 mixer with CMake and Clang/GCC, and he notes the original pinball.exe is only 270 KB.
• Building it needs your own copy of the original game. The repository does not redistribute the licensed bitmaps and sound files. Hanselman got them by mounting an old Windows XP virtual hard drive he keeps on his Synology, built the code under Ubuntu 18.04 in WSL, and copied the resources next to the Linux binary.
• WSLg runs the Linux build beside the original on Windows 11. He shows the Linux executable running through WSLg next to the original XP executable running directly on Windows. He closes with a quip that "the year of the Linux desktop is happening on Windows 11."

2021-10-15 · open the original ↗

• Crosstalk's own Cloud PBX sells phones outright rather than renting them. The host argues that RingCentral leases phones monthly for as long as you stay, even after they are paid off. With Crosstalk the customer owns the phones and can take them to another system. Service is month to month with no contract, and setup (call flows, IVR, extension names) is done for the customer.
• Crosstalk's calculator prices a 12-user example at $9,519 over five years. The example has six 250 phones, two 270s, one cordless handset, one conference phone and two softphone-only users. Upfront cost, including setup and shipping, is $2,409. Monthly cost is $118.50 for one number, one toll-free number, 4,000 minutes and 1,000 toll-free minutes, plus taxes the host puts at 15–20%. That gives about $3,831 in year one and $1,422 a year after.
• The host's RingCentral comparison comes to $20,569.20 over five years. It uses RingCentral's annual price of $19.99 per user per month, which he notes is $10 per user cheaper than month to month, for $239.88 a month. Phone rental adds $102.94 a month, with the Cisco 8851, Polycom VVX 350 and Polycom IP5000 ($34 a month) as equivalents. Year one is $4,113.84.
• The host frames hosted PBX vendors as working against customers. He says he structured the Crosstalk Cloud PBX this way because RingCentral, Jive, Vonage Business and 8x8 "are out to rip you off". By his figures, his own product costs less than half as much as RingCentral over five years and is cheaper even in year one.