Souk's Notes - Unofficial Summaries

Unofficial, machine-generated summaries, as of 2026-11-10.

Scott HanselmanPostgres Replication at speed with PeerDB's Sai Srirampur
synopsis

Sai Srirampur, CEO and co-founder of PeerDB, argues that Postgres has become the system of record for enough businesses that moving data in and out of it deserves a dedicated, Postgres-native tool, and that PeerDB's parallel snapshotting and Temporal-based recovery make it faster and sturdier than generic movers.

Why Postgres. He credits its spread across transactional, analytical and search workloads, open source and the absence of lock-in, its community, and usability. He says its revenue grew from 1% to 10% of Oracle's in five years.

Migration versus replication. Offline migrations use pg_dump/pg_restore. Online ones take a snapshot and then apply the transaction log through change data capture, which is also how Azure and AWS migration services work. Hanselman pushes on "real time", and Srirampur agrees that freshness is a cost decision: Snowflake charges by warehouse activity, and PeerDB's refresh interval ranges from seconds to hours depending on the job.

Where the speed comes from. PeerDB partitions tables by tuple identifier and streams the partitions in parallel. He claims a terabyte that pg_dump takes days to move goes in hours, and a 5 TB Snowflake load drops from four or five days to one. Its use cases are Oracle-to-Postgres migration, pgvector embedding pipelines, and warehouse sync.

Recovery. Temporal orchestrates the work, partition-level idempotency avoids restarts, and a five-minute outage the night before recovered without intervention. He calls it validation of the design.

Business and scope. Open source is a trust builder; revenue comes from the managed service. PeerDB stays Postgres-first, aiming for quality over breadth, and may expand to other operational stores later.

  • Postgres is winning on openness, versatility and "it just works". Srirampur, CEO and co-founder of PeerDB, says it has grown from a metadata store into transactional, analytical and search use, and that enterprises are migrating off Oracle and SQL Server to avoid lock-in. He says Postgres revenue has gone from 1% to 10% of Oracle's in five years, and cites DB-Engines for it being the only database still growing in popularity.
  • Migration is a snapshot; replication keeps two stores continuously in sync. Offline migrations that can afford downtime use pg_dump/pg_restore; online ones take a snapshot and then read the transaction log (logical decoding / change data capture). Continuous sync suits cases like offloading fraud detection from an OLTP Postgres to Snowflake, where freshness is a cost choice: one customer syncs invoices about every minute, another every two hours, and the interval can be edited on a running job.
  • PeerDB says parallel snapshotting turns days of copying into hours. It logically partitions large tables by Postgres tuple identifiers, which map to data on disk, and streams the partitions in parallel. He claims a 1 TB move that takes a couple of days with pg_dump/pg_restore takes a few hours, and that customers who waited four to five days for a 5 TB initial load into Snowflake get it within a day; the repository claims 10x over existing tools.
  • Fault tolerance comes from a state machine built on Temporal. The initial load is idempotent at the partition level, so a crash resumes rather than restarts. He reports the service's first outage, five minutes the previous night over an IPv4/IPv6 transition, recovered with no manual intervention; across customers PeerDB moved about 3 TB in 3 hours.
  • Open source builds trust; the managed service makes the money. He argues self-hosting at scale takes months of setup, so production users will pay for the managed offering, and he is not worried about copycats because his team works on it full time. PeerDB is Postgres-only by design, a "peer-to-peer" approach of quality over breadth rather than hub-and-spoke; MySQL or MongoDB might follow once the Postgres story is nailed.
Scott Hanselman.NET Developers should be using dotnet-outdated to update their project's references
  • dotnet-outdated is Dependabot for the command line. Hanselman says it "honestly should be built into .NET"; it installs as a dotnet global tool and, after the original author's project changed hands, now lives in a dotnet-outdated GitHub organisation run by two maintainers. It lists each package's available update, coloured by whether it is a major, minor or patch bump.
  • Upgrading is one flag, but never upgrade blindly. Running it with -u updates every package (sometimes it needs more than one pass); he then checks the csproj diff and runs unit tests, code coverage, and headless and "headed" Playwright browser tests to confirm the site still works. Patch bumps he usually trusts to the test suite; major ones such as packages moving from .NET 6 to 8 need more thought.
  • Pair it with Upgrade Assistant for framework upgrades. With the transitive-dependency option it shows what his dependencies depend on, which is where he switches to the .NET Upgrade Assistant, project by project from the leaf node, then reruns dotnet-outdated to catch stragglers. He prefers that to the whole-solution upgrade a viewer asked for.
  • A footer showing commit and runtime tells you what's in production. Following his previous video, his sites print the .NET version, commit hash and build number, which links straight to the deployed commit; he notes some people would show it only to admins.
Polis PanditCelebrate Every Day: How I Handle Grief
  • This post includes paid content that is not available publicly. See the original source.
Scott HanselmanUpdating my personal website from .NET 6 to .NET 8 LTS in 15 min
  • Moving from .NET 6 to .NET 8 LTS is an easy call. Hanselman notes .NET 6 is in support only "until this November", while .NET 8 (8.0.2 at recording) brings new features, performance, and support moved out a couple of years.
  • Upgrade Assistant makes a simple Razor Pages site a one-line change. He runs the .NET Upgrade Assistant CLI on a new branch; it offers .NET 7, 8 or a .NET 9 preview with their support dates, and for his site it only changed the target framework. He used his GitHub Copilot CLI alias to recall the git command for making the branch.
  • The cloud must be upgraded too, not just your machine. The build pipeline needs the .NET 8 SDK (a YAML step on one site, the old visual Azure DevOps pipeline on this one) and the Azure App Service runtime setting must change. For a real production site he says he would deploy to staging behind something like Azure Front Door and A/B test; here he deployed straight to production.
  • His only failure was forgetting to push. The site failed until he realised the merge had never been pushed to trigger CI; once pushed, the release deployed and the footer showed .NET Core 8.
Scott HanselmanReinventing the API Gateway with Zuplo's Josh Twist
synopsis

Josh Twist, co-founder and CEO of Zuplo, argues that authentication, key management, rate limiting and documentation are security-sensitive plumbing no API team should build itself, and that Zuplo provides them as a programmable, OpenAPI-native gateway deployed to the edge everywhere at once.

Origin. Twist helped launch Azure API Management through an acquisition in October 2013 and later led payment-methods product at Stripe. He says his mother's sudden death weeks into that job pushed him to leave and build the gateway he had long designed in his head, starting from the question of whether the idea was any good or just him.

What a gateway is for. Small companies get the developer experience Stripe set as the bar, plus protection from clumsy client code. Enterprises get one consistent management plane across hundreds of teams. Hanselman frames it as a horizontal slice that is not his expertise; Twist agrees.

Edge and rate limiting. Deploys reach 300 data centres in seconds, with unlimited environments, and being everywhere is the cheapest option. Caching and rate limits are programmable in TypeScript, using web-standard request and response objects. Global rate limiting is the hardest part. Zuplo chooses to fail open and offers an async check to avoid added latency.

OpenAPI as source of truth. After moving away from a proprietary route format, Zuplo keeps its settings as OpenAPI extensions and diffs re-imports so that design-first users keep their own master document.

Backends and integrations. Any HTTP backend works, with sockets planned. A WireGuard tunnel serves bare-metal and VPC users. Logs flow to Datadog, Sumo Logic, Dynatrace and OpenTelemetry. Twist says most big companies are "multicloud by accident", through acquisitions.

Keys and when you need a gateway. He prefers opaque API keys for machine-to-machine calls and JWTs for people, and auto-revokes leaked keys through GitHub secret scanning. Rolling your own key auth or per-node rate limiting is the red flag that a team needs a gateway.

  • A gateway buys small teams a Stripe-grade API experience. Twist, co-founder and CEO of Zuplo, lists what shipping an API now demands: docs, self-serve key management, analytics and protection, since "your partner or your internal developers will take you down with a clumsy for loop". For large enterprises the pitch is one choke point instead of hundreds of teams' own auth and rate-limiting sprawl; he compares it to Auth0, which he says 95% of the startups he talks to now use rather than building identity.
  • Zuplo deploys to the edge, everywhere, by default. He says a git commit deploys in about 6 seconds, always under 20, to 300 data centres, within 50 ms of everyone except the ISS and Antarctica; environments are unlimited (one customer runs 250 previews), and fewer data centres costs more, on the Enterprise plan. Bare-metal and VPC backends connect through a WireGuard-based secure tunnel, which lets SecOps own connectivity and API engineers own the gateway.
  • Distributed rate limiting is the hardest thing Zuplo built. Syncing limits across 300 data centres fights the speed of light, so it fails open and may let an extra call through; an async mode lets requests proceed during the check to avoid added latency. Limits can be set dynamically in a few lines of TypeScript, and he says per-node limiters behind an autoscaler, a mistake he attributes to an unnamed product, multiply the limit as nodes are added.
  • Zuplo rebuilt itself to run natively on OpenAPI. Twist was not a fan in the Swagger 2 era but saw design-first users adopt it, so Zuplo stores its settings as OpenAPI vendor extensions; customers can make Zuplo's file the master, or re-import their own and have a smart diff keep the extensions while overwriting the rest.
  • API keys suit machine-to-machine calls; JWTs suit people. He argues opaque keys are easier to revoke than JWTs, which are part of OpenID Connect and fit calls made on behalf of a person. Zuplo's managed keys are covered by GitHub secret scanning, so a leaked key is revoked automatically with a webhook, Slack or email alert, free tier included.
Crosstalk SolutionsNEW! USW-Ultra PoE switch #unifi #shorts #crosstalk
  • Ubiquiti's USW Ultra can run entirely on PoE input. The first switch in the Ultra line has a gigabit PoE++ input port on the back and seven gigabit PoE+ ports on the front, and the PoE budget left for devices depends on how much power comes in. It costs $129 in the US without a power adapter, with a 60 W or 210 W AC adapter offered as an add-on.
  • A magnetic mount makes the switch easy to place. The host likes that it holds to metal surfaces without needing a permanent install.
Scott HanselmanHow to run a local AI chatbot on Windows in 5 min, no cuts, no edits, with Ollama, LMStudio, OpenAI
  • Local models keep your data off third-party servers, even offline. Hanselman's case is privacy, cost and working "in airplane mode"; he says you need a decent GPU, typically an RTX 2080 or 3080 (some manage on a 1080), and that Intel-only laptops probably won't cope. His machine has a 3080 with about 10 GB of GPU memory.
  • LM Studio downloads and chats with quantized models locally. He loads Microsoft's Phi-2 (about 2 GB quantized), Mistral and Code Llama (a 7-billion-parameter model of about 4 GB) and shows GPU memory rising as each loads. Setting GPU offload to -1 puts all 32 layers in GPU memory and is visibly faster, with little CPU load.
  • The developer payoff is a local server that impersonates OpenAI. LM Studio's server on localhost:1234 answers OpenAI-style calls such as /v1/models and chat completions from curl; he hit connection-refused errors and had to restart it, and multi-line curl calls failed until put on one line. Responses vary between runs, a reminder that the models are not deterministic.
  • Ollama does the same from the command line or Docker. The Windows preview runs from the tray, pulls models such as Llama 2 (a few GB each) and serves them; it also runs as a Docker container with WSL. Typing "bye" in the chat does not free GPU memory, so you have to quit the app. His cache already held 17 GB of models and he warns disk use climbs fast.
  • Expect confident fabrication. Asked about Scott Hanselman, Llama 2 produced a wrong birth date, a wrong hometown, a job at Borland and a consulting business called Hanselminutes. He says to think of model output in terms of grounding in reality rather than hallucination.
Crosstalk SolutionsVLANs Made Easy: Learn This Today!
synopsis

The host builds VLANs up from a plain LAN to the per-port settings that place each device, and ends by showing the same four-network design working on UniFi and on a Synology-and-Aruba mix, where his PC and VoIP phone pulled addresses from different VLANs on the same port.

The LAN and its subnet. A LAN is a router's inside interface, one subnet in which every device gets an address. A typical 192.168.1.0/24 (subnet mask 255.255.255.0) offers 254 usable addresses, with .0 kept for the network and .255 for broadcast. He covers IPv4 only.

What a VLAN adds. A VLAN layers further subnets onto the same hardware, with each Ethernet frame carrying a VLAN ID. His example adds guest (10), IoT (20) and VoIP (30) beside the default VLAN 1, justified by security, organization (business camera and phone VLANs) and performance in large layer-3 networks. In his office-building analogy the front door is the firewall and each company's key-card suite is a VLAN.

Untagged, tagged and trunk. The untagged (native) VLAN is where a device that knows nothing of VLANs lands. Tagged VLANs ride on the same port for devices configured to ask for them. A trunk carries the default untagged and all others tagged. That works the same as tagging by hand but picks up new VLANs automatically, and trunks usually join switches. Four diagrams follow: a trunk, an IoT port with VoIP tagged, a guest-only port for an exposed waiting-room jack, and an access-point port mapping SSIDs to VLANs.

UniFi. Networks are created with manual VLAN IDs, and the Port Manager shows native and tagged VLANs per port, with port profiles to apply them in bulk. Client isolation goes on the guest network but not IoT, whose devices must talk to each other.

Mixed equipment. The Synology RT6600ax gives each port only trunk or single-VLAN options, and the Aruba switch must be told each VLAN separately. Tests confirmed the expected addresses on each port, and the phone got no address on the guest-only port.

  • VLANs layer separate subnets onto the same physical network. Each Ethernet frame carries a VLAN ID (tag), so devices are grouped by tag rather than by the hardware they plug into. The host's example adds guest on VLAN 10, IoT on 20 and VoIP on 30 beside the default LAN on VLAN 1, each a /24 (254 usable addresses), with the VLAN ID matching the third octet by his own convention. He gives three reasons: security, organization and performance.
  • The untagged VLAN decides where VLAN-unaware devices end up. A PC or IoT device lands on whatever VLAN a port has untagged, while a device configured for a tag, such as a VoIP phone looking for VLAN 30, joins that VLAN only if the port carries it tagged. He recommends an exposed jack in a public space, like a doctor's waiting room, carry only the guest VLAN untagged, so a plugged-in device gets guest access and a tagged phone gets no address at all.
  • Trunk ports match manual tagging but pick up new VLANs automatically. A trunk carries the default LAN untagged and every other VLAN tagged, which works the same as listing them by hand. The difference is that a VLAN added later (say 40 for cameras) must be added to each manually configured port. Trunks are typically used between switches; an access-point port carries the secure LAN untagged plus the guest and IoT VLANs tagged, each mapped to its own SSID.
  • UniFi sets up VLANs in two steps from one console. Networks are created under Settings with a manual VLAN ID, then the Port Manager shows each switch port's native and tagged VLANs, and port profiles apply a set to many ports at once. The host enables client isolation on the guest network but not on IoT, because casting, AirPlay and Philips Hue-style hubs need IoT devices to reach each other; the networks still need firewall rules between them, which he does not demonstrate.
  • Mixed-vendor gear works but each device must be configured separately. VLANs are a standard, but off-the-shelf consumer routers may offer only a guest network. The host's Synology RT6600ax allows each of its four ports only to be a trunk or carry a single untagged VLAN, and his Aruba 24-port PoE switch had to be told about each VLAN. Plugging in, his PC received 192.168.20.x on the IoT port while the VoIP phone on that same port received a VLAN 30 address.
Technology and FriendsHillel Wayne on TLA+ [EPISODE 795]
  • Formal specification checks the design, not the code. Wayne, a formal methods consultant, separates it from the better-known branch that proves code correct with a theorem prover (his "Let's Prove LeftPad" project shows that branch). Specification checks an abstract blueprint of the system. He says it is less powerful because it cannot show the code works, but faster and cheaper for companies, and has grown more popular than proof over the past few years.
  • TLA+ explores every interleaving of a concurrent design. Instead of being run, a TLA+ spec is model checked: every random outcome and concurrent interleaving from the initial state is checked against safety properties ("no account ever goes below $0") and liveness properties (the money in the system adds up once every transaction has been processed, even if a process crashes partway). His example is a bank wire, where a check-withdraw-deposit design can hit a race condition and overdraft an account.
  • Writing the spec first is cheap compared with the code. Wayne says a spec usually takes a tenth to a twentieth as long as the code; on one project the spec took two days and the code two months. Code cannot practically be generated from a spec. His pitch is that you then write code for a design you know is correct, not one that may be fundamentally flawed. He says generating test suites from specs is a promising but not yet mainstream field, in which MongoDB has shown good results.
  • Some work is not worth specifying. Wayne names three cases: code that will be finished within a day or two (he finds TLA+ economical for projects of a couple of weeks to a month); complicated legacy code where a change would need a very large model first; and simulation or highly computational code such as machine learning, where you do not know the answer until you run it. He has seen ETL pipelines into ML systems specified, but not the ML itself.
  • The tooling is free, open source and funded by Microsoft Research. The TLA toolbox IDE or a VS Code extension includes the model checker, and specs should be checked in and code reviewed with the source. The syntax is mathematical, so Wayne points beginners to PlusCal, which compiles to TLA+ and which AWS used around 2014 to find complicated bugs in S3 and DynamoDB, to a newer language called Quint, and to his site learntla.com. He says the work began at AT&T before the inventor joined Microsoft Research about 15 years ago, and a TLA+ foundation now oversees funding and development.
Andrej KarpathyLet's build the GPT Tokenizer
synopsis

By the end of this build he has implemented, from scratch in Python, a working byte-pair-encoding tokenizer capable of reproducing GPT-4's own tokenization behavior — training a vocabulary, encoding text to tokens, and decoding back — and used that implementation to explain a long list of otherwise-mysterious LLM failures, from bad arithmetic to a glitch token that makes models swear at users. The throughline is that tokenization is a completely separate preprocessing stage from the language model itself, with its own training set and algorithm, and that a surprising fraction of what looks like a model or architecture problem actually traces back to this stage.

Why not just feed in raw bytes or characters. His earlier character-level tokenizer (from the "build GPT from scratch" lecture) used a vocabulary of only 65 symbols, one per character seen in a small dataset — simple, but impractical at scale. Text in Python is a sequence of Unicode code points, of which roughly 150,000 exist, but using code points directly is unattractive both because the standard keeps changing and because encoding to raw UTF-8 bytes gives a vocabulary of only 256 symbols, which would stretch every document into extremely long byte sequences that a Transformer's finite context window and attention cost can't accommodate efficiently.

The byte-pair encoding algorithm. The fix is to compress those byte sequences by repeatedly finding the most frequently occurring adjacent pair of tokens and minting a new token to represent it, replacing every occurrence — for example, merging the common pair "e" + " " (space) into a single new token once it's identified as the single most frequent pair in a sample paragraph. Repeating this some chosen number of times (a hyperparameter — GPT-4 does enough merges to reach a vocabulary near 100,277) builds up a "forest" of merges on top of the 256 base byte tokens, and this merge table, once built, is all that's needed to both encode new text into tokens and decode tokens back into text. He demonstrates this concretely: 20 merges on a ~24,000-byte blog excerpt compress it to about 19,000 tokens, a 1.27x ratio that improves further with more merges. Critically, vocabulary size can't grow without limit — a bigger vocabulary means a bigger embedding table and a bigger final classification layer, more parameters that individual rare tokens will under-train, and a risk of cramming too much meaning into single tokens for the network's fixed per-token computation to unpack.

GPT-2's regex-based pre-splitting. OpenAI didn't apply plain BPE to raw text; GPT-2's released code (encoder.py) first splits text using an elaborate regex that separates letters from numbers from punctuation from whitespace, so that merges can never cross those boundaries — preventing nonsensical joint tokens like "dog!" merging as a unit with "dog?" while still keeping the two semantically identical. He steps through the regex clause by clause, showing quirks like inconsistent handling of apostrophes (a Unicode right-single-quote isn't matched the way a plain ASCII apostrophe is) and case-sensitivity bugs GPT-2's own documentation admits to. GPT-4's tokenizer (used via the tiktoken library, vocabulary roughly double GPT-2's ~50k) revised this pattern to be case-insensitive and, notably, to group runs of whitespace into single tokens rather than leaving each space isolated — a change he shows cuts token counts for indented Python code roughly in half, and identifies as a real contributor to GPT-4's markedly better code handling, separate from any model or training improvement.

Special tokens and model surgery. Beyond byte-derived tokens, tokenizers reserve dedicated IDs for structural markers — GPT-2's single <|endoftext|> token delimits documents during pretraining, while chat models add a family of tokens (<|im_start|>, <|im_end|>, and others) to mark turns between user and assistant. Adding a new special token to a pretrained model requires literal "model surgery": extending the embedding table with a new randomly-initialized row and widening the final output layer by one, which is routine practice when moving a base model toward a fine-tuned chat or tool-using model.

SentencePiece as an alternative. Used by Llama and Mistral, SentencePiece differs fundamentally from tiktoken by running BPE merges directly on Unicode code points rather than on UTF-8 bytes; any code point too rare to have a token gets mapped to a fallback — either a generic unknown token, or, if "byte fallback" is enabled (as in Llama 2), decomposed into UTF-8 bytes and represented by dedicated byte tokens instead. He walks through SentencePiece's large, historically-accumulated configuration surface (sentence-splitting assumptions, normalization options, a mandatory unknown token, a "dummy prefix" space added to make a word look the same whether or not it starts a sentence) and judges it considerably less clean than tiktoken's approach, though it remains widely used because — unlike tiktoken — it supports training a vocabulary, not just running inference with one.

Multimodal tokenization and vocabulary extension. He notes briefly that the same Transformer architecture is increasingly used across modalities simply by inventing new tokenizers — chunking images into patches (citing an early image-tokenization paper and OpenAI's Sora, which represents video as "visual patches" analogous to text tokens) rather than by changing the model itself. Separately, techniques like "gist tokens" show vocabularies can be extended purely to compress long prompts: new tokens are trained by distillation, with the rest of the model frozen, so a handful of learned tokens can later stand in for an entire long prompt with near-identical model behavior.

Diagnosing real failures through tokenization. He closes by tracing a list of well-known LLM quirks back to this stage. Long, high-frequency tokens like .DefaultCellStyle bundle many characters into one indivisible unit, so a model asked how many "L"s it contains gets the answer wrong — it never sees individual letters, only the whole chunk — while asking it to first print the characters separated by spaces and then reverse them works, because that breaks the token apart. Arithmetic suffers similarly: digit groupings into tokens are arbitrary and inconsistent (a four-digit number might be one, two, three, or four tokens depending on what merged), disrupting the character-level carrying logic addition needs — which is why Llama 2 explicitly splits all digits during tokenization. Non-English text tokenizes far less efficiently since the tokenizer's own training data skews English — a Korean greeting can take three tokens versus one for its English equivalent, a roughly 3x expansion that effectively shrinks the usable context window for other languages. Oddities like a completion API breaking on trailing whitespace, or choking on the literal string "<|endoftext|>", stem from the mismatch between how partial or special tokens are represented internally versus how they appear in raw input. The most vivid example is "SolidGoldMagikarp": a Reddit username that appeared often enough in the tokenizer's own training corpus to earn a dedicated token, but never occurred in the language model's actual training data — leaving that embedding row permanently untrained and effectively random, so invoking the token later triggers undefined behavior (evasion, hallucination, even insults), which he compares to reading uninitialized memory in a C program. He ends with a practical recommendation: reuse GPT-4's existing tokenizer and tiktoken library where possible, and be wary of SentencePiece's many easily-miscalibrated settings if training a custom vocabulary is unavoidable.

  • Byte-pair encoding builds a vocabulary by repeatedly merging the most frequent adjacent byte pair into a new token. Starting from 256 raw UTF-8 byte values, GPT-4 performs enough merges to reach roughly 100,277 tokens; vocabulary size is a tunable tradeoff, since more tokens shorten sequences (letting attention see more text) but enlarge the embedding table and output layer and risk under-training tokens that rarely occur.
  • GPT-4's tokenizer improved on GPT-2 mainly by changing the regex used to pre-split text before merging, not the core algorithm. GPT-2's pattern left every single space in indented Python code as its own token, bloating sequences and contributing to its weak coding performance; GPT-4's revised pattern groups runs of spaces into single tokens, which he demonstrates cuts the same code snippet's token count roughly in half.
  • Tokenization, not model architecture, explains several famous LLM weaknesses. Long single tokens like ".DefaultCellStyle" crush multiple characters together so the model can't reliably count letters inside them; arbitrary, inconsistent digit groupings (a 4-digit number might become one, two, three, or four tokens depending on context) undercut simple arithmetic; and non-English text, being underrepresented in the tokenizer's own training data, breaks into roughly 3x more tokens than equivalent English, effectively shrinking the context window for those languages.
  • The "SolidGoldMagikarp" glitch showed what happens when a token's embedding is never trained. A Reddit username appeared often enough in the tokenizer's training corpus to earn its own dedicated token, but the string never occurred in the language model's own training data, leaving that embedding row essentially random; invoking the token later produced undefined behavior — evasion, hallucination, even insults — comparable to reading uninitialized memory in a C program.
Polis PanditLove.
  • This post includes paid content that is not available publicly. See the original source.
Technology and FriendsPaul Sheriff on Starting and Running a Successful Consulting Business [EPISODE 794]
synopsis

Sheriff, who ran his own software company from 1991 until selling it in 2017, argues that independence depends less on programming skill than on time management, visibility, a financial cushion and basic business knowledge. He promotes his own YouTube course on the subject.

Getting started. After working at Boeing and then a small consulting firm in Munich, he launched on the back of a friend's training-seminar series, which paid the bills and brought clients. He advises six months of living expenses saved, partner buy-in, and, ideally, starting while single.

Finding work. Teaching, writing, LinkedIn and conference speaking make people treat you as an expert. The non-billable hours spent marketing are why he says poor time managers should not go into business.

Structure and staff. He incorporated as an S corporation for liability protection and avoided partnerships. Admitting he was a poor manager, he hired a former Boeing IT director to run roughly 16 staff, and he enforced a 10-minute rule before asking for help. Giard adds an MBA case study of the founder who outgrows their own management ability.

Lean times. Every payment was split by percentage into a rainy-day account. In one downturn his staff chose a shared pay cut over a layoff, with his own cut 50% deeper. Giard backs the value of managers being transparent during layoffs.

The exit. After weighing employee buyouts and mergers, he used a business broker. The sale took two years because he rejected buyers who would harm his staff, and he kept it secret from employees.

  • Start with a cash cushion and as few obligations as possible. Sheriff went independent in 1991 after Boeing and about a year at a small, fast-growing consulting firm in Munich. A friend's national training-seminar series paid enough in a couple of weeks a month to leave the rest for finding clients, and seminar attendees became clients. He advises six months of living expenses in the bank, says the best time to start is when single with no kids, and says a spouse needs full buy-in. He worked 60 to 80 hours a week from a small apartment.
  • Clients find you if you keep your name out there. Early advice he took: teach and write articles, because an audience assumes a speaker is an expert. Today that means consistent LinkedIn posting, blogging, and speaking at user groups and conferences. He says strong programmers often fail at the marketing and sales side, and that anyone poor at time management should not go into business, because the non-billable hours spent finding the next client are unavoidable.
  • Incorporate once you have employees, and buy the management you lack. He moved from sole proprietor to an S corporation for limited liability and lower taxes than a C corp, and he distrusts partnerships unless the skills complement each other. At his peak he had about 16 employees. Calling himself "the worst manager in the world", he hired a former Boeing IT director as manager, who stayed 17 years. Staff were hired by word of mouth and in-person interviews, worked from an office, and followed a 10-minute rule: if you can't find an answer in 10 minutes, ask a colleague. He stresses a lawyer, client contracts, an employee handbook, workers' comp, and the employer's half (7.5%) of the 15% payroll taxes.
  • Survive lean times with a rainy-day fund and open books. Incoming revenue was split by percentage into an operating account and a rainy-day account, and he says that fund should never drop below six months. In one downturn he gave staff the choice between one layoff and an across-the-board pay cut, with his own cut 50% deeper. They chose the cut, and he restored salaries once business recovered. His lesson is to talk to employees when things get tough.
  • Selling the company took two years because fit mattered more than speed. He lists the exit options as winding down, an employee buyout paid over about 10 years, a merger with a friendly competitor (he tried, without success), or a business broker, which is what he used in 2017 after 27 years. He kept the sale secret from staff, since nervous employees leave and the value falls, and he turned away a buyer with cash but no business experience. The buyer gave everyone a raise, then sold to a larger company two years later.
GeoHussarYour Aspirin, Tylenol, and Ibuprofen come from Crude oil.
  • Crude oil is embedded in products far beyond fuel. He says 99% of pharmaceutical feedstocks derive from petrochemicals, including aspirin, Tylenol and ibuprofen, along with synthetic fabrics, vegan leather and artificial heart valves — over 6,000 products in all. He argues that even if every factory and car ran on renewables, crude would still be needed for these.
  • All US manufacturing depends on oil, if only for lubrication. He cites over 623,000 US manufacturing businesses and a fuel split of 43% gasoline, 20% diesel, 12.2% other liquids and 7.7% jet fuel. He calls pipelines the cleanest way to move oil, and says railroad lobbies oppose pipelines because they want the transport business.
  • Full reliance on renewables is impossible for a major manufacturer. He reports renewables now produce a record 21.3% of US electricity, but says the world's second-largest manufacturer cannot match Paraguay's 100%. Citing a free-market think tank, wind supplying half of world electricity would take nearly 2 billion tons of coal and 1.5 billion barrels of oil, a figure he suspects is overstated.
  • Hydro, geothermal, tidal and nuclear are the cleanest, safest options. He calls nuclear the closest thing to unlimited energy, noting the US has 93 of the world's 436 reactors. He presents fusion as different from today's fission, claiming its radioactive waste decays within a second, and says the UK, not the US or China, currently leads the fusion race.
Mr. GlobalNew EV Battery Plant
  • Taxpayers overpaid for Panasonic's plant, with the surplus unexplained. He says Panasonic received $6.8 billion in Inflation Reduction Act money for a $4 billion EV battery plant and he cannot find where the other $2.8 billion goes.
  • The battery plant will run on coal, then natural gas. It needs about 250 megawatts, a small city's worth; the coal plant supplying it will emit 6 million tons of CO2 a year, and the planned switch is to natural gas, the fuel whose projects Biden just paused.
  • Local ratepayers subsidize the plant's power. He reports Evergy is seeking a rate hike for local customers to cover the added load while Panasonic gets a 40% developer discount on its electricity.
  • The plant barely offsets its own electricity emissions. By his figures it must produce over 2 million EV batteries a year, about 5,500 a day, just to offset the coal power, before construction, steel or mineral mining.
Mr. GlobalTrump And Two Dollar Gas
  • Trump's sub-$2 gas pledge is as undeliverable as Biden's. Reading his own Substack piece, he likens it to Biden's "no more drilling" promise and calls the LNG pause an attempt to appease those voters; both promises, he argues, cost the industry later.
  • Voters misremember why gas was cheap under Trump. He says Trump inherited low prices after the 2015 crash, prices rose in his first two years, and fell only after a late-2018 crash and then Covid.
  • A second term cannot reproduce first-term prices. He cites producer capital discipline, OPEC's unwillingness to repeat its 2018 output increase, and lost refining capacity, so lower gasoline would need even lower crude than before. He expects gas to stay above $3 a gallon, with US producers blamed.
  • The promise is politically "great" precisely because it is broken safely. With no reelection to face, and supporters concentrated in low-price states such as Texas, he expects Trump to claim victory if local prices near $2 even with the national average around $2.79.
Technology and FriendsGael Fraiteur on Metalama [EPISODE 793]
  • Roslyn source generators made a successor to PostSharp possible. Fraiteur says PostSharp, begun in 2004 when the C# compiler was closed-source C++, had to read, rewrite and recompile MSIL to inject boilerplate such as logging and INotifyPropertyChanged. Microsoft's source generators three or four years ago led him to build Metalama on Roslyn, which became generally available in May of the previous year. PostSharp is now in maintenance mode: still supported and updated for new platforms, but getting no new features, which all go into Metalama.
  • Aspects transform code, report errors and suggest refactorings. A Metalama aspect runs at compile time and in the IDE. It can add code (implement an interface, override properties, add methods), raise diagnostics when its preconditions are not met, and offer a refactoring that writes the generated code into source. Developers apply aspects by custom attribute, by LINQ-style queries over the codebase in a "fabric", or by inheritance from a base class.
  • Templates are written in "T#", a dialect fully compatible with C#. In one template method, build-time expressions such as a parameter's name sit beside runtime expressions such as its value. Fraiteur compares this to Blazor, except that the input and output languages are both C#. Aspects can live in a separate project for reuse, but he says they usually sit next to the classes that need them, such as a change-tracking aspect beside its base entity.
  • The core ships as NuGet packages on Metalama's own Roslyn fork. At build time, the open-source Metalama Compiler adds an ISourceTransformer entry point that turns one compilation into another, because standard Roslyn does not allow code to be changed during compilation. At design time it uses the standard analyzer, source generator and code fix extension points, so it works in any editor. An optional Visual Studio extension adds aspect syntax highlighting, a diff between source and generated code, and CodeLens markers for aspects.
  • Code validation enforces a team's own architecture rules in the IDE. Fraiteur argues that architecture erodes because guidelines exist only as text checked in code review, where lapses slip through. Existing analyzers enforce community-wide .NET conventions, and architecture unit tests (he names NetArchTest) check a team's own rules through the test runner. Metalama instead shows violations as red squiggles in the editor.
Scott HanselmanLocal AI empowers startups with StoryGraph's Rob Frelow
synopsis

Rob Frelow, co-founder and chief AI officer of StoryGraph, argues that a two-person freemium startup with millions of users survives only by keeping costs low and user trust high. That meant moving off the cloud to rented bare metal, and running its language model on its own servers rather than sending readers' data to a third party.

Off Heroku. Costs tracked users in lock step, and the forecast showed no path to profit. Cloud 66 gave them Heroku-style deploys onto bare-metal servers they rent. He considered servers in his garage and colocation, and rejected both. The company has since become profitable.

The economics. StoryGraph has over 2 million registered users and about 50 million book views a day, funded by just over 10,000 Plus members paying about $5 a month. Hanselman likens the arrangement to the "thousand true fans" theory; Frelow says it leaves the business dependent on goodwill.

The holiday surge. Daily users more than doubled around New Year, and about 100,000 Goodreads imports meant roughly a billion database inserts. That caused outages, which Frelow calls the worst week of his professional life. Hanselman tells a story of his own about a traffic shift at a former employer, and urges Frelow to give himself grace.

Local AI. A self-hosted model runs on every book page hit, chosen for cost, privacy and trust. It is opt-in, and a footnote says no data leaves StoryGraph's servers. Hanselman credits its explanations of why a book suits a reader as responsible AI. The personalised preview is to move from Plus to the free plan.

What comes next. Customers vote on the road map. Shareable year-end graphs drove the January 1 traffic. Buddy reads hide spoilers by percentage, and book clubs with group recommendations were due shortly.

  • Leaving Heroku was forced: freemium costs rose with users. Frelow, co-founder and chief AI officer of StoryGraph, says costs rose in lock step with usage and their forecast showed the company "had no future" on Heroku. They now rent bare-metal servers deployed through Cloud 66, which he says gives Heroku-style ease and is "really the reason" they are profitable without hiring ops staff; the company has two full-time people, and co-founder Nadia is the only developer.
  • The business runs on the goodwill of a paying minority. He reports well over 2 million registered users and about 50 million book views a day, against a Plus membership of about $5 a month that has just passed 10,000 members. He calls that model precarious because it depends on users continuing to like and trust them.
  • The bottleneck in a surge is the database, not server count. New dedicated servers arrive within minutes, he says, but over the holidays daily users more than doubled and about 100,000 Goodreads imports of roughly 1,000 books each, with about 10 attributes per book, came to on the order of a billion inserts. That caused outages and a trade-off between keeping the app up and processing imports; he expects to need replication or a distributed database.
  • Every book page hits a locally hosted language model. Sending millions of hits to a third party would cost too much, give away user data, and risk the trust the business depends on, he argues. The feature is opt-in through a pop-up that never reappears if declined, and a small share of users still dislike it. The personalised AI preview is currently a Plus feature because of cost; he plans to move it to the free plan in the coming months and reshape Plus around stats.
  • Users set the road map; features favour reading together. He cites Nadia's mantras: keep costs low, keep the tech simple with Ruby on Rails, keep talking to customers. Buddy reads lock each comment until a reader reaches the same percentage of the book, read-alongs give up to 1,000 people chapter checkpoints, and book clubs with a group-recommendation AI were due within a week or two. He says they avoid gamification.
Crosstalk Solutions10-Minute Guide to a Secure Remote Home Lab Setup
  • Cloudflare Tunnels expose home-lab services even behind CGNAT. The cloudflared connector dials out to Cloudflare and holds the connection, so no firewall ports need opening. Cloudflare then routes each DNS hostname down the tunnel to an internal service, including other devices on the LAN. The host demonstrated it over T-Mobile Home Internet, says he was not paid by Cloudflare or ZimaBoard, and has not tried the alternatives he names, Tailscale and ZeroTier.
  • The ZimaBoard is a cheap one-click platform for this. The ZimaBoard 832 costs $199, with an Intel Celeron, 8 GB of RAM, 32 GB onboard storage, two SATA ports, two gigabit Ethernet ports and two USB 3 ports. Its CasaOS app store installs OpenSpeedTest (port 3004) and cloudflared in one click. Where casaos.local does not resolve, the host finds its IP in the DHCP leases or on an attached monitor, and updates it first.
  • A tunnel needs a Cloudflare-managed domain and per-service hostnames. The domain is either bought through Cloudflare or pointed at Cloudflare's name servers from another registrar. The tunnel is created under Zero Trust > Networks > Tunnels, and its token command is pasted into cloudflared. Public hostnames then map to http://IP:port, such as the CasaOS dashboard, OpenSpeedTest and the T-Mobile gateway at 192.168.12.1. Until locked down, anyone with the URL can reach them.
  • Cloudflare Access locks the hostnames down, but only with a wildcard subdomain. Leaving the application's subdomain blank protects only the root domain, so the host uses an asterisk. His policy uses an emailed one-time PIN for addresses ending in his company domain and adds a US-only country requirement, which he concedes a VPN easily bypasses. IP-range rules and SSO providers (Google, Azure, GitHub, Facebook) are other options.
Polis PanditIs Fine Dining Worth Over $1,000?
  • This post includes paid content that is not available publicly. See the original source.
Scott HanselmanOur Retro FPGA future powered by Jose Tejada (JOTEGO)
synopsis

Jose Tejada, known as JOTEGO, argues that FPGAs are the superior way to preserve old arcade and console hardware, because they recreate the circuit itself. He funds the work through Patreon early access while keeping it open source, and his day job as a chip designer.

What an FPGA is. It is generic logic: one-bit registers fronted by programmable lookup tables, with some chips carrying a hard ARM CPU on the side. They are mostly used in signal processing. A core is a bitstream that sets switches, closer to a save state for the chip than to a program. Tejada's first contact was the MiST project's Atari and Amiga work, and Hanselman places MiSTer around 2020 or 2021.

Why not software. Every critical signal can in principle be cycle-exact, and software simulation of the same logic runs hundreds of times slower than real time. Tejada agrees with Hanselman that FPGAs will always be more accurate and faster.

Recovering the design. Arcade boards were mostly bespoke per game, so a game-specific core can take as much work as a console. Missing documentation means extracting schematics from boards or decapped chips. He once exchanged messages with a Capcom veteran involved in Street Fighter II, who doubted a Spanish-made board in Tejada's collection was original. He reads US case law as permitting reverse engineering that produces your own design.

Making it pay. Betas go to patrons first and are released later with source. He says staged releases keep people engaged, and that detailed posts make the community feel valued. The day job pays more than Patreon could, and he values its cross-pollination.

The Neo Geo Pocket. The 1999 handheld's CISC CPU, close to 300 instructions with mismatched register, address and data widths, was the hardest part. The beta is monochrome. His choice to use microcode, as the original did, keeps it off smaller FPGAs.

  • An FPGA core describes the original hardware rather than emulating it. Tejada (JOTEGO) explains FPGAs as registers plus programmable lookup tables, enough to build any digital circuit; a "core" is not software but a bitstream that sets switches, so at power-on the chip is the arcade board or console. He believes the Analog Pocket's FPGA uses ordinary volatile memory, so it can be reprogrammed without limit.
  • FPGAs will stay more accurate and faster than software emulation. Given enough information, every signal can be reproduced to one clock cycle on systems clocked at roughly 6 to 30 MHz. His evidence is that simulating the same logic on a PC during development runs hundreds of times slower than real time.
  • Arcade games often need their own cores, rebuilt like archaeology. Arcade makers usually built new hardware for each game, so a single game can cost as much work as a console. He works from schematics and datasheets where they exist and otherwise extracts the design from boards or decapped chips; he says original companies have often lost the material. On legality he points to US rulings on a PlayStation emulator and Intel versus NEC that allowed reverse engineering as long as you build your own thing, and notes that in Spain modifying a console is illegal, which he says his work does not do.
  • Paid early access funds open-source work. Patreon backers get betas before cores are released publicly with source, which he calls one of the few working open-source business models; releasing one thing at a time also makes people value each core more. He keeps his day job as a microelectronics engineer designing chips, citing synergy between the two, and pays two helpers, one of whom answers repetitive support questions from templates.
  • The Neo Geo Pocket core's hard part was a convoluted CPU. The beta, released 5 January, is monochrome only; he says colour "should not be that complicated". The Toshiba TLCS-900H at 6.144 MHz has close to 300 instructions and mixes 32-bit registers, a 24-bit address bus and 16-bit data paths. Implementing it with microcode, as the original did, makes the core too large for smaller FPGAs.
Technology and FriendsKashif Qureshi and Nick Simons on Fluid Framework [EPISODE 792]
  • Fluid Framework syncs application data between clients almost instantly. Simons describes it as a client-side runtime plus a service, built for Microsoft Office productivity apps; Microsoft Loop and Whiteboard use it. Qureshi adds that Teams meeting notes run on Loop components built on it. Any JSON-shaped data can be synced, but it currently has to fit in client memory: about 10 MB is a good ballpark, and the team is working past that limit. The guests name Autodesk and the manufacturing firm Hexagon as the most prominent external partners.
  • Developers use synced data structures as if they were local. The runtime is TypeScript (JavaScript also works) and fits any front-end framework. Writing to the data model updates every client and fires a change event. A service is still required: Azure Fluid Relay, where you bring your own authentication and permissions, or SharePoint Embedded, in preview, which stores Fluid data in customers' M365 tenants. Client code barely changes between them. There is an open-source reference service, but the guests say running your own is a months-long effort for a large team, while a working collaborative app on the hosted services takes an afternoon.
  • Version 2.0's main addition is SharedTree, a schema-based tree structure. Simons says users found 1.0's primitives, mainly SharedMap (key-value pairs, nestable), inflexible. SharedTree supports classes, objects and full arrays, and merges concurrent array edits so there is no data loss or merge conflict, letting a whole app run on one structure. The 2.0 beta shipped in January, with general release expected "later this spring", around mid-year.
  • A browser dev-tools extension shows Fluid state during testing. Qureshi describes a Fluid tab in the Edge developer tools, with a Chrome version too, that shows an app's Fluid components, the current state of its SharedTree, and who else is in the session. More features are to be announced in the coming weeks at aka.ms/fluid and fluidframework.com.
  • The runtime is free and open source; the service is not. Azure Fluid Relay has a free tier for development but none for production. The guests present open source as the answer to reservations about adopting a big company's technology, backed by Microsoft's scale, and they are asking for feedback through GitHub Discussions ahead of the final 2.0 release.
Polis PanditWhy You Aren’t Creative and What To Do About It
  • This post includes paid content that is not available publicly. See the original source.
Technology and FriendsJordan Thayer on the AI Landscape [EPISODE 791]
  • Large language models jumped forward abruptly, after long incremental progress. Thayer, AI practice lead at a software product consultancy, says fields move slowly and then advance "as if 10 years happened overnight". He credits more special-purpose hardware and deep-learning advances in compression that keep large models in memory. The models are now used for work needing more state and structure, such as coding assistants and image, time-series and video generation.
  • Most of his recent projects were not generative AI. He says clients think of generative AI first, but most of his projects in the last couple of years were vision and planning or scheduling systems. Those techniques have been fielded longer, and clients' equipment telemetry is in better order than their internal knowledge bases. Manufacturing examples: deciding where to cut a two-by-four from a board to minimise waste, and estimating the remaining useful life of tractor-trailer parts, which he calls state estimation. The two big needs he sees are avoiding unscheduled downtime and making the most of raw material, time or labour.
  • In regulated industries, he puts generative output in front of an expert. He sees three camps of client: those with a defined problem, those exploring generative techniques, and those who need "AI in the box" for funding or competitive reasons. He warned a pharmaceutical company that a product-recommending chatbot raised medical-device and liability concerns, which "wasn't what they wanted to hear". For a financial services firm with a similar idea, the workable version fed the generated advice to its expert advisers as a draft, with them as the final check.
  • Developers should learn older, less hyped AI fields too. His own background is heuristic search and optimization, close to operations research. It covers puzzles and pathfinding, and also FedEx depot placement, US Air Force air-to-air refuelling sorties, ship scheduling and nurse rosters. He also recommends classic machine learning (decision trees, clustering, k-nearest neighbours), classic NLP such as sentiment analysis, which needs less hardware and maths than LLMs, and OpenCV vision; a friend built a cat-versus-possum detector. His reading list: 3Blue1Brown on YouTube, Russell and Norvig's AI: A Modern Approach, Judea Pearl's Heuristics, and Toby Walsh's Machines Behaving Badly.
  • AI's impressive results come from "comically stupid" methods. He says a solver finds the shortest Rubik's Cube solution by trying move sequences hundreds of thousands of times a second, and most approaches just encode a problem as linear algebra: "it's just doing math". His looming concern is that people stop scrutinising output they don't have to check, so he sees a lot of UX and human-computer-interaction work ahead before these systems are used responsibly in medicine or driving. Giard cites Tesla's eye-tracking alerts. Thayer is most excited about self-driving cars letting ageing people, like his parents in rural Kentucky, keep their independence.
Scott HanselmanThe Power of Open Telemetry with Dr. Sally Wahba
  • Monitoring is reactive; observability answers questions you didn't anticipate. Wahba, a principal engineer at Splunk, says monitoring detects a problem after it happens using predefined metrics. Observability's goal is to reason about a system's internal state from its outputs and answer new questions without adding instrumentation, an investment in "your future self".
  • Distributed systems outgrow the debugger. In microservices a request may never touch your process, and in Kubernetes an ephemeral pod's logs vanish with it unless harvested. She contrasts this with her NetApp storage-OS work, where you could SSH in or read a core dump, and draws parallels with the sensor networks she worked on, where nodes came and went without knowing their neighbours.
  • OpenTelemetry's value is instrumenting once, vendor-neutral. With proprietary libraries, a change of vendor means re-instrumenting everything; OpenTelemetry makes that a one-time investment, with vendors differentiating on top.
  • Instrumentation depth is an art, and needs culture and buy-in. Instrumenting everything costs money and buries the needle in a bigger haystack. Like unit tests, observability should shape design and needs management backing, which she says is best won by pointing to past disasters it would have shortened. Personal data stays out of telemetry, enforced partly by code review.
  • Being on call made her a more empathetic engineer. NetApp shielded developers from production, while at Splunk her team runs its own service, which pushed her to build for fewer 2 a.m. pages and faster recovery. Observability experts are scarce because the field is new and rarely taught, so she advises starting small with zero-config auto-instrumentation.
GeoHussarThe US Dollar keeps outperforming the world, except for Mexico
  • Among major currencies tracked against the dollar, he singles out the Mexican peso as the standout, calling it on a "strong tear" since COVID and one he's optimistic will keep rising. By contrast he describes the pound at a recent record low, the euro down from near $1.50 to about $1.08, and the ruble having gone "from crappy to poopy."
  • He argues dollar dominance has swung through decades of similar cycles before, undercutting current "de-dollarization" claims. He traces the dollar's share of global foreign exchange reserves from 35% in 1951 up to 84% by 1970, down to 47% by 1989, back to 67% by 1998, and roughly 57.5% now.
  • He cites the euro's launch in 1998–99 as the closest historical parallel to today's dollar-decline narrative, noting it was expected to challenge the dollar but never broke 25% of reserves. As further evidence, he notes the BRICS bank itself still operates in dollars because that is where the largest pools of liquidity are.