tech

Unofficial, machine-generated summaries, as of 2026-11-09.

Crosstalk SolutionsTech Websites You Should Know About #1
  • Passwords-generator.net beats built-in generators on options. Beyond the usual numbers, cases and symbols, it can drop look-alike characters (O and 0, I, 1 and l), forbid repeated or sequential characters, and generate several passwords at once (five by default). The host rates it one of the best for its simplicity.
GCastCreating a Copilot Agent with Copilot Studio [GCast 188]
  • Copilot Studio builds an agent through a natural-language dialogue, without code. At copilotstudio.microsoft.com, Create offers templates (travel, finance, weather, a website) or "New agent", where Copilot Studio's own copilot asks what to make. It then asks in turn for a name, what to emphasize or avoid, a tone, and a public website as data source. Giard describes a health-and-wellness chatbot, renames it "GCast Wellness", tells it not to answer medical questions to avoid giving bad medical advice, and picks a friendly tone.
  • A website data source must be two levels deep or less. Giard explains that a domain with two subfolders is accepted but a third level is not. He chooses none for now, and says the source can be changed later.
  • Topics are trigger-driven workflows, some created automatically as system topics. Conversation Start shows a greeting built from the bot.name variable as soon as the agent loads. Greeting fires on phrases like "good morning" or "hi", and Giard adds "good evening" to its list. Start Over asks a yes/no question: yes resets the conversation context that otherwise lets a follow-up like "tell me more about that" work, and no carries on. In the test panel, "let's start again" triggered it although that is not one of the listed phrases. Fallback asks the user to rephrase up to three times, then hands off to an Escalate topic ("talk to a person"), which he says is not yet configured beyond a message.
  • Uploaded knowledge replaces public-internet answers with your own content. By default the agent answers from the public internet. Knowledge can instead come from a public website, a SharePoint site, Dataverse or uploaded files. After Giard uploads a Word document of healthy-eating Q&A, which takes a few minutes to parse and index, the same question on eating out returns the document's answer with a link to the source.
  • Publishing to a website first requires changing authentication to none. The Channels tab warns that only Teams channels are available under the default Teams authentication. Giard switches it under Settings > Security > Authentication to no authentication, essentially anonymous. He then publishes to a demo website rather than a custom HTML page; at its URL the agent answers the greeting and returns the uploaded document's answer.
Scott HanselmanEPISODE 5 - Scott and Mark Learn To... Undocumented APIs
  • Mark's undocumented-API career began with reverse engineering. He studied a published disassembly of the Apple II ROM in about 1985 and added a computed GOSUB to Applesoft BASIC, which he wrote up in Compute! magazine. His Windows work grew out of his Carnegie Mellon PhD on "application transparent fault management": he tried to apply its checkpoint-and-restore idea to Windows 3.1 and 95, which took him deep into their internals.
  • Regmon required reverse engineering the native API beneath Win32. Mark describes Win32 as a facade, one of the "personalities" Windows NT was designed to carry over an undocumented native API. He worked statically, with a disassembler he wrote that merged in the private symbols Microsoft accidentally shipped on an NT 4 beta CD for hardware developers. He also worked dynamically with the SoftICE kernel debugger, at whose maker, NuMega, he briefly worked.
  • APIs stay undocumented so Microsoft keeps the freedom to change them. Mark says that once an important app depends on an API, it can no longer change without breaking that app. He accepted the risk because he maintained his commercial tools and simply fixed a diagnostic tool when it broke, and the core internals move slowly anyway. He says Microsoft must document any API its own products use, so there is no hidden trove of exciting APIs. Hanselman's answer was "document everything". Mark's was that internal functions, open source included, are internal for a reason.
  • Compatibility shims exist to get enterprises onto new Windows. Hanselman argued that Microsoft gets too little credit for running old software, citing VisiCalc running on 32-bit Windows 10. Mark countered that the credit is the billion PCs Windows runs on: enterprises will not upgrade unless their old IT software comes along. He adds that apps lock themselves to a release in subtle ways, such as checking whether a function sits at a given address. Windows no longer has a 16-bit subsystem.
  • Mark's NTCrash fuzzed Windows before "fuzzing" had a name. In 1996–97 he wrote it to barrage the NT system-call interface with garbage, inspired by the crashme tool he had used on BSD Unix at Carnegie Mellon. Microsoft fixed the faults he published. A later version that also hit the kernel-mode Win32 graphics and windowing interfaces found more. When he joined Microsoft he found NTCrash and NTCrash 2 checked into the Windows NT codebase as test tools.
Crosstalk SolutionsA Ghost Town Goes Online: 1800s Silver Mine Gets WiFi
synopsis

The host, Dave Barger and YouTuber Techno Tim spent three days wiring Cerro Gordo, an 1800s silver-mining ghost town at 9,000 ft in California. They left it with wireless coverage across town, a backup WAN, and a 10 Gbit fiber link 700 ft down a mine shaft. Ubiquiti sponsored all the network equipment, TrueCable donated the outdoor Cat6, and Infinite Cables donated the fiber.

The core moves. The plan put the core on the General Store, but it had no power. The host moved the 4U rack, 1U UPS, UniFi Dream Machine SE and a Rocket Prism with an omnidirectional antenna into the Gordon House instead, and he later judged that the better site. Internet comes from a wireless ISP in Lone Pine through a solar relay pole. The crew left that relay alone ("if it ain't broke") because a Starlink Mini now gives a second WAN.

The Bunk House and the hill. Until then, guests' Wi-Fi had come from an indoor AP hanging out of a window. The Bunk House got a NanoBeam, a U6 Mesh Pro outside and a U6 Plus inside. It was also the only place with line of sight past the tailings pile, so the crew ran 300 ft of shielded direct-burial Cat6 up the hill to a NanoBeam aimed at the Hoist House. They painted visible gear brown with Plasti Dip so it would blend in.

The mine shaft. The old coax could carry Wi-Fi down the 900 ft shaft but couldn't power cameras or more APs. The crew chose a hybrid: 244 m of armored six-strand OM3 fiber to an Enterprise 8 PoE switch at the 700 level, and pre-terminated Cat6 for the UK-Ultra APs at 100, 200 and 900 ft. A G5 Flex camera watches the water source. Brent, the owner, installed the run about three weeks later, and the switches' SFP+ ports gave a 10 Gbit link, which the host calls overkill.

The smaller sites. At the recording studio, a NanoBeam's PoE-out port powers a mesh AP over one cable. The General Store got a Switch Ultra 60W, a hidden NanoBeam and two G5 Flex cameras, running off an extension cord until permanent power goes in. Brent's house got a NanoBeam and a U6 Mesh Pro bridged with PoE injectors. Dave measured about the ISP's full 50/40 Mbps inside the tin-sided church, so they skipped it and kept the spares.

The owner's view. Brent recalls a 1–2 megabytes-per-second hotspot and driving to Lone Pine to upload videos. He names the hotel and future cabins as the next needs.

  • A site without power forced the network core into another building. The plan put the UniFi Dream Machine SE and a Rocket Prism point-to-multipoint antenna on Cerro Gordo's General Store, which had no power, so the crew moved them to a locked 4U rack with a 1U UPS in the Gordon House. The host thinks this ended up better than the original plan. Ubiquiti sponsored all the network equipment.
  • They kept the old solar-powered ISP relay and added Starlink as backup. The wireless ISP's signal from Lone Pine reaches a solar relay pole (NanoBeam, MikroTik router, LiteAP). They brought new NanoBeams to replace it but left it alone because it worked, and a Starlink Mini now plugs into the UDM SE as a second WAN beside the roughly 50/40 Mbps ISP link.
  • A tailings pile meant relaying to the Hoist House via a hilltop NanoBeam. The Bunk House was the only spot with line of sight up the hill. A NanoBeam there picks up the Gordon House link, and 300 ft of shielded direct-burial Cat6 donated by TrueCable runs up the hill to a NanoBeam aimed at the Hoist House. They painted the outdoor gear brown with Plasti Dip, which the host says doesn't hurt Wi-Fi.
  • The 900 ft mine shaft got fiber plus Cat6, replacing coax. The old coax could carry Wi-Fi down but couldn't power cameras or more APs. Infinite Cables donated 244 m of armored six-strand OM3 LC-LC fiber, giving a 10 Gbit link between Enterprise 8 PoE switches at the top and at the 700 level. Pre-terminated Cat6 feeds UK-Ultra APs at 100, 200 and 900 ft, plus a G5 Flex camera on the water source. The owner, Brent, installed the shaft run about three weeks later.
  • Some sites needed far less than planned. Dave Barger measured close to the ISP's full speed inside the tin-sided church, so they skipped it and kept the spares. At the recording studio, a NanoBeam's secondary PoE-out port powers a mesh AP over one cable. The General Store got cameras running off a temporary extension cord. Brent says the town went from a 1–2 megabytes-per-second cellular hotspot to working internet, and he sees the hotel as the next need.
Crosstalk SolutionsStop Network Intruders: Automatic Device Blocking with Fing Agent!
  • Fing Agent blocks new devices by default after you approve existing ones. You first scan the network and confirm which devices belong. With automatic block turned on, any new device is kept off the network until you allow it, and Fing Agent notifies you when one tries to connect.
  • Each device can be blocked outright or paused for a chosen time. A block removes the device from the network until you unblock it. A pause cuts its internet access for a period you choose or indefinitely, which the host says suits businesses that want control without constant manual work.
  • The host relays a Black Friday price on Fing's Premium plan. As captioned, it costs $449.99 a year and covers up to three Fing Agents. The short presents this as a limited-time offer and says nothing either way about sponsorship.
Scott HanselmanManaging secrets with Onboardbase and Dante Lex
synopsis

Dante Lex, CEO of Onboardbase, argues that secrets management fails because the secure path is less convenient than the insecure one. His product therefore assumes developers will make mistakes and hides secrets from them, while making sharing and leak-catching automatic.

Positioning against Vault. Lex markets Onboardbase openly as a simpler, cheaper HashiCorp Vault. He likes Vault but says it needs dedicated security engineers, and that naming it brings in customers who already know what they want.

Why secrets leak. Lex blames convenience. Developers keep secrets in text files, Notion and Slack, and he has lived through a breach. His design target is a tool as easy as pasting into Slack.

Seeing nothing, sharing deliberately. In his account, secrets are injected in real time and stay invisible to engineers. Service tokens are scoped per environment, device tokens can be revoked, credentials rotate after a set number of uses or days, and shared secrets travel as links that self-delete minutes after viewing. He wants .env files gone.

SecureLog and assumed negligence. The new product scans console logging and React server components, then masks or strips leaked secrets before they reach production. Lex dismisses the worry that it breeds laziness: he says mistakes are certain. Hanselman calls this falling into "the pit of success".

Testing and friction. Lex says each feature gets a week of security checks and that his team uses the product on all its own work. He calls friction the one controllable variable, and claims setup takes five minutes.

  • Onboardbase sells itself as a simpler HashiCorp Vault. Its homepage reads "if HashiCorp Vault was simpler, priced right and just worked". Lex, its CEO, says he used Vault extensively and likes it, but it suits late-stage enterprises with security engineers to set it up. He says the comparison wins customers who already know Vault and need little explanation, and that HashiCorp accounts have signed up without ever contacting the company.
  • Secrets leak because developers favour convenience over security. Lex says developers are wrongly assumed to be "secure by default", and they keep secrets in text files, Notion, Google Docs and Slack. He has dealt with a data breach at a former employer. His conclusion is that the secure tool has to be as convenient as pasting a secret into Slack, or it will not be used.
  • Developers should work with secrets they never see. By Lex's account, Onboardbase injects secrets in real time into local machines and servers. Per-environment service tokens limit each process to what it needs, and device tokens can be revoked when someone leaves or a machine is compromised. Tokens can auto-expire or rotate after a set number of uses (100, say) or a set time (30 days). Deliberate sharing goes through an encrypted link that deletes itself a few minutes after viewing. His stated goal is to eliminate .env files entirely.
  • SecureLog catches the secrets developers leak into logs anyway. Lex says it scans console.log and console.error calls and React server components, then masks or removes the secrets it finds and tells the developer. He says this keeps secrets out of production builds, including the browser's developer tools. Asked whether it would make developers lazy, he said he already assumes negligence and that mistakes are certain. Hanselman framed this as his "pit of success".
  • Lex claims every feature gets a week of security testing. By his account, the product gets automated and manual testing, with only the marketing website exempt, and the team uses Onboardbase on all its own projects. He calls friction "the one thing you can always control". He says setup takes five minutes or less and every product he builds ships with a live demo, which he credits with bringing in customers.
Crosstalk SolutionsUltimate RV Internet Setup: Triple WAN Router Changes Everything
  • The host pitches the GL.iNet Spitz AX for semi-permanent mobile setups. He names RVs, construction sites, remote cabins and boats, and runs it with three WANs: Starlink, Wi-Fi as WAN, and dual cellular SIMs. GL.iNet sponsored the video, and the description carries a 30%-off link.
  • It has dual 5G SIMs and removable antennas for external cellular antennas. The router has a 2.5 Gbit WAN port, a 1 Gbit LAN port, USB-A for storage or tethering, and microSD. The SIMs aren't hot-swappable, so install them before powering on. Four of the six antennas are cellular and two are Wi-Fi 6, and any can be swapped for external ones.
  • Use an omni antenna on a vehicle and a directional one at fixed sites. On his RV roof, the host put a Mobile Mark omni antenna on the four cellular leads and kept Wi-Fi inside. For fixed sites he suggests a directional antenna such as the Waveform Quad Pro. He notes an RV's Winegard Air 360 picks up only TV, while the Air 360+ adds cellular and Wi-Fi.
  • The host puts cellular last to avoid data caps and uses failover. His order is Ethernet, then Wi-Fi as WAN (repeater mode), then cellular, to limit data-cap and overage costs. He says failover suits most cases, but load balancing is worth it with several unlimited links. For the two SIMs, two different carriers is ideal.
  • In his driveway test, cellular was fastest and Starlink was erratic. Starlink Mini gave 137/14.8 Mbps; he usually sees 60–70 up to about 220 Mbps. Wi-Fi as WAN to his house Comcast gave 174/128 Mbps through the RV walls, so good campground Wi-Fi may be worth preferring. T-Mobile through the roof antenna gave 268/34 Mbps.
Crosstalk SolutionsFing Agent: Raspberry Pi Network Security Made Easy!
  • Fing Agent turns a Raspberry Pi into an always-on network monitor. The host says it keeps a live device inventory and alerts you to new or unauthorized devices, which you can block one at a time or by default.
  • The host says it also scans for vulnerabilities and reports performance. He says its automated scans find open ports and weak router configurations, and it reports on network health, internet speed and ISP performance. He pitches it for small businesses through to growing enterprises; the short doesn't mention sponsorship.
Scott HanselmanBONUS - Scott & Mark Learn To... Skin Care
  • Mark's skincare routine is deliberately minimal. He uses Head & Shoulders and bar soap, shaves with a cartridge razor because electric razors never shave close enough, and uses a moisturizer he shows on screen without naming. He is unsure whether it has SPF. He keeps a short stubble rather than a clean shave to avoid ingrown hairs.
  • Hanselman argues men should moisturize with SPF daily. His routine is longer. He co-washes his hair with conditioner and uses Jack Black Double Duty face moisturizer with SPF 20 every day. He also uses Clinique All About Eyes serum, recommended by a makeup artist at Microsoft Build, a Neutrogena dark-spot corrector for sun spots, and retinol at night. If limited to two products he would keep the moisturizer and the shampoo. He says none of the products carry affiliate codes.
  • Hanselman says clear aligners suit only light corrections. He got braces in his 40s and says they fixed his bite. He argues that aligners cannot apply enough torque to move a tooth more than a few degrees.
Scott HanselmanKotlin from Scratch with Faisal Islam
  • Islam argues Kotlin took the best of its predecessors. He calls it the newest major language: its first official release came in 2016, against roughly 30 years for Python, Java and C++ and 14–15 for Go, Julia and Rust. He credits it with clean syntax, type safety, elegant null handling, first-class functions and freedom to mix functional and object-oriented styles. It is fully interoperable with Java, including automatic translation of Java code and direct use of Java libraries. When Hanselman raised how much Kotlin borrowed from Scala, Islam said he does not know Scala.
  • Google and JetBrains drove Kotlin's rapid adoption. Hanselman notes that the first commit was in 2010 and that Google made Kotlin its preferred Android language less than three years after the 2016 stable release. Islam cites figures he looked up: about 60% of professional Android developers use Kotlin, and it has been downloaded "more than 200,000" times. He adds that it comes built into JetBrains' IntelliJ IDEA. He says Compose Multiplatform is still evolving but is production-ready for Android and desktop.
  • The book teaches problem solving, not Android development. Hanselman counts about seven mentions of Android in nearly 400 pages. Islam says the book began as one on computational thinking, and he chose Kotlin over Python for researchers and other non-professional coders. It has 37 projects using only high-school maths, such as calculating Earth's circumference. Its code comes in small chunks that mirror how the problem is broken down. He credits the in-code numbered callouts to his publisher, No Starch Press.
  • Kotlin's academic future depends on visualization and ML libraries. Islam used JavaFX in the book but says it can look dated, and he found Julia better integrated with visual libraries. TensorFlow has been ported to Kotlin, but he says many data-mining and machine-learning tools remain in Java or Python. For casual research projects he says Kotlin already has enough, and he calls Python error-prone because it is dynamically typed. He plans to publish solutions to the book's exercises on Medium.
Technology and FriendsDanny Kim on Cybersecurity in Industry and Education [EPISODE 831]
  • Kim's security company has stayed bootstrapped and founder-run for decades. He started it at Cornell with two college roommates, a political science and a hotel management major, before graduating in 1990; the first product ran on DOS 2.0 and locked and encrypted drives, files and directories on the fly. He says the three are still together 38 years on, took no VC or investment money, and now serve enterprises (Walmart, Boeing, Bank of America) and, more recently, government work he cannot detail. His closing advice is to start a company with friends who share your passion, vision and principles.
  • Assume attackers are already inside, and hide the critical assets. Kim calls the end user a weak link that cannot be re-engineered. He says his lead architect, an ex-CIA hacker, saw two freshly started Azure VMs attacked more than 5,000 times over lunch, which led to a product (captioned as "Shepard") that removes the need for open ports without changing the application or server. He claims an unnamed agency averaging up to 10,000 attempted breaches and breaches a month went to zero after deploying it, and pitches it as additive to existing defences.
  • AI scaled attacks first; defenders are using it to catch up. Kim says threat actors used AI to scale their attack vectors and were ahead at the start, while defenders now use it to learn user behaviour and spot a hacker's, alongside behaviour-analytics firms such as CrowdStrike. He puts the average time an attacker sits in a network before ransomware or exfiltration at three to four months; Giard adds that AI can track patterns spanning months that no administrator could.
  • Education is a prime target: regulated data, weak defences, easy ransom. Kim says he has heard education is the third most attacked industry, because children's data is regulated like finance and healthcare data while schools have low cybersecurity resilience, and hackers are "inherently lazy". He says a sister school of the high school where he volunteers had its student information system data encrypted a couple of months earlier and paid a half-million-dollar ransom the next day; he adds that a small business with its order system down can be put out of business.
  • Kim's nonprofit aims to bring hands-on STEM and cybersecurity to all students. He says his nonprofit, Quest, began as a San Jose STEM program, built with NASA a permanent experiment unit on the International Space Station with capacity for 8 million experiments, runs an underwater facility 20 miles off Monterey, and now teaches middle and high school students cybersecurity, including a Chicago event in Microsoft offices organized by Microsoft's Lori Kim. He argues cybersecurity needs communicators and managers, not only deep hackers, and that the biggest change he sees is in underserved students' confidence.
Scott HanselmanEPISODE 4 - Scott & Mark Learn To... Pick a Programming Language
  • Mark says language choice divides first on garbage collection. Systems code cannot tolerate garbage-collection pauses, their unpredictability, or the memory that builds up between collections. He says C/C++ and Rust are the only mature non-GC languages, meaning they have the tooling and package ecosystems behind them.
  • Azure allows no new C/C++ code, by Mark's own policy. He says he declared the policy a few years ago. Agents on Azure's Boost offload card, which runs Linux and were ported from Windows-based C++ on the host, are being rewritten in Rust, and new ones are written in Rust. For non-systems code he would use C#, Python, Go or maybe Rust. He credits Rust's ownership system: without the unsafe keyword you cannot create a memory-safety problem.
  • The ecosystem, not the syntax, decides where a language dominates. Mark says AI research has pushed him into Python for the last couple of years because the ecosystem leaves no choice. Hanselman argues that languages are converging on the same keywords and collections. He offers a half-joke for why Python won ML: it is "more fun to say".
  • Hanselman argues languages need not "win" to justify existing. His analogy is Finnish, which suits its speakers, while JavaScript, like English, is an undesigned mash that steals from everything. He also says languages built with hindsight are better, calling Kotlin "demonstrably better than Java". Mark has no favourite language and says languages serve different purposes and stylistic preferences. Hanselman says his own favourite is C#.
  • CSnakes lets C# call Python in-process. Hanselman describes Anthony Shaw's tool, which uses source generators to parse a Python file and generate C# bindings, then marshals data across. The goal is to consume Python data-science libraries such as PyTorch from C#. Hanselman says they have that working, with edge cases likely. He contrasts it with earlier projects such as IronPython, which tried to reimplement Python.
Scott HanselmanPutting AI into Production with Fireworks AI's Lin Qiao
synopsis

Lin Qiao, CEO and co-founder of Fireworks AI, argues that generative AI in business is heading toward small, customized open-weights models. In her view, the hard problem is serving them fast and cheaply, tuned to each customer's workload.

Leaving Meta. After five years taking PyTorch to production at Meta, Qiao saw enterprises such as Walmart, Disney and John Deere lacking the software, hardware and teams to adopt AI. She judged helping the whole industry the bigger impact.

Why inference. Inference scales with end users, training only with researchers. She calls training a poor business because models are superseded weekly and hardware generations arrive several times a year. Latency and cost are what break products, and cost can bankrupt a startup that finds product-market fit.

FireOptimizer. On top of Fireworks' own PyTorch build, kernels and caching, the optimizer works like a database query planner. Each customer gets a personalized quality–latency–cost curve and chooses a point on it. Speculative decoding pairs a small and a large model and pays off only when the small model's hit rate is high. The optimizer aligns both models to the workload.

Safety. Qiao says model providers such as Meta carry most of the guardrail work. Because industries and regions differ, she argues customers need to customize their own safety rules.

Small models. She predicts that models of a billion parameters or fewer, customized, will handle narrow business tasks. Hanselman adds his own preference for small local models over giant ones.

  • Qiao left Meta because enterprises lacked the means to adopt AI. She spent five years taking PyTorch from a research project to production at Meta's scale. Working with companies such as Walmart, Disney and John Deere, she heard that they lacked the right software, hardware and teams. She judged that serving the whole industry was a bigger impact than staying at Meta.
  • Fireworks chose inference over training as the larger problem. Qiao argues that inference demand scales with end users, bounded only by Earth's population, while training scales with the far smaller number of researchers. She says training is a hard business because models are superseded almost weekly and hardware generations now arrive several times a year instead of every two or three years. Fireworks bets on open-weights models plus lightweight fine-tuning. She names latency and serving cost as the two problems, and says startups that reach product-market fit can go bankrupt on cost.
  • FireOptimizer tunes inference to each customer's workload. Qiao compares it to a database query optimizer. It shows each customer their own trade-off curve across quality, latency and cost, and lets them choose a point on it. Beneath it sit Fireworks' own PyTorch build, custom GPU kernels, a distributed execution engine and caching. She endorsed Hanselman's analogy of a reverse proxy in front of a model. Speculative decoding pairs a small and a large model, giving the small model's latency and the large model's quality only when the small one's hit rate is high. She says FireOptimizer aligns both models to the workload automatically.
  • Qiao says safety starts with model providers, then customization. She cites Meta, for whom Fireworks was a Llama 3.2 launch partner, putting heavy post-training work into guardrails because it has no hosted API to control. She argues that safety means different things in different industries and regions, so customers must be able to adjust the model to their own guidelines.
  • Qiao predicts business AI will move to ever smaller models. She argues that business tasks are constrained, not open-ended, so models of a billion parameters or fewer, plus customization, can match trillion-parameter models on narrow tasks. Hanselman added his own view: he is disappointed by the fascination with giant models and expects the interesting work in groups of small models running locally.
Scott HanselmanBuilding The Spoiler Talk app with Charnelle Asante
synopsis

Charnelle Asante, a registered nurse and founder of Spoiler Talk, ends the conversation two weeks past a relaunch, with 440 users, a developer in Ghana, a newly hired marketer and no intention of slowing down. Her position is that the idea kept proving itself every year she nearly quit, and that a smaller, safe community is acceptable even as she expects it to grow large.

Six years to launch. She had the idea in 2018 and, after nursing school in 2019, saved for it by working 70-plus hours a week. A team of about 10 in India built the first version, cost more than she expected, and left an app with problems she could no longer afford to fix. Developers she later showed the code to could not follow it, so in 2023 she started over with a developer found through her brother in Ghana.

Choosing and trusting a developer. With no coding background, she let seven candidates read the repository and picked the one who was confident, had a plan and seemed to care. She says caring mattered as much as skill, and she defers to him on technical choices such as React Native.

Getting through Apple. Apple rejected the app repeatedly, raising one issue per submission; the last was the reporting, blocking and filtering a social app must have. A phone call with Apple resolved it.

What the product is. Discussion is tied to a specific book, show, film or club, so people who have not seen it stay out. She ignores competitors, plans author pages and support for independent authors, and is building moderation tools. Books come from an API; TV and films are entered manually for now.

Scale and growth. Hanselman puts the "thousand true fans" idea to her; she goes back and forth between a boutique app and an eventual buyout by an entertainment media company. Growth so far is from building in public to close to 5,000 TikTok followers, many from BookTok, with a target of converting 10%. She is self-funded and waiting on a grant.

  • The app survived a failed first build and a full rewrite. Asante, a registered nurse who now manages a healthcare clinic, had the idea in 2018 and funded it by working 70-plus hours a week as a nurse; a pricey team of about 10 in India built version one, then she ran out of money as it developed problems. In 2023 she found a developer in Ghana through her brother, and they rebuilt from scratch after several developers who saw the old code said they could not follow it.
  • A non-coder should pick the developer who cares, not just codes. She gave seven candidates access to the repository; she chose the one who was confident about what he saw, had a plan and seemed genuinely invested, where she felt the earlier team was "just slinging code". She lets him make the technical calls (the app is React Native on iOS and Android).
  • App Store review rejects one problem at a time; ask for a call. Apple, stricter than Google Play, kept rejecting the app, the last time because a social app must let users report, block, hide or filter others. She says a phone call with a human at Apple explained everything and the app was accepted soon after.
  • She wants a safe, structured space more than sheer scale. Conversation is organised around a specific book, film, show or club, so someone avoiding spoilers simply stays out of that room; she builds to her own vision rather than copying Letterboxd or Goodreads, and an admin panel for moderation is in progress. She wavers between a "boutique" community and expecting an entertainment media company to buy it out; Hanselman offered his "thousand true fans" framing (a thousand fans at $100 a year is a $100,000 business).
  • Early traction comes from building in public on TikTok. At recording, two weeks after launch, the app had 440 users across iOS and Android, after about 200 in beta; she has close to 5,000 TikTok followers, about half from BookTok, and targets converting 10%. She is bootstrapping and waiting on a grant, has just hired a content marketing specialist in Nigeria, and courts independent authors; books arrive through an API refreshed every 24 hours, while TV and films are still added by hand.
Crosstalk SolutionsThe Return of Dr. Frankenstein's Dream Machine!
  • A UK Ultra board fits inside the Dream Machine's drive tray. The host's team mounted a stripped UniFi UK Ultra (the "Swiss army knife" access point) on a 3D-printed plate in the Dream Machine SE's hard drive tray, powered by a short patch cable to a front PoE port; STL files are linked. The trade-off is losing the drive bay for UniFi Protect.
  • The second build packs router, access point and camera into 1U. This version keeps the drive tray, wedges another UK Ultra beside the power supply with RP-SMA connectors extended to the front bezel for external antennas, and wires a dissected G5 Flex camera to look out from the front panel, IR night vision included.
  • Internal power came from hardwiring two of the switch's PoE ports. The team pulled the modular connectors behind switch ports 1 and 2 and hardwired patch cables to the pins, making those ports unusable from the front. UniFi still shows both devices normally, the UK Ultra at 1 Gbps and the G5 Flex at Fast Ethernet.
  • The host frames it as a Halloween stunt, not a recommendation. He says Ubiquiti would not condone voiding warranties this way, notes he bought over $1,000 of hardware for the video, and gives no reason for the builds beyond seeing whether it could be done.
Technology and FriendsChristina Aldan on Changing Careers [EPISODE 830]
  • Career transitions strain mental health, so get two mentors. Aldan, who sits on the boards of two mental health nonprofits, says transitions are the most stressful periods of life, including layoffs and promotions from developer to manager without training. She urges a career mentor for networking and resume review and a technical mentor for getting unstuck, and says mentors push people to apply when only, say, 90% qualified. Giard raised women's reluctance to apply without meeting every requirement; Aldan says peer-reviewed studies repeatedly find it, and adds cultural pressure for perfection among the Asian Pacific Islander students she mentors for free.
  • Knowing your core values tells you which jobs to refuse. Aldan turned down an entry-level front-end job in Las Vegas 17 years ago when the sites turned out to be pornography sites, and she says values also settle questions like working in the legal marijuana industry. Giard gives his own case: he left an e-commerce build because it sold cigarettes behind an age checkbox a child could tick. Aldan says enforcing such a boundary also builds confidence.
  • Protect sleep and health during a job search, or interviews suffer. Aldan recommends at least seven hours of sleep, nourishing food, walks, coffee with a friend and time in nature, so that your nervous system is calm when the interview comes. Searching around the clock on four cups of coffee, she says, makes you interview out of desperation and exhaustion. Both agree that rejection is routine, often comes with no reason given, and does not mean you did anything wrong.
  • Rehearsing a hard conversation makes the next one easier. Aldan and her LinkedIn Live co-host Leslie Martinich run a workshop with role-play of difficult conversations and salary negotiation. Her reasoning is that once the neural pathway has been created it only needs reinforcing, so each hard interview leaves you better prepared rather than more afraid. She reminds people they have "survived 100% of your worst days so far."
  • Aldan is leaving tech-adjacent consulting to train in myofascial release. Her brand strategy clients, mostly mid-sized tech companies and startups, closed or lost funding during lockdown. After a seminar and retreats of one month and 10 days in John Barnes's style of myofascial release, she was told the advanced classes require a licence such as massage therapist, so she is in massage school four days a week. She says losing an identity built on 18–19 years of marketing work is hard, and she steadies herself with her core values: contribution, growth and community.
Scott HanselmanEPISODE 3 - Scott & Mark Learn To... Use AI and Know AI Limitations
synopsis

Mark Russinovich ends where he starts: AI is a large productivity gain he uses every day, but hallucination and jailbreaks are built into how these models work, so the people deploying them have to design for those failures rather than hope them away. His forthcoming LLM fundamentals paper for Communications of the ACM covers the same ground.

Using AI without knowing the language. Russinovich writes Python and PyTorch with Copilot and says he needs only enough Python to work efficiently. Hanselman, who rubber-ducks with models, asks whether this rots the brain; Russinovich relays that professors now teach fundamentals first and then allow the tools.

Where tone comes from. Claude saying "certainly" against its own published system prompt is, in his account, baked in by alignment training. Grok, which he calls unaligned on safety, shows each vendor deciding what its model will say.

Hallucination. He explains next-token sampling: wrong answers seen in training keep some probability, and an early wrong word pushes the model to justify it, which Hanselman pictures as a marble falling into a gravity well. Longer coherent chats now come from more data, multi-turn training and better alignment. His reliable triggers are a made-up "Russinovich's 10 immutable laws" and requests for citations, which fail even with web search. Omissions count, and groundedness checks catch only one class.

Jailbreaks. His Crescendo technique walks a model from the Finnish resistance to Molotov cocktail instructions using its own answers. Hanselman compares it to badgering a witness.

Guardrails. Hanselman argues barriers belong where speeds are high and that decisions are being made by companies behind opaque models; Russinovich says deployers must know whether their risk is a quiet street or the autobahn.

  • Know a language only as well as efficiency requires. Russinovich says he can no longer code without AI and writes a lot of Python and PyTorch for AI research without knowing Python well, learning more only when relying on the model stops being the efficient route. Hanselman likens the worry to older fears that syntax highlighting, IntelliSense and calculators would "rot your brain"; Russinovich relays that university professors have settled on students learning fundamentals first, then leaning on tools such as GitHub Copilot.
  • A model's tone comes from post-training, not the underlying technology. Russinovich attributes Claude's habit of saying "certainly", which the published Claude 3.5 Sonnet system prompt of July 12 tells it to avoid, to examples in its alignment training. He calls Grok the only GPT-4-class model without safety alignment, and says each model maker deciding what its model will and will not say risks a fractured landscape.
  • Hallucination is inherent and cannot be driven to zero. He explains it from autoregressive next-token sampling: trolling in training data gives a wrong answer some probability, and a model that opens with "no" will invent a justification for it; omitting key facts from a summary counts too. Reliable triggers he gives are asking for "Russinovich's 10 immutable laws" (they are Scott Culp's laws of security) and asking for a paper reference, which fails even with web search; groundedness-checking APIs in Azure AI Studio remove only one class of error.
  • Jailbreaks steer the model with its own earlier answers. His Crescendo technique asks what weapons the Finnish resistance made, then how they made them, getting Molotov cocktail instructions without ever naming the request. Hanselman compares it to a prosecutor leading a witness and to journalists who coerce a model and then report what it said.
  • Guardrails should match the stakes of the deployment. Hanselman argues for barriers where traffic is fast, not in quiet neighbourhoods, and says no one would put a VM on the open internet without a firewall; Russinovich says anyone deploying an LLM must know which kind of risk they are running. His LLM fundamentals paper, covering hallucination, indirect prompt injection and jailbreaks, was forthcoming in Communications of the ACM at recording.
GCastCreating Azure AI Services [GCast 187]
  • Azure AI Services is the renamed Cognitive Services. Giard says Microsoft rebranded Cognitive Services as Azure AI Services "not long ago"; the categories include speech, search, vision and language, among others.
  • A single-category service needs only the Basics tab. Giard creates a Speech service from the Azure portal's Create a Resource button, filling in a resource group, region (East US), name and the standard pricing tier; networking, identity and tags are optional. The Computer Vision service uses a near-identical dialog, plus a checkbox acknowledging the terms.
  • Each single service gives a REST endpoint and its own studio. The resource exposes a REST API endpoint called with one of its keys, and a link to Speech Studio or Vision Studio, with playgrounds and low-code or no-code tools such as real-time speech-to-text.
  • One "Azure AI services" resource covers all the categories. Searching for Azure AI services turns up several similarly named entries, and Giard points to the one with a specific icon; creation took about 35 seconds. Its overview blade has a tab per service (Speech, Content Safety, Computer Vision, Language, Translator and more), each with its own endpoints. Speech has three endpoints: speech-to-text, text-to-speech and custom voice. A link opens Azure AI Studio, which has the same playground tools.
  • Giard's rule: one service individually, several through the combined resource. He says the combined service makes the most sense when an application calls several services, and a single individual service when only one is needed.
Scott HanselmanThe Xbox Adaptive Joystick with Kaitlyn Jones
synopsis

Kaitlyn Jones, senior product manager for Xbox accessibility, makes the case that adaptive gaming is a kit players assemble for themselves, and that the new $29.99 Adaptive Joystick extends that kit cheaply using standards people already own. She ends on the view that the work will never be finished and should reach every piece of Xbox hardware.

The hub. Hanselman, who used the Adaptive Controller after shoulder surgery, calls it a construction kit. Jones explains its 19 3.5 mm ports, two unmapped wildcard ports that accept a joystick, driverless recognition as a normal controller, and up to three remap profiles saved on the device. Makers have built pillow buttons for children who dislike clicks.

The joystick. It has one thumbstick and six buttons, is ambidextrous, works alone or alongside other controllers, and has a 1/4-20 tripod thread so it can be mounted for chin, foot or wheelchair use. Price was a primary goal because the community already pays for many assistive devices.

Toppers. Xbox Design Lab now generates free STL files for custom thumbstick toppers across the joystick, Elite and standard controllers; Elite support was a priority because many players with disabilities use it.

How she got here. As an occupational therapist she found games more engaging than standard exercises, and her father's nonprofit, Warfighter Engaged, hacked controllers for veterans. A Microsoft engineer reached out, hackathons followed, and that work fed the Adaptive Controller. Her father is stepping back at year's end.

What comes next. Jones sees no end state, wants software such as head tracking and voice integrated with the platform (Hanselman discloses an investment in Cephable), and points to Reddit, Makers Making Change and Logitech's adaptive kit. Both argue ageing players need gentler modes as well.

  • The Adaptive Controller is a hub, not a finished controller. Jones, a senior product manager for Xbox accessibility, describes 19 labelled 3.5 mm ports that externalise every standard button, plus two unmapped "wildcard" ports, X1 and X2, that can take a 10K potentiometer joystick. It appears to a machine as an ordinary controller with no drivers and stores up to three remap profiles on the device itself, so they travel to a friend's console; Hanselman, who used one after shoulder surgery, calls it "a controller construction kit".
  • The new Adaptive Joystick reuses standards people already have. It is a one-thumbstick, ambidextrous device with six buttons that works alone on PC or console, with Controller Assist (formerly Copilot) or plugged into the Adaptive Controller. Its 1/4-20 tripod thread lets it be mounted for chin, foot or wheelchair use, the same logic as the headphone-jack ports; due early next year at recording, it is priced at $29.99 because users already spend heavily on medical and assistive devices.
  • Adaptive Toppers let players 3D-print their own thumbstick grips. Announced in August through Xbox Design Lab, the tool offers about six topper shapes, adjustable height and width, and a free STL file for the Adaptive Joystick, the Elite or a standard Series X|S controller. Jones says Elite support mattered most because many players with disabilities use it; Hanselman notes prints take minutes and a library can make them.
  • The product came from outside hackers brought into Microsoft. Jones was an occupational therapist who used games in treatment, and her father's nonprofit, Warfighter Engaged, an all-volunteer 501(c)(3), soldered adapted controllers for veterans with limb loss. A Microsoft engineer saw its Twitter feed, hackathons followed, and those partnerships fed into the Adaptive Controller; her father plans to stop custom designs at the end of the year, hoping commercial products like the joystick fill the gap.
  • Accessibility work has no end point and is spreading to standard hardware. Jones wants inclusive features in every future Xbox device and hopes tools combining head tracking and voice can integrate with the platform; Hanselman discloses he is an investor in one such tool, Cephable, free for individual use. She cites Logitech's adaptive kit, with 12 buttons and boards for $100 against about $60 for a single assistive button before it, and both argue that ageing players need easier modes too.
Crosstalk SolutionsPeplink SpeedFusion: Bond Starlink with this Internet Game-Changer!
  • Bonding beats load balancing because sessions survive a link failure. Peplink sponsored this video, and Crosstalk is a Peplink gold partner that sells and installs it. The host explains that load balancing pins each client to one link, capping its throughput and dropping calls if that link dies; SpeedFusion splits each session's packets across all links through an encrypted VPN to an endpoint that reassembles them.
  • Smoothing trades extra bandwidth for loss-free live streams. It sends duplicate packets over separate links, so a packet lost on one arrives on another. The host cites a client streaming sports events from a portable Peplink kit with several Starlinks and LTE backup, and "hot failover" keeping VoIP or Zoom calls alive when one link drops.
  • Setup through SpeedFusion Connect takes a few clicks. On a Peplink B One 5G (MSRP $599; a B One without 5G is $299), the host picked Seattle, San Francisco and San Jose endpoints from a latency-based suggestion list, avoiding the suggested Vancouver to keep traffic in the US. Dragging WANs between priority levels switches between load balancing and failover, and Wi-Fi can be used as a WAN.
  • Bonded throughput is capped well below the router's WAN speed by default. The B One 5G routes 1 Gbps without SpeedFusion, but by default bonded links reach 400 Mbps aggregated unencrypted and 200 Mbps encrypted; paid Peplink plans raise throughput and data allowance. The host's Starlink Mini typically tests 50–150 Mbps down and his Gen 3 80–300 Mbps, and he says bonding evens out that fluctuation, upload especially.
  • Crosstalk has deployed Peplink in remote and mission-critical sites. The host describes an NDA-bound TV production in remote Northern Canada given a PACE plan: dual Starlinks, Iridium satellite, LTE SIMs from several carriers and local wireless ISPs. He also says Peplink has bonded up to 12 Starlinks on Royal Caribbean cruise ships using a Balance 2500 EC.