tech
Scott HanselmanVIDEO: Making "Tales of Kenzera: Zau" with Abubakar Salim
synopsis
Abubakar Salim, an actor and the founder of Surgent Studios, presents Tales of Kenzera: Zau as a first game in which every major choice serves one purpose: expressing his grief over his father's death. The genre, the feel of the controls, the mythology and the price all come back to it, and he argues that this heart is what lets a small studio's debut stand next to far bigger releases.
Why a game, and why this genre. His father, a C++ engineer at Xerox, introduced him to games and died just before Salim graduated from drama school. A game rather than a film was the only fitting tribute, he says. He chose the Metroidvania because it throws a character into a hostile, alien world that grows familiar over time, which is how grief felt to him.
Building a studio from nothing. With no engineering background and no experience of making games beyond voicing a character in Assassin's Creed Origins, he spent most of four years building a team, learning the craft and signing with EA. The bulk of the game was made from 2023 onward. The team moved from Unity to Unreal, the CTO arrived only in the final year, and the studio has been remote by design, with artists spread across several African countries, Europe and New York.
Myth drawn from life. Hanselman notes that the lore is real rather than invented. Salim confirms that he drew on several Bantu traditions, including the impundulu lightning bird and the South African healers he met while filming there, and that he did it from his own perspective and his father's stories rather than in response to Black Panther. Because the tradition is oral, every teller reshapes a story, and he wanted the game to carry that.
The feel in the hands. Salim describes the movement as a dance that demands precision: frustration and button-mashing fail, while calm rhythm succeeds, mirroring the work of grief. The instant-death spikes are deliberate, to make players think, though he concedes the developers had stopped noticing how hard the game is for newcomers.
Price. Remembering that he could afford about one game a year as a child, he set the price at roughly that of a pizza, about $20.
- The Metroidvania genre was chosen because it maps onto grief. Salim, actor and founder of Surgent Studios, says the genre drops a character into an alien, hostile world they cannot prepare for, which grows more comfortable the longer they stay. The game is a homage to his father, a C++ software engineer at Xerox who introduced him to games and died just before Salim graduated from drama school; he says games, not film, were the only way to do right by him.
- The platforming rewards calm rhythm, not frustrated button-mashing. Salim says the team wanted movement to feel like a dance that still demands precision: attacking the controller harder fails, while stepping back and finding "the beat of the drum" succeeds, mirroring the journey through grief. Instant-death white spikes, unlike the pink thorns that only knock you back, are deliberate, to force the player to think; he concedes that developers who had lived with the game for four years stopped noticing how taxing it is for new players.
- The lore draws on real Bantu myth across many cultures. Rather than invent a pantheon or pick one country, Salim pulls from several Bantu traditions, among them the Zulu impundulu lightning bird and the traditional healers he met while filming Raised by Wolves in South Africa. He rejects the idea that it was prompted by Black Panther: it is his perspective and his father's stories. He told the team that sending players down a "Wiki wormhole" meant they had done their job, and he says the oral tradition, which lets each teller change a story, is built into the game.
- Most of the time went into building the studio, not the game. Salim says most of the four years since the studio's founding went on building a team from scratch, learning what making a game means, and signing the EA deal; the bulk of the game came together from 2023. The team began in Unity, moved to Unreal after talks with people at Epic, and its CTO joined only in the final year. The studio is remote by design, with artists in Nigeria, Botswana and South Africa as well as New York, France and mainly England, and many of the developers came from the Hitman series and had never built a side-scroller.
- It is priced like a pizza to keep it accessible. Salim says that in talks with EA the team asked what a pizza or takeaway costs and set the game at about $20, against the $60–70 that Hanselman notes big releases cost, because he could afford only about one game a year growing up. He sees leading with "heart" and showing the humans behind a game as how a debut cuts through against a release like Prince of Persia. The game is out on Switch, PlayStation 5, Xbox and Windows under the EA Originals label.
Scott HanselmanMaking "Tales of Kenzera: Zau" with Abubakar Salim
synopsis
Abubakar Salim, an actor and the founder of Surgent Studios, presents Tales of Kenzera: Zau as a first game in which every major choice serves one purpose: expressing his grief over his father's death. The genre, the feel of the controls, the mythology and the price all come back to it, and he argues that this heart is what lets a small studio's debut stand next to far bigger releases.
Why a game, and why this genre. His father, a C++ engineer at Xerox, introduced him to games and died just before Salim graduated from drama school. A game rather than a film was the only fitting tribute, he says. He chose the Metroidvania because it throws a character into a hostile, alien world that grows familiar over time, which is how grief felt to him.
Building a studio from nothing. With no engineering background and no experience of making games beyond voicing a character in Assassin's Creed Origins, he spent most of four years building a team, learning the craft and signing with EA. The bulk of the game was made from 2023 onward. The team moved from Unity to Unreal, the CTO arrived only in the final year, and the studio has been remote by design, with artists spread across several African countries, Europe and New York.
Myth drawn from life. Hanselman notes that the lore is real rather than invented. Salim confirms that he drew on several Bantu traditions, including the impundulu lightning bird and the South African healers he met while filming there, and that he did it from his own perspective and his father's stories rather than in response to Black Panther. Because the tradition is oral, every teller reshapes a story, and he wanted the game to carry that.
The feel in the hands. Salim describes the movement as a dance that demands precision: frustration and button-mashing fail, while calm rhythm succeeds, mirroring the work of grief. The instant-death spikes are deliberate, to make players think, though he concedes the developers had stopped noticing how hard the game is for newcomers.
Price. Remembering that he could afford about one game a year as a child, he set the price at roughly that of a pizza, about $20.
- The Metroidvania genre was chosen because it maps onto grief. Salim, actor and founder of Surgent Studios, says the genre drops a character into an alien, hostile world they cannot prepare for, which grows more comfortable the longer they stay. The game is a homage to his father, a C++ software engineer at Xerox who introduced him to games and died just before Salim graduated from drama school; he says games, not film, were the only way to do right by him.
- The platforming rewards calm rhythm, not frustrated button-mashing. Salim says the team wanted movement to feel like a dance that still demands precision: attacking the controller harder fails, while stepping back and finding "the beat of the drum" succeeds, mirroring the journey through grief. Instant-death white spikes, unlike the pink thorns that only knock you back, are deliberate, to force the player to think; he concedes that developers who had lived with the game for four years stopped noticing how taxing it is for new players.
- The lore draws on real Bantu myth across many cultures. Rather than invent a pantheon or pick one country, Salim pulls from several Bantu traditions, among them the Zulu impundulu lightning bird and the traditional healers he met while filming Raised by Wolves in South Africa. He rejects the idea that it was prompted by Black Panther: it is his perspective and his father's stories. He told the team that sending players down a "Wiki wormhole" meant they had done their job, and he says the oral tradition, which lets each teller change a story, is built into the game.
- Most of the time went into building the studio, not the game. Salim says most of the four years since the studio's founding went on building a team from scratch, learning what making a game means, and signing the EA deal; the bulk of the game came together from 2023. The team began in Unity, moved to Unreal after talks with people at Epic, and its CTO joined only in the final year. The studio is remote by design, with artists in Nigeria, Botswana and South Africa as well as New York, France and mainly England, and many of the developers came from the Hitman series and had never built a side-scroller.
- It is priced like a pizza to keep it accessible. Salim says that in talks with EA the team asked what a pizza or takeaway costs and set the game at about $20, against the $60–70 that Hanselman notes big releases cost, because he could afford only about one game a year growing up. He sees leading with "heart" and showing the humans behind a game as how a debut cuts through against a release like Prince of Persia. The game is out on Switch, PlayStation 5, Xbox and Windows under the EA Originals label.
Crosstalk SolutionsU7 Pro Wall Has Arrived!
- The U7 Pro Wall is designed to disappear into the wall. With Ubiquiti's flush-mount accessory ($39 extra, with a paintable cover) it protrudes only about half an inch (just over 1 cm); out of the box ($199 MSRP) it mounts on a wall or single-gang box like earlier in-wall models, and a $39 desk mount also exists.
- It drops the switch ports of earlier in-wall models. It is a Wi-Fi 7 AP with 2x2 MIMO on 2.4, 5 and 6 GHz, up to 320 MHz channels, PoE+ power and a single 2.5 GbE port; the host reasons extra ports are of little use flush in a wall. Ubiquiti told him a more traditional U7 in-wall with switch ports is coming, with no ETA.
- The 5.7 Gbps headline overstates real-world speed. Ubiquiti's figure (with 300+ concurrent clients) adds upload and download together; the host expects about 1.8–2 Gbps each way at best. His test, a Wi-Fi 7 Pixel 8 beside the AP at 320 MHz to OpenSpeedTest on a 2.5 GbE port, gave 1,600/2,100 Mbps and then 1,560/1,973 Mbps.
- The host rates it highly, especially for installers. He measured 99°F (37°C) on the back, likes paintable covers over fixed skins (one is now also out for the U7 Pro), and predicts copycat flush-mount APs from TP-Link or others by the end of the year.
Crosstalk SolutionsProtect 4.0 is Here - All New Features Explained
- Protect 4 is claimed to be faster and hold more cameras. Ubiquiti says a re-architected NVR core engine speeds the user experience and raises camera capacity by 20%; the host hopes this cures playback stutter and speculates the storage gain comes from optimizing unchanged pixels. He was on UniFi OS 4.0.3 on his UNVR on the day it went GA.
- Footage can now be stored downscaled to save disk. Cameras can record to the NVR at 2K or HD rather than full 4K, which the host suggests for low-detail views such as a hallway or doorway.
- Video archiving exports footage to Google Drive or OneDrive. You choose a date range and cameras and it uploads in the background; in his Google Drive test it created a UniFi folder with subfolders by date.
- New search and tracking tools narrow events to what matters. Camera shortcuts jump to another camera at the same moment, which he demonstrated following himself across three cameras. Area-of-interest filtering limits events to part of the frame, such as a gate, and licence plates can be labelled with a notification when a given plate is detected.
- PTZ patrol and custom doorbell animations were also added. G4 PTZ cameras can pan between set start and end points, and the Doorbell Pro accepts custom JPEG, PNG or GIF images larger than 240×240 pixels. The host upgraded his own UNVR without issue.
Crosstalk SolutionsSet Up Secure VPN in Minutes with GL.iNet Routers!
- A home router plus travel router gives easy remote VPN access. In this GL.iNet-sponsored video (the host says he used their routers long before the sponsorship), a Flint 2 at home runs a WireGuard server and a Slate AX travel router connects to it as a client. The Flint 2 has two 2.5 GbE ports and four 1 GbE LAN ports, on sale for $127 through June 15.
- Basic home settings deserve attention before the VPN. The host sets the time zone, and recommends Dynamic DNS if your WAN address is dynamic, since a changing IP breaks the VPN server. He also enables AdGuard Home network-wide and widens the default DHCP pool of .100–.249 to .10–.254.
- Enable "remote access to LAN" or VPN clients cannot reach anything. The WireGuard server's default 10.0.0.1/24 tunnel network is fine, but without that setting clients reach only each other. He generates one client profile per device and enables "use DDNS domain" in it if the home IP is dynamic.
- The travel router's LAN must not overlap the home subnet. Both ship on 192.168.8.x, so he moves the Slate AX to 192.168.10.1, also avoiding the remote gateway's 192.168.12.x. Over T-Mobile Home Internet, a CGNAT connection standing in for a hotel, he reached OpenSpeedTest at home at about 40/40 Mbps.
- The Slate AX's side toggle can switch the VPN client on and off. He maps it to the WireGuard client, so in a hotel you connect the router to the wired or Wi-Fi internet and flip the switch. Devices set up once on the travel router then need no reconfiguring at each new hotel.
Scott HanselmanEthics, AI, and Human-centered Computing with Dr. Casey Fiesler
synopsis
Casey Fiesler, an associate professor at CU Boulder and a public communicator on technology ethics, ends up arguing that generative AI is almost certainly here to stay, so the question is how to develop and deploy it as responsibly as possible. She holds that the speed of market competition and the public's poor grasp of what chatbots are both make that harder.
What a chatbot is. Hanselman proposes that chatbots are a new user interface that people anthropomorphize. Fiesler agrees that people misread them as search engines or encyclopedias, and calls the output a predictable "bundle of tropes". She says users should always be told when they are talking to a bot.
Ethical debt. Her term, from an op-ed with a former student, names the consequences taken on unknowingly by moving fast. She cites chatbot failures at a New York City business-advice service, an eating-disorder helpline, Air Canada and a car dealer, and calls many of them foreseeable.
Hype and hidden humans. Hype in both directions inflates the technology. Drawing on Weizenbaum's ELIZA paper, she says explanation normally dispels technological magic, but generative AI is hard to explain briefly, and forgetting the human data labelers makes it seem more magical and hides bias.
Consent and regulation. She finds the argument against unconsented training data valid but expects the technology to persist whatever the copyright cases decide. She expects the EU AI Act to have limited impact, and its GDPR-like requirements, such as training-data disclosure, to be its most likely effect.
- People misunderstand chatbots; they are neither search engines nor encyclopedias. Fiesler, an associate professor of information science at CU Boulder, calls a chatbot's output "a bundle of tropes": the most predictable answer, which is why ChatGPT writes "terrible fanfiction". Hanselman frames chatbots as a new, unresolved user interface that people anthropomorphize, and calls the temperature setting randomness rather than creativity. Fiesler links this to her 2009 PhD work coding videos of professional improv troupes to build improvising micro-agents, which took a stereotype and changed one element.
- Users should always know when they are talking to a chatbot. Fiesler says how human an interface should feel depends on context, but undisclosed customer-service chatbots upset people, and she expects this to remain a continuing problem.
- Racing to market is piling up "ethical debt". Fiesler and a former graduate student coined the term in an op-ed about four years earlier, by analogy with technical debt; the difference is that you may have no idea what consequences you are taking on. She blames market competition for the speed and cites failures she thinks were foreseeable: a New York City small-business chatbot that The Markup found advising illegal things, an eating-disorder helpline bot gone within about five days after staff tried to unionize, and chatbots giving away an Air Canada upgrade and a $1 car. Hanselman's comparison is the early-web rule never to trust user input, now ignored in "a giant text box and a button".
- Hype in both directions overstates what the technology can do. Fiesler says the "change everything tomorrow" and "destroy humanity" camps are sometimes the same people. Citing Joseph Weizenbaum's ELIZA paper, she argues the magic usually crumbles once a technology is explained, but "basically autocomplete" is not enough to dispel it for generative AI, and forgetting the human data labelers behind it makes it seem more magical and hides sources of bias. She aims to make the general public more critical, not to change minds at OpenAI.
- The consent argument is valid, but the technology will persist. Fiesler calls the case that AI built on unconsented data is fundamentally unethical "very valid", yet thinks copyright rulings shutting it down are unlikely; if they came, she expects weaker models or open-source ones trained anyway and shared on torrents. She expects the EU AI Act to have less impact than people think because parts are hard to implement, and the GDPR-like rules, such as disclosure of training data, to be the likeliest to take hold.
Technology and FriendsValerie Gurka on Documentation in Software Engineering [EPISODE 804]
- Skipping documentation saves money now and costs more later. Gurka, who runs a software development company of five architects and 10 engineers and has done project and engineering management for over 20 years, says clients with no documentation, or none they can find, end up paying staff and then outside help to research code nobody understands, and often rewrite it from scratch. Documentation, she says, does not spare you the work on a system; it spares you starting from zero.
- Different audiences need different kinds of documentation. Gurka lists technical documentation (architecture diagrams, what talks to what, databases), written in parallel with the coding rather than before or after it; requirements kept as a backlog in tools such as Jira or Azure DevOps and exported to a document for the client, which she sees replacing the old waterfall business requirements document; user guides, which she says are often missed at the end of a project; and release notes, which clients should not have to ask for. On code comments she defers to Giard, who prefers documenting method by method or class by class and wants the code itself to be self-documenting line by line.
- Good documentation is concise, free of jargon and kept current. Gurka says to make the point clearly rather than write a novel, avoid acronyms or add a glossary page, and update the document with every enhancement so it is versioned alongside the system. She favours tools developers can write in together, such as Confluence or SharePoint.
- AI removes the writer's block, but its output still needs review. Gurka has AI write release notes from the code and uses a tool that turns uploaded meeting transcripts into summaries and action items; Giard adds that GitHub Copilot can generate documentation for code he right-clicks on. She says there is no shame in using it as a tool, provided you check what it writes.
- Put documentation in the estimate and name the deliverables. Gurka says projects skip documentation because it was never estimated and the budget or time ran out, so she writes it into the estimate and statement of work as specific items: backlog, architecture diagram, user guide, release notes. The most common problem she meets is outdated documentation, such as an architecture diagram that describes the system as it was years ago and that the client sends without looking at it.
Scott HanselmanCommunity and content with Android Expert Madona Wambua
synopsis
Madona Wambua, an Android developer, author, startup founder and now a CTO, comes down on community and persistence as the way to survive a hard tech market. Her advice to early-career engineers is not to quit, to find people who will walk the road with them, and to trust that skill compounds over years. As a CTO, she means to build the culture that she once found missing.
A hard market. Wambua dates the layoff wave to late 2022 and early 2023, declines to blame AI, and notes the irony of "over-hiring" claims from companies that remain profitable. Engineers are taking other jobs within months. A plan B helps, she says, but founding a company is not for everyone.
Community as a safety net. Backed by her husband's income, she built a consultancy on community referrals and finished five projects in 2023. She gives her time freely, booked on a calendar and focused by the topics people send in advance, and she makes direct introductions for referrals. Hanselman agrees, provided that time is capped and the questions are specific.
Learning that compounds. Her Android cookbook records how much the platform has matured since about 2013. She learned Kotlin by rewriting her own app by hand over weekends, and her years of experience now let her read unfamiliar languages such as C# well enough to diagnose bugs. This is why she says good coders take years, not days.
Culture. A past employer penalized her for asking too many questions. That pushed her toward communities and teaching, and she says her own team will be encouraged to ask questions and to help one another rather than chase tickets.
- The tech job market is exhausting, and the cause is unclear. Wambua, an Android developer, startup founder and now a CTO, dates the wave of layoffs to late 2022 and early 2023 and says she is not ready to blame AI. She relays the "over-hiring" explanation while noting that the companies remain very profitable; Hanselman objects to the word because the people laid off have mortgages and lives. She says programmers are being forced into other jobs within three or four months.
- Community, not a job board, carried her consultancy. Leaning on her husband's full-time income, she started a mobile and web consultancy by asking her community for work. The first job, rebranding a women's community site, came through a community member, and one job led to the next: five projects in 2023, including one for a large New York web3 and crypto company. Hanselman notes that in the US, health insurance makes going independent a privileged option.
- "Pick your brain" requests deserve time, but with structure. Wambua offers free calls booked through her calendar and spread across days, asks people to list the topics they want to cover, and makes direct introductions for referrals; she once connected a stranger to a friend at Pinterest. Hanselman caps his own community time at one to two hours a week and says three to five well-thought-out questions energize him where an open-ended ask irritates him.
- Moving from Java to Kotlin took deliberate rewriting. Wambua resisted Kotlin until interviewers told her she could interview in Java but their code was Kotlin. She rebuilt her own budgeting app in Kotlin over weekends rather than using the automatic converter, whose formatting was poor, to build muscle memory, and now prefers Kotlin. Her book, Modern Android 13 Development Cookbook, records how much easier Android has become since she began around 2013–14, now that it has defined architectures and the Jetpack libraries. Years of experience, she says, now let her read C# well enough as a CTO to find a bug and suggest a fix, which is why juniors should not quit.
- A culture that punishes questions isolates engineers. One employer gave her a negative review for asking too many questions, which nearly put her on a performance plan; she blames a heads-down culture of closing sprint tickets instead of helping struggling colleagues. She took her questions to communities instead, which led her into teaching through webinars, and as a CTO whose team is in Europe she says she encourages questions and admits what she does not know. She sees politics as her eventual career.
Crosstalk SolutionsNEW! U6-Mesh-Pro access point. #unifi #crosstalk
- The U6 Mesh Pro brings Wi-Fi 6 to an old form factor. It replaces the UAP-AC-Mesh-Pro, first released in 2017, with PoE-powered gigabit Ethernet plus a gigabit pass-through port, IPX6 weatherproofing, 2x2 MIMO and 8 dBi antenna gain on both 2.4 and 5 GHz, wall or pole mounting and 350+ clients, at $199 MSRP in the UI store.
Crosstalk SolutionsSynology NAS Upgrade Step-by-Step
- The host upgraded a full NAS to a larger eight-bay one. He moved from a Synology DS1520+ to a DS1821+; the old unit had 30 TB usable with 28.4 TB used, well past Synology's 20%-free warning. Synology supplied the DS1821+, two 800 GB NVMe cache drives and a dual 10 GbE card ($2,640); he bought eight 12 TB IronWolf drives at $200 each, for $4,240 in all. SHR with two-drive fault tolerance gave just under 63 TB usable.
- Synology's Migration Assistant worked almost perfectly but wipes the new volume. Installed on the destination NAS, it deleted the SHR volume he had built, so he advises leaving the new drives unformatted. Its 3-day-14-hour estimate for 29.1 TB at about 100 MB/s, held to gigabit by the old NAS, proved accurate.
- Some steps remain after migration. He had to repair about three packages and expand the copied volume to the maximum size. Surveillance Station licences need manual reactivation, and the NVMe pair has to be set up as a read-write cache.
- His backup audit found important data failing the 3-2-1 rule. His working drive meets the rule and his Windows image misses it acceptably. But his user folders, mapped to the NAS, rely only on Backblaze if the NAS dies; "RAID is not a backup", so he will add the external USB drive as a second local copy.
- Home Assistant would not start until its RAM was cut. The DS1821+ ships with 4 GB against the old unit's 8 GB, so the 2 GB VM failed; he ran it at 1 GB on its own IoT-network port. He bought two 16 GB Crucial ECC SO-DIMMs at $54 each, against $350 each for Synology-branded ones. The Pi-hole container moved intact but needed its new IP in DHCP.
Technology and FriendsScott Hermes on Microsoft Fabric [EPISODE 803]
synopsis
Hermes's position is that Microsoft Fabric is a fast-maturing platform that gives a company one governed place to find and use its data, wherever that data physically lives. It works alongside tools such as Databricks rather than forcing a migration or a choice between them.
What Fabric is. Hermes calls it a SaaS wrapper around Azure data services, sold by capacity tier, with OneLake holding structured and unstructured data under one layer of security and governance. His case for it is a client that bought the same dataset two or three times. Power BI licences come included, but other visualisation tools work too. He says it went GA on 16 November 2023, about five months before the first Fabric conference in Las Vegas, and the interview is dated 9 April.
Reaching data elsewhere. Shortcuts read S3, Google Cloud Storage, S3-compatible stores and Dataverse where they sit. Mirroring replicates Snowflake and others read-only, with F64 capacity including 64 TB of mirrored storage. Hermes credits Azure with a better on-premises story than other clouds, and an on-premises gateway is now in public preview. The gaps he concedes: only S3 on AWS, with Mongo still on the roadmap.
Databricks. Parquet and Delta Lake underneath, plus two-way Unity Catalog shortcuts, mean "no need to make a hard choice."
Controls. Item-level permissions, regional capacity, and Git integration for reports, notebooks and lakehouse definitions. As far as he knows that integration runs through Azure DevOps only.
Pace. Hermes estimates around 60 features a month across six or seven product teams, the most aggressive rollout he has seen. He adds Copilot for Fabric and a redesigned Purview for business users, and says the product team takes community suggestions into its priorities.
- Fabric aims to give a company one copy of its data under one set of controls. Hermes, an Azure platform architect at a digital consultancy, describes it as a Microsoft SaaS product wrapping services such as Data Factory, Synapse and Data Lake Storage around OneLake, "OneDrive for the enterprise", with one layer of security, governance and discoverability. He cites a client that paid for the same dataset two or three times because no one could find what the company had already bought.
- Data can join Fabric without being migrated. Hermes says shortcuts query data where it sits: Amazon S3 at launch, and now Google Cloud Storage, any S3-compatible store and Dataverse, with an on-premises gateway in public preview. Mirroring keeps a read-only replica close by for performance, with Snowflake newly announced; mirrored storage is free up to an allowance, F64 capacity getting 64 TB. Coverage is incomplete: on AWS only S3 is reachable, and he says Mongo is on the roadmap.
- Fabric complements Databricks rather than replacing it. Hermes says teams happy on Databricks should stay there, since Fabric stores everything as Parquet in the Delta Lake format Databricks uses, and newly announced shortcuts link Fabric and Databricks' Unity Catalog in both directions. A team can start in Fabric and add Azure Databricks later against the same lake.
- Git integration now covers the definitions, though not the data. Hermes says Power BI reports and semantic models, notebooks, lakehouse definitions and Spark job definitions can now go into Git, and a workspace can be branched. As far as he knows this works through Azure DevOps only, not directly with GitHub. On security, rights now reach the individual item as well as the workspace, and capacity is set by region, with a switch for access from anywhere that is off by default to protect data sovereignty.
- Fabric is adding features faster than any product Hermes has seen. He puts it at around 60 new features a month, because six or seven product teams, Power BI and pipelines among them, each ship on their own. Features he expects to matter include Copilot for Fabric, which comes with higher capacity tiers, and a redesigned Microsoft Purview interface aimed at business users who decide what is confidential.
Technology and FriendsRaj Krishnan on the Challenges of Artificial Intelligence [EPISODE 802]
- AI is old; what changed is how little modelling it now takes. Krishnan says he once used integer and linear programming on historical queue data to staff a call centre, and that this kind of algorithmic AI (regression, prediction, clustering) needed data scientists and parameter tuning. Now, he says, you hand data to a model and tell it what to do, citing TimeGPT producing what he calls pretty accurate forecasts from raw data; Giard adds cheap rented cloud compute and OpenAI's work as the two drivers.
- Retrieval-augmented generation is harder than the demos make it look. Krishnan says a model built for around $100 million on internet data gives no references and can hallucinate, so enterprises vectorize their own knowledge, find the chunks most similar to a question, and tell the model to answer only from those. He says what you vectorize, how you chunk it, the chunk size and the prompt all change the answer; people who saw a demo built on Paul Graham's essays will be disappointed when they ask questions of their own data, such as an insurance client wanting policies similar to a given one.
- Grounding RAG in a knowledge graph first is the next step. Krishnan describes building a graph of nodes and relationships in Cosmos DB or Neo4j, which he calls more deterministic, querying it before the retrieval step, and then using RAG. He says much current work focuses on combining the two.
- Too many tools are arriving, and cost has to steer the choice. Krishnan, who works for Microsoft, lists AutoGen (open-source agents that write code, talk to each other and correct themselves), Semantic Kernel for .NET, LlamaIndex, LangChain and TaskWeaver, and says his job is trying them to see what works. He still rates GPT-4, and even GPT-3.5, as the best at summarization and entity extraction, but says GPT-4's price means testing whether an open-source model or a combination gives similar results; he also likes LlamaIndex's semantic chunking, which sizes chunks by content so related text stays together.
- Beginners should start with low-code tools and generated code. Krishnan recommends Copilot Studio or AI Studio on your own data first, moving to LangChain or Semantic Kernel only when they hit a limitation. He uses generated code from TaskWeaver or GitHub Copilot to learn, finding it better commented than his own, but would not ship it as production code; Giard says Copilot gets him about 80% of the way and he never trusts it fully, and Krishnan calls it "a job aid", not a job killer.
Technology and FriendsA Celebration of Friends [EPISODE 800]
- Episode 800 is a montage of past guests' closing remarks. Instead of an interview, it strings together dozens of short clips, nearly all variations on the show's "technology and friends" sign-off; few speakers are named in the captions beyond Buck Woody and Jeff Fritz, who plugs .NET Conf and live streaming.
- The recurring claim is that tech careers run on community. Many guests say their closest friends came from user groups, conferences, open-source mailing lists or long tenure at one company. One says the pandemic showed that "talks aren't great, but hallway tracks are"; another urges viewers to find events on Meetup and LinkedIn as in-person events restart.
- Programmers underestimate how differently others use technology. One guest says that when they asked friends how to turn a paragraph into all caps, the most common answer was to retype it with caps lock on. They draw the lesson that small help, like the few months they spent cleaning up all of one nonprofit's computers, can matter a great deal.
- A few clips make substantive professional points. One guest argues open source shared among friends and open source as a corporate commons are both valid but must not be conflated. Another repeats the "people, process, and tools, in that order" line they say they wrote about in Code Magazine for over 20 years, holding that only people can decide the what and why of a technology; a third says friends don't let friends build distributed systems without OpenTelemetry "in 2022".
- Tech has more roles than development, and newcomers should explore them. A designer in one clip lists design, development and cybersecurity, and advises against copying whatever someone with a technology title does. Another guest says over 20 years their work has become less about technical detail and more about people, process and delivery.
Scott HanselmanOpen Core Open Source with Mermaid Chart's Knut Sveidqvist
- Mermaid began as a fix for his own diagram problem. Sveidqvist, CTO of Mermaid Chart, says that almost 10 years earlier, at a large Swedish telecom, diagrams lived in Word and Visio and some original Visio files had been lost; with Markdown gaining ground, he wanted diagrams as text that developers could manipulate. He named it after The Little Mermaid, which his children were watching, and expected maybe 20 users.
- Chasing zero open issues nearly burned him out. His motivation dropped until other contributors stepped in. He then time-boxed Mermaid to one or two evenings a week, and he remains its top committer with almost 2,500 commits. That near-burnout is also why he wanted a company behind the project: with a full team, Mermaid does not depend on one person who will eventually burn out.
- Open core works only with a clean line between free and paid. Open Core Ventures, the venture studio of GitLab CEO Sid Sijbrandij, approached him and coached the split: Mermaid itself, including new diagram types, stays open source, while the paid Mermaid Chart platform adds a visual editor that round-trips edits to the code, plus AI features. He wanted above all to avoid pull requests to Mermaid for paid features. He predicts a dual-license model will eventually emerge so that large companies give back; Hanselman, who works at Microsoft, says big companies have to choose sustainability over throwing money at projects.
- Once a syntax ships, it can never change. Sveidqvist wanted the syntax to be readable like Markdown rather than maximally terse. New diagram types stay "experimental" because, once approved, changing the syntax would break the diagrams of perhaps 100,000 to a million users; there are things in flowcharts he would do differently but cannot. To allow more than the 8–9 diagram types he had held to, now about 14, the company added lazy loading to control bundle size.
- ChatGPT brought non-developers to Mermaid. ChatGPT turned out to write Mermaid well because so many diagrams existed to train on, and it sent real-estate agents and business people to Mermaid Chart, which is why the visual editor exists. Next he plans to extend the editor to every diagram type and to add diagrams to open-source Mermaid, which also benefits paying customers. Hanselman cites 20 million-plus visitors and a recent seed round from Open Core Ventures.
Crosstalk SolutionsFirst Look! UniFi Pro Max 16 PoE Switch
- The USW Pro Max 16 PoE is a compact switch with Etherlighting. It has 12 gigabit ports, four 2.5 GbE ports, which are the PoE++ ones and suit a U7 Pro, and two 10G SFP+ cages; the other ports are PoE/PoE+ (802.3af/at). A non-PoE version is $279 (US). The PoE model's price is garbled in the captions, though the host expected it to undercut the $799 24-port Pro Max.
- An external power brick is what keeps the chassis small. The supply is rated 54 V, 3.9 A, and there is no power switch. The included rack ears slot into rear notches for wall mounting with a levelled template. An optional rack kit makes it a reversible 1U unit that also holds the brick.
- Setup is standard UniFi, plus Etherlighting controls. It adopted from his UDM Pro Max and was up to date; port LEDs can show speed or VLAN in chosen colours, with breathing mode optional. Filming on May 1, 2024, a day after receiving it, he plans to use it in his 10-gigabit home upgrade in place of the 24-port model, since he does not need the ports.
Scott HanselmanExploring Decentralized Tech with TBD's Rizel Scarlett
synopsis
Rizel Scarlett, a staff developer advocate at TBD, a Block incubator, argues that decentralized identifiers and verifiable credentials can give the web the identity layer it lacks, without crypto. She says TBD is building the developer tools to make cross-border payments as easy as tapping a phone. The stack is not yet at 1.0, but she says some companies already use it.
The missing identity layer. Scarlett says online identities are fragmented across platforms and cannot move with their owners. A decentralized identifier would travel with the user, held in a phone wallet, and Bluesky already uses them. Hanselman counters that today's domain- and WebFinger-based schemes are too complicated for non-technical people. Scarlett says the wallet approach would hide that complexity.
Why payments. Block already made payments easy within a country through Cash App and Square. Abroad, Western Union-style transfers are slow and expensive. TBD's currency-agnostic exchange protocol, tbDEX, is meant to close that gap. Hanselman supports the case with his family's own costly remittances.
Not a blockchain. Pressed by Hanselman, a self-declared crypto sceptic, Scarlett says there is no coin and no blockchain. TBD moved from a Microsoft DID method anchored to a blockchain to its own did:dht, which runs on BitTorrent's distributed hash table.
How credentials work. An issuer signs a credential using ordinary public-key cryptography. The subject or a holder presents it, and the verifier checks it through selective disclosure, learning that someone is of age without learning their address. Retention depends on the wallet and the verifier.
Status. Packages are at about 0.41. The project's progress site shows 85% overall and 62% for decentralized web apps. FormFree's Passport already lets lenders compete for borrowers who disclose only what is needed.
- The web has no identity layer; decentralized identifiers would supply one. Scarlett, a staff developer advocate at TBD, a Block incubator, relays Angie Jones's framing: her own usernames on Twitter and GitHub are linked only because she made them, and her data cannot move with her. A decentralized identifier (DID, a W3C recommendation) would travel across the web, stored in a phone wallet much like a debit card, and users need not know it is there; she cites Bluesky as already using DIDs under the hood. Hanselman counters that even Bluesky's domain-based check and Mastodon's WebFinger demand a domain and a web server, which is beyond a non-technical parent.
- TBD's aim is cheap, easy cross-border payments. Scarlett says Block, owner of Cash App, Square and Tidal, wants to bring that ease to sending money between countries, where services like Western Union mean delays and high fees and many recipients have no bank. Its exchange protocol, tbDEX, is currency-agnostic. Hanselman adds his own family's experience: an international wire costs about $30, some relatives pay with phone minutes, and picking the wrong day to convert can lose them $50.
- This is not crypto: no coin and no blockchain. Scarlett says TBD at first used a Microsoft DID method anchored to a blockchain but has built its own, did:dht, which stores DID documents in a distributed hash table anchored on BitTorrent. Hanselman, who says he does not support crypto or web3, presses the point, and TBD's GitHub describes the network as "permissionless" and blockchain-free.
- Verifiable credentials disclose only what a verifier needs. An issuer such as a motor-vehicle department signs a credential with standard public and private keys; the subject holds it; a verifier, such as a bar checking age, sees only "of age" and not name or address. A holder can present it on the subject's behalf. Whether the verifier keeps the data depends on the wallet and its policy, though Scarlett says verifiers are not supposed to. Hanselman's test case is a laid-off friend locked out of a GitHub account whose recovery ran through a work email.
- The stack is unfinished, but some companies already use it. It is not yet at 1.0, and some TBD packages are at version 0.41. The project's "are we web5 yet" site shows 85% overall, with DIDs and verifiable credentials at 100% and decentralized web apps at 62%. Scarlett cites FormFree's Passport platform, where borrowers disclose only the necessary data and lenders compete for them, which she presents as reducing bias in loans. Hanselman calls the "Web5" branding "off" because web3 is burned; Scarlett, who was not part of the naming, likens the goal to OpenAI making AI usable by everyday developers.
Scott HanselmanInnovation in Accessibility with Fable's Kate Kalcevich
synopsis
Kalcevich, head of accessibility innovation at Fable, ends where she starts: accessibility is a continuing practice built with disabled people, measured by their experience rather than compliance checklists, and a source of innovation rather than a chore.
People over tools. She came to Fable as a government customer and argues that tools reduce workload but real users reveal which barriers matter most.
Who counts as disabled. Against Hanselman's one-in-eight figure she offers one in four in Ontario and one in two over 65, plus temporary and situational limits. Both describe invisible disabilities they hesitate to claim: his type 1 diabetes, her hearing loss.
Measuring it. A binary score is a "false narrative". The Accessible Usability Scale, a 10-question survey averaged over critical flows, gives a user-side number; staff training and processes need measuring too. Executives respond to market size and loyalty, and most of all to watching someone struggle.
Empathy and its limits. She cautions that simulation exercises without disabled participants can produce the wrong fixes. Users lean on their own accommodations, so native, flexible code serves them better than per-site features.
AI and innovation. Appointed to a Canadian standards committee on accessible and equitable AI, she points to hiring tools trained on past, biased selections. Co-design, she argues, yields new ideas, and gaming accessibility is advancing as companies talk about it publicly.
- Accessibility work should centre on disabled people, not tools. Kalcevich, head of accessibility innovation at Fable (a former Fable customer from two decades in government), says tools matter for the volume of large sites, but testing with assistive-technology users shows which of the many standards failures to fix first; she presents Fable Engage as the way to do this remotely.
- Disability is far more common than people admit. Hanselman cites about a billion people of 8 billion (one in eight); Kalcevich says it is closer to one in four in Ontario, and one in two over 65, though most seniors do not identify as disabled. She adds temporary disabilities (a broken arm) and situational limits such as glare on a phone screen.
- "Accessible or not" is a false binary; measure it instead. She argues no continually updated product is ever fully accessible, and a yes/no hides why and whether it is improving. Fable's Accessible Usability Scale is a free 10-question survey given after usability tests with assistive-tech users, averaged over critical task flows like checkout; she would also measure staff knowledge and processes.
- Empathy exercises can lead teams to do the wrong work. Hanselman recalls having engineers use screen readers with their laptop lids closed for a day; Kalcevich warns that daily assistive-tech users are far more skilled, so simulating disability without engaging disabled people can make a product less accessible. He says his exercise worked because it pushed engineers to work with blind engineers.
- Build flexibly, because users bring their own accommodations. She relies on Chrome's live captions and OS-wide font sizes rather than hunting for each site's options, and combines hearing aids, captions and lip reading; native HTML rather than custom components preserves that flexibility. She noticed Hanselman's podcast transcripts were hard to find.
Crosstalk SolutionsUDM-Pro-Max Gateway: What You Need to Know
- This gateway is built for large deployments, not homes. At an MSRP of $599 USD as of recording, it has about twice the capacity of the UDM Pro and UDM SE: 200 or more UniFi devices and 2,000 or more clients, by the host's account.
- Its onboard switch assumes you bring separate PoE switching. The 8-port gigabit switch has no PoE (unlike the UDM SE) and no Etherlighting. The WAN can be port 8, the new 2.5 GbE RJ45 port (up from gigabit) or either 10G SFP+ cage. In the host's reference design, two gateways uplink over 10G to a USW Aggregation feeding USW Pro Max 48 PoE switches, with a USP RPS on both.
- It is rated well above the UDM Pro with IDS/IPS on. It is rated for 10 Gbps wire speed with the firewall only and about 5 Gbps with intrusion detection and prevention, against 3.5 Gbps for the original UDM Pro with IDS/IPS. These are rated figures; the host did not report a throughput test.
- The drive bays only mirror, and failover does not sync footage. Two drives configure themselves as a RAID 1 mirror for UniFi Protect, with no RAID 0 option; the host's two 1 TB surveillance drives synced in about 2 hours. Under high availability, Protect footage is not copied to the secondary, so he advises a second drive set where recording must never lapse, otherwise moving the drives over by hand.
- Shadow Mode high availability brings automatic failover within seconds. Due in UniFi OS 4.0, it links two gateways directly, using port 7 as the heartbeat. Unplugging the primary on an alpha build cost a few dropped pings. Both units must be the same model, which Ubiquiti told him covers all rackmount Dream Machines; he tells installers to budget for two units.
Scott HanselmanDigital archaeology reading 40 year old C64 Floppy Disks with a Greaseweazle, Fluxengine, and Aaru
synopsis
Streaming live to YouTube and TikTok, Hanselman pulls games off 40-year-old Commodore 64 floppies found in a garage. He uses a Greaseweazle and FluxEngine, checks the images with Aaru and runs them in the VICE emulator. After several failed reads he gets a lunar lander, a chess program, Mario Bros and Donkey Kong running, and leaves the remaining discs, and why some images will not load, for later.
The problem and the tool. Old discs rot, pick up mildew and magnetic damage, and come in many densities, track counts and file systems. Copying through a real old machine needs a bridge such as an SD card. The Greaseweazle, open-source hardware and software, reads raw flux over USB-C and ignores file systems.
Setup. He uses a roughly $30 eBay Fujitsu 5.25-inch drive in a 3D-printed case, powered by a 12V Molex adapter, on an edge connector. The cable twist selects the drive. The device shows up as COM3.
First reads. The command line and its GUI, which writes the command for you, failed with "no index". FluxEngine reported an unrecognised command. The real fault was a loose 12V cable. He calls it a lesson in rechecking assumptions.
Verification. HxC flagged errors, which he suspects came from a file-system mismatch. Aaru confirmed the image. In VICE, Lander and a listable chess program ran.
Damaged discs. FluxEngine showed bad sectors, and Pac-Man and Donkey Kong hung. Re-reading at a different density helped. Mario Bros loaded slowly under true drive emulation, which can be turned off. Donkey Kong then ran, played with a numpad-as-joystick setting. He points viewers to the Internet Archive.
- Reading raw magnetic flux sidesteps old formats and file systems. Hanselman says discs vary by sides, density, 35 or 40 tracks, and FAT, Amiga or Commodore file systems; the Greaseweazle, open-source hardware bridging USB-C to floppy drives, captures the flux and leaves decoding to software such as FluxEngine and Aaru.
- A vintage drive needs its own power and cabling. His drive is a Fujitsu 5.25-inch IBM PC drive bought on eBay for about $30, in a 3D-printed case; it needs 12V from a Molex adapter because USB supplies only 5V, and the twist in the ribbon cable decides drive 0 or 1. The Greaseweazle appears in Windows as a USB serial port (COM3), not a drive, because COM ports are the easiest lowest common denominator to program to.
- Most failures were his own setup, so recheck assumptions.
gw inforeached the device, but reads returned "no index" and FluxEngine said the device did not recognise the command; the cause turned out to be the 12V cable he had bumped loose. - Check each image with separate tools and an emulator. The HxC floppy emulator reported errors, possibly from the wrong file system setting; Aaru (by Natalia Portillo) confirmed a raw image and its sector count; the VICE emulator then ran a lunar lander game and a chess program whose BASIC source he could list.
- Bad sectors call for re-reads with different settings. FluxEngine flagged bad spots, and Pac-Man and Donkey Kong at first would not load; after re-reading with another density setting, Mario Bros loaded slowly under true drive emulation and Donkey Kong eventually ran. He says the discs, found in a garage, date to about 1981–82.
Scott HanselmanHow to REALLY use Microsoft Word: Styles, Multilevel Lists, and Outline View
- Outline view needs styles, not manual formatting. The viewer's presentation outline used hand-set colours and sizes with no styles, so Word's outline view showed nothing; Hanselman selects each heading from the left margin and uses "create a style" in the Styles pane to make H1 through H5.
- Multilevel lists are what tie styles into levels. Under "Define multilevel list" (distinct from bulleted lists) each level is linked to a named style, whose name does not matter; then Tab and Shift+Tab move a paragraph between levels.
- The hidden link is a paragraph setting inside each style. Outline level lives under Modify Style > Format > Paragraph, which he calls the part no one figures out, along with an option to start collapsed; once each H style has its level, and ordinary text is left as body text, Outline view's Show Level collapses and expands the document.
- Levels must look consistent to work. Each level carries one fixed size, so a heading that should look different needs a different level; the viewer's mixed sizes forced choices, such as jumping from level one straight to level three.
Scott HanselmanFoundations of Design for Developers with Kathryn Grayson Nanz
synopsis
Nanz, a senior developer advocate at Progress who is studying for a master's in human-computer interaction, argues that developers should learn design foundations deeply enough to talk with designers and to iterate past "not bad". She does not think they need new tools or a career change.
Path and tools. She came to code to keep her designs from being handed off unfinished, and grew up on view-source-era MySpace and GeoCities. Asked about a Figma monoculture, she says that, as with React, people have found something that works. Devs should use what they already know.
The low bar. Doing one job is hard enough. Designers knowing CSS helps them, and devs need only learn the vocabulary, for instance that a Figma variable is not a JavaScript variable. Then the two can meet in the middle.
Foundations. Her free, roughly 200-page ebook starts with colour. Fine arts training resets students to fundamentals, because naming why something is off requires colour, balance and visual hierarchy.
Problem first. She endorses Hanselman's practice of giving designers feeling words, because design starts by naming the problem and the emotion. She adds that developer-written micro-copy is design too. Hanselman cites old, ambiguous error messages in Windows 11.
Homogeneity. Templates make the web look alike but functional. Hanselman likens it to ChatGPT's "B-minus" output. She urges iterating as one refactors.
Psychology and patterns. Gestalt principles and cards persist because they work and they follow trends. Breaking users' mental models costs them, as Hanselman's tax-form dropdown showed. Delight is not always the goal.
- Developers need only enough design to communicate and not be bad. Nanz, a senior developer advocate at Progress with a fine arts degree, says few ask "should developers design?" though many ask whether designers should code; she would have devs design with the tools they know, CSS in the browser or pen and paper, rather than learn Figma, and says designers who know CSS and semantic HTML work "two steps ahead".
- Foundations like colour and hierarchy explain why something looks off. Her free, roughly 200-page ebook Foundations of Design for Developers (Progress) opens with colour, not components, mirroring how a fine arts course restarts students on perspective and value; being able to say why is what lets you catch a design that feels unprofessional.
- Design starts by defining the problem and the feeling. Hanselman describes giving designers feeling words ("this isn't energizing") instead of solutions; Nanz agrees, saying colours cannot be chosen intentionally until the emotion and goal are known. She adds that developers write more copy than they think, in error messages, button labels and tooltips, often at the moment a user most needs help.
- Same-looking websites come from templates, and iteration is the fix. She attributes the homogeneous web to Squarespace- and WordPress-style templates, which she does not criticise, and denies Figma is a monoculture; to Hanselman's "80% fine" she answers that design is iterative like refactoring, 60% to 70% and onward.
- Gestalt principles are shorthands, but users' mental models constrain them. Proximity, grouping and cards work because of how people parse visuals; she says designers must be distinctive without breaking expected patterns, which Hanselman illustrates with a tax site's custom dropdown that ignored typing. She cautions that ease and speed sometimes matter more than delight, as with tax software and Duolingo's animations.
Crosstalk SolutionsCerro Gordo's Wi-Fi: Network Design for a Ghost Town
- The existing network hangs on a solar-powered router up the hill. Internet from an ISP in Lone Pine reaches a solar receiving station: a 100 W panel and two batteries powering a MikroTik router, a NanoBeam AC Gen 2 and a 120° LiteAP AC point-to-multipoint radio that feeds the Hoist House and the Gordon House. Coverage was spotty, metal-sided buildings got none, and the ISP's own solar antenna loses power under snow, according to the owner, Brent Underwood.
- The design moves the network core off solar power. A NanoBeam AC Gen 2 there feeds WAN 1 of a Dream Machine SE in a locked 4U enclosure with a 1U UPS. The SE adds dual WAN, so Starlink can serve as primary or backup (too power-hungry for the hilltop solar), plus Protect cameras against theft. The host accepts the double NAT this creates as a trade for getting the core off solar power.
- Every building gets the same simple, sparable kit. A Rocket Prism AC with a 10 dBi omni on the General Store feeds NanoStation AC or NanoBeam AC Gen 2 stations at each building, with U6+ access points behind wood covers inside. The host keeps the Gordon House's NanoStation AC and UAP-AC-M, which runs off its 24 V passive PoE port, and replaces the bunkhouse's mesh-fed UAP-AC-LR. The metal-sided church gets its own station.
- The Hoist House needs its own link, not VLAN trickery. It has no line of sight to town, and routing it through the hilltop solar station would be too hard to troubleshoot at a site this remote. The host proposes a point-to-point link from the bunkhouse, possibly from a pole or the outhouse about 30 ft uphill, reusing the Hoist House's NanoBeam. Contacts on site are still checking the line of sight.
- The favoured mine design skips levels rather than run power down. In Dave's preferred option, a USW Pro 8 PoE at the Hoist House powers Switch Ultras and UK-Ultra access points at the 100–200 ft levels over PoE++. The 400 and 550 ft levels are skipped, and a Game Changer extended-reach Cat6 run carries data to 700 ft. There the pump's AC power runs a switch, an AP and a camera on the pump, with a single Cat6 drop to 900 ft.
Scott HanselmanGithub Advanced Security with Jacob DePriest
synopsis
DePriest, GitHub's deputy chief security officer, argues for getting the basics right and then using GitHub's scanning. Account security comes first. Then come the Advanced Security tools, which GitHub offers largely free on public repos as part of its responsibility to open source, with AI layered over them. AI-written code, he says, still needs the same checks.
Background. At the NSA he led an 18-month effort to open-source a million lines of code. He co-founded DevX there, an internal developer platform for an agency of more than 40,000 people. He says many organisations still have fragmented Git servers "under people's desks".
Basics. Hanselman asks whether a small shop needs supply-chain thinking. DePriest says yes, but only after 2FA and locked-down storage. GitHub made 2FA mandatory for contributors over roughly 18 months. It stopped short of hardware keys for equity reasons. He sees passkeys as progress.
The three tools. Code scanning on CodeQL now suggests AI fixes. Dependabot covers dependencies, and Hanselman calls it "an employee that makes pull requests while you sleep". Secret scanning with push protection blocks credentials before they enter Git. He says remediation after a leak is expensive, and vaults are better than repo secrets. Hanselman cites a nation-state actor using stolen tokens at Microsoft, where he works.
Scale. A counter-abuse team fights mining and spam across 100 million developers. CodeQL models evolve per language. Hanselman corrects himself: Rust is unsupported, and Kotlin and Swift are in beta. DePriest ties sustainability to leadership's commitment.
Copilot. Tuned models and Microsoft-partnered filters screen out insecure suggestions. He calls this early days and says it is "a co-pilot". Hanselman wants explanations rather than magic, and both see refining a query as a skill to teach.
- Secure the account first: "don't ever skip leg day". DePriest, GitHub's deputy chief security officer after 15 years at the NSA, names two-factor authentication and no internet-open storage accounts as the core; GitHub spent about 18 months making 2FA mandatory for active contributors because too many incidents start with password spraying or leaked credentials. It does not require YubiKeys or passkeys, citing users without phones or modern hardware, though he favours passkeys.
- GitHub Advanced Security bundles three scanners, now with AI. He describes code scanning on CodeQL with AI autofix suggestions in the pull request (described as "just recently announced"), Dependabot and dependency scanning for supply chain, and secret scanning that AI extends beyond high-confidence tokens to usernames/passwords and SSH or RSA keys; he says most of it is free on public repos, which Hanselman urges listeners to turn on.
- Block secrets before they land, because pushed secrets must be rotated. Push protection sits between the editor and GitHub, inspects incoming pushes for credentials and blocks them, with overrides and enterprise-tunable responses; he says GitHub used it to clear and keep secrets out of its own codebase. Secrets are better fetched on demand from enterprise vaults via APIs, or at minimum stored in GitHub's secrets feature.
- Free compute draws abuse and raises sustainability questions. With 100 million developers, a counter-abuse team uses machine-learning pipelines and auto-detection against spam, crypto mining and ToS-violating binaries; on whether free scanning lasts, he says leadership values the community, though GPU-bound AI features are harder. CodeQL keeps up via per-language models, GitHub's own vulnerability researchers and AI-assisted modeling; compiled languages still often need build integration.
- Copilot is filtered for insecure code but still needs checking. He says its models are tuned for software development and filtered, with Microsoft, for security issues such as SQL injection and for toxicity, calling it early days; developers should still run security scanning and tests. Its context comes from open files and Copilot Chat, and he credits it with fixing an unfamiliar Jupyter notebook in about five minutes.