tech

2023-05-12 · open the original ↗

• A UniFi Switch Aggregation fits inside a Dream Machine Pro. The switch's eight 10 Gb SFP+ cages almost exactly match the UDM Pro's drive-bay footprint. The host and a mechanical-engineer friend spliced both off one power supply and removed the drive cage, mounting the switch board on a 3D-printed bracket. They also cut down a heatsink and laser-cut the front bezel; the STL files are linked, and the warranty is almost certainly void.
• The cost is storage: only a 2.5-inch drive, now unserviceable. The UniFi Protect drive sits on a bracket above the UDM Pro's board on a SATA extension, so changing it means unracking and opening the case; the host fitted a 1 TB SSD and says up to 5 TB fits. He adds that anyone needing more than 5 TB, or more than a few cameras, should move to a UNVR anyway.
• UniFi adopted the hybrid as normal, but AR broke. The UDM Pro detected the internal switch as a separately connected switch at full 10 Gbps. The AR feature misplaced the switch's ports and would not lock onto the UDM Pro screen at all. Both units share the same 1.3-inch display board, mounted side by side, and the host warns these screens chip easily on removal even with a heat gun.
• His real wish is a 2U UniFi all-in-one. He wants a 2U UniFi firewall with a 16-port PoE switch, 10 Gb and 2.5 Gb WAN options, dual drives for redundant Protect storage, and true dual power supplies.

2023-05-09 · open the original ↗

• This lab turns the earlier bundle into a Marketplace offer. Transactable Containers lets Microsoft partners put a container- and Kubernetes-based offering on the Azure Marketplace. Lab 3 takes the CNAB (Cloud Native Application Bundle) pushed to the Azure container registry in Lab 2, so Labs 1 and 2 come first, and the work needs a Microsoft partner login at partner.microsoft.com.
• The offer is built in a tabbed Partner Center wizard. Under the Marketplace Offers tile, New Offer, Azure Container asks for an offer ID and alias; the lab suggests an ID starting "CW". Giard then works through the tabs, saving a draft on each. He checks "sell through Microsoft", picks the category Containers then Kubernetes app, and accepts Microsoft's standard contract. For the listing, the lab recommends putting "Kubernetes app" in the descriptions so the offer is easier to find, and supplies a 216 by 216 logo and a screenshot. A test offer can use Microsoft's privacy statement, but a real one needs its own. A video is optional, a screenshot caption is required, and the preview audience takes an Azure subscription ID for testing.
• The plan sets market and price, then attaches the bundle. Giard creates a plan with a summary and description, limits the market to the United States, and sets a custom price of $0 per core per hour because it is a test. On technical configuration, "add CNAB bundle" lists the container registries in the Azure account tied to the partner account, then their repositories and bundles. He has only one of each. Twice a save appeared to fail, and both times refreshing the page cleared it.
• Do not publish a test offer; publishing triggers manual certification. Giard stops at review and publish. He says he published a test offer before and sent feedback, and the lab now warns against it, because a person reviews each submission and would reject a test offer. For a real offer, he says the review takes about a day, after which Partner Center shows it as accepted or rejected, with the reasons for any rejection.
• Missing screenshot captions get offers rejected, though the form allows them. Giard says one of his own submissions was rejected because a picture had no caption. Captions are required for accessibility, but the form does not enforce that.

2023-05-09 · open the original ↗

• Lab two packages the containers with Microsoft's CNAB tooling image. CNAB stands for Cloud Native Application Bundle, which Giard describes as a standard for bundling, installing and managing container-native applications and their coupled services. The lab pulls Microsoft's container package app image (latest) from mcr.microsoft.com with docker pull.
• The tooling container runs with the working folder mounted as a volume. The docker run command adds a -v volume pointing at the container-labs folder; on Windows the path is written Linux-style, with forward slashes and no "C:". The entry point is bash, so the command drops you inside the container, where the mounted folder appears under the data directory and the container package folder sits inside it.
• The lab's ARM template failed verification on an outdated API version. cpa verify works as a what-if check; Giard says he hits this error only sometimes. It flagged the Kubernetes extensions resource in clusterdeployment.json as using the 2022-04-02 preview API version; he changed it to the newest listed version, 2022-11-01, and verify then reported zero failures. He presents this as his workaround and hopes the labs get corrected.
• Building the bundle needs Azure and registry logins, plus one more fix. He runs az login through the device-login page (with two-factor approval in his case), logs into the registry with the admin credentials, then runs cpa buildbundle. That failed because a billing identifier "should not be present" in the to-do app's values file, an error he says he has hit before; commenting it out let the bundle build and push to the registry.
• The portal shows a new bundle repository with a 1.0 tag. The last step verifies the new repository alongside Mongo and to-do JS, with its manifest and artifact reference. Giard notes an extra "-installer" entry he had not seen in earlier runs of the lab, which he says does not seem to cause problems.

2023-05-09 · open the original ↗

• Both local images are pushed into the Azure Container Registry. Giard runs docker login against the registry with the admin user and password, which succeeds with a warning that a password is less secure than tokens, then docker push for each image. The registry then shows two repositories, Mongo (tag latest) and to-do JS (tag v1).
• The Helm chart's values.yaml takes the registry and image digests. Giard calls Helm a package manager for Kubernetes that gives more control over managing a set of containers. The lab has you put the registry server on lines 10 and 14 (front end and back end) and each image's SHA256 repo digest on lines 8 and 12, add MongoDB key-value pairs, and set a namespace of your choosing on line 30. He finds the digests with docker inspect, redirecting its output to a text file because he finds it hard to read in the terminal.
• Deployment and UI files pass the MongoDB admin credentials through. In deployments.yaml, which defines the Kubernetes deployment, lines 25 and 27 are uncommented and pointed at the MongoDB admin values. In createUiDefinition.json the lab's JSON goes into the elements array and the outputs section.
• The ARM template gains parameters prompting for MongoDB admin credentials. Two parameters for the MongoDB admin username and password are added anywhere in the parameters section of clusterdeployment.json, which Giard describes as an ARM template for deploying to Azure. The lab also points to the Microsoft Kubernetes extensions resource type, which he says adds extra functionality to the template.
• The manifest file closes lab one. In manifest.yaml the registry server is completed with the registry name and the namespace set to the one chosen for the Helm chart.

2023-05-09 · open the original ↗

• Transactable containers run a partner's solution in the customer's Azure tenant. A Microsoft partner bundles one or more containers into a complete solution, sold through the Azure Marketplace and based on Azure Kubernetes Service. The partner controls the containers' configuration and contents, but they are deployed to and run in the customer's tenant. Giard notes the offering was in preview when he recorded, so details may change. The labs need a Microsoft partner registration, which he says is free and takes a few minutes.
• Download the labs as a zip and work in a copied folder. Giard downloads the lab repository from GitHub as a zip of about 26 MB instead of forking it, because nothing gets pushed back. He copies the lab's starting folder to a new location and renames it "container-labs", so the original stays untouched in case he needs to start over. He points out what looks like a typo in the folder path the lab gives.
• Create an Azure Container Registry and record its credentials. He creates the registry in a new resource group in East US with the Basic SKU, the cheapest, since this is a demo. Availability zones are optional, for extra redundancy. Validation failed until he gave the registry a name, and creation takes about a minute. Under Access keys he enables the admin user, then records the login server, username and password for the later commands.
• Build the app image and pull MongoDB, both tagged for the registry. He adds the lab's code to the Dockerfile without deleting its existing first line. Docker Desktop must be running. On Windows he runs the commands in an Ubuntu terminal under WSL rather than the default PowerShell. docker build -t with the registry's login server, the to-do image name and tag v1, and a trailing . builds the image locally. docker pull mongo:latest fetches MongoDB from Docker Hub, and docker tag points it at the same login server.
• Both containers run on one Docker network as a working app. After docker network create makes a network for the app, one container runs MongoDB on port 27017, with an admin username and password the user chooses. The other runs the to-do web server pointed at it. The app at localhost:3000 adds, completes and deletes tasks. Giard says Lab 1 is much longer than the other labs, so it continues in the next video.

2023-05-02 · open the original ↗

• A Raspberry Pi PBX and an ATA give hotline dialing cheaply. For a friend's art installation, the host runs Incredible PBX on a Raspberry Pi with an antique Model 40 phone on a Cisco SPA112 ATA. Lifting the Model 40's handset rings all three registered VoIP phones (including a Polycom VVX 410 and a Sangoma S300) at once, and lifting any of them dials the Model 40; the short closes with a pitch for Crosstalk's VoIP services.

2023-05-01 · open the original ↗

• Reviving a Zune in 2023 is four separate problems. Hanselman, working with a Zune 30, a Zune HD and a small Zune, splits it into updating the firmware, installing the software, getting the PC to see the device, and getting content onto it.
• Firmware updates depend on a community site faking Microsoft's servers. The Zune software still phones home to zune.net, but nobody answers; zuneupdate.com, run by a community member rather than Microsoft, has you change DNS settings and the hosts file and run a local server so the PC answers itself and the firmware can be updated.
• The software installs, but Windows 11 will not recognise the device. The installer is zunepackage.exe and needs .NET 3.5, which Windows should offer to install or which can be added through Windows Features; on Windows 11, he says, plugging the Zune in just produces the connect and disconnect sounds.
• The driver fix means forcing a file into system32. A fix he credits to Reddit users is copying a file into the en-us folder under system32; he traces the failure to a MUI file for the Zune co-installer DLL that lacks permission to be copied there, so you take ownership as admin and copy it by hand, which he did after the install failed with an error that it "requires an interactive Windows station". He also points to a GitHub tool, the Zune modding helper, with a heavy caveat: it is unsupported and he would not use any of this on a machine you care about.
• His working answer was old hardware for old hardware. Rather than keep fighting Windows 11 — though he says he won't give up on it — he put Windows 8 on an old laptop, where the Zune software installed and recognised the device and he copied video onto it with no workarounds.

2023-04-28 · open the original ↗

• The host rates the USW-Aggregation an overlooked, inexpensive 10 gig switch. At $269 it is a fanless layer 2 switch with eight 10 Gbps SFP+ ports (160 Gbps total switching capacity), 4.7 inches deep and drawing 30 W maximum; 10 gig Ethernet transceivers can wire in up to four 10GbE devices. He pitches it for uplinks to other switches or 10 gig devices.

2023-04-28 · open the original ↗

• The first career choice is hands-on technology versus sales. Rodriguez, a Microsoft cloud solution architect since 2015 and at the company since 1999, says technology work is predictable if you work at it hard enough, while sales means persuading decision makers who often just want the cheapest thing that works; he says that skill has real value and does not treat "sales" as a bad word. Within technology the next choice is developer or infrastructure; Giard argues from his own career that the split is not binary, and Rodriguez agrees it is better to know both.
• Short engagements demand credibility fast; assigned accounts bring pressure. In roles like his current partner team or the Microsoft Technology Center, Rodriguez says you may see a customer for a few hours and must prove your expertise immediately. As an account technology strategist with assigned accounts he could build relationships, but when one customer began considering a move to Google he was on weekly calls with VP-level people, which he describes as stressful; Giard says he avoids quota roles partly because no quota lets him speak candidly about competitors.
• Higher pay usually buys more pressure and less balance. Rodriguez suggests Glassdoor or LinkedIn for salary ranges, says better-paid roles often trade away job happiness, and says he would not be happy in an 80-hour-a-week job because he sits on the boards of several orchestras. He cites friends who joined a new Microsoft partner and were paid about $5 million when it was bought out, against another whose paychecks bounced; Giard adds that he once took a significant pay cut to stop travelling 100% of the time while his children were young.
• He stayed 24 years because Microsoft itself kept changing. Rodriguez contrasts a company that once mocked Linux with one that now backs open source, Linux, Postgres and MySQL, and says it treats employees better than competitors he sees as treating staff as disposable. He says friends at competitors make "100 to 200 more" than he does, a trade he doubts he would take, and that adjusting to another company's culture, such as locked-down machines without admin rights, would take longer than learning its technology.
• Change jobs when your current one won't give you growth. Rodriguez advises raising it with your manager first, and looking outside the company only if the opportunity is not there, while planning how to get from, say, Exchange administration to AI work. He says his two years as an account technology strategist were valuable because they showed him how consulting, support, licensing, account teams and partners fit together around a customer.

2023-04-25 · open the original ↗

• The real fault was a second DHCP server on his secure LAN. Swapping his core US-24-PoE for a USW-Enterprise-24-PoE (12 × 1 GbE, 12 × 2.5 GbE, two 10G SFP+, locking power and an RPS port), the host plugged his Comcast Business gateway's 10.1.10.x network into a port without setting its isolated untagged VLAN. Devices took addresses from whichever server answered first, so cameras landed on 10.1.10.x and dropped out of UniFi Protect.
• Pre-November 2020 UNVRs fail when their internal USB boot drive wears out. Units with a back-panel date code of 2048 or earlier are affected and stop booting with a fast-flashing white LED; newer units have no flash drive. Ubiquiti has extended their warranty by two years, and UniFi OS for NVRs 3.1.7, in Early Access at recording, copies the boot data to an installed hard drive (at least one required).
• Swapping the glued-in flash drive did revive his failed UNVR. The host replaced it with a slim Kingston 32 GB USB 3 drive, after pulling and labelling the hard drives in order so the RAID would not need rebuilding, then restored a cloud backup. The fix only looked like a failure because of the concurrent DHCP problem; a later factory reset with drives left in wiped all his past footage.
• The UNVR's static-IP screen orders fields gateway first, inviting mistakes. It asks for gateway, then IP, then subnet mask; in haste the host swapped gateway and IP, making the UNVR unreachable and duplicating the gateway address on the network. He calls this his own fault but also an odd interface choice by Ubiquiti.
• Make one change at a time and chase every unexplained symptom. The host's lesson is to let each change settle before the next, and that "if something isn't working there's always a reason"; he credits Ubiquiti with handling the UNVR flaw well through the hardware change, warranty extension and software fix.

2023-04-24 · open the original ↗

• A "feature complete" blog engine fell behind a web that kept moving. Downie says Clemens Vasters wrote it in the early 2000s, soon after ASP.NET appeared, as one of Microsoft's first open source projects, and Scott Hanselman and others carried it on; Downie, a Microsoft principal program manager on Visual Studio production diagnostics, picked it up around 2014, when it was abandoned. His first fix was letting a post set its own Open Graph header data, which until then meant editing the code; Giard recalls Hanselman saying there were no new features "because all the features are already there."
• The .NET Core port kept most of the original code running unchanged. Starting around 2015, Downie set out to make DasBlog Core run on Windows or Linux, in a new GitHub repository separate from Hanselman's ASP.NET classic version. The hard part was Windows assumptions baked in, such as time-zone data read from the registry; the Web Forms UI was almost entirely replaced with a new MVC layer over an abstraction that talks to the old code, while the code for saving a post is "almost unchanged" and now runs on Linux, Windows and the cloud.
• Storing posts as plain XML files means the author owns their words. Downie says avoiding a proprietary database was DasBlog's distinctive idea: posts are XML files dated by creation, so backup or moving servers is just copying files, and leaving means writing a program "in an afternoon" to convert them. Giard, who has used DasBlog for his blog for over 20 years, values the same portability but doubts he could write that converter in half a day.
• Migration is designed to preserve every old URL. Downie says users of the old version can copy their content folder (XML files and images) into DasBlog Core, and old .aspx addresses redirect with a 301/302 to the new hyphenated canonical URLs; the project wiki covers a one-click Azure free-tier setup contributed by a community member, migration, security and Open Live Writer, and he answers questions through GitHub issues, using them to improve the documentation. Giard migrated by hand over FTP and found links between his own posts broke, which he fixed by searching the downloaded XML files; Downie broke links moving his blog from popstring.com to popstring.com/blog and wrote a program to find and replace them.
• A blog could act as its own node in the Fediverse. Downie asks whether a blog could act as an independent node in the federated network that others subscribe to, much as they subscribe to RSS, and says he has already made his blog discoverable there, identifying him by his Fediverse handle. He presents it as ongoing exploration that he and Vasters, who has recently returned to contributing to the project, are both thinking about.

2023-04-23 · open the original ↗

• A breadboard kit rebuilds the Apple I step by step. Hanselman is following SmartyKit's online assembly instructions, with chips for CPU, RAM, ROM and video, and pre-cut wires; he describes the Apple I as Wozniak's 1976 6502 machine that preceded the Apple II. Last session stalled on a bad keyboard decoder chip, which the company replaced, and he uses a $10 PS2 keyboard from Goodwill.
• Measure parts rather than trust colour bands. He uses a cheap multimeter–oscilloscope hybrid to see the clock LED's on/off waveform, and tests each resistor (2.2k, 10k, 220 Ω) before placing it. One reading was "surprisingly large" and fluctuating until he removed the alligator clips, at which point it read the expected 2.2k.
• The instructions can hide a step. A viewer noticed a wire he had missed because a pop-up covered part of the instructions; he says the circuit worked without it but he would probably have had to debug it later.
• Keyboard and video controllers now work without a CPU. The video controller's small screen powered on, which he calls only the "hello world" equivalent. With the keyboard controller wired to it over an eight-wire data bus, keypresses show as ASCII on a row of LEDs, putting him at step 70, "two of six" stages. Next time he plans to add CPU and memory, boot the original 1976 Apple I ROM, and send the RCA video out via an HDMI adapter to OBS.
• The point is understanding the foundations. He says there is "absolutely no reason" to do this "other than it's awesome". He contrasts it with talk about ChatGPT: "somebody has to understand how to do this or the system breaks down", likening it to driving stick shift and to the joke that computers are rocks we put lightning in.

2023-04-18 · open the original ↗

• The Azure Marketplace is where third-party software is bought. Falgout, a Microsoft cloud solution architect who helps partners onto the marketplace, contrasts it with the portal's "plus" button for Microsoft's own services. The partners are mainly independent software vendors, who write software, and system integrators, who implement solutions and may themselves use an ISV's product.
• Publishing starts with becoming a Microsoft partner. Falgout says a company creates a Partner Center account at partner.microsoft.com and publishes an "offer" there, which then appears in the marketplace. For technical guides and labs on building a SaaS offer he recommends "Mastering the Marketplace" on GitHub, and he points to his own slide deck.
• Kubernetes apps put partner software into customers' clusters. The partner packages its offer as a Helm chart, Microsoft runs security checks, and the customer installs it with a click; any charge appears as a line item on the customer's Azure bill, so the vendor avoids purchase orders and procurement. At recording this was in public preview, which Falgout says to treat like a beta, with general availability coming "very soon" at an unstated date.
• Vetted marketplace spend counts against customers' Azure commitments. Falgout says large enterprises sign a Microsoft Azure commitment contract (a "MAC") to spend millions on Azure. For transactable containers and Kubernetes apps that Microsoft has validated, which is part of his and Giard's job, the customer's payments to the partner decrement that commitment, which he calls a big draw for expensive software.

2023-04-14 · open the original ↗

• Put Home Assistant and all IoT devices on an isolated VLAN. The host argues IoT devices phone home to unknown cloud services and are attractive hacking targets, so the IoT network should have internet access only, with secure networks able to see into it but not the reverse. He also recommends network-wide DNS filtering such as Pi-hole or AdGuard Home to block malware, ads and data reporting.
• A Raspberry Pi works, but he distrusts its microSD card long-term. He ran Home Assistant on a Pi for over two years; installation uses Raspberry Pi Imager's built-in Home Assistant image (Pi 4, Pi 3, or CM4/Home Assistant Yellow options) onto a class 10 or better card, 32 GB being plenty. The web interface is at the device's IP on port 8123.
• The host runs his own instance as a VM on a Synology NAS. RAID 5 storage removes the SD-card risk and weekly snapshots allow rollback, though he stresses snapshots are not backups. He uses the VirtualBox VDI image with the recommended minimum of two CPUs, 2 GB RAM and 32 GB disk, switches legacy BIOS to UEFI, and gives the VM the NAS's second NIC, cabled to an untagged IoT-VLAN port.
• Docker is easiest but broke device discovery on his dual-homed NAS. He pulls the official image's "stable" tag (about 2 GB), mounts a NAS folder at /config, sets a TZ variable and uses host networking. With the NAS on both secure LAN and IoT VLAN, the GUI answers on both but discovery only happened on the secure LAN, so he does not use Docker himself.
• Automations are built from triggers, optional conditions and actions. His example turns the Lutron outdoor lights on at sunset (an offset like -01:00:00 fires an hour earlier) and a duplicated second automation turns them off at 10:30 pm. Devices found in the IoT network appear under notifications; Lutron and Philips Hue pairing requires pressing the bridge's physical button.

2023-04-14 · open the original ↗

• Borrow ChatGPT's ideas, but don't copy its text. Asked for a metaphor for a movie that starts poorly but ends well, it offered "a diamond in the rough". Giard says pasting that into a review and claiming it as his own raises ethical issues. Taking the concept and putting it in his own words is fine, the way you would paraphrase sources found through Bing or Google.
• One sentence or premise is enough for a whole story. An unprompted opening line (an enterprise architect asked to code a solution to world hunger), a line about two characters debugging code, and a premise about a politician who insults everyone who disagrees with him each produced a full story or dialogue. Asked to grade its own story for a 12th-grade writing class, it refused to give a grade but listed strengths and no weaknesses. Giard suggests that is probably because it wrote the story, and says you could give it your own writing instead.
• Everyday requests get usable starting points. He asked for movies like Tim Burton's Big Fish, an espresso machine within a stated budget, a birthday gift for a 15-year-old who loves basketball, and dinner from what is in the fridge. The recipe came with an ingredient list and step-by-step instructions. Giard calls the espresso list a good starting point for further research. He also ran a C# programming text adventure as "game master", which someone online suggested, and a movie trivia game that ended when he typed "stop".
• It returns structured output in a format you name. Asked for NCAA Division I men's Final Four results as a table with set columns (champion, runner-up, final score, other teams, location, MVP), it built the table. It also wrote Mermaid diagram code for a family tree from Abraham to Jacob that rendered in mermaid.live. The tree was incomplete: it left out the wives.
• Its bio of Giard mixed fact and error. It called him an independent consultant, though he is a Microsoft employee. It also said his bachelor's degree was in computer science from the University of Michigan, when it is in biochemistry from Michigan State. After he corrected it in the chat, it fixed some of the errors. Giard says he hopes the corrections will make their way into its knowledge base, which is his hope, not something the demo showed. Rewrites of the bio as a haiku and in the voice of Foghorn Leghorn worked, in his view.

2023-04-14 · open the original ↗

• ChatGPT understands and answers in natural language, with stated limits. Giard describes it as built on a large natural-language model that handles colloquialisms, idioms and slang, works in several languages (he tested only English), and remembers earlier questions so follow-ups work. As of the recording he says the free version is GPT version 3, trained on internet data through 2021, text only, and liable to carry the internet's biases and false information; about $20 a month buys version 4 and higher priority when demand is heavy. He starts at chat.openai.com.
• Generated code is a starting point even when it may be wrong. Asked how to delete a row in MongoDB using PHP, a stack Giard does not use, it returned connection and delete code with a copy button and a plain-language explanation of how the code works. He says he tested it and thinks it works, but argues that even flawed output beats starting from manuals, search results or books.
• The more specific the request, the closer the answer. Asking for sample baseball statistics as CSV returned PHP code that would write a CSV file rather than the data itself; "regenerate response" gave much the same, though he says an earlier run output the data directly. His lesson is that a more precise question gets the expected answer.
• Use its drafts as input, not as your own work. Giard calls pasting a generated blog post on the dangers of AI into your own blog unethical, and using it for homework clearly so, but treats a generated presentation outline as fair to expand and claim — the same mindset as combining search-engine results. A private email to a boss excusing a late project read as professional but invented a reason (a family member in hospital), and a job description for his own title, Cloud Solution Architect, needs proofreading since it knows only the title.
• It explains a concept at whatever length and level you ask. "Explain autoscaling" gave a few paragraphs; "in one sentence" gave a one-line definition; "like I am five years old" gave a simplified version built on metaphors. Giard pitches this for catching up on an unfamiliar term mid-meeting, and notes it can also answer "like a pirate" for fun.

2023-04-05 · open the original ↗

• PDX LAN detects torrenting from a mirrored port feeding Suricata. A 10 Gbps fiber connection enters a MikroTik CCR1072, fiber-linked to a Cisco Nexus 5020 whose uplink port is mirrored to a 2U server. Suricata on it inspects all internet-bound traffic and logs events to syslog, which PacketFence, an open-source network access control system, monitors.
• PacketFence holds each attendee in VLANs tied to MAC and switch port. New machines land in a detection VLAN with a captive portal of event rules (no hacking, no BitTorrent, no illegal downloads); accepting moves them to the authorized main VLAN, with PacketFence knowing their MAC address and switch port.
• Any peer-to-peer transfer, legal or not, sends a user to torrent jail. The host tested it with a Fedora torrent and lost connectivity almost immediately, landing on a quarantine portal; after stopping the torrent, access returned in roughly the 30 seconds the admins quoted. Per the admins, a third offence locks the user out until they see the network staff.
• The jail dates from a 2011 abuse of the event's bandwidth. The host relays that with a then-large 1 Gbps connection, an attendee downloaded a whole TV season, and since the event centre's connection receives the infringement letters, the admins built the block.

2023-04-04 · open the original ↗

• ngrok exposes a local app to the world, then layers controls. Casey, who has worked in ngrok's product marketing and developer advocacy for about a year and a half, says a local agent opens a tunnel via reverse proxy to ngrok's cloud and puts a URL in front of your port, handling TLS, DNS and NAT traversal. On top he lists identity providers, OAuth, basic auth, IP restrictions, mutual TLS, load balancing, circuit breaking and webhook verification, and says a Kubernetes ingress controller was launching the week after recording.
• Webhooks are message passing between systems over HTTP and JSON. Casey explains them as object-oriented state-change notification across the wire, such as a card payment moving from confirmed to paid, and says their unrealized power is that they work with any stack. He says ngrok gets about 4,500 sign-ups a day, most of them doing something with webhooks, because many providers' webhook guides start by telling you to create an ngrok account.
• Every webhook provider invented its own verification scheme. Casey says the first 50 providers they surveyed had 50 different methods, with duplicates appearing only around 120–130, often differing in small details such as parameter case or ordering. Of about 100 they collected, ngrok implemented 50, and he and a colleague published the research as webhooks.fyi, free on GitHub, lightly ngrok-branded and open to pull requests, with best practices for both providers and consumers.
• Match the verification method to the security you need. Casey calls a shared secret, like Twilio's auth token, sufficient for low-security cases and best when you control both endpoints. He puts HMAC at the higher end for broadcasting to endpoints you don't control, so you need not publish a secret, and warns that even internal webhooks need verification because success brings outside customers or partners onto the system.
• Providers routinely omit sample code and sample payloads. Casey says most providers give a bulleted list of steps instead of working verification code they surely wrote to test it, and that probably half of those surveyed had no sample payload. He says the site supplies field data to standardization efforts, naming an IETF working group and the OpenID Foundation's Shared Signals and Events work, which thanked them, though he does not know whether it uses the data.