tech

2022-12-06 · open the original ↗

• PDXLAN's temporary network is built on enterprise gear with headroom. A Comcast 10 Gbps fiber feeds a 72-core MikroTik CCR1072, which the host saw barely strained at sustained 3–5 Gbps and a peak around 7.5 Gbps. A core switch with a 40 Gbps uplink sends 1 Gbps to two 48-port switches per table row; public Wi-Fi runs separately on a UDM Pro SE with DPI and two U6 Mesh access points, with Grafana, PRTG and a Discord bot alerting staff to offline switches.
• A flat /16 for about 650 devices is oversized but harmless here. The admin told the host he chose it because it is easy. The host says a /22 would fit best, and that a /16's risks (oversized layer 2 tables, broadcast traffic swamping printers) appear only with tens of thousands of devices, which a four-day event with enterprise gear never approaches.
• Torrenting users are automatically quarantined until they agree to rules. Internet-bound traffic is port-mirrored to a 2U Suricata server doing layer 7 filtering; on detecting peer-to-peer traffic it moves the user to a VLAN with no internet and a captive portal of event rules, returning them once they stop and accept the terms.
• The torrent ban mainly protects the venue's internet connection. Beyond ticket terms and a possible, unlikely saturation of the 10 Gbps link, the host says the real concern is piracy: Comcast could send notices or disconnect the Clark County Event Center near Portland, Oregon, jeopardizing future events there. Legitimate torrent users are simply out of luck.
• 1 Gbps uplinks to table switches are deliberate, not a bottleneck. Each 1 Gbps link serves 24 attendees on an event with 10 Gbps total, so the host argues 10 Gbps links would add nothing, while the 1 Gbps cap limits how much bandwidth any one user or table can take from others.

2022-12-04 · open the original ↗

• Microsoft's targets are too ambitious to meet without its partners. Benhamron, a Microsoft industry cloud architect for sustainability, uses the term to mean carbon measurement under the Greenhouse Gas Protocol. She gives Microsoft's commitments as carbon negative, zero waste and water positive by 2030, and removal of all emissions since its founding by 2050, which she says is why it built tools for its ecosystem.
• Carbon accounting is a data problem spanning the whole value chain. She says emissions must be counted upstream (business travel, commuting, purchased goods, capital goods) and downstream, such as an Xbox drawing power in a customer's home, which requires data sharing with suppliers and customers. Measurement comes first because without a baseline an organization cannot know whether its investments move it toward its goals.
• Sustainability Manager is a Power App acting as an emissions CRM/ERP. Benhamron says Microsoft Cloud for Sustainability is vertical offerings inside Azure, Dynamics and Microsoft 365, not a separate data center, on a sustainability data model in Dataverse. Sustainability Manager has data capture through Power Query and connectors, a calculation service from raw consumption to emissions, and reporting against goals; Azure and Microsoft 365 emissions have their own dashboards, with an Azure emissions API announced at Ignite.
• Customer demand far exceeds supply, because sustainability cuts across every industry. She says she is triple or quadruple booked and that more people are needed in her role. Customers already want to act but do not know how, and account teams that budgeted an hour find customers wanting a whole day; her own job is teaching partners carbon accounting and how to extend the product.
• Unified data must come before Microsoft's other three priority scenarios. Benhamron's four are unifying data intelligence, green IT (cloud migration and workload efficiency, backed by sustainability guidance for the Well-Architected Framework released at Ignite), a transparent value chain, and optimizing operations through energy management and smart facilities. She says the first must be tackled before the rest.

2022-11-22 · open the original ↗

• The host runs Unbound locally instead of an upstream DNS provider. After installing pi-hole with Cloudflare as a temporary upstream, he installs Unbound (config at /etc/unbound/unbound.conf.d/pihole.conf) so it queries root DNS servers directly on 127.0.0.1 port 5335, then points pi-hole's upstream DNS at that custom resolver so no outside party logs the household's DNS lookups.
• He warns against stacking too many block lists, since over-blocking breaks browsing. The default install pulls Steven Black's unified list (~158,000 domains); he adds the top two lists from each category on the Firebog's "green" (well-maintained, low-breakage) tier, raising the total to about 221,000 blocked domains, roughly a 30% increase.
• A static IP must be set before running the pi-hole installer. It can be a router-side DHCP reservation or a manual edit to the pi's dhcpcd.conf; for networks with multiple subnets (he runs a LAN, guest, and IoT network), the DNS setting must also change from "only allow local requests" to "respond only on interface eth0" so pi-hole answers queries from other VLANs.
• Without a firewall rule, savvy users can bypass pi-hole entirely. A device can simply be pointed at another DNS server, such as 1.1.1.1, so the host recommends blocking outbound port 53 traffic to any address except the pi-hole's own IP, though he leaves the exact router configuration out of scope of the tutorial.

2022-11-21 · open the original ↗

• A Flipper Zero can clone an LED strip's remote control. The host uses the Sub-GHz "read" function to capture the remote's on and off buttons for the strip behind his server rack, saves them as "rack on" and "rack off", then replays each from the saved list with "emulate"; he says the same works for infrared-controlled LEDs.

2022-11-18 · open the original ↗

• Most AI projects fail, often for reasons that are not technical. Dhall shows a slide quoting 83–92% failure rates and a Gartner prediction that 85% of AI implementations would fail by 2022, which he reads as projects not delivering rather than models misfiring. He claims his own consultancy has a 100% success rate on AI projects because it tests feasibility and sets expectations up front. Giard adds that on his own AI projects the customer was told at the start that the data might not support any prediction.
• No cloud won outright on handwriting recognition, and results drift. In Dhall's firm's May 2020 tests, Microsoft had 12 errors overall, Google 20 and Amazon 37, though Amazon did not then support handwriting. On neat cursive Google had 15 times Microsoft's errors, on French Microsoft had about five times Google's, and only Google recognized two pasted-together images as separate. In an October 2022 retest Google's word accuracy improved but it made a structural error, so under his weighting (5 for structure, 2 for word accuracy) it scored worse, and he says users have to keep track of where their cloud is going.
• Pick a form-recognition service by whether speed or accuracy matters. In May 2020 Microsoft Form Recognizer trained in about five seconds where Amazon Textract and Google Document AI took about an hour, and it was then the only one returning bounding boxes with the OCR. Google reached 100% accuracy on 10 samples. Dhall's firm still adds a human review UI, which he says turns a 200-person job into a three-person one. On receipts, none of the three read "lb", and he ranks Amazon above Google because Google made three structural errors to Amazon's one.
• The goal is real-time action, not just real-time analysis. In Dhall's hypothetical, a fast-food chain's bot reads a rival's 20%-off ad with computer vision and automatically posts a deal 5% better. Where approval is required, he would have everything ready for a human to approve with one click.
• Using more than one cloud for AI APIs is "a no-brainer." Dhall says enterprises expect multi-cloud to cost 70–80% more when data has to move, but an AI service is just an API call, so at least two of the three clouds should be used. He would pipeline them and add domain-specific rules, such as correcting "1B" to "lb". Customers barred from the cloud by compliance may have to train their own models instead.

2022-11-16 · open the original ↗

• U2F hardware keys are the strongest second factor against phishing. The host says U2F cuts the chance of being phished to "practically zero", while OTP apps such as Google Authenticator or Authy, though far better than nothing, can still be phished. SMS is the least secure option, yet Google's two-step setup offers the account's phone number by default, so choose "show more options", then "security key".
• Register several keys and name each one descriptively. The host registers three, two YubiKey 5 NFC and a YubiKey 5Ci (on a USB-C to USB-A adapter), each named for its skin, so a lost key can be removed from the account without guessing. He says any U2F-capable key works the same way, even a Flipper Zero.
• Keep the ten backup codes, and skip weaker fallback methods. Printed or downloaded and stored safely, the single-use codes still let you in if every key is lost. Adding an authenticator app, voice or text message as further second factors reintroduces phishable routes, so the host advises keeping the account as locked down as possible.
• NFC keys make phone sign-in a tap rather than a plug-in. On the host's iPhone, Gmail's two-step prompt was cleared by holding the YubiKey 5 NFC to the back of the phone. The 5Ci's Lightning connector would also work, but he found NFC more efficient.
• Google domain admins should require two-step verification, then go further. Requiring it beats password-only sign-in, the host says, and for the next level he points administrators to Google's Advanced Protection Program, which requires U2F.

2022-11-15 · open the original ↗

• A powered pole with a PtMP receiver suits a remote park corner. At the far end of an RV park, the host points to a pole carrying power, a light, a box he takes to be a PoE network switch, two cameras and a receiving antenna on top; he calls it not pretty but done right for covering an area far from everything else.

2022-11-12 · open the original ↗

• Database security fundamentals are slipping as the threat grows. Woody says newer data professionals have had more done for them and are stretched across BI, machine learning and AI, while data now sits in far more places and sophisticated nation-state attack tools have leaked to cybercriminals.
• Do at least the basics; you need not do everything. Woody says most attackers are script kiddies trying doors, so patching, upgrading and strong, changed passwords will send them to the next target, though a nation-state that wants your data will likely get it. He cites one shop with 2,500 custom applications against one server, which made testing a patch hard, and a customer still being upgraded from SQL Server 2005, 17 years of security patches behind; he would encrypt sensitive columns rather than the whole database. Giard frames it as making the cost of a breach exceed the data's value, and offers his own guess that cheap measures protect 90% of the data.
• Zero trust is the "how" of defense in depth. Woody says defense in depth layers protection from the building and OS (down to driver patches) to row, column, at-rest and in-transit encryption built into SQL Server, and zero trust says how: verify explicitly at each step, and assume breach, for example by checking logs for logins from countries where you have no users. His free, self-paced, hands-on course on GitHub, aka.ms/SQLSecurity101 (all his courses at aka.ms/SQLWorkshops), carries a defense-in-depth checklist and ends with a post-breach after-action report; he also runs it module by module monthly at the Tampa SQL Server user group.
• Applications that log in as one super-user are the worst pattern. Woody says it is very common for an app to keep its own users and permissions and act in the database through one privileged login, so whoever gets that password has everything. Nearly every customer environment he reviews still lists users who left, one five years earlier.
• People, not technology, are the weakest link. In Woody's account of the Uber breach, attackers texted an employee posing as IT, got her MFA code, then sent IT a screenshot carrying a Trojan that spread through an administrator to the whole company — social engineering, not tech. He calls the state of database security "good but in peril", because security is a tax that does not sell products and IT staff are being laid off.

2022-11-10 · open the original ↗

• Official UniFi Access cards are far more capable than cheap NFC tags. Per the data sheet, the starter kit's 20 cards are ISO 14443 Type A MIFARE DESFire EV2 with 4 KB of memory, room for a unique ID plus a cryptographic key, and the "UniFi Access proprietary security protocol"; they cost $2–4 on Amazon. NTAG215 tags (as in Nintendo amiibo) hold 504 bytes, no room for keys, and cost 35–65 cents.
• UniFi Access accepts almost any NFC credential, cheap tags included. On his test setup the host enrolled and opened the door with an official card, a YubiKey and an NTAG215 tag, but warns that being able to use any NFC type does not make it advisable.
• A Flipper Zero clones an NTAG215 tag and opens the door. Reading the official card and the YubiKey gave an "unknown ISO tag" whose UID emulation did nothing; the NTAG215 was identified, emulated and granted access. The host's advice: never use cheap NFC tags for access control.
• The host argues Ubiquiti should reject insecure cards outright. He asks why Access cannot detect that a tag cannot run its security protocol and either block it or accept only official cards, as Ubiquiti already restricts UniFi Protect to its own cameras. He admits he does not understand the card technology well and asks viewers to explain.

2022-11-08 · open the original ↗

• The host expects businesses to need managed workplace EV charging. Over the next five to ten years he expects many more employees charging at work, which raises who pays, how per-employee use is tracked or capped, how outsiders are kept off, and how electric delivery fleets are managed. He thinks that makes a real market for a product like Ubiquiti's EV Station.
• EV Station's announced specs are in line with other smart chargers. It lists at $799 in Ubiquiti's Early Access store, and the host notes EA pricing is subject to change. From the announcement: an SAE J1772 connector (Teslas need an adapter), 50 A charging shown, making it Level 2, a 10.1-inch touchscreen, a 16.4 ft (5 m) cable and a NEMA 3R weatherproof rating.
• It is managed through UniFi Connect with three access modes. The screenshots show plug-and-charge (open to anyone, he assumes), authorized users only, and disabled. The host speculates a price-per-kWh field to bill employees could follow, and spots SSO logins (Amazon, Microsoft, GitHub) and a "UniFi Talk" button he guesses is a softphone in the Connect app.
• He likes the idea but wouldn't bet a parking lot on Ubiquiti. Given Ubiquiti's history of launching products and then abandoning them, he would not spend thousands or tens of thousands filling a lot with EV Stations on the gamble they are still supported in three to five years, and he thinks the company may be ahead of the curve.

2022-11-05 · open the original ↗

• Every number carries uncertainty, so precision should match the question. Munroe says his disclaimers make his uncertainty explicit: he checks a value in two sources, would check a third "if I was going to trust my life" on it, and does not want to be cited as the authority. His "two millimeters of rock" for the 20-pound weight-loss question is deliberately loose, since sand versus bedrock moves it only between about 2.5 and 3.2 centimetres in a related calculation; he says density choices only become critical when two masses are subtracted.
• Easy answers open rabbit holes, and librarians beat six hours of Googling. Pushing Niagara Falls through a McDonald's straw takes about a third of the speed of light, but checking the flow rate led him to a US–Canada treaty setting daytime and night-time minimums and appointing one compliance officer per country. After hours on overlapping Great Lakes agency websites, the Harvard Law Library's librarians got the officers' names from the commission itself.
• The practical expert often beats the theory. For the steak dropped from orbit, he abandoned engineering heat-flow equations for a cookbook, and footnoted that he did not know how raw steak tumbles at hypersonic speed. Two doctoral students at the University of Manchester later tested a steak in a hypersonic wind tunnel: as he predicted, the outside seared and ablated away, the inside stayed raw, and it looked far more ragged than he drew it.
• Test pilots answer absurd scenarios with flat, correct priorities. Chris Hadfield told him a T-Rex on a jetliner roof is fine if it stays near the centre of gravity, citing the 747 that carried the Space Shuttle; to dislodge it he would push the nose down for negative G, dive or roll. Asked about saving the dinosaur for science he replied "not my concern", which Munroe ties to the pilots' order of aviate, navigate, communicate.
• A star would smell like ozone and taste sour. Munroe draws this from cancer patients whose olfactory bulb was in a radiation beam and reported bleach, burning hair and ozone smells, likely from ionised mucus; stellar plasma's free hydrogen ions would trigger sour receptors. He says, and a chemist he consulted agreed, that this explains the sour taste reported by a victim of a lab criticality accident with a bomb core.

2022-11-03 · open the original ↗

• ITDRC volunteers restore communications after disasters. An ITDRC leader describes the nonprofit as about 3,300 tech-sector volunteers, set up in 2008 after a government-sponsored post-9/11 effort never took off. About a month after Hurricane Ian it had opened about 130–135 sites in southwest Florida, moving from search-and-rescue support to shelters and community recovery, and had over 80 active US deployments.
• The Fort Myers Beach marina hotspot runs on solar, Starlink and CBRS. The trailer has four 300 W panels and batteries, Starlink as primary and a Meraki CBRS link from a high-rise point-to-multipoint antenna as backup. The open SSID is throttled to 5 Mbps down/5 up with layer-7 filtering against streaming and torrents. Its batteries had stopped charging and were below 10%; a volunteer pulled one battery and used a generator to reach about 50%.
• A community hub got Wi-Fi, 5G, a printer and VoIP. The Pine Island American Legion serves 500–800 meals a day, so ITDRC covered the parking lot and food area for a computer cafe (FEMA forms, email, photos) on a 5G modem. It replaced the flooded printer, added a Polycom VoIP phone, and left a card with a site ID for logging tickets with central control in Texas.
• The host calls Starlink a game changer for disaster response. It recurred at every site: a medical tent with Starlink and a Meraki MR86 (another group withdrew a second dish), and the Cajun Navy's base with extra SSIDs for other organizations. The setups break often: an access point lost power during nearby electrical work and needed a generator, and one site's equipment had vanished.
• ITDRC's mobile command truck combines cellular, satellite and radio interoperability. Mobile Technology Unit 4 has multi-carrier cellular, a 1.8 m VSAT dish as secondary, a 50-ft tower with Wi-Fi and cameras, and 20 roof antenna slots. It carries VHF, UHF, aircraft, marine, 700/800 MHz and 2 m radios, a gateway that cross-patches VHF to 800 MHz with phone patch, and a team awareness kit tracking staff and CRM-fed sites.

2022-11-02 · open the original ↗

• A saved Flipper Zero signal pops open other people's Tesla charge ports. The host sends a saved "Tesla" Sub-GHz signal in a Costco parking lot and opens the charge ports of two Model Ys, calling it a harmless but fun prank.

2022-10-21 · open the original ↗

• The router was chosen because it also records the cameras. Eagle Paragliding, a Santa Barbara school opening a remote southern Oregon property, needed coverage at a main house, a warehouse and a camping area; Starlink feeds a UDM Pro, picked by the client because it also runs UniFi Protect, fitted with a 4 TB Seagate SkyHawk drive. U6 Lite APs cover interiors, U6 Mesh APs the outdoors, alongside G4 Pro and G4 Bullet cameras.
• Point-to-point wireless bridges tie the three sites together. Two GigaBeam-to-GigaBeam links connect house, warehouse and camping area; the host likes them because the 60 GHz link (about 1.6 Gbps planned) has a 5 GHz fallback he expects to carry 300–400 Mbps in bad weather. On site the links read 82.5% link potential with 1.4 Gbps capacity, and 84.5% with 1.3 Gbps at 70.8 m; he stops at "rock solid" rather than tuning toward 100%.
• The larger switches were chosen for passive PoE, not port count. The GigaBeams need 24 V passive while the APs are 802.3af, and the US-8-150W does both; the warehouse unit ended up using seven of eight ports. The camping area's USW Lite 8 PoE does only 802.3af, so an INS-3AF-I-G converter powers its GigaBeam. Network is 192.168.64.x on DHCP, with the GigaBeams statically set at .10–.13.
• Speed tests came close to full Starlink speed everywhere. The host measured 221/13 Mbps at the main-house driveway, 68.7/11.9 at the warehouse, 80.6/5.52 at the camping area through both GigaBeam hops, and 62.3/8.06 about 50 yards from the camping AP. APs were left at defaults, to be fine-tuned remotely if problems appear; one U6 Mesh for a future building arrived too late and will be shipped.
• The host still recommends UPS units and Ethernet surge protectors. The area gets severe weather and lightning, and the sites had surge strips but no UPS; he wants grounded UPSs for backup and clean power, and grounded Ethernet surge protectors on every outdoor device, of which he brought only one. Crosstalk, which did the design and install, offers both as services.

2022-10-19 · open the original ↗

• Teams Premium is a paid add-on that removes nothing. Rose, a senior product marketing manager for Teams at Microsoft, says it was announced at the previous week's Ignite as a separate service beyond E3 or E5, due "next spring", covering personalization, intelligence and security. He says it sits on top of existing Teams; the one feature moving into it is live translation, which some advanced preview customers had already been using.
• Intelligent Recap is meant to replace re-watching a missed meeting. Rose says it will send a summary after a transcribed meeting with each mention of you or your project and any action items assigned to you, so someone booked into three meetings at once can catch up on the two they missed.
• Premium lets IT set meeting security by department. Rose describes per-meeting controls: no forwarding, named attendees only, no recording, and a watermark carrying a unique code so a photographed screen can be traced back to its meeting. Meeting templates let IT make, for example, HR meetings restrictive by default while sales meetings stay open.
• Share decks with PowerPoint Live rather than screen sharing. Rose says the presenter keeps control of the deck, sees speaker notes and attendees, and viewers can click links or pop the content out. He puts the bandwidth at about 20% of a full screen share because only changed pixels redraw. Excel Live brings the same to spreadsheets, where each viewer can zoom or filter without changing anyone else's view.
• Work hours and location in calendars restore chance office encounters. Rose says marking which days you are in the office lets colleagues book in-person time on those days, recovering the "water cooler moments" lost to remote work. He goes in on Thursdays and will add a day if people he wants to see are in, so that a commute is not wasted on an empty office.

2022-10-17 · open the original ↗

• Getting Linux onto Windows is now one command. Hanselman shows wsl --install doing the Windows-features toggling and reboots that used to be manual, running a lightweight utility VM rather than Hyper-V so it works on Windows Home, which he says was deliberate so students without Pro can use it. Distros come from the Windows Store as tar files, as many as you like (he has Ubuntu 20.04, Kali, Debian and installs Oracle Linux 8.5 live), and he recommends the Store's WSL preview for updates to wsl.exe.
• WSL is integrated with Windows, not a VM-in-a-box. Windows drives appear under /mnt/c, and Linux distros appear in Explorer via \\wsl.localhost; notepad.exe and explorer.exe . launch from the Linux shell, line endings survive editing on either side, and Linux GUI apps such as GIMP run in their own windows. His caveat: work on /mnt/c is slower than on the native Linux file system because it is "effectively" a network share, so keep code under /home.
• .NET on Linux is just another distro package. He recommends the official package archives (Ubuntu's own, or packages.microsoft.com, which Microsoft supports for several distros) over tarballs or scripts, and builds a console app that is a 142K Linux executable needing only the runtime. The demo uses .NET 6, with .NET 7 described as "coming out in a few weeks" and .NET Conf on November 10.
• The dev loop runs in Linux but feels local. code . installs a VS Code server in WSL, so the C# language server and debugger run on Linux while the editor is the Windows app. An ASP.NET app listening on Linux localhost (port 7036, on an internal 172.21 network) opens in the Windows browser because a WSL host process forwards the port automatically, which he calls the principle of least surprise.
• Build on Windows, deploy to Linux containers in the cloud. Docker Desktop uses WSL, so the same images are visible from Windows and Linux; he builds his Hanselminutes site (862 episodes at the time) as a container and shows it running on Linux in Azure, deployed by an Azure DevOps pipeline that ran in 1 minute 36 seconds, with GitHub Actions as the alternative.

2022-10-14 · open the original ↗

• The captions hold only song lyrics, no spoken content. The 27-second short's caption track is a few lines of a song ("There's a starman waiting in the sky…"); nothing about the 3D print or UniFi gear named in the title is said.

2022-10-10 · open the original ↗

• Memory is physically trainable, like a muscle. Aldan, who describes her evidence as largely anecdotal, says the brain stores data in chunks across six memory subsystems, and that left-brain/right-brain works only as a metaphor. Repetition strengthens neural pathways through thicker myelin sheaths and more protein synthesis. She recommends practising one technique for three months before moving to the next.
• Bilateral stimulation while holding a thought aids recall. Her "shoot the thumb" exercise moves the thumbs back and forth while you hold a memory in mind, which she says works both hemispheres and speeds transfer between them. She stresses it does nothing unless you are actively thinking of the thing.
• The brain remembers patterns but rejects overload. Aldan, a brand strategist, says cadence, tone and repetition make things stick, as with phone numbers read in the familiar 3-3-4 grouping. She says about five or more simultaneous stimuli overwhelm people, which is why she steers clients away from busy websites.
• Association anchors new information to what you already know. Her workshop ends with an hour building a Sherlock Holmes-style "mind palace". She also advises taking a test in the same conditions you studied in, down to the music or the lucky hoodie.
• Interruptions are the number one reason people forget. Aldan says a developer juggling layers of work drops them all at "can I have five minutes?" and needs about an hour to recover. Her fix is to set boundaries ("just a moment, let me finish this"), including with yourself against phone and social-media distractions.