tech

2022-10-08 · open the original ↗

• Nightscout can run on Azure for nothing, indefinitely. Hanselman, a type 1 diabetic, pairs Cosmos DB as the database with an App Service web app, both on free tiers, filling what he says is a gap in reliable write-ups for Azure. He frames this as a first run-through ("a beta test"), and says he himself pays for his own Nightscout hosting.
• Lock the database to its free tier before creating it. He ticks "apply free tier discount" and "limit your account", which caps it at 25 GB and 1,000 resource units, more than enough for Nightscout, and keeps the database named test at a maximum of 1,000 RU because Nightscout still expects that name. In the Node.js connection string he replaces maxIdleTimeMS with socketTimeoutMS to work around what he calls a small Nightscout issue.
• Deploy the website from a pinned Docker image on the free plan. He creates a Linux web app from the Nightscout team's Docker Hub image nightscout/cgm-remote-monitor, recommending the specific version 14.2.6 rather than latest, on the free F1 plan. The paid tiers he shows cost about $80 and $13 a month, and he calls the $13 one a reliable, inexpensive option; the web app should sit in the same region as the database.
• Configuration is a handful of app settings, each save restarting the site. The essentials are DB_URI with the edited connection string and API_SECRET, which failed until he made it at least 12 characters; optional settings cover plugins, enabled features and the Dexcom bridge credentials. Each save restarts Nightscout, so the site needs a moment before refreshing works.
• Confirm it worked by checking for the seven collections. He looks for food, settings, treatments, device status, activity, profile and entries in the database, and says to restart the web app or start over if they are missing; first launch then goes through the profile editor, authenticated with the API secret.

2022-10-07 · open the original ↗

• Graph API is one REST interface to everything in Microsoft 365. Giard describes it as a plain REST API called over HTTP or HTTPS that can read, create, update and delete user accounts, Active Directory information, email, OneDrive files and calendar data; he calls it simple to use and well documented, pointing to the "Microsoft Graph API v1.0 endpoint reference".
• The call is easy; the prerequisites are the real work. Every call needs a bearer token saying which account it runs under, issued by a trusted authority such as Azure Active Directory from a tenant ID, an application ID and a client secret. That account must already hold the permission the call needs (user read access to read users, create permission to create email), and getting the ID, secret and permissions means registering the app with Azure Active Directory, steps he covers in episodes 137, 138 and 139.
• Decoding the token shows exactly which permissions it carries. In the demo, an app registration in a sample Contoso tenant was granted User.Read.All, and a token generated in Postman by an HTTP POST to a URI containing the tenant ID, passing the client ID and secret, was pasted into jwt.ms, which showed User.Read.All as its only role.
• A GET to the users endpoint returns the tenant's users. Sending an HTTP GET to https://graph.microsoft.com/v1.0/users with the token set as a bearer token under Authorization returned HTTP 200 and the list of users. Giard says a call lacking permission or using an invalid token gets an unauthorized response ("a 401, I think"), and that a valid token with the right permissions can be reused for as many calls as you like.

2022-10-06 · open the original ↗

• Regulators have begun expelling non-compliant carriers from phone networks. As reported in FCC tweets and an fcc.gov notice, its Robocall Response Team issued first-of-their-kind Enforcement Bureau orders to begin removing seven named voice service providers from the Robocall Mitigation Database unless they show compliance, including STIR/SHAKEN across their IP networks. Chairwoman Jessica Rosenworcel wrote that "fines alone aren't enough."
• Removal means every other carrier must drop that provider's traffic. The host reads it as carriers such as Verizon and Bandwidth.com getting lists of IP addresses to block outright, legitimate calls included, which he expects will effectively kill small telcos that profited from terminating robocalls. He calls it the strongest enforcement he has seen.
• The host shut his own SIP business rather than comply. He says call-termination infrastructure, identity certificates and digitally signing every call had too steep a learning curve for the revenue, and many other small carriers left too. He still welcomes the crackdown because so many robocalls are scams; he points to his earlier STIR/SHAKEN video with Tony Lewis, CEO of ClearlyIP.

2022-10-05 · open the original ↗

• A bearer token identifies the account an API request runs under. Giard describes it as an OAuth standard issued by a trusted authority; Azure Active Directory issues it as a JSON web token (JWT) carrying claims about the account, including its permissions. The account must already hold permission for whatever the API does, such as reading OneDrive documents or sending email through Microsoft Graph.
• Three values come from the app registration. These are the client ID, the tenant ID (on the overview page and the registration) and a client secret, plus Graph application permission User.Read.All with admin consent, as in episodes 137 and 138. He creates a new secret expiring in six months and repeats that its value is shown only once and works as a password, best kept in Azure Key Vault in production.
• The token comes from one form-encoded POST to the tenant's endpoint. Using Postman (free at postman.com), Giard posts to https://login.microsoftonline.com/<tenant ID>/oauth2/v2.0/token as x-www-form-urlencoded data with four fields: client_id, client_secret, scope and grant_type. For Microsoft Graph the scope is https://graph.microsoft.com/.default and the grant type client_credentials, which he says are the same every time; the client ID and secret change.
• The returned access token is encoded JSON that jwt.ms can decode. The request returned HTTP 200 and an access token. Decoded at jwt.ms, its aud claim names Microsoft Graph as the intended recipient and its roles claim lists User.Read.All.
• Changing permissions does not update an already-issued token. Giard says that if you add a permission (his example is bookmark.read.all), the existing token will not carry it; you must send the POST again, from Postman or from code, to get a token that includes it.

2022-10-05 · open the original ↗

• Permissions are granted on the app registration's API permissions page. This builds on the registration from episode 137. By default a registration carries the delegated permission User.Read; Giard explains delegated permissions as continuing a context the caller is already running under.
• Application permissions make calls run as the registration's own account. Giard chooses Add a permission, then Microsoft Graph, then Application permissions, so an API call is explicitly assigned the account tied to the registration. He advises being specific because Graph covers users, email, Teams, OneDrive and more, and he picks User.Read.All under User to read all user profiles without write access.
• User.Read.All needs admin consent before it takes effect. The portal shows a warning that admin consent has not been granted; logged on as an administrator, Giard clicks Grant admin consent and confirms, and a check mark replaces the warning. He calls the process simple, with the catch that you must be an administrator.

2022-10-05 · open the original ↗

• LinkedIn Live went from an application process to a self-serve switch. Rey says that when he started, about a year before recording, you had to apply and wait for LinkedIn's approval; now you turn on "creator mode" on your profile, which also unlocks audio-only events, and he believes a profile or company page needs about 150 followers or connections. LinkedIn has no built-in streaming software, so he first tested with StreamYard on a colleague's profile, Mark Steele's, which had access before his own did, and ended up with about a minute of unexplained silent video on Steele's feed.
• Rey picks his streaming tool on price against the channels he needs. StreamYard's licence limited him to three simultaneous destinations, so within about three months he moved to Restream.io, which allowed unlimited channels for the same price or about $5 a month more; he used it for over a year until a July licensing change made extra channels over twice StreamYard's price, and he went back to StreamYard. He also says he favoured Restream for a long time because a Microsoft viewer told him in a live comment that it runs on Azure while StreamYard runs on AWS.
• Rey streams to LinkedIn and Twitter, then one topic-dependent third channel. LinkedIn is his main presence and Twitter his second-largest network at over 10,000 followers; the third might be his Tip Tuesday YouTube channel, which he says has no fixed schedule and had last gone live about a month earlier because it earns him nothing. Both StreamYard and Restream run entirely in the browser, and he says the recordings stay viewable after the live event for people who missed it.
• Streaming public events raises consent and copyright questions. Rey went live from a Sergio Mendes concert and from the DeKalb Corn Classic 10K without asking the mayor, the anthem singer or attendees; he notes some events carry a disclaimer that attendance grants use of your likeness, and says this matters more when streaming for or on behalf of a larger company.
• A Teams meeting can go live directly using a stream URL and key. Rey demonstrated copying the stream URL and key from LinkedIn's go-live page into a Teams meeting's custom streaming setting, so the meeting is recorded and broadcast at once; on the version of Teams they tried, he concluded it streams to only one destination at a time, though stopping the stream unlocks the fields to switch to another. He also says StreamYard's custom RTMP output can feed a production into a Teams live event.

2022-10-04 · open the original ↗

• The shrunken version 2 slightly outperforms the original in testing. The host concludes TP-Link, with the EAP610 v2, significantly shrank the Wi-Fi 6 access point while improving speeds a little, answering the common complaint that its APs are too large. He doesn't know whether v1 will be end-of-lifed and wants the same treatment for TP-Link's more powerful APs.
• The new model is cheap, compact and flexibly powered. It lists at $99.99 MSRP, is just over 6 inches across and 1.3 inches tall, with a 4 dBi 2.4 GHz antenna rated up to 574 Mbps and a 5 dBi 5 GHz antenna up to 1.2 Gbps. It runs on 802.3at PoE, 48 V passive PoE or an included 12 V 1.4 A DC adapter, and is managed by an Omada controller (hardware OC200, software or cloud).
• Averaged runs from three devices all favoured v2 slightly. The host ran five tests per device (his PC, an iPhone 13, an iPad) against an OpenSpeedTest server on Ubuntu 22.04, through a TP-Link TL-SG2210MP switch and TL-R605 router, with identical positioning. He flags that the server's gigabit NIC may have capped results, and that the iPad's uploads ran about half its downloads on both APs.
• Five-minute sustained stress tests showed the two essentially tied. Run twice per AP from the PC only, v2 led on download by what the host eyeballed as roughly 10 (units unstated) and trailed slightly on upload, which he called splitting hairs.

2022-10-03 · open the original ↗

• The host's bench test link delivered near-gigabit throughput. The host bridged two GigaBeams across his office, each powered from a US-8-150W switch port set to 24 V passive PoE, with one side feeding a UDM Pro and an OpenSpeedTest server on a Shuttle PC. He measured roughly 712 Mbps down and 941 Mbps up from a wired laptop across the link.

2022-10-03 · open the original ↗

• Registering an app is the first step to Azure AD authentication. In Azure Active Directory, choose App Registrations and then New Registration; Giard notes you need admin-level permissions on the account. Only two fields are required. The first is a name, and he advises one that is easy to identify and search for later, since the registrations list is found with a filter box.
• The second required field sets who may authenticate. The options are this tenant only; multiple Active Directory tenants (customers, partners or acquired companies, which needs a trust relationship); multiple tenants plus Microsoft accounts such as Xbox, Skype, Outlook.com, Hotmail and Live; or personal accounts such as Gmail addresses that the directory trusts. Giard picks single tenant and later shows it can be switched to multi-tenant on the registration's details page.
• The redirect URI is optional and can be set later. It names the page or screen a web, mobile or rich-client app sends the user to after a successful sign-in. Giard leaves it blank because not every app has a user interface: a registration may be for web service calls only.
• A client secret acts as the registration's password. Giard says a bearer token for a web service call needs one. Under the registration's certificates and secrets, New client secret takes a name and an expiry, from soon to two years or a custom range with a future start date; he sets three months.
• The secret's value can be copied only once. After a page refresh the value is gone and is not regenerated, so Giard says to copy it immediately to a safe place such as a key vault or a locked-down directory. Anyone holding it can create a token and impersonate the account.

2022-09-29 · open the original ↗

• Flink's exactly-once guarantee scales where other engines' does not. Scherr, developer advocate at Ververica, says Flink's checkpoints and savepoints, delineated by watermarks, let it reread only the section since the last checkpoint without stopping the stream, so nothing is duplicated; she says other engines reread or store data differently and build up backlog. Because small proofs of concept show similar latency and throughput across engines, she urges testing with masses of generated data (DataGen, Faker).
• Its commonest use is fintech fraud and anomaly detection. Scherr puts that at perhaps "30% or 40% or 50%" of use cases, the rest being unusually varied, because it needs near-real-time results with no duplicates (no double charge, no anomaly flagged twice); machine learning and analytics are also big. Flink is stateful and keeps snapshot metadata locally or externally for rollbacks, but the data itself sits in external databases reached through built-in or third-party connectors.
• Newcomers should start with Flink SQL, not Java, Scala or PyFlink. She says Flink SQL abstracts much of the complexity, is language agnostic and suits DevOps people, though Java 8 or 11 must still be installed because parts of it use the Java heap. Installation was local at recording, a roughly three-step download she has live-coded in about five minutes or less; she hinted at unannounced changes to that answer.
• Flink itself is free; Ververica earns from an enterprise platform. Flink is licensed through the Apache Software Foundation like any Apache project, while Ververica, which wrote and maintains it, sells the Ververica Platform for deployment, integration with other tooling, analytics and production support, with a free community edition and paid tiers.
• The open-source community is what drew her to Flink. At a previous employer new to stream processing, Scherr says a patch she submitted for an odd use case was approved within a couple of days; she calls Flink's mailing list one of the most active in Apache. She recommends meetups, where she says the founders and engineers from Netflix and Apple give talks.

2022-09-28 · open the original ↗

• KC7 generates realistic fake security data so anyone can practise. Kakpovi says learners need realistic data that no one will hand over for privacy and secrecy reasons, so the game simulates a fictitious company's employees sending email and clicking links, 98–99% of it benign, with adversaries mixing in credential-harvesting and phishing links for the player to find.
• Players pivot from a single tip to an actor's whole pattern. A game starts from a tip, such as a fake tweet naming a suspicious domain, and players weigh how confidently related senders and domains are malicious; Schloemer says modelled actors reuse themed keywords (Viking words like "Norse" in email addresses). All querying is in Azure Data Explorer with KQL, the tools the two use daily as threat analysts, on a free Kusto cluster loaded by a script from their GitHub page.
• Each game can be regenerated, so answers cannot be memorised. Kakpovi built a small manual dataset almost four years earlier at a professor's request; now a button produces a new company, adversaries and TTPs. The name refers to the seventh, final stage of the Lockheed Martin cyber kill chain, and they intend the full game to cover all seven phases, claiming that anyone who can play it can work in cyber.
• Business students with no technical background asked how to make it a career. During a Microsoft Hackathon team of over 100 people, they ran the game at Montgomery College in Maryland and a teammate took it to Florida Memorial University, described as South Florida's only HBCU. About an hour to an hour and a half in, a student asked how to do it for a living, and several gave similar feedback.
• They blame cybersecurity's lack of diversity on access, not skill. Schloemer describes a cycle in which you need data to get the job and the job to get the data; Kakpovi, a Howard University alumnus, recalls a Lockheed Martin Cyber Analyst Challenge with four Black people in a room of 100, himself and three co-workers. KC7 is free and open source, and the two, analysts rather than developers, ask for contributions by pull request.

2022-09-24 · open the original ↗

• Only an administrator can add users, from the Users blade. Giard logs into the Azure portal as an admin of a Contoso sample directory. He notes Azure Active Directory's overview page has its own "add user" link, but he prefers going to Users in the left menu and choosing "new user".
• New user offers two paths: create internally or invite externally. "Create new user" makes an account inside this Active Directory. Inviting an external user sends an email that lets someone from elsewhere join.
• Only the user name and name are required. The user name becomes the sign-in address under the directory's onmicrosoft.com domain and must be unique within the directory. Giard says everything else on the form is optional and can be changed later. The other options he covers are an auto-generated password, which he shows and says to copy; assigning a group or a role, where the default role is User; "block sign in", for someone who starts next week; location; and job details such as title, department, company and manager.
• Profile properties can be sent as claims in a token. Editing the user after creation shows many more fields the create form never asked for, such as city and address. Giard says this information, along with groups, roles, job title and manager, can be passed to another application in a token so it knows who the person is.
• The same user page handles password resets and deletion. Giard shows resetting a password, for a user who has forgotten theirs, and deleting a user who has left the company. Deletion asks for a second confirmation.

2022-09-24 · open the original ↗

• Infrastructure as code buys repeatability and enforceable governance. Benkovich says clicking through the portal is not repeatable, while templates can apply one naming and tagging formula on any cloud or on-premises, and take per-environment parameters, such as large Kubernetes node VMs in production and smaller ones in dev or test.
• Deploy infrastructure once, and the app's code many times. Benkovich treats the IaC deployment as building the environment the code runs in, with a separate continuous delivery pipeline shipping the code afterwards; Giard adds that in practice it would run from a script or CI/CD tool rather than a right-click in Visual Studio.
• VS Code beats Visual Studio for authoring ARM templates. Benkovich says Visual Studio's resource group project gives a starter template (web app plus SQL) but weak IntelliSense on parameters, while VS Code with the ARM extension, snippets and multi-line editing handles his concat-based naming variables better. In his demo he swaps a plain-text password in the parameter file for a Key Vault secret.
• Bicep is a more readable language that compiles to ARM. Benkovich calls it an ARM transpiler: az bicep decompile turned his verbose JSON template into a cleaner Bicep file, and some people liken its format to Terraform's.
• Choose Bicep or Terraform by how you manage state and clouds. Benkovich says ARM/Bicep are Azure-only and record each deployment in Azure, while Terraform works across Azure, AWS, Google and more and keeps its own .tfstate file; his Terraform-built resources left no entry in the portal's deployment history because it went through the REST API.

2022-09-22 · open the original ↗

• At Best Buy, the host would pick Netgear's cheaper Wi-Fi 6 router. Skipping the whole-home mesh kits and anything branded "gaming", he narrows it to two Netgear models with near-identical specs, the AX2400 Nighthawk at $179 and the AX1800 at $139, and buys the AX1800. He passes over a $500 Nighthawk with a 2.5 Gbps Ethernet port, and a Linksys Wi-Fi 6 router at $149 that he says matches another model costing twice as much.

2022-09-20 · open the original ↗

• Crosstalk is posting exclusive content on Facebook, not YouTube. The first one, "My G4 Doorbell Pro broke", goes through the host's troubleshooting steps for getting a UniFi G4 Doorbell Pro back online, and is only on facebook.com/crosstalksolutions. The host adds that the channel is now on Instagram and TikTok too.

2022-09-17 · open the original ↗

• Queues and hubs decouple the front end from the back end. Gorman says users can submit data as fast as they like without the UI bogging down, while the database scales or stays small and, if processing is not urgent, catches up overnight.
• Event Hub and Event Grid are separate services, not companions. Gorman says Event Hub ingests big data and streaming telemetry at millions of records per minute, with up to 32 partitions (around four for a typical workload) and consumer groups that can each replay events, which opens the door to duplicate reads. Event Grid responds to one-off events, such as those logged by Azure Monitor, and fans them out to filtered subscribers; IoT Hub is a lighter subset of Event Hub.
• An event only says something happened; a message carries the payload. Gorman's example is a blob-upload event whose data is just the blob's URL, while a Service Bus message can carry a serialized object. Service Bus queues guarantee first-in-first-out order, and topics give pub-sub, as in his demo that loads 17 or so movies once and serves R-rated, family and all-movies subscribers separately.
• Storage Queue is the cheaper, lighter option with fewer guarantees. Gorman says it cannot guarantee order, returns an item to the queue after 60 seconds unless the lease is renewed, purges after seven days by default, and holds over 80 GB but with a smaller message size. Service Bus has no automatic purge, though he thinks a time-to-live can be set.
• Pick Service Bus when you need to know a message was handled. Gorman credits an attendee named Barry at DevUp in St. Louis with the deciding question: does someone need to acknowledge it? Event Hub and Event Grid don't care whether an event was consumed, while Service Bus has dead-letter queues. He also advises beginners not to start with custom Event Grid events, using Storage Queue or Service Bus instead.

2022-09-17 · open the original ↗

• The host treats the Uber breach as a complete compromise. He advises changing an Uber password now to be safe. The New York Times broke the story first, after the attacker contacted it with images of Uber's internal email, cloud and code repositories.
• The attacker got in through social engineering and a hard-coded credential. As reported, an 18-year-old who did it "just for fun" social-engineered an employee, logged in over VPN, and scanned the intranet. On a network share he found PowerShell scripts, one with an admin username and password in it, and used those to take over nearly everything. He then announced the breach on Uber's internal Slack, and staff at first took it for a joke.

2022-09-15 · open the original ↗

• Two hardware "lies" bridge a 40-year-old computer to the internet. Hanselman shows his Commodore 64, his first computer and recently working again. A WiModem on his Wi-Fi tells it that it is an old-style modem, and a cartridge with a Raspberry Pi inside tells it that it is a floppy disk.
• Dialing a BBS now means connecting to a network address and port. In his terminal program, which he likens to a text-mode web browser, he switches between 40- and 80-character modes and moves from 300 to 2400 bits per second. He then "dials" an address and port (not port 80). He says the board on the other end is another Commodore 64, and it asks whether his machine can do color and graphics.
• BBSes were social media before social media. Hanselman says people have made bulletin board systems available again. He checks his email on the board (no mail) and presents the demo as nostalgia for the fun people had calling each other's machines by phone.

2022-09-13 · open the original ↗

• STIR/SHAKEN made Crosstalk close its own SIP-trunking business. Crosstalk SIP ran for about three years and served 60–70 customers, peaking at 130,000–140,000 calls a month. It resold wholesale minutes from VoIP Innovations, which Sangoma later bought, at a 15–20% margin after billing, tax and staff costs. All customers have now been moved to other providers.
• Attestation grades how far a carrier vouches for a caller. Calls are signed with a digital certificate at a session border controller (SBC). Level A means the carrier knows the caller and that they own the number, B means it knows the caller but not the number (for example Follow Me forwarding), and C is a gateway call with neither verified, which is the grade most likely flagged as spam. The host cites Bandwidth.com: 3–5 billion robocalls a month, about 40% thought to be fraud.
• Compliance costs a small reseller more than its margin can carry. According to ClearlyIP CEO Tony Lewis, a carrier needs a token from iconectiv, priced as a share of its FCC 499 filing revenue with a minimum of a few thousand dollars a year. It then needs a certificate costing thousands a year, a sandbox test suite, and geographically redundant SBCs that handle 911. Lewis calls the cheaper option, call-forking signing services that need a PJSIP patch, convoluted.
• The host's advisers wrongly told him a reseller was covered. Both VoIP Innovations and a telecom lawyer said its compliance covered him. Around June–July the FCC clarified that whoever bills the end user is the originating provider and must sign the calls. The exemption for providers under 100,000 subscribers ended July 1, and the FCC legal department sent warning letters to firms claiming compliance without a certificate. Lewis says Inteliquent will now sign uncertified customers' calls only at C.
• Lewis and the host doubt the system stops robocalls yet. Lewis reports that T-Mobile users see "likely spam" and nine in ten test calls arrive at C, partly because SS7 legs strip SIP headers. The host predicts the large carriers will lobby their way past enforcement while robocallers work around the rules. Disclosure: the two co-run a paid open-source PBX training course.

2022-09-11 · open the original ↗

• Leaders grow people; managers direct tasks. Guadagno, a director over several teams at Rocket Mortgage, says the word "manager" is frowned upon there; he contrasts a meme of a manager in a cart whipping staff forward with a leader in front helping pull, and a manager assigning a report by a date with a leader growing the person.
• Leadership can partly be taught but rests on traits. He names compassion, wanting to grow and putting others first, and ties his own to having trained as a high school math teacher and a philosophy of leaving the world better than he found it.
• He hires for fit with the team over top technical skill. Across his five teams he weighs communication against engineering skill, and rather than turning everyone into a leader he tries to grow each person toward what they want to be "when they grow up"; he spots leadership potential in those who raise flags and ask what-if questions.
• Knowing each person individually is why he says turnover stays low. He holds one-on-ones, bans calling people "resources", and tailors how he talks to and praises each one, from a quick Teams thank-you to a public award. Of 55 people over four years, he says about two have quit, against an industry where people change jobs every two or three years; Giard adds that the empathy has to be sincere.
• Humour eases pressure during outages and deadlines. His teams are known for bad jokes and did costume and Zoom-background days after going remote; he deliberately throws in a joke when an outage has people circling.

2022-09-09 · open the original ↗

• Headless CMS separates content editing from a custom-built front end. Miller says his agency uses WordPress only as a database and admin portal for non-developers, pulls the content via GraphQL or the REST API, and renders it with Next.js into static pages hosted on Netlify behind Cloudflare. The page is rebuilt when a post is saved, so no database call happens when a visitor opens it.
• Google's page-speed demands are what make plain WordPress a problem. Miller says Google's 2021 algorithm change around Core Web Vitals wants pages to load on mobile in about a second. A WYSIWYG builder like Elementor is convenient for a quick personal site, but its generated code makes that hard for bigger companies that depend on SEO or paid advertising.
• Moving the front end into code brings a real development lifecycle. Miller says changes now live in GitHub and go through pull requests, so a breakage can be traced back and rolled back. Netlify builds a preview URL for each pull request for clients to approve before merging, and A/B testing is possible but rarely done because it is a lot of work.
• Serving cached static copies improves security and scalability. Miller says Cloudflare copies the rendered site to locations worldwide, so an attacker, including in a DDoS attack, hits a static copy with no server or database behind it. He stresses he would never call it unhackable.
• Headless takes developers, not WordPress developers. Miller says retraining his WordPress staff from CSS and PHP into JavaScript front-end work was one of the largest challenges. He knows of no prepackaged offering that avoids custom development, and says that at his talks four of five attendees don't know what headless is.

2022-09-07 · open the original ↗

• Map the walls before placing any access point. The host traces the floor plan in the UniFi Design Center (design.ui.com), marking exterior walls, interior walls and window or door openings. Exterior walls weaken signal more because of stucco or siding, so knowing which walls are exterior matters; he had to guess for the garage and closet walls.
• Two U6 Lites cover a 1,575 sq ft house. The host puts the $99 access points in two spots. One goes in the dining room near the back window, to reach the patio and master bedroom. The other goes just outside the opening between bedrooms 2 and 3 rather than inside their hallway, which keeps the foyer and garage in range. His target is light blue coverage everywhere at 2.4 GHz, with about –60 dBm (green) at worst.
• Too much overlap makes phones flip-flop between access points. iPhones are especially aggressive about jumping to the strongest one. The host's fix is to keep the strongest zones barely touching and to lower output power on the dining-room access point, which serves an open space with few obstructions. He calls tuning more art than science: test and adjust.
• 5 GHz leaves weak spots that 2.4 GHz covers. On 5 GHz the far bedroom and the garage are weaker, but most devices drop to 2.4 GHz and keep working. If the garage needs strong Wi-Fi, the host suggests adding an access point there at low power so it covers only the garage.
• Design Center plans transfer to other brands' access points. The host says the results hold for any brand whose signal strength is similar to the Ubiquiti model placed in the plan.

2022-09-01 · open the original ↗

• The USP-PDU-Pro is a UniFi-managed 2U rack power strip. Its MSRP is $279. It has 16 outlets rated 125 V AC and 15 A, 1,875 W in total: 12 across the top, plus 4 spaced out along the bottom for large power bricks. It also has 4 USB-C ports (2 A per port, 20 W shared), a circuit breaker, and a 1.3-inch touchscreen. The host has run it in his test rack since February, through Early Access.
• Its redundant-WAN ports did nothing in the host's software. Besides a Fast Ethernet management port, it has three gigabit ports for splitting one ISP link across two Dream Machine Pros, the guide's "type B" install. On UniFi OS 1.12.24 and Network 7.2.93, those ports did not appear in UniFi and showed no activity, though traffic did pass through to his UDM Pro. The host expects UniFi to support redundant firewalls eventually but cannot say when.
• Each outlet can be named, switched, metered and power-cycled from UniFi. The host keeps his loud rack fans set to disabled, so they shut off once the PDU connects. A "modem power cycle" option reboots the outlet labelled as the ISP modem when the UDM Pro detects an internet outage. At recording, his rack drew about 91 W.
• The host wants outlet schedules and rates the price as fair. He would like time groups for switching outlets on and off on a schedule. He judges $279 reasonable against 1U and 2U rack PDUs from CyberPower and APC, and asks viewers for an equally capable competitor at that price.

2022-08-31 · open the original ↗

• Krebs has retracted his Ubiquiti breach reporting and apologized. His post "Final thoughts on Ubiquiti" says his sole source, since federally indicted for allegedly giving false information to the press, is no longer credible and that the articles are removed. The host, saying he has not followed the lawsuit, speculates that the terse wording reads like the product of a settlement.
• The original report cost Ubiquiti about a quarter of its share price. Krebs's anonymous-source story came out in April 2021, about the breach the host dates to around December 2020; he shows the stock falling from about $389 on March 26 to about $289 on April 1. It sat near $311 at recording, which he puts down mostly to the market, chip shortages and supply-chain problems.
• The "whistleblower" turned out to be the hacker himself. By December 2021 it emerged that the Ubiquiti security employee feeding Krebs had done the breach, then leaked it posing as an insider when Ubiquiti did not pay a ransom the host recalls as about 60 bitcoin. The host says Krebs had no way to know.
• The host guesses the settlement bought an apology, not damages. Ubiquiti sued Krebs around April 2022. The host reasons that a blogger could never cover the roughly $4 billion of market capitalisation lost, so the suit may have aimed at the concession and deletion, perhaps with legal fees; he stresses this is speculation.
• He blames only the hacker, neither Krebs nor Ubiquiti. In his reading Krebs acted reasonably on a vetted source and had reason to protect it, while Ubiquiti acted in its own interest in not disclosing the breach and then suing. He leaves open how sure a journalist must be before publishing damaging claims.

2022-08-29 · open the original ↗

• The newer Yarn is a ground-up rewrite, not an incremental release. Richardson, a software engineer at Kroger Technology, says the lead maintainer rewrote Yarn's code base because he felt the project needed a different direction; it shipped as Yarn 2, then 3, with 4 "coming out soon", and Richardson uses "Berry" for every version after 1. He describes Yarn as fully free open source with no pricing model, and says the lead maintainer's employer, Datadog, supports his work because it uses Yarn itself.
• Berry's developer-experience gains are coded CLI output and stronger workspaces. Richardson says every line the command line prints carries a code that can be looked up for detail on the message, warning or error. Workspaces, which Yarn was among the first to introduce, group several packages or projects (he likens them to a .NET solution) so they can import each other, which he says makes managing a monorepo cleaner.
• Pinning the Yarn version per project removes cross-developer inconsistency. With yarn set version, Yarn downloads the chosen version into the repository, it is committed to source control, and everyone running Yarn in that project uses it, so lock files stop changing between people. He recommends it even to teams staying on Yarn 1 and says it has been "hugely helpful" at Kroger.
• Plug and play replaces node_modules with zipped packages read on demand. Yarn keeps each package as a zip in a cache folder and hooks into Node, extracting a file only when Node requests it. Richardson says the performance testing he has seen and done shows no significant overhead, citing a prior job where reading smaller zipped files proved faster than reading uncompressed ones. Because the zips can be committed, a freshly cloned repo is ready almost immediately; Kroger uses this "zero install" strategy in some projects.
• Migrating from the old version is easy unless you adopt plug and play. Richardson says that coming from Yarn 1, less complex projects upgrade "essentially seamless[ly]", complex ones may hit a few small issues, and the move to plug and play is where migration gets more complicated; migration docs are at yarnpkg.com. He agrees with Giard that greenfield projects should start on the latest version.

2022-08-25 · open the original ↗

• A free equipment-list request became a public design video instead. A Tennessee lodge owner wanted Ubiquiti gear for a four-acre property: 16 cabins 20–30 feet apart, a main building 200–500 feet away, and no trenching allowed. The host says Crosstalk sells design and installation, not Ubiquiti hardware, because there is "zero margin" in it.
• The main building is designed for redundancy because guests expect uptime. Two Netgate 4100 Base firewalls ($599 each, the first Netgate model to support high availability) with dual WAN, so Starlink could back up the line, plus optional TAC Pro support. Inside go three U6 Pro APs at $149 and a Cloud Key Gen2 Plus, chosen because the Gen2 was out of stock.
• Two PoE switches were chosen so either can carry the full load. The host specifies two Switch Lite 16 PoE at $199, eight PoE+ ports each, over two cheaper Switch Lite 8 PoE. Those have only four PoE ports against five PoE devices, so losing one would mean dropping an AP or adding an injector.
• One sector AP reaches all the cabins over clear line of sight. A LiteAP GPS ($99) on the building's north corner feeds NanoBeam 5AC Gen2 stations, about 300 Mbps per link in Ubiquiti's design tool at 40 MHz width. It needs an INS-3AF-I injector, since it runs 24 V passive PoE and the switch only provides 802.3af, plus surge protectors on outdoor units.
• The host rejects the client's AP-in-every-cabin plan as overkill. Instead he puts a Mesh Pro AP ($199) outside about every third building, six satellite sites at almost $2,000 total. Each chains two PoE injectors from the NanoBeam; adding a Switch Lite 8 PoE per site would cost about $774 more across six.
• Crosstalk would bill this as a two-day, two-person install. Main-building equipment comes to about $3,383 before cabling. The host prices labor at about $6,200: four hours of design at $200 an hour, a two-day minimum on site at $1,800 a day including per diem (ideally with two staff), and two travel days at half rate ($900).

2022-08-24 · open the original ↗

• The U6 Enterprise's 6 GHz band buys capacity, not speed. The host explains that this first Wi-Fi 6E AP from Ubiquiti gains less interference and room for 80 and 160 MHz channels in a band about four times the size. Ubiquiti rates it at 10.2 Gbps aggregate (4.8 Gbps on 6 GHz, 4.8 on 5 GHz, 570 Mbps on 2.4 GHz) and 600 clients, on a 2.5 GbE port with PoE+.
• Single-client tests landed around 200–400 Mbps. On a UDM Pro (UniFi OS 1.12.24, Network 7.2.91, the latest stable at recording), with the AP on a 2.5 GbE port of a USW Enterprise 24 PoE, the host's Wi-Fi 6 laptop and iPhone averaged about 350 Mbps down and 350–400 Mbps up to an OpenSpeedTest server on 10 GbE. iPerf gave 200–350 Mbps; he concedes this does not test a 600-client AP.
• A 20-laptop class contest still bottlenecked elsewhere. At the Crosstalk Fundamentals of Networking class in Austin, students raced to download a 2 GB file for a prize of a U6 Enterprise and UDM SE worth about $800. The Windows 11 SMB share on the host's laptop was the weak link, and the winner took about 8 minutes; the AP "didn't break a sweat".
• Wi-Fi 6 access points are hard to load-test without real money. The host had considered a dozen Raspberry Pis running a random-browsing script but notes they are not Wi-Fi 6. He has no cheap capacity test and asks viewers for one.

2022-08-21 · open the original ↗

• Original 1541 drives are the weak point of a restored C64. Hanselman, refurbishing a 40-year-old Commodore 64 still in its original Sears box, says the 5¼-inch 1541 drive has moving parts, heads that drift out of alignment, and is very slow.
• Pi1541 emulates the drive clock-perfectly, so the C64 cannot tell. The open-source project by Stephen White (whom Hanselman says he has donated to) puts a hat on a Raspberry Pi Zero, roughly a $10 board he estimates at three to four thousand times the C64's speed, and serves disk image files picked from an SD card. He stresses that only the drive is emulated, not the C64 itself: "emulation is lying" to the machine.
• Small adapters let real Commodore hardware use modern conveniences. His second example translates between the C64's 1351 mouse and a PS/2 mouse connector, and he argues such devices let him keep original hardware while using modern mice and disk-file loading.

2022-08-19 · open the original ↗

• VS Code deploys to App Service through Microsoft's Azure extension. Giard installs the Azure App Service extension from Microsoft (about 60 seconds), which adds an Azure icon to the left toolbar; you pick the right subscription, expand App Services and right-click to create a new web app. His demo app is Node, but he says the method applies to any language App Service supports, such as C#, Java or Python.
• The advanced create path asks more questions for more flexibility. Its six questions are a globally unique app name, a new or existing resource group, the runtime stack (he takes the most recent Node), Windows or Linux (both supported; he picks Linux), a region chosen for latency to users and to the resources the app calls (he takes East US), and a new App Service plan with a pricing tier of free, development/test or production. Application Insights is optional and, like much of this, can be changed later in the portal.
• Creating the web app does not deploy the code. A separate Deploy button asks which folder to deploy and whether to always deploy it to this app service (he skips that); it uploads only the files needed to run, such as binaries and views, not all the source. In the demo it took about two minutes, after which "browse website" served the same page that had run locally on port 3000.

2022-08-19 · open the original ↗

• No single best language; success is possible in any. Hanselman names C#, Java, JavaScript, Python, Ruby, Rust and Go, and argues people fixate on language details when they should be thinking about the larger systems languages live within.
• Pick by enjoyment and local jobs, and ignore "this language sucks". His advice is to learn one, see whether it "feeds your spirit", check the job market where you live, and switch if it doesn't suit; he notes your favourite websites are probably written in a language someone else thinks sucks, so success is the better metric.

2022-08-18 · open the original ↗

• Edge profiles keep separate settings and accounts in one browser. Giard keeps one for work and one for personal, each tied to a different email address; he says this suits defaulting to different sign-ins, or single sign-on with a customer's account.
• A new profile is added from the profile icon and synced to an account. The icon sits at the top right; "Add profile" then asks you to sign in to sync data with an existing or new email account. Giard suggests giving each profile a different color theme so it is easy to tell which one you are in.
• Rename, repicture or remove a profile under Settings, Profiles. The three dots next to a profile offer edit (a descriptive name in place of the default "Personal 2", and a picture in place of initials) and remove. Any profile but the first can be deleted; there must always be at least one.