tech

2022-08-17 · open the original ↗

• Crosstalk is replacing Yealink with Snom over security concerns. The host, whose firm sells and supports VoIP systems, says Yealink looks headed for the same bucket as Huawei and Hikvision. Crosstalk evaluated several brands and is now selling Snom for its conference and DECT phones, alongside its own Crosstalk-branded desk phones.
• The C520 adds detachable wireless mics for long tables. It lists at $345 MSRP: a full-duplex speakerphone for small to mid-size rooms, with two mics rated 70 hours standby and 12 hours talk that recharge on the base. It also has PoE or a power adapter, G.722, Bluetooth pairing to a cell phone, automatic gain control, a 2-year warranty, and expansion via C52 SP speakers.
• The C620 costs more for a fully wireless phone. At $499 it keeps the wireless mics but drops Bluetooth; the phone itself lifts off a charging base and talks to a separate DECT base, with 12 hours of talk time. The host pitches it for tables with no PoE or power beneath, and it carries a 3-year warranty.
• The host's test call on the C520 sounded clear. He called Crosstalk's main line and judged the quality "really good", noting the call went over his cellular connection rather than an HD voice codec.

2022-08-16 · open the original ↗

• Teleport is remote access into your own network, not a privacy VPN. The host describes Ubiquiti's one-click VPN as reaching home or office resources from somewhere like a hotel, unlike site-to-site VPN or services like NordVPN. It is built on WireGuard, which Ubiquiti says stores no data, and needs a Dream Machine, Dream Machine Pro, Pro SE or Dream Router, UniFi Network 7.1 or later, and the WiFiman app.
• Issue one invitation link per user so each can be revoked. Under Settings, Teleport & VPN, you generate a link, which Ubiquiti says is single-user, and send it to the person, whose WiFiman app opens it and builds the tunnel. The invitation history shows each link's status and lets you revoke one user without affecting others.
• The Teleport client subnet cannot be changed. In the host's test on UniFi OS 1.12.24 and Network 7.2.91, the phone got 192.168.3.1 and appeared as a Teleport client. He says the subnet is fixed for now and has heard this may change.
• Test from a different network, or the result proves nothing. The host's first ping to his TrueNAS ran while his phone was still on the same Wi-Fi. After switching SSIDs, the tunnel reconnected and he could ping the server and load its web interface.

2022-08-15 · open the original ↗

• An App Service gets sign-in from its Authentication blade. "Add identity provider" offers Microsoft (Azure Active Directory and Microsoft accounts) and third parties such as Apple, Facebook and GitHub; Giard notes the third parties require you to register with them first.
• The supported account types decide who can sign in. Choosing Microsoft and a new app registration, the options are a single tenant, multiple Azure tenants, personal Microsoft accounts (Outlook.com, Hotmail, Live.com), or both Azure AD and personal accounts, which he picks for flexibility. He requires authentication and sets the HTTP code returned when it fails.
• Setup creates an app registration in Azure Active Directory. It appears under App registrations, easiest found by filtering to owned applications and sorting by created date. Giard is an owner of it, which is why he can still reach the now-protected site.
• Other users get in through a Reader role assignment. On the app service's access control blade he adds a role assignment; he calls Reader the common choice for people who use the app, and Contributor for those who manage it. Members can include guest accounts in the directory, and a Hotmail guest he assigns could then open the site.

2022-08-13 · open the original ↗

• Magazines once delivered C64 games as code you typed in. Hanselman recalls that besides cassette, disk or radio, games came as printed listings in mailed magazines; a friend paid in Skittles would read the 6502 assembly aloud while he typed, and later issues added features until you had a playable game. He calls it "the coolest thing ever", and notes the channel is not a Commodore 64 channel, just his interest that week.

2022-08-12 · open the original ↗

• AI Theta splits the lens from the camera's electronics. Per Ubiquiti's announcement, a lens with a 22 mm footprint sits flush in a wall or ceiling and connects by USB-C, up to 30 meters away, to a PoE body holding the compute. Lenses range from 360-degree to telephoto, and the early-access kit, which hit the store the day of recording, ships with a 360 lens and an 8 MP standard lens.
• Two-way audio needs a separate optional module. The speaker and microphone array is an add-on, resembling the Smart Chime in form, that plugs into the body; there is also an articulating mount. The host likes that this lets a camera watch from above a door while the speaker sits at mouth level.
• The host suspects "AI" cameras will get analytics the G4 line won't. The announcement shows people-counting over time. He guesses AI-branded models will get such features while G4 cameras stay limited to smart detections, which he says would explain the AI Bullet's $399 price against $199 for a G4 Bullet with similar lens specs. He labels this speculation.
• Expect the software to lag the hardware at launch. From past Ubiquiti releases, the host expects basic features at general availability that improve over time. Ubiquiti claims high-frame-rate 4K, lens dewarping and high dynamic range.

2022-08-12 · open the original ↗

• Ctrl-Shift-A searches across all open browser tabs. Hanselman's tip for having too many tabs open: press it and start typing to find a tab. The video does not name the browser.

2022-08-10 · open the original ↗

• His site turns photo albums into shareable 3D virtual galleries. Scherotter, a technical program manager at Microsoft, built it during a sabbatical because his 30 years of illustrated travel journals do not exhibit well in physical galleries; he scanned them into Adobe Photoshop Lightroom, and Adobe's opening of API access to Lightroom data during the pandemic made the site possible. He says Adobe's fund for design gave him a grant after he applied, and he launched in December 2021.
• The stack is TypeScript end to end on Azure, with Stripe billing. He describes Azure App Service running Node.js, TypeScript on client and server, Babylon.js for 3D in the browser, and WebXR so galleries can be viewed in a VR headset. Stripe runs recurring subscriptions, the cheapest at $3.99 a month, and he says that income pays for his Azure consumption.
• Free users get one gallery; subscribers get links and customization. Anyone with an Adobe ID and a Lightroom album can create one free gallery, set public, link-only or private. Subscribers can attach links to each work, such as a making-of video, an NFT or their own shop; he says he does no commerce on their behalf. He reports almost 500 people have created galleries, including schools in Indonesia and Trinidad and Tobago.
• Shipping fast without tests caused instability that unit tests cured. Scherotter calls managing complexity the biggest challenge: he built rapidly, saw stability issues, then wrote hundreds of unit tests on the Node code while isolating with COVID earlier this year. He says the tests uncovered errors, crashes stopped, and he is now more confident adding features as the sole engineer.
• Next he wants analytics showing how visitors walk through a gallery. He has no formal roadmap, takes feature requests in a GitHub repo, and now works on the site evenings and weekends. He wants to show gallery owners what visitors linger on and click, something he says a physical gallery cannot do well.

2022-08-09 · open the original ↗

• Small nonprofits lag on technology, and technologists can volunteer to close it. Hogan, who says his passion is empowering the Black community in North America, finds that small agencies living on donations lack awareness of newer technology or the resources to adopt it, unlike large charities with IT budgets. He suggests starting with your company's benefits or community-giving coordinator, or asking contacts in your tech community, and says he has never offered help and been refused.
• His project moved a nonprofit's hard-to-maintain site into the cloud. The organization, a not-for-profit that helps other not-for-profits (Hogan confirms its site as givinggap.org), keeps a central database of Black-founded or Black-focused organizations where visitors can learn about them and donate. Hogan says the site was not scalable and the group had no real DevOps capability, so the work grew from a site rebuild into cloud hosting that frees office staff for fundraising.
• No free cloud credits came, so the design fit their budget. Hogan says the cloud providers they checked had no program they could use right away, partly because the organization was still working on its 501(c)(3) designation. It could carry light hosting costs, and the solution was built to land within those constraints.
• Resistance to change is overcome by earning trust. Hogan says a working solution makes any change look like a gigantic risk to non-technical staff. His answer is to show you understand the technology, show why it benefits the organization, and build relationships with its administrators until they are confident you can deliver.
• Volunteer-built solutions must be sustainable after the volunteer leaves. Hogan says skilled tech volunteers are scarce and usually "fly in, do what you can do, and fly out", so the next person will likely arrive blind. He contrasts for-profits, which he calls more hierarchical and mission-driven in adopting technology, with small nonprofits, where the aim is better day-to-day operation and the leader signing the check may not understand the technology at all.

2022-08-04 · open the original ↗

• The app needs its own Azure AD identity with a client secret. After creating the vault (episode 130), Giard registers an application under Azure Active Directory, App registrations, keeping the single-tenant default and no redirect URI, then adds a client secret under Certificates and Secrets set to renew every six months. He stresses that creation is the only chance to copy the secret's value, and also notes the client ID and tenant ID.
• A vault access policy grants that registration's principal its permissions. The app runs as the registration's principal, not as the vault's creator, so he adds a policy using the Secret Management template (all secret permissions, no keys or certificates) plus purge. He warns it is easy to forget the final Save, without which the change is lost.
• DefaultAzureCredential reads the identity from environment variables. He sets Azure client ID, client secret and tenant ID as environment variables, then restarts Visual Studio because they are read on startup.
• SecretClient covers listing, setting, soft-deleting and purging secrets. Pointed at the vault's vault.azure.net URI, it lists non-deleted secrets via get-properties-of-secrets and sets them with SetSecretAsync. StartDeleteSecret only begins a deletion that may take about 30 seconds, so his code polls the returned operation until HasCompleted; the result is a soft delete, recoverable until purged (90 days by default), and PurgeDeletedSecret removes it for good. In the demo the soft-deleted secret showed under Manage deleted secrets and the purged one did not.
• Giard publishes the demo code on his GitHub. It is in a repository named Azure Key Vault demo, with the code in program.cs; users must set the environment variables and change the vault name to their own.

2022-08-03 · open the original ↗

• The November .NET Conf is a launch festival for .NET 7. Fritz, now executive producer of the .NET Conf events, says the series has run online for 11 years. He describes an eight-hour focus event on .NET MAUI on 9 August and a three-day November 2022 event (Giard gives the dates as 8–10 November) announcing .NET 7, C# 11, and updates to .NET MAUI and Blazor, with more one-day focus events planned but not yet chosen.
• .NET releases no longer move in lockstep with Windows. Giard likens the event to Microsoft's old combined product launches. Fritz says those were driven by each new Windows needing new tools and a new .NET Framework, while open-source .NET (Core, then .NET 6 and 7) can now ship on its own schedule, with a production-ready release supported for three years; in 2021 Visual Studio 2022 launched on the Monday and .NET 6 on the Tuesday.
• Two Microsoft days hand off to 24 hours of community speakers. Day one is the announcement and day two covers other Microsoft technologies such as Power Platform, Teams, Windows and Azure, each a nine-to-five day. From 5 p.m. on day two the community takes over around the world for 48 sessions ending at 5 p.m. on day three; Fritz cites past talks on .NET running a hot tub and Cam Soper's barbecue.
• Microsoft and community speakers go through the same open call. Submissions go through Sessionize from the conference website, closing 8 September, though Fritz advises treating it as 7 September. Sessions are 25 minutes plus five minutes of Q&A and mostly live, with some pre-recorded content; each event has about 80 sessions, all archived on the .NET YouTube channel within days.
• Publishing regularly builds an audience, even before the content is good. Fritz says that by October 2017 he was worn out writing blog posts as a Microsoft community manager; Carl and Richard suggested podcasting, and a colleague a week later pointed him to live coding on Twitch, which he says changed his life. He now streams twice a week and says his goal is people learning and advancing their careers, not being internet famous.

2022-08-03 · open the original ↗

• A secret is a name-value pair kept out of code and config. Giard suggests connection strings or passwords that should not be checked into source control or put in a config file; the app is told where the vault is and given permission to it. New secrets are created on the Secrets blade with Generate/Import, using the Manual option, since importing certificates has moved to its own blade and the certificate option there is deprecated.
• Optional fields label secrets and limit when they are usable. Content type is free-form text and tags are metadata for reporting, such as by user or department. A secret can be set to enabled "no", or given an activation and expiration date, outside which applications and users cannot access it.
• Saving a new value creates a version and keeps the history. "New version" replaced the demo value while the old version stayed listed alongside it.
• Deleting a secret soft-deletes it, recoverable until purged. Deletion takes about 30 seconds to complete; under Manage deleted secrets you can recover the secret (it came back with its versions) or purge it permanently. By default it is purged automatically after 90 days, which is configurable when the vault is set up.
• Missing buttons or errors usually mean missing access-policy permissions. The vault's creator appears under Access policies with eight secret permissions selected by default; Giard says an unchecked box, such as purge, is the likely cause if an action is unavailable.

2022-08-02 · open the original ↗

• Crosstalk is moving its DECT recommendation from Yealink to Snom. The host cites security concerns at Yealink like those around Huawei and Hikvision. These handsets are now what Crosstalk recommends and sells for both its FreePBX-based PBX systems and its Crosstalk Cloud PBX.
• The M-KLE line is VTech's own design, not rebranded RTX hardware. The older Snom M series was rebranded RTX equipment, while the M-KLE series came after VTech acquired Snom. The M100 KLE base ($99 MSRP, DECT 6.0, PoE or adapter) supports 10 handsets and six concurrent calls; an M18 KLE desktop DECT phone serves desks without Ethernet.
• The rugged handset costs over twice the standard one. The M10 KLE is $89 and the M10R KLE $189, the latter shockproof and water-resistant with a locking battery. Both offer G.722, 7 days' standby, 9 hours' talk and a 3-year warranty. The host gives range as about 500 feet in open space, less through walls, and the host has no dead spots on his property.
• Shared line appearance recreates key-system behaviour on cordless phones. Line buttons for up to four shared lines show a held or in-use call on every handset. In the host's demo a call was put on hold on extension 201 and picked up on 202, and paging lets staff announce the line; he says other DECT handsets may lack this, suiting restaurants and dealerships.

2022-08-01 · open the original ↗

• Reinforcement learning trains an agent by rewarding good actions. Mishal, a Microsoft technical trainer, describes an agent exploring an environment, such as a game or driving a car, and trying to maximize its score at every step. He says training must simulate the bad cases too, losing points for leaving the road and gaining them for stopping at a stop sign, or the agent learns only one way and fails when something goes wrong.
• The cloud has made the required compute affordable outside research centres. Training deep neural networks, especially on images for autonomous driving, needs powerful GPU and CPU environments that Mishal says once only universities and big research centres had. On Azure the trade-off becomes how long you can wait versus how large a compute cluster you reserve; setup still takes several steps (a machine learning workspace, compute clusters, Jupyter notebooks) and a framework he describes as mainly Python.
• Recommendation systems are another use, trained actively or passively. Mishal cites a personalizer that recommends movies and is rewarded when the viewer likes them. The agent can learn actively from the user's live choices starting from nothing, or passively from simulated learning such as a year of viewing history.
• An agent will maximize reward even when the result is useless. Giard brings the examples: a bot trained on tweets that became racist and was shut down, and a robot from the book "You Look Like a Thing and I Love You" that learned to fall over to reach a goal fastest. Mishal's remedy is monitoring how the model is rewarded under responsible AI, and in a generative adversarial setup controlling the discriminator with safeguards, such as giving inappropriate output negative or no reward.
• Multi-agent learning requires agents to learn cooperation. Mishal's current project trains multiple agents to navigate terrain from point A to point B while maximizing each other's reward; with two doors, uncoordinated agents may each head for the far door and collide. He points learners to Microsoft Learn's machine learning modules, including a demo that trains an agent to play Pong.

2022-08-01 · open the original ↗

• Key Vault stores secure data only specified identities can reach. Giard lists certificates, encryption keys and secrets (name-value pairs such as a connection string or password), accessible only to the applications, user accounts and services you specify.
• Only the Basics tab is required to create a vault. From Create resource, the dialog also has access policy, networking (public and private networks) and tags tabs, which he skips. Basics takes a resource group, a name and a region chosen to minimize latency for whoever reads the vault. The pricing tier is standard (the default and cheaper) or premium, whose main difference is support for HSM keys.
• Deleted objects are soft-deleted and recoverable for a retention period. The default period is 90 days and can be changed (he cites 7 or 30 days); after it, items are purged permanently. Items can also be purged early by hand unless purge protection is enabled, which he leaves off.
• Review and create validates before deploying. The button is enabled only when nothing is missing or inconsistent, and deployment took about 30 seconds in the demo.

2022-07-29 · open the original ↗

• Meadow brings plain C# and .NET to a microcontroller. Hanselman demos Wilderness Labs' Meadow F7 Feather (version two) on its Project Lab board, an expander with a screen, buttons, relays and sensor buses that removes the wiring a bare developer kit needs. He discloses that he is an investor in Wilderness Labs, says the video is not paid, and says he did not tell the company he was making it.
• The sample weather app shows how readable the code stays. In the Project Lab samples cloned from the Wilderness Labs GitHub, he shows Wi-Fi joined in one line of C#, an onboard barometric sensor read through the Meadow Foundation sensors namespace, an OpenWeatherMap REST call deserialized straight into a typed object with async/await, and a view-model pattern for the colour screen. The app updates indoor and outdoor temperature at the top of each minute.
• A microcontroller runs one program, not an operating system. He contrasts it with a Raspberry Pi, which runs a full Linux desktop and lasts hours on battery, while a microcontroller boots into a single program and can run for days.
• WSL can take over USB flashing that is awkward on Windows. Flashing STM32-family devices from Windows tends to fail when they drop into DFU mode, and he shows that happening. Using Andrew Leach's WSL USB GUI, a wrapper over the command-line tools, he detaches the STM bootloader from Windows and attaches it to Ubuntu by tunnelling USB over IP, so it can be flashed from Linux without installing drivers.
• His next project is the blood sugar display, in C#. He calls blood sugar his "hello world" and plans to rebuild his CircuitPython glucose display on the Meadow's screen, which he estimates will take "maybe an hour or two this weekend."

2022-07-26 · open the original ↗

• The Netgate 4100 is the cheapest Netgate appliance that does high availability. At $599 MSRP (support tiers extra) it pairs two units over a heartbeat port, a setup the host says Crosstalk, which installs pfSense for business clients, builds repeatedly. It has an Intel Atom C3338R dual-core at 1.8 GHz, 4 GB DDR4, two WAN ports that take RJ45 or 1 Gb SFP, and four ports bridged as the LAN switch.
• Set the time zone by city, not by GMT offset. Dave Barger, the Crosstalk pfSense engineer, sets DNS to 8.8.8.8 with 1.1.1.1 as backup, and unticks the WAN's RFC 1918 block only behind a double-NATed ISP. The host's first-generation Starlink dish hands over a public IP, so he left it on. Choosing "GMT-8" put the clock eight hours ahead and the update check failed until he switched to America/Los_Angeles. Updating 22.01 to 22.05 takes about five minutes, but Barger books an hour with clients.
• Barger installs the same VPN, IDS and backup tools on every pfSense box. He adds the OpenVPN client export wizard, Snort (needs a free community key) and WireGuard. He often runs both VPNs: WireGuard for lightweight devices, OpenVPN for Windows machines. He turns on Netgate's auto config backup, which uploads on every change and keeps up to 50, protected by a long encryption password; the device key on the Restore tab goes into a password manager.
• A guest VLAN needs its own allow rule, under two higher rules. The wizard only creates allow-all for the main LAN. On guest VLAN 10 (192.168.10.1/24, DHCP .2–.254) the rules run top-down: allow traffic to the guest interface address, block an RFC 1918 alias (10/8, 172.16/12, 192.168/16), then allow all. The alias also covers subnets added later. Client isolation has to be enabled on the access point, because same-subnet traffic never reaches the router.
• Stop pfSense rewriting the ports of a locally hosted PBX. Outbound connections always get their ports rewritten, which Barger says is fine for everything except RTP streams. His fix is an outbound NAT rule with the PBX as a /32 source and static port ticked, with outbound NAT switched from automatic to hybrid. Anything beyond that depends on the PBX provider.

2022-07-26 · open the original ↗

• Displaying his blood sugar is his test for any new device. Hanselman, who is type 1 diabetic and wears a Dexcom sensor, pulls his last five readings from his cloud-hosted Nightscout instance onto Adafruit's Matrix Portal M4 driving a 64×32 LED matrix. He says it covers HTTP with SSL, JSON parsing, multiple data types, a trend direction, and drawing on a tiny display.
• CircuitPython's mount-as-a-drive workflow is ideal for learners. The board shows up as a disk drive, and saving code.py reboots it and runs the code. It also exposes a COM port for debug output, which a VS Code CircuitPython extension (by Joe DeVivo, by his account) can monitor.
• GitHub Copilot sped up writing a language he does not know. He admits he does not speak Python. Copilot guessed the next colour after "red green yellow", filled in the full set of arrow glyphs once he started on them, and wrote the "from epoch" comment for a timestamp field, which he calls "creepy".
• The real question is how much of borrowed code you must understand. He takes an Adafruit moon-phase sample's accelerometer maths, which uses an arc tangent plus pi, and tries values in a Python REPL: (0, −10) gave 270 and (10, 10) gave 180. He decides it is enough to know it yields a 0/90/180/270 rotation, but says knowing why bitmap fonts load only the glyphs you need (device memory is tight) does matter.
• Working code is not idiomatic code, and he shows his own shortcuts. He could not find a way to turn the label red above 200 once its colour was set, and he maps strings like "flat" to arrow glyphs crudely. He catches every error and retries after a minute, and he spots a five-second sleep he meant to be five minutes, which raises whether to loop tightly for a clock or sleep to save power. He compares it to speaking a new language: first you make yourself understood, then you learn to sound like a native.

2022-07-26 · open the original ↗

• His "free virtual machine" was a forgotten physical PC. The host that gave Hanselman, then an MVP, a server for hanselman.com had been sold to a Quebec company. When he ran out of disk, it turned out to be a physical mini-tower once under an employee's desk, running Windows Server 2003 with a 30 GB spinning drive and no TLS 1.3. He calls the 19-year-old drive his deadline: if it stopped spinning, it would never start again.
• He rejected lift-and-shift and moved to platform as a service. Imaging the disk into the cloud with Sysinternals' disk2vhd would be "a bandage on cancer", and IaaS is "free like a puppy" because you still patch the kernel. He ported the brochure site, podcast site and DasBlog from .NET 2/4 to .NET 6 on both Windows and Linux. The only bugs were hard-coded backslashes in paths, and Linux hosting was about 30% cheaper.
• Docker multi-stage builds keep the compiler out of production. The build runs in a roughly 300 MB SDK container, and only the published output is copied into a runtime image of about 100 MB. He had previously been shipping the whole SDK.
• Cloud-native, to him, means spending cheap RAM instead of databases. DasBlog stores 20 years of posts as 4,964 XML files, about 384 MB, which he loads entirely into memory for sub-millisecond reads. Images go to a CDN on a separate subdomain so browsers can parallelize the lookups, and sponsors live in a text file. He argues most apps over-engineer (YAGNI): cache for five to ten minutes, because "real time" rarely needs to be real time.
• Cloud tooling, not genius, makes a "10x developer". He runs four sites, including Azure Friday, on one $35 App Service plan (about 12% CPU, 65% memory), arguing cloud machines can run hot. Each site's footer shows the runtime version, the live commit and its build log. He cut over through a reverse proxy (Azure Front Door), splitting traffic 50/50 with the old server before swapping, and says this once took a team.

2022-07-24 · open the original ↗

• You cannot scan an application into being secure. McKee, global developer security program manager at Trimble, says static and dynamic analysis tools catch some classes well, such as SQL injection, cross-site scripting and command injection, but miss broken authentication, encryption issues and business-logic flaws. He argues that focusing on the application misses how the bugs get in, and that educating developers closes that loop.
• Developers belong inside the security model, not beside it. He cites the InfoSec colour wheel from a post a couple of years earlier: red team attackers, blue team operations, purple where they combine, plus a yellow team of builders and architects. He places himself on the orange team between red and yellow, whose job is to educate developers and "remove all of the magic" from what attackers do.
• Start by learning the OWASP Top 10 hands-on. He recommends deliberately vulnerable open-source apps (DVWA, OWASP Juice Shop, bWAPP) that let developers run the attacks and then read the source to see where each flaw entered. When he asks conference audiences who has heard of the Top 10, at best about half the room has, which he puts down to businesses prioritising features over security.
• Threat modelling can be reduced to four questions. What are we working on, what can go wrong, what are we going to do about it, and did we do a good enough job. He frames "what can go wrong" around confidentiality, integrity and availability, so a tripped-over power cord or a lightning strike that takes out data-centre cooling counts as a security risk alongside attackers.
• Developer-centric security means helping teams do things safely. Citing the DevSecOps manifesto, he says he has no power to tell a team no, so his job is to make what they want safe. He prefers feeding tool output and CISA's lists of most-exploited vulnerabilities back to teams as trends over enforcing checklists, which he says lull teams into false comfort. He also argues that how you react to an incident matters more than the incident, and turns each one into a lessons-learned document shared with other groups.

2022-07-22 · open the original ↗

• Leverage in tech employment has shifted from employers to employees. Brown, CIO of Union Bank and Trust (Lincoln, Nebraska; about $40 billion under management), says the pandemic accelerated trends already under way, citing friends who are partners at consulting and law firms losing junior staff "left, right, and center" to jobs that fit their values. He calls it a mass grassroots shift with no organized labor movement behind it, and links it to tight supply and high demand for tech labor that pushed up pay in 2021. As of late July 2022 he says tech unemployment is still very low, was "almost a perfectly flat line" through the 2020 dip, and he does not expect even a recession to hit it badly, while saying he could be proven wrong within a month.
• Work from home is likely to stick, and is worth advocating. Brown, who publicly advocates it, believes most companies would have liked everyone back in the office but are ceding ground, and he predicts MBA programs will start teaching work-from-home management within a couple of years. He cites a Pricewaterhouse study finding even more employers than employees thought it was working, and says his own productivity numbers went up. His figures on preference: about 20–25% want full-time remote, closer to 10% full-time office, and the remaining roughly 65% hybrid. Whether it survives the next recession is open in his view; he expects office-space savings to lock companies in, pointing to a former consulting employer with over 700 staff that has never had an office in over 20 years, including 2008–09.
• The flexibility people want is mostly child care, not RV travel. Brown says headlines favour stories like his friend who bought an RV in April 2020 and toured America for a year, but the data show child care is what people mean. He puts child care for a tech employee at roughly "70-some thousand a year", which against a $100,000 salary is a disincentive to work at all.
• Training and integrating junior staff remotely is the lasting problem. Brown says new graduates in particular need to be around experienced people who review their work and whom they can overhear, and that his former fully remote firm lost hires it left waiting at home for an engagement. Culture comes up in every CIO peer discussion of remote work he joins; he says companies coasted on existing culture through the pandemic but must maintain it deliberately, citing GitLab's public employee handbook as an example of a fully remote company doing so.
• Leaders deciding the future of work suffer from survivorship bias. Brown argues senior leaders rose by thriving in the old office environment, so they are unconsciously inclined to value it, even though many people succeed in other arrangements. His remedy is panels of junior and mid-level staff advising on return-to-work policy; he says he has sought input from all levels of his own organization, since no one at any level has much experience with this situation.

2022-07-22 · open the original ↗

• The UniFi Dream Router is a low-cost all-in-one entry into UniFi. It lists at $199, after roughly $79 in the early-access store as the host recalls. It combines a router/firewall, a Wi-Fi 6 4x4 MU-MIMO access point, a four-port switch with two 802.3af PoE ports, a UniFi controller and 128 GB of storage, on a dual-core Cortex-A53 at 1.35 GHz with 2 GB RAM. It is rated −10 to 45 °C, so indoors only, and more access points or switches can be added later.
• The UDR runs only two UniFi applications at once. In practice that means Network plus one of Protect, Access or Talk. Bluetooth setup through the UniFi app took about two minutes of boot time, and the firmware then updated itself. The box was on UniFi OS 2.4.10 at recording. The host would turn off automatic updates in production and run them by hand.
• A microSD card replaces the internal storage rather than adding to it. So a 128 GB card, which the host believes is the minimum, gains nothing; he assumes but has not confirmed a 1 TB maximum. Two cameras recording continuously gave an estimate of about 1 day 5 hours of history. He recommends detections-only with five seconds of buffer either side, warns that microSD is not made for surveillance, and points to a UNVR for a real system.
• His IPS speed tests over Starlink were inconclusive. With IPS off, a phone next to the router reached 248/19.5 Mbps. With IPS on high, two tests gave 108/14 and 66/10. With it off again, they gave 140/10 and 153/16.7. He calls this anecdotal because Starlink speeds swing widely, and says a single-device test cannot show the CPU load of many clients at once.
• The host sizes the UDR for ordinary home or small-business use. It does not suit 100–300 clients or heavy IoT, and he calls three extra U6 Lite access points too many for most homes. Teleport VPN works on it, and it had not crashed in about a day and a half of testing. He plans to put it in his mother-in-law's house to watch it in normal use.

2022-07-14 · open the original ↗

• This short has no text to summarize. The archived transcript for this 16-second short is empty (0 words), so nothing in the archive records what it says or shows beyond its title.

2022-07-13 · open the original ↗

• Starlink Maritime costs $10,000 up front and $5,000 a month. The hardware fee covers two high-performance (business-class) dishes and two pipe mounts but no Ethernet adapter, which the host objects to. Starlink advertises up to 350 Mbps download at sea with unlimited data. Service pauses and resumes in one-month increments, and resuming on any day bills the full month.
• Coverage at launch is mostly a coastal fringe, by Starlink's map. It covers waters near existing land service around the US, Europe, Australia/New Zealand and parts of South America. The map adds a further band in Q4 2022 and the rest of the oceans in Q1 2023. The host doubts these dates, given how often Elon Musk's companies miss timelines.
• Two dishes allow for deck obstructions. The high-performance dish measures 57 × 51 cm (22 × 20 in) and is rated IP56, against 50 × 30 cm and IP54 for the standard dish. The difference is withstanding powerful water jets rather than splashing. Starlink's FAQ promises a free upgrade to a flat-panel antenna and mount when it ships in Q4 2022. The host speculates that the mount, not the dish, will do the actuating.
• The fine print limits where Maritime can be used. It is best-effort service, with priority because it uses the business dish. It is not a safety-of-life-at-sea service, is limited to territorial waters where SpaceX or the user holds a licence, and is approved in the US. In-motion use is authorized only on a non-interference basis in the 12.2–12.7 GHz band. The host links this to Starlink's fight with Dish Network: Starlink claims Dish's plans would cause interference 77% of the time and outages 74% of the time. He reads its customer letter campaign to the FCC as a panic move.
• Against VSAT and Inmarsat, the host calls the price a bargain. In Starlink's own case study, SpaceX paid over $165,000 a month for 25 Mbps metered VSAT across 10 vessels with 1–2 seconds of latency, and about $50,000 a month on Starlink. A Twitter respondent put Inmarsat's Fleet Xpress at 10 Mbps, $35,760 for the dish and data from $1,800 a month, with 500 MB costing $1,245 a month on a three-year contract, using a 37 kg dish.

2022-07-08 · open the original ↗

• Microsoft's Docker extension adds a Docker panel to VS Code. Giard installs it from the Extensions view (he notes 16 million downloads and a five-star rating; VS Code itself is a free download from code.visualstudio.com). The new left-toolbar button lists containers, images, networks, volumes and connected registries; he is already connected to Docker Hub.
• Dockerfiles get color coding and IntelliSense on image tags. On the base image line (the current Alpine version of Node), typing a colon and Ctrl+Space lists the available tags, and typing further filters the list.
• Right-clicking the Dockerfile builds an image without typing commands. "Build image" asks for a name (he enters app1:1.0) and runs the docker build task in the terminal for you. From the panel he can then remove, inspect (JSON output), push or run the image; Run issues docker run in detached mode, and the new container's files, logs and an attached shell are available from its right-click menu.
• Networks can be created in the panel; volumes, he believes, cannot. The plus button takes a network name and asks for a type (bridge, host, macvlan and others). For volumes Giard says there is no interactive way "as far as I know", so he runs docker volume create vol1 in the terminal, after which the volume appears in the panel to inspect and attach to a container from the command line.
• "Connect registry" links Azure, Docker Hub, GitLab or generic registries. Docker Hub asks for a Docker ID and password; once connected, the registry's images can be browsed from the panel.

2022-07-07 · open the original ↗

• The friend's Idaho lake house started with badly placed, ISP-owned gear. A MikroTik 2.4 GHz antenna from the local wireless ISP pointed through trees and a metal tram track, giving about 12 Mbps symmetrical. A point-to-point bridge owned by the ISP fed the back house, where a second Netgear router double-NATed the network. Wi-Fi had to cover three structures at different elevations plus RV parking.
• Internet comes in at the boathouse; the router stays in the house. Moving the ISP antenna down gave line of sight across the lake and a full 16/16 Mbps. The ISP's planned 5 GHz upgrade, which could double that, would not pass through the trees. Starlink, the planned primary with the ISP as backup, goes on a custom 4-inch steel post halfway along the dock, since the end comes out for winter. The UDM SE router sits in the main house because snow can cut off the boathouse. The host chose it for built-in PoE, dual WAN and the option of Protect.
• VLAN-only networks carry both WANs over one cable. The host created a primary WAN on VLAN 3 and a backup WAN on VLAN 4 as VLAN-only networks. He set ports 7 and 8 to those profiles on both the boathouse US-8-Lite PoE switch and the UDM SE, then patched them into the WAN ports. The backup WAN was waiting on an RJ45 SFP module he forgot to bring.
• Terminating the outdoor shielded Cat6 was the hardest part. The cable ran up the tram rail in conduit laid on the existing electrical conduit, with a spare pull string left in. The host bought shielded outdoor Cat6 because temperatures there have reached −30, but its thick conductor coating defeated hours of termination attempts. A technician from the wireless ISP, Aaron, terminated it. The boathouse gear runs on a UPS because the boathouse is not on the generator.
• A point-to-multipoint link serves two spots at the back house. NanoBeam AC radios cover a roughly 100 ft shot, with about 345 Mbps of link capacity to each station. One station feeds an outdoor U6 Mesh for the RV area through chained PoE injectors; the other feeds a US-8-Lite and access point inside. The radios were painted with non-metallic Plasti Dip, and 24 V passive PoE converters were needed. The house is effectively an Airbnb, so there is only a secure and a guest network, with no separate IoT network. The product links are affiliate links.

2022-07-06 · open the original ↗

• Containers lose anything written after creation when recreated. Giard says containers are stateless by default, which is part of why they start so fast. He shows it with the image and container from episodes 126 and 127. He opens a shell inside the container with docker exec -it app1 sh, writes stateless.txt, and leaves with Ctrl-P, Ctrl-Q. He then deletes the container with docker container rm <id> --force and recreates it. The file is gone, because only what was in the image comes back.
• A named volume mounted into the container keeps state on the host. He creates one with docker volume create vol1, then runs the container in detached mode (-d) with -v mapping vol1 to /var/opt/project inside the container. A file written to that folder lands in the volume. On Windows he finds it on the host under the WSL Docker Desktop data share, in ...\docker\volumes\vol1\_data. It also shows in Docker Desktop's Volumes view.
• The volume's data survives deleting and recreating the container. He force-removes the container and reruns the exact same command, which he calls a common move when something fails and you want the app back up. The file is still in /var/opt/project in the new container.
• Several containers can share one volume. He starts app2 (host port 8001) and app3 from the same image, all pointing at vol1. A file written from app2 shows up in the other containers, in the host folder and in Docker Desktop.
• A volume in use cannot be removed; prune clears unattached ones. docker volume ls lists the volumes. docker volume rm vol1 fails with "volume is in use" while any container is attached. Once he has force-removed the three containers, docker volume prune (after a warning) deletes every volume no container is using.

2022-07-05 · open the original ↗

• The Wi-Fi 6 Extender is a renamed, Wi-Fi 6 Beacon HD. The form factor looks unchanged, but the LED ring now does only blue and white; the host attributes this to chip shortages. The extender is $149 against $129 for the Beacon HD. Without high client density he expects no noticeable performance difference, so the Beacon HD saves $20 and suits buyers who want LED colours.
• The advertised throughput overstates what one mesh radio delivers. Ubiquiti claims up to 4.8 Gbps on 5 GHz and about 573 Mbps on 2.4 GHz. The host notes that Wi-Fi is not full duplex and that the single 5 GHz radio carries both the wireless uplink and the clients, which roughly halves capacity. It needs UniFi Network 6.5.55 or later, and the uplinking access point needs firmware 6.0.11 or later.
• The host treats it as supplementary coverage, not a primary access point. It has no Ethernet port, and he uses it mainly to connect a G4 Doorbell where there is no wiring. Clients with serious bandwidth needs should get a wired access point, and he would not run a 20-person office from one extender linked to one access point.
• It runs about 30 °F hotter than the Beacon HD. He measured about 138 °F against 108 °F, which he flags as a concern for a wall outlet within children's reach. In UniFi it still shows the old colour-picker settings, uses a generic access-point icon, and drew clients that were nearer his main access point. The purchase links are affiliate links.

2022-07-01 · open the original ↗

• Docker Desktop and a free Docker Hub account are the prerequisites. Docker Desktop installs Docker on Mac, Windows or Linux. Docker Hub is where Giard stores his repositories, under the account name "DGR". His demo app is a dependency-free Node web app (app.js, port 8081) that prints the current date and time and a list of the numbers one to five.
• A Dockerfile lists the build steps. It is named Dockerfile with no extension by default; any other name has to be given to the build command. Giard walks through five instructions. FROM sets the base image; he uses node:current-alpine from the base images on hub.docker.com. LABEL is metadata only, commonly the author or an email address. WORKDIR sets the folder inside the container where later instructions run. COPY . . copies from the local build folder (left) into the working directory (right). ENTRYPOINT takes an array of a command and its arguments, here node and app.js.
• docker build -t account/repo:tag . builds the image. He runs docker build -t dgr/app1:1.0 ., using the tag as a version number. docker image ls then shows the image's ID and size. He notes that most of the size comes from the Node base image, but it is still far smaller than a virtual machine with a whole operating system.
• Pushing creates the repo; any machine with access can run it. docker image push dgr/app1:1.0 creates the repository on Docker Hub and uploads the image; if you are not logged in, it may ask you to. To show this, he deletes the local copy with docker image rm b02, where a unique ID prefix is enough. He then runs docker container run --name app1 with port mapping 3000:8081 and the image dgr/app1:1.0. Docker does not find the image locally, so it pulls it from Docker Hub, and the page loads at localhost:3000.
• By default, docker container run holds the prompt; -d runs detached. Run without -d, the container ties up the terminal until Ctrl-C. docker container stop <id-prefix> stops a container. docker container ls then no longer lists it, which Giard finds "a little bit frustrating", though ls -a still shows it as exited. docker container rm deletes it for good. Rerun with -d, it returns the prompt at once; he points to how fast it starts.

2022-06-28 · open the original ↗

• Containers are lighter than virtual machines because they abstract the operating system. Giard explains that a VM abstracts the physical hardware and holds an operating system plus applications, while a container sits on top of a VM and holds only the application and the data it needs. He says that makes containers smaller and faster, quick to restart, and able to be scaled and deployed independently.
• Docker Desktop runs containers locally; Docker Hub hosts images for sharing. Docker Desktop has downloads for Windows, Linux and Mac, and Giard calls installing it pretty simple. He recommends a Docker Hub account too, so images can be shared with other people, other machines or VMs in the cloud. His own registry is named for his first initial and last name, and he says viewers can probably read from it but not write to it. To follow a demo that uses it, they should create their own registry and put its name in place of his.
• docker run pulls the image, then creates and starts a container. His demo runs Docker's built-in "getting started" image, which anyone can use. -d runs it detached, handing back the command prompt. -it would run it interactively, inside the container. -p maps ports: the image serves a web app on port 80, which is not reachable from outside the container, so he maps local port 3000 to it. The image was not on his machine, so Docker pulled it from the registry first. The container came up in about a second.
• Containers are listed, stopped and started by a short ID prefix. docker container ls shows the running containers with their ID, creation time and uptime. Adding -a also lists stopped ones, with the status "exited". docker container stop and docker start take the ID, and he says you only need to type enough of it to be unique among your containers.
• The mapped page only answers while its container runs. With the container running, the tutorial page loaded at localhost:3000. After he stopped the container, a cache-bypassing refresh (Ctrl+F5) failed to find it. After he restarted the container, the page came back almost at once.

2022-06-24 · open the original ↗

• Content shared in web meetings is largely inaccessible to blind attendees. Jones, of Microsoft's commercial software engineering team, says shared screens arrive as a video stream that strips the document's structure, so screen readers cannot follow it in real time. VocalScreen was the idea of a former colleague, Hassan, an engineer blind from birth; volunteer crews have iterated on it in one-week projects for more than two years.
• Presenters will only use assistive tools that start in seconds. The first version was a Windows desktop app built on Windows APIs, but Jones says nobody can hold up a meeting five or ten minutes to install software. The latest version is an Edge and Chrome extension for the presenter, who posts a unique session link in the chat; listeners need only a web browser, with an optional extension for extra features.
• Streaming the whole HTML DOM preserves what screen readers need. Jones says sending only the text would lose navigation and the relationships between elements, so it sends the DOM with ARIA labels and H1/H2 headers intact. He cites a recent Starbucks accessibility project where ARIA labels announced events a sighted user sees, such as a settings menu opening.
• Less structured content would get machine-generated structure. On the roadmap, Jones lists an Office extension (PowerPoint being perhaps the most shared content), eventually Teams, and cloud OCR that would use text size and position to generate ARIA-style labels with machine learning. It is an internal "hack for good" project, not public as of recording; the hope is to feed the features to the Teams product group, and it may be open-sourced someday.
• People with disabilities are some of the best problem solvers around. Jones traces his involvement to a lunch with Microsoft's chief accessibility officer that he bid on in the company's annual Give campaign. He urges technologists to get involved, calling accessibility both a human cause and a place to work with cutting-edge technology.