Debugging Web Access Issues with Microsoft Edge

Edge comes with Developer Tools (Control-Shift-I).  

These tools are surprisingly powerful. The tools appear right next to the rendered webpage in the browser.

Suppose you are trying to log in to a service called "Microsoft New Service" but it doesn't work.  The tab text says "Sign in to Microsoft New Service". Open up Dev Tools. Click on Network (the wifi-style icon). 

Now reload the webpage.  

You will see entire flow of HTTP requests and responses. A 200 response is status code OK, a 204 means No Content. In fact, any status code between 200 and 299 is a form of success. 300-399 are redirection messages, and anything about that represents an error.

You may be surprised by the number of conditional access-related HTTP requests that are involved in an authentication attempt.

Why Pre Shared Keys are not Wifi Passwords

It is tempting to think of wifi passwords as equivalent to Pre Shared Keys (PSKs) used in authenticating wifi connections.  In fact, the wifi password is combined with the SSID (Service Set Identifier) of the wifi network to produce a 256-bit cryptographic key.

The Pre Shared Key model is not ideal for enterprise deployments, as anyone who knows the password can decrypt traffic, if they capture the handshake. IoT devices using Pre Shared Keys are also not secure where keys are leaked in plaintext logs. This is why there is a separate WPA2-Enterprise that abandons the PSK model.

WPA3-Personal replaced PSK with SAE (Simultaneous Authentication of Equals) to enhance security, adding a principle of forward security, by introducing unique keys for every session.

Protecting RAM

Attacks on RAM are one of the arguments to better protect data in use.

There are various security attacks on RAM. One is malware that can scrape memory e.g. for plaintext credit card numbers (once read into RAM prior to encryption).  Modern systems aim to encrypt data as early as possible in the processing pipeline.

Privileged operators (e.g. cloud admins) can peek into RAM. This is why confidential VMs isolate memory to hide data-in-use from cloud providers. 

DMA devices such as Thunderbolt peripherals can read system memory (and hence potentially sensitive data, from RAM). Modern operating systems restrict "hot-plug" DMA access.

Note: this list of compromise attacks is non-exhaustive. This is a big field of operations.

Microsoft's GitHub

Microsoft's GitHub is worth perusing from time-to-time. Some of the big projects are VS Code and TypeScript but many more additions are made to cover new directions like confidential computing.

Microsoft also have a website (opensource.microsoft.com) detailing their open source initiatives more broadly.  The Microsoft open source blog is also worth reading.

OHTTP

OHTTP (Oblivious HTTP) is an IETF network protocol to enable anonymous HTTP transactions over the Internet. 

Its primary goal is to enable users (browsers, agents, other software) to send HTTP requests without revealing their IP address.

It is defined by RFC9458.

IPv4 vs IPv6

Purpose of IP Addresses and the Problem IPv6 Solves

An IP address (Internet Protocol address) is a numeric label to identify a network interface of a computer or network node participating in a computer network using the relevant IP version.

IPv6 was created to tackle the problem of IPv4 exhaustion.

IPv6 uses 128 bit addresses, yielding an address space of 2^128 possible addresses.   This contrasts massively with IPv4 which is only 32 bits!!

Why is there no Planned IPv7?

The address space of IPv6 is so large that address exhaustion is not a foreseen possibility, and hence no IPv7 is planned at present.

What transition technologies are in play to help move to IPv6?

There are some transition technologies e.g. NAT64, aimed at easing the transition from IPv4 to IPv6.

Apart from Bigger Address Space, what else does IPv6 Bring to the Table?

Apart from bigger size, IPv6 also adds some interesting new features. Learn these.

Understanding localhost

Everyone has used localhost. But few have explicitly thought about and written down what it really means. 

localhost is a reserved domain name that the OS maps to itself; typically 127.0.0.1 for IPv4 and ::1 for IPv6.

It bypasses DNS as requests to localhost never go out to the Internet. The OS resolves it internally.

Localhost traffic is routed through a virtual network interface that loops packets back into the machine without touching any physical network hardware.

Developers run local servers (e.g. localhost:3001) to test code quickly, safely and without exposing anything to the Internet.

More on the Common Information Model

We have previously mentioned the CIM, or  Common Information Model, in the context of systems management standards. It is effectively an object-oriented schema for classifying objects pertaining to systems management. 

An example schema can be found here (note: there are multiple versions of the schema).

Notes from Microsoft Learn on this topic can be found in Microsoft's WMI SDK notes here.

From an organization perspective, the most important aspect is consistent adoption of a sufficiently descriptive data model, rather than the details of the data modelling itself.

The Mesh Network

A mesh network is a type of LAN topology where every node connects (in a flat layout) to as many other nodes as possible. Nodes can then work together to route data as efficiently as possible.

The LM Link Feature in LM Studio

LM Link is a way to connect devices on which LM Studio is installed; allowing you to load models on remote devices as if they were local. Chats remain local and the only thing loaded on LM Studio's backend servers are your device list.  In a way, it's model-connectivity-as-a-service using your own hardware.

LM Link is implemented on top of Tailscale VPN.

WinJoe, Was ist Delta Format?

Delta format (often called Delta Lake) is an open-source data storage layer originally developed by Databricks. 

It sits on top of Apache Parquet and enhances it with database‑like guarantees and metadata management. 

Delta is designed specifically for large-scale data engineering where reliability, consistency, and performance are essential - according to the creators, Databricks,

Big Data's New Vacation Home - The Lakehouse; Microsoft's Approach

The lakehouse concept combines the capabilities of data lakes (which have scalability qualities) and data warehouses (which have advanced query functionality).

Microsoft Fabric's resources on Data Engineering delves into the concept of data lakehouse (and Microsoft's SaaS implementation, OneLake, billed as OneDrive for data)  with notes on how the lakehouse makes use of Apache Spark.

Troubleshooting WSL2 Memory Hogging

WSL2 hogs memory and doesn't release it even when all consoles are closed. Do wsl --shutdown to free up memory.

Why does TypeScript feel a bit C-Sharpy?

TypeScript was created by Anders Hejlsberg, a Danish software engineer, in 2012. He formerly created C# around the year 2000. He is also known for Turbo Pascal and Delphi, both extraordinary products in their time. Deservedly he is a Microsoft Technical Fellow (a list of whom appear here).

Types in TypeScript

The basic types are called primitives: 

• boolean
• number (which represents integers and floating points)
• string  

There is also:

•  BigInt (ES2020+) to represent whole numbers larger than 2^53 -1, and
•  symbol to create unique identifiers

Starting with ES2015, symbol is a primitive type, whose values are created by calling the Symbol constructor.

Examples:

let sym1 = Symbol();

let sym2 = Symbol("keyname");

Symbols are immutable and unique, which can result in what may be initially feel like strange behaviour, but on reflection makes sense.

let sym2 = Symbol("key");

let sym3 = Symbol("key");

sym2 === sym3; // triple equality - false, Symbols are unique.

Node Version Manager - Strongly Recommended

The Node version manager, nvm, is strongly recommended to manage your version of Node.js and npm. 

It also allows switching between various versions of Node (Nodejs and npm) for testing purposes. 

As per official docs, nvm is designed to be installed per-user and invoked per-shell. It works on "any POSIX compliant shell" - including on Unix, macOS and WSL.

Once you install nvm (by wget'ing the installation shell script and piping it to bash) you can restart WSL and start using nvm.

Some nvm commands to know:

nvm install node   # install latest version

nvm install --lts     # install latest LTS version

nvm use node        # switches to latest version

nvm use <version>    #switch to a specific version

To see all Node versions, do nvm ls.   Node uses semantic versioning, following the pattern MAJOR.MINOR.PATCH.

nvm ls shows the version active in shell in blue, and installed versions in green. Yellow are versions referenced by aliases but not installed.

Installing a Transpiler

Do install a transpiler in WSL as follows.

sudo npm install -g typescript

The -g option to npm install is short for --global and means install the said package globally (global npm directory) as opposed to the local node_modules folder of a project.

Binaries are then also exposed on your PATH, so you can run tsc conveniently.

Note that you need an up-to-date installation of Node to run TypeScript. If not, some of the modern operators (e.g. null coalescing operator) will not work when running tsc.

Dawn of the Transpiler

The term "transpiler" (referring to a source-to-source translation tool, or "translating compiler") gained popularity around 2013 with the proliferation of translators from TypeScript and other abstractions (CoffeeScript, Dart) into JavaScript.  

JavaScript at the time was becoming a "universal runtime".

Babel is a popular transpiler. tsc is the official transpiler. It can be installed via npm.

Downsampling from a Data Science Perspective

Downsampling in data science and data processing is as follows (this excludes the DSP, or digital signal processing, technical definition of downsampling - which is similar in spirit but differently defined).

Downsampling involves reducing the number of data points in a data set to enable comparability (sometimes referred to as "balancing the data").  This helps machine learning models avoid bias towards a dominant class.

Various approaches to downsampling (e.g. random downsampling) are described in this IBM article.

Scala, Scala, Everywhere

For legacy observations on Scala, check out JVM stuff.  Here we build a fresh relationship with Scala.

Scala is a strongly statically typed language supporting OOP and functional programming.  Strong static typing means it avoids implicit type conversions when calling functions and other scenarios.

A good starting point for learning Scala is scala.dev here.

Apache Spark (and its roots in Scala)

Apache Spark is a foundational layer underlying many data platforms. 

It is written both in Java and Scala. Read the source code here.

A good starting point is SparkSession.scala.

One of Spark's "selling points" is "Exploratory Data Analysis (EDA) on petabyte-scale data without having to resort to downsampling" (see detailed post on downsampling). 

A petabyte (PB) holds 1000 terabytes (one thousand million million bytes).

The Apache Incubator

The Apache Incubator services projects seeking to enter the almighty Apache Software Foundation. Projects (called "podlings") are "ingested" and become subject to Apache-style governance and operation.

The name Apache was taken from the Apache Indian people, a Native American tribe known for their warrior spirit and inexhaustible endurance, and was first used in the context of the cross-platform Apache Web Server (launched in 1995; despite being cross-platform most instances run on Linux distributions).

Qwen Series of Models

The Qwen series of models comes from Alibaba Cloud.  The Qwen 3.5 models, released in early 2026, has set new records for sub 2B models. It is much smaller than gpt-oss.

Compile to WASM - The Emscripten Toolchain

Emscripten is an open-source compiler toolchain to Wasm. C/C++ (or any other LLVM-supported language) can be compiled and run on the Web, Node.js or other Wasm runtimes.

WebAssembly Not Automatically Blocked by Browsers

WebAssembly is a type of code designed to run in modern web browsers.  It is designed to run alongside JavaScript using WebAssembly JavaScript APIs - creating an option for performance critical functionality.

As WebAssembly increases the browser's attack surface, so browsers contain WASM inside the browser's sandbox and restricts system access. 

A risk maybe breaking out of the sandbox. Adobe Flash was a product sandboxed after a bunch of exploits, and after sandboxing exploits still occurred.

Transmission of WASM does not require TLS, HSTS or any other transport layer security mechanism making it susceptible to man-in-the-middle attacks.

Integrity checking is also impossible as WASM modules need not be signed by the author.

Some security-focused browser configurations can block WASM.

An Insider Look at CPython: The "Compiler-Interpreter"

A run-of-the-mill Python programmer may not necessarily think about CPython on a day-to-day basis. 

But CPython is an interesting thing to think about.

It is the reference implementation for Python, written in C and Python. C was used in theory to make portability easier - it's also more efficient (so there's no C++ or STL in there).

CPython is both a compiler and an interpreter. Python code is compiled (into bytecode) before being interpreted.  So you can think of it as a "compiler-interpreter".

One (potentially) painful feature of CPython is the Global Interpreter Lock (GIL) - and the GIL is used on each interpreter process - which means effectively only one thread can run at any one time (more explicitly, only one thread can process Python bytecode at any one time). While this simplifies the implementation, it becomes a bottleneck for CPU-intensive tasks.

Concurrency can be achieved by having multiple Python processes (which have by extension, multiple interpreter processes) and enable inter-process communication.  The Python multiprocessing module aims to make this paradigm simpler to implement.  This is however not available on mobile platforms or WebAssembly platforms.

UTM is Urchin Tracking Module

UTM is something you may come across first in URLs. 

UTM refers to Urchin Tracking Module, named after Urchin, the firm Google acquired in 2005 to form the basis for Google Analytics.

• utm_source denotes a tracking parameter in a URL - to denote where traffic is coming from
• utm_source=google indicates traffic came from google
• utm_source=email traffic came from an email

Google Analytics alternatives such as Plausible have been built which follow the UTM convention.

TypeScript in CodePen

Can you do TypeScript in CodePen?  

The question is valid as CodePen reveals three containers, one for HTML, one for CSS and one for JavaScript, in its default interface.

To enable TypeScript input, go to Settings, select JavaScript preprocessor and choose TypeScript. Other available preprocessors are LiveScript, CoffeeScript (billed as a "simple and elegant way" to write JavaScript) and Babel.

Note that CodePen will run TypeScript without type-checking errors blocking execution.

Bun - The JavaScript Runtime used by All (Cool Cats)

Bun is a fast JavaScript runtime. It's website is bun.sh (where the suffix sh denotes a St Helena domain). Bun is built from scratch to "serve the modern JavaScript ecosystem".

A major selling point of Bun is it starts fast and runs fast. It extends the performance-minded JS engine built for Safari known as JavaScriptCore. Fast start times leads to fast apps like Claude Code CLI.

Bun also boasts "cohesive DX" (developer experience) with a package manager, test runner and bundler all included.

Design-wise it has been designed to be a drop-in replacement for Node.js. Thousands of Node.js and Web APIs have been implemented in Bun like fs, path and Buffer.

Bun's ambition is to run most of the world's server-side JavaScript.

CodePen

CodePen is a web environment to experiment with front-end code.

Inside the Claude Code CLI

On 31 March 2026, Anthropic's CLI tool Claude Code that lets you interact with Claude for software engineering tasks from the command line - edit files, search codebases, manage git workflows and more - had its src directory leaked revealing TypeScript code with UI written in React and Ink (React for interactive command-line applications). It uses the Bun runtime - a fast JavaScript, TypeScript and JSX toolkit.

PowerShell Inspired Installations using iwr

iwr is the short form for Invoke-WebRequest which can be used in PowerShell via its aliases as iwr, wget or curl.

npm and pnpm - the differences

npm, the Node package manager, can be incredibly disk-inefficient. pnpm was created to be (literally) a "performant npm" sometimes also called "painless npm".

The difference lies in each others' ability to store packages. 

npm duplicates node_modules per project, resulting in a huge disk footprint, whereas pnpm uses a global store and stores links to the same, resulting in 70-90% space savings.

node_modules is a directory in a NodeJS project storing third-party libraries and dependencies.

TypeScript for Java and C# Programmers

There is a good tutorial here and also a basic (W3schools) one here.

An important point to note is that while TypeScript adds static typing to JavaScript, the underlying runtime is the same as JavaScript.

Recall that with static typing, the type of every variable and expression is checked before the program runs.  This enables errors to be caught at compile-time rather than run-time (in dynamic typing, by contrast, types are enforced only when code executes).

TypeScript is not a "mandatory" OOP language, in the same way as Java or C# (wherein the class is the basic unit of code organization - all data and behaviour is contained in a class). In JavaScript, and by extension TypeScript, this constraint is not present.  Functions can live anywhere. Avoiding OOP hierarchies where possible tends to be the preferred programming model.

In the spirit of not mandating classes for general programming, static classes are unnecessary in JavaScript. Singletons are also generally not used.

LoRA in Real Workflows

LoRA, or low-rank adaptation, is a fine-tuning technique for LLMs (one of many disparate techniques). 

The idea is to inject low rank matrices into large pre training models.

Recall that the rank of a matrix A is the dimension of the vector space spanned by its columns. This in turn corresponds to the number of linearly independent columns of A.

So LoRA is essentially a dimensionality reduction of the column space of parameters to ease off compute.

Books and Resources on AI Engineering

Apart from staying up to date through websites there are a number of good books on AI Engineering. Here is a recommended reading list.

AI Engineering, Chip Huyen (2025, O'Reilly) - really good book on building systems on top of LLMs. Chip's Github is here.

Hands-On Large Language Models, by Jay Alammar and Maarten Grootendorst (O'Reilly) - uses Python to convey an understanding of how LLMs operate under the hood, covers similar ground to AI Engineering - definitely worth reading. It has quite a few text processing canned examples which are quite interesting.

Mathematics for Machine Learning, by Deisenroth et al. - not as directly connected to AI Engineering but good at explaining some of the underlying maths of ML intuitively (and in somewhat long winded fashion - at least from an engineering perspective).

OpenAI's Open Source Tokeniser

OpenAI has created a Python package called tiktoken which is a BPE tokeniser.

Tokenising is something that's needed by chat interfaces (and other applications: compiler, interpreter etc.) to break text into tokens.

BPE stands for byte-pair encoding. It was described in 1994 by Philip Gage and a modified version is used in LLMs. The original algorithm is a clever compression technique replacing the most frequently occurring pair of bytes with a new byte not in the original data set, and uses as lookup table to recreate the original text. A modification extends this technique into tokenisation.

Lambda Calculus and System F

The lambda calculus is a theory that treats functions as formulas or expressions. 

Arithmetic is another example of a language of expressions.  

In arithmetic, you have variables (x,y,z..), numbers (1,2,3...) and operators (+, - ...). x+y then denotes the output of applying the addition operator to x and y and this can be extended to more complicated expressions. 

Lambda calculus extends this concept to functions. 

If we define a function f mapping x to x squared; then consider A = f(10); then in the lambda calculus we simply write A = (lambda x. x^2)(10). The expression (lambda x. x^squared) stands for the function that maps x to x squared rather than the statement that x is mapped to x squared.

One advantage of the lambda calculus, is it allows us to easily consider higher-order functions, i.e. functions with functions as inputs and/or outputs. 

An example is the expression f maps to f.f which takes the function f and applies it to the function f, the composition of f with itself. In lambda notation we write (lambda x.f(f(x)) and the operation that maps f to f composed with itself is (lambda f . lambda x. f(f(x)). You can see this is easy to extend to triple composition, and so on.

Technically speaking, lambda calculus is Turing-complete, that is, it is a universal model of computation that can be used to simulate any Turing machine.

Now lambda calculus can be typed or untyped, typed is more restrictive - we say it is weaker than untyped lambda calculus. In untyped lambda calculus we are flexible about domains and codomains. For typed calculus we have simply-typed - where we specify the type of every expression and polymorphically typed, where we have types of a specific form X->X but we don't specify the type.

System F is a form of polymorphic lambda calculus.

System F formalizes parametric polymorphism in languages. In so doing, it forms a theoretical basis for languages like ML and Haskell. 

System F was discovered independently by logician Jean-Yves Girard (1972) working in proof theory, and computer scientist John C Reynolds, who held positions at Edinburgh University, Imperial College and Carnegie Mellon.

The ideas aforementioned stemmed from interest and investigation in the 1930s into what does it mean for a function to be "computable" - in other words, have results derivable using (in principle) pencil and paper only.

Overhauling Legacy Software with AI

There are opportunities and challenges with modernizing legacy software with AI.

How AI helps break the cost barrier to COBOL modernization | Claude

What are "Distillation Attacks"?

"Distillation attacks" are a form of intellectual property theft whereby an attacker repeatedly queries a proprietary AI model and uses input-output pairs to mimic it. 

This removes the need to access or acquire the relevant training data or weights (the production process of which can be extremely expensive).

Anthropic, for example, has accused a number of developers in China of large-scale distillation "campaigns", namely DeepSeek, MiniMax Group and Moonshot AI.

Public APIs and Democratized Data

A directory can be found here.

Techie Startup Stories

Covered here.

Amazon Bedrock

Amazon Bedrock is the AWS fully managed platform for building generative AI services. It is basically (like LangChain) a unified API to call into various models and provides managed capabilities like retrieval-augmented generation (RAG), vector embeddings, guardrails and agents/agent orchestration.

Vercel

Vercel is a deployment technology that also exists as a GitHub app.

It's good for product teams that want to ship quickly without managing infrastructure.

Windows Baseline Security

Windows Baseline Security is something new for the Age of AI Agents.

The AI Agent Prevention Society

One of the obstacles to AI agents becoming all powerful is the technology infrastructure that actively seeks to obstruct agents.

This technology has various names, one being WAF, or web application firewall.  

The purpose of a WAF is to stop web applications from common attacks. 

Recall the OWASP Top Ten Risks? Some of the motivation behind these protections are good - for example, guarding against bot-driven DDoS attacks.

There are various vendors and products in this space; such as Imperva WAF, Cloudflare, Akamai Site Defender, AWS WAF, Azure Web Application Firewall and Google Cloud Armor.

These solutions are all effective at detecting and blocking agents, headless browsers, scrapers, credential stuffing bots (where leaked usernames and passwords are used across numerous websites to exploit potential duplication) and automated (even if legitimate) login attempts.

Action taken could range from limiting requests based on IP, presenting CAPTCHA challenges and blocking certain geographies.  However, these actions may prevent legitimate bots from using required services, or performing agentic actions on behalf of legitimate users.

Hushlogins

CloudFlare R2

The CloudFlare R2 Developer's Guide is good reading for developers needing to use this CDN.

Applications include storage for cloud native applications, podcast content as well as storage for batch process output.

Core concepts are Buckets and Objects.

Accelerating "safe AI adoption" is one of the company's current mantras.

Immutable Github Releases

Some software is distributed as immutable Github releases (this is for software supply chain security). One such example is Inno Setup.

Windows SDK

Windows SDK is needed for MSIX packaging. Windows 11 SDK includes Windows Performance Toolkit, Application Verifier for Windows and Debugging Tools for Windows.

Ingress and Egress Fees

Ingress and egress fees refer to the cost of data transfer into and out of the cloud.

• Ingress fees are typically zero - allowing users to upload data to Amazon S3 or Azure Blob Storage with no additional charge. 
• Egress fees are typically charged when data exits the cloud. These fees can differ significantly between providers and source and destination region.

Hosting on S3 will set you back $0 for 1 GB download per month, and around 1000 downloads of a 50MB file will cost you just under $5 a month.

Microsoft Store Policies

Microsoft Store (Windows Store) has policies on Product and Content, which developers must abide by.

There are a few rules around IAP - short for "in app purchases".

What is DXCore ... really?

Suppose you run wsl --version and see your DXCore version listed as 10.0.26100.  

This happens to be a similar version code to your Windows version. 

So, what is DXCore?

DXCore is the low-level engine inside Windows that talks directly to graphics hardware. It is the foundation layer that modern graphics APIs (like Direct3D 12) run on.

The IARC and Windows Software

The IARC is the International Age Rating Coalition, a global initiative to streamline age ratings for games and applications. Over 19m games and apps have so far been published using IARC. Developers must abide by the IARC Terms of Use.

Uploading App Packages to the Windows Store

There are a bunch of rules to follow when uploading packages to the Windows Store.

One hard requirement is a "Package URL" which is a versioned, secure URL pointing to the app package (MSI/EXE) hosted on your CDN.

An example could be https://windowscottoneyejoe/downloads/1.1/setup.exe

When a customer installs a package, the Store downloads the package from the URL. Good CDN practices should be followed - to ensure the URL is performant, reliable and available in your relevant target markets.

(Sidebar - Google have some great recommendations on CDN best practices (they also have their own commercial CDN products known as Cloud CDN and Media CDN, other vendors offer CDN services too, including CloudFlare).

Note: as your application versions evolve, you may need to update the package URL. This is done by using the Update submission option in Partner Center to specify the new package URL.

Windows Store Apps - Pricing

If you are a Windows Store developer, you have a few pricing options: Free, Freemium (optional in-app purchases, Subscription or Paid (one time payment).

Quick Guide to the GDK

The GDK, or Game Development Kit, enables developers to develop games on Xbox and Windows.

The Whats New page covers new developments to the GDK.

Do Not Commit csproj.user file

This contains per developer, per machine settings.

For example, when you last run a Debug session, it will have a record of what you selected in the dropdown next to the Run/Debug button under _lastSelectedProfile. This may also contain user-specific folder paths as well.

What is Ready to Run (R2R) Compilation in Visual Studio?

Ready-to-run compilation is a feature in .NET that improves startup performance by compiling them in Ready-to-run format. This is a form of AOT (ahead-of-time) compilation that reduces work for the JIT compiler as the application loads. Your binary contains IL and precompiled IL. It only works if you target specific environments such as Linux x64 or Windows x64.

Rust uses C++

Tales of the end of C++ are greatly exaggerated. 

Rust uses C++ in the form of LLVM which is built in C++. Sure, the Rust compiler (rustc - which was initially OCaml'd and rewritten in Rust) is mostly Rust with some legacy bits in C++, but the backend (LLVM) used for code generation is C++ code. 

The standard library has some C bindings too, but that's by the by.

The Return of C++ Tools in Visual Studio

Today - C# programmers must embrace C++ development tools. There is No Alternative.  C++ tools container the valuable link.exe to create standalone .exe files.  Publishing .NET programs as standalone EXEs needing no runtime need this toolkit. Install it! Give up that 1.5 GB of space for some C++ tooling!

How Does GitHub Copilot Analyze Unexpected Behaviour

Suppose you have a release EXE file that has an unexpected dependency at runtime on a DLL. Github Copilot will analyze your project file (Csproj) for build settings and request permissions to view the build log output from your most recent build. It then makes recommendations (e.g. fill in a missing step in the build to remediate your problem).

Where did the .csproj file go in Visual Studio??

Ooh tricky one.  Go to Solution Explorer. 

Double click on your project under Solution XYZ (1 of N projects).

It pops up.

If still stuck - GitHub Copilot always knows where it's hiding.

GitHub Copilot Integration in Visual Studio

GitHub Copilot integrates neatly into Visual Studio - if a little slowly.  A little green tick in the top right of your IDE shows you that Copilot is active.  You also get a "Copilot Consumptions" screen that shows you your consumption in terms of requests and code completions.

Control-Shift-A

Create a new resource in the Solution Explorer in Visual Studio.

Windows Application Packaging Project

The best way to build an MSIX.

Lift the Hood, Change the Oil

...understand all the components... This technology is so important to the future. You must have some tactical understanding of it. Recommends Jensen Huang, 2026.

The Most Important Part of AI is Applications

 ..all the layer underneath is just infrastructure stuff (Jensen Huang, 2026).

How Users Can do Side-Loading

Here's a how to.

• Double-click the .msix or .msixbundle file
• Install via PowerShell: Add-AppxPackage
• Deploy and distribute internally

Add-AppxPackage is a cmdlet.

WinUI Blank App (Packaged)

This is project template for creating a WinUI app along with a MSIX package for side-loading or distribution via the Microsoft Store.

Side-loading in the above case refers to installing an app outside of the Microsoft Store, usually by providing the MSIX package to users.

A Closer Look at System.Drawing's Bitmap Class

The System namespace is your root namespace for all foundational features in .NET. Primitive types (Int32, String, Boolean) as well as core base classes (Object, Exception) are found here.

The System.Drawing namespace is the home of GDI+ functionality (GDI+ is the enhanced form of the Windows Graphics Device Interface, or GDI, in use since Windows XP i.e. since 2001).

Within this, you have the Bitmap class, which represents a GDI+ bitmap where a bitmap is simply an image defined by pixel data.  The code lives in System.Drawing.Common.dll.

It is a sealed class, which prevents it from being inherited.

If you are missing the relevant package in your .NET project, run the following command in your project directory: 

dotnet add package System.Drawing.Common

(dotnet add package, adds package references to a designated project file, or searches the current directory for one if not specified).

Recover Solution Explorer

If you have closed Solution Explorer (for example, to have a more complete view of your code) then Control-Alt-L is the classic key combination to recover the Solution Explorer.

Enable Native AOT Publish

Native AOT (Ahead-of-time) deployment compiles your app to native code avoiding the need for a runtime. Compilation takes longer but the app runs faster, and with lower memory usage. Debugging may be more complicated relative to regular .NET applications.

The Solution Explorer project file contains the essential code required for this.

<PublishAot>true</PublishAot>

More details on AOT deployment here.

Top Level Statements (TLS) in .NET

Top level statements were introduced in .NET 9 as a way to avoid Main methods in .NET programs. This makes .NET programs look more like simple scripts.

STS versus LTS in .NET Versioning (STANDARD vs LONG)

STS and LTS have very specific meanings in .NET versioning. WinJoes must be truly on top of these different versioning schemes.

For example, WinJane may be faced with a choice to build a console app with .NET 8.0 (LTS) or .NET 9.0 (STS) and should understand the trade-offs between the two.

STS = Standard Term Support (NOT short term support, which might be seen as the natural counter to LTS).

STS releases have a shorter support window, faster iteration and more frequent updates. It is needed for developers needing newest features and ok with no multi-year stability guarantees. It is intended to keep the platform evolving quickly. Since .NET 5, STS releases have odd version numbers.

STS releases have a typical lifetime around 18 months, and LTS around 3 years.

Software teams have different strategies: 1) anchor on LTS for stability, 2) use STS to ride the innovation wave. Microsoft keep odd numbered versions as STS and even numbered as LTS.

Keep up to Speed with C# Language Design Discussions

The content of language meetings are detailed here.

Personal AI Assistants

Personal AI assistants are here, but security controls are askew.  

OpenClaw is an example of such an assistant.  It acts as a bridge between messaging devices (such as WhatsApp, Telegram, iMessage) and AI agents.

You will find OpenClaw "advertised" on openclaw.im (the im suffix indicates the country code top-level domain (ccTLD) for the Isle of Man. You don't need to be in the Isle of Man to have this domain, and it had become quite popular with instant messaging software with registrations from Meebo and Yahoo! amongst others (Meebo was acquired by Google in June 2012 at which point it had 100m users).

Some of its taglines include "Your Code, Your AI, Your Rules". Its GitHub location is here.

Ollama integrates with OpenClaw. In this context, Ollama acts as a local LLM provider.

GGUF = GPT-Generated Unified Format

GGUF is a special model file format used to run LLMs efficiently on your own computer. It stands for GPT-Generated Unified Format. It is the successor to GGML. Privacy-sensitive workflows are one application of these optimized-for-local execution model packages.

Using ssh-keygen from WSL to generate an SSH key

SSH keys are useful to enable access to networked resources.  

The command ssh-keygen (the OpenSSH authentication key utilit) can be used to generate keys.

Example usage:  ssh-keygen -t ed25519 -C "myemail@mydomain.com".  

The -t option signifies type, and ed25519 refers to the algorithm based on Elliptic Curve Cryptography using an Edwards curve (the recommended default - it competes with RSA which is needed for compatibility with older systems). The -C flag provides a new comment. 

What gets generated is actually a pair of keys, a private key (stored locally) and a public key (stored on the server, but reference copy is typically stored locally too, in your .ssh directory).  It is an asymmetric authentication (not encryption) protocol.

info ssh-keygen will help you decode other command line options for generating keys.

The generated keys are stored in ~/.ssh.

Managed HSM as a secure key storage option in Azure

Managed HSM (Hardware Security Module) is when you need the highest level of key protection in Azure. 

FIPS 140-3 Level 3 hardware is utilised.  

These are stringent security requirements set by NIST. They include: physical security through hardened enclosure and tamper-evident seals and active tamper-detection. The tamper detection includes detection of physical intrusion, temperature and voltage anomalies.

Azure Key Vault

Azure Key Vault can store keys (e.g. API keys) securely which can then be retrieved by applications at runtime. Passwords and certificates can also be stored in the vault.

Objects in the vault are uniquely identified by a case-insensitive identifier called the object identifier. It has a prefix identifying the key vault, object type, user-provided object name, and object version. 

The key vault section starts with https://{vault-name}.vault.azure.net or https://{hsm-name}.managedhsm.azure.net, for Managed HSM Pools.

Object types are "keys", "secrets" or "certificates". 

Object name must be unique within the key vault. Only digits, letters and dashes are allowed in the object name. The object name must be between 1-127 characters. 

LiteLLM

LiteLLM lets you make calls into a variety of LLMs using OpenAI conventions. Think of it as a lightweight model router. LangChain is somewhat similar - but with a bunch of added stuff on agents and orchestration.

OpenAI's Advice on Key Safety

OpenAI has a set of recommendations on key safety. 

There are basically two types of keys: API keys and admin keys (to check usage limits, quotas etc.). 

Read more on those recommendations here, also summarised below.

The first recommendation (rule) is do not share API keys. API keys are unique to users, even if those users are on the same team.

The second recommendation is that the OpenAI API key should not be exposed in client-side environments like browsers or mobile apps, which could allow malicious users to make requests as you.

Excel Data Validation Rules

Where to find data validation rules in Excel's ribbon? 

Data -> Data Tools -> click on the drop-down with a green tick and a red no-entry sign, then select Data Validation.

You can choose to allow any values, or restrict values e.g. to a list.

Software as a Production Line

Think of software as a production line. You want to automate all parts of that production line. And there are lots of pieces to automate.  Continuous integration and continuous deployment are components of that, but there are other elements not covered by CICD which also need automation. Automate everything.

iex in PowerShell

iex in PowerShell is Invoke-Expression - a cmdlet that takes a string and executes it like a PowerShell expression.  It's often used to run code fetched from external sources.

How Claude Code Works

Read more here.

Claude Code is an agentic assistant running in your terminal. It is an "agentic harness" around Claude.

Programming Work and AI

Using AI for programming makes you realise (if you haven't already) how much of programming work is mechanical.  

AI then becomes a high-level design partner once that low-level development is conquered.

At an even higher level, AI is the business partner that helps you decide what to build.

irm in PowerShell

The irm command in PowerShell is an alias for the cmdlet Invoke-RestMethod. This is used to send HTTP and HTTPS commands to RESTful web services and retrieve the response. It is used to interact with APIs and download data from the web.

Claude Code

Learn about Claude Code here.  When you log in to Claude for the first time, it asks you to identify three areas of interest. This could range from coding, learning to business strategy.

The conditions Claude will ask you to approve will be to acknowledge:

• Service may impose rate limits or usage quotas
• Output accuracy is disclaimed
• Output may be refused if it violates safety policy

Various Python Text UI Options

We have covered Textual in an earlier post.  Some other frameworks to build text UIs in Python include:

• Curses - a wrapper around Unix ncurses
• Rich - rich text formatting in the terminal

Python Textual Framework

Textual is built by Textualise.io. Applications can be run in a terminal or web browser. Here is a tutorial.

Blogger API and OAuth2

Read more here.  The latest Blogger API is v3. OAuth2 ("Open Authorization") is a standard protocol replacing OAuth 1.0 in 2012.

JDK Switcheroo for "Xamarin"

Read more here on the move from Oracle's JDK to a more lightweight version intended solely for Android development.

Your version of Visual Studio is no longer supported or serviced

Visual Studio has to be constantly updated. This is for security fixes, quality updates and experimental features. Sometimes, stuff gets removed, too.

Character format issues in emacs

The command cat -v is very useful to show control characters in a file. For example, if you want to debug unusual speech marks (Unicode used instead of ASCII) this is one way to do it.

Replit versus GitHub Codespaces

Replit lets you build and run applications in the cloud, from within a web browser. GitHub Codespaces replicates VS Code in the cloud / kind of replicating a full dev setup in the cloud.

dataclasses in Python

Classes that hold data - cool, right? But boring to implement. Python dataclasses have the solution. But check too what Pydantic has to offer. They are described in PEP557.

What is Pydantic?

Pydantic is used in a number of Python frameworks and libraries - for example, it is used in Langchain extensively.

Pydantic is a widely used data validation library.  

It makes extensive use of the annotations feature in Python. It is worthwhile to understand them in the context of type hints.

Deployment Toolkit (MDT) Support Removed - Try Windows Autopilot

Microsoft has removed support for its legacy enterprise deployment toolkit known as MDT (Microsoft Deployment Toolkit). 

This means no more updates (including for future versions of Windows) or security patches. 

Microsoft have recommended Windows Autopilot for cloud based deployment, or Configuration Manager operating system deployment (OSD) for on-prem infrastructure requirements, as alternatives.

Autopilot can be used to deploy Windows PCs as well as Hololens 2.

Fans lament that MDT was free and did not force Azure cloud adoption.

What is SASE?

SASE is Secure Access Service Edge, which delivers networking and security through a cloud service.

Analytics Libraries Expect Regularised Data

This is a recurrent theme in quantitative computing. 

Analytics libraries expect clean, regularised data, e.g. time series with no missing values.  Real-life data often has gaps and idiosyncrasies - it needs to cleaned often (to create a golden source) but even then subsequently rejigged based on the consumer need. 

This is akin to the Adapter Design Pattern in programming. In the Adapter you adapt an "interface" to another "interface" - for example, an XML dataset is "adapted" into a JSON dataset for JSON consumers.

Statistical libraries in particular are particularly picky about datasets and consistency, particularly when comparing datasets and trying to find relationships or errors between actual and expected values.

What a DataFrame truly is in Python

A DataFrame is actually a pandas.core.frame.DataFrame.

The list() constructor in Python

The list constructor in Python is interesting because there are evidently more obvious ways to create lists, namely via square bracket notation.  However, using the constructor directly has a number of use cases.

Here are some syntactical examples of using the list constructor.

empty_list = list()

tuple_to_list = list( (1,2,3) )

string_to_list = list("constructor") # creates a list made of individual letters as elements

Testing Prediction Models - Out of Sample Testing

When testing a prediction model, it is a good idea to do "out of sample" testing. 

This involves testing a model or strategy on data that was not used during model building or training. It thus evaluates how well the model performs on new, unseen data.

Python Internal Modules - The Underscore Convention

After debugging Python for a while you will certainly see some files with leading underscores. 

This is a Python convention to indicate the file is not part of the public interface of the module.  An example could be _mixins.py for a mixins class (this is used in pandas for example).  

When doing a "from package import *" any file with an underscore is not imported, respecting this convention. 

Sometimes an underscore can also be used to prevent name collisions e.g. implementing some JSON helpers in _json.py to avoid conflict with another json.py (pandas has this file too).

Pat yourself on the back if you have debugged into an underscore-prefixed file - you have ventured into the hidden depths of a package's implementation details. Good Job!

Python Debugger Survival Skills

There are many times you will need to use the Python debugger to understand why something is not working (oftentimes in a third-party library).

pdb - invokes the debugger

n - moves to the next line (can press carriage return - same effect)

s - steps into the code

It will certainly help you explore and understand more about how the third-party libraries work.

ARIMA in Python: Endogenous versus Exogenous Variables

The ARIMA model in statsmodels is described here.

Its constructor has the following initial arguments: ARIMA( endog, exog=None, order=(0,0,0),....).

• endog - observed time series process, y
• exog - array of "exogenous regressors"
• order - (p, d, q) model for autoregressive, differences and moving average component

Exogeneous regressors are added to the ARIMA equation where external variables may have some forecasting power. For example, electricity demand could utilise temperature as an exogenous variable.

The (p, d, q) component specification can be said to be the true "spirit" of ARIMA.

ARIMA methods were created by George Box and Gwilym Jenkins and are hence sometimes called  Box-Jenkins methods.

SARIMA extends this to Seasonal Data, where seasonal differencing is used to create stationarity.

Claude Code

Claude Code is built for developers - try it.

You can run it from a terminal (formerly only WSL).

Due to prompt injection risks, do not use it on codebases you do not trust.