Last Week in .NET

Two years of simmering discord came to a head last week as the .NET OSS maintainers openly revolted against the .NET Foundation for years of non-communication, the Executive Director resigned, and newly elected board members are left to pick up the pieces.

It was a wild week.

First, there was some discord due to the .NET Foundation saying a board member left ‘for personal reasons’ when in reality they left due to the nature of the .NET Foundation itself.

Second, during this brouhaha and when finding out the Executive Director merged a PR without communicating, the .NET community learned that their projects were moved to the Foundation’s Github Enterprise account without their consent, that the DNFAdmin service account was basically a trojan horse (an actual Trojan Horse, not the virus variety), and that even if they signed the ‘contributor model’ contracts, they may not own their own projects.

As I said, it was a wild week.

So, the Executive Director apologized, not for the lack of communication, or moving the projects to the .NET Foundation’s Github Enterprise account, or misstating why Rodney Littles II left the board, or for the fact that the foundation has not been up front with what it means to have a project join the .NET Foundation, but for… forcing through a PR on a project that the foundation ostensibly owned.

Naturally members of the community asked for the Executive Director’s resignation, and they got it. And we sit, a few days later, watching more communication from a single member of the board than we had from entire previous Boards of Directors, particularly around most of the painpoints the community mentioned previously. One of the board members spoke up during the incident but said nothing of consequence, except to say, “Likewise, I think that the community and projects may have not understood what they were agreeing to when they were brought under the .NET Foundation umbrella.”. That’s what we in the biz like to call an understatement. I’m also not the only person to call this entire thing a brouhaha.

And since I’m writing this newsletter, I get to have my say.

I don’t think Claire Novotny should have resigned as the Executive Director of the .NET Foundation. I believe her to be a scapegoat for the structural issues the .NET Foundation has, as I’ve written about and spoken about previously. We’ve had entire Boards of Directors come and go from the .NET foundation with nary a peep from them in public about their work, no after-action review or postmortem, nothing outside of their initial interview to become a member of the Board of Directors.

I believe if anyone should resign, it should be the Boards of Directors. They ultimately are responsible for what the Executive Director and what the .NET Foundation does, and while half the board is fresher than a prince from Bel-air, the other half aren’t, and in some form of irony, it’s only the new people who are speaking out. I think they’re Good People, but they either have no idea what they’re doing or they haven’t seen and felt the issue simmering for the last few years, in which case they most assuredly shouldn’t be representing the community in the .NET Foundation.

It really all comes back to a single question: What does the .NET Foundation do? or, taken further: Why does the .NET Foundation exist?. We haven’t really gotten an answer to that question yet; especially the vague “commercially friendly” mission statement.

I’m willing to bet the Board of Directors haven’t been taking minutes for their daily meetings over the past week, even though the bylaws require them to, and so I’ve taken to asking that the bylaws be amended to require that the minutes are shared for review by the membership of the foundation.

If the .NET foundation is going to exist, then it’s going to have a vision and a purpose. If you care about .NET and the future of .NET, you should be right there, holding their feet to the fire. Otherwise we’re going to get what we’ve always got, a mono-culture that seeks to fulfill Microsoft’s whims about .NET; not what the actual OSS community wants or needs of .NET.

With that bit of news in the can, let’s see what else happened Last Week in .NET:

📚🔥Facebook went down, and of course since it wasn’t DNS it had to be BGP. Honestly I can’t explain BGP to you. I’d like to, but I can’t. Back in the day when I was building a product to discover and map legacy networks, a network engineer took me aside to explain BGP to me and the nightmares didn’t stop for weeks. I’ve since blocked out most of it except for “it’s a way for networks to tell other networks how to route to them”. It’s astonishing that anything works and that we aren’t all finding a desert island to inhabit, away from people and technology.

🧓 Maybe because of, but certainly related to in some form, I learned what a Basil Hayden Old Fashioned was from Adam Rackis, and it sounds delicious. Also if you’re making Old Fashioneds in your kitchen and you have a gas stove, you can use the burner to burn the inside and outside of the orange peel, which apparently helps with the flavors of the orange.

🦄 Either SQL is old or SQL is new again and I can’t figure out which because C# 9 loves some SQL keywords like is, or, and and. If a C# developer fell asleep between 2013 and 2022 they’re gonna be really confused as to the language they came back to.

📅 I did it before it was cool, but Jetbrains released their .NET Annotated Monthly for October 2021, and if you really want a list of links in a monthly format, you could read this list, or just wait and not read LWiDN for a month and read it all at once.

📞 The iPhone 13 can finally photograph dark-skinned folks. This is why diversity in tech matters. 14 years of phone-based cameras for non-white people to get good photos. That’s far too long.

📨 The Register covered Rodney Littles resignation from the .NET Board. They have also previously covered other tech issues like the various

The biggest news this week (and will likely trump any sort of news for the next couple of weeks in the Microsoft space) is that Azure has a vulnerability dubbed “ChaosDB” that exposed its customers keys to the world, leaving every single CosmosDB customer’s database data exposed for the taking. There’s a technical deep-dive into this vulnerability as well. I hope the Azure team is wearing their brown pants.

This is as bad as it gets. Good news though! They gave out a bounty of $40,000 to the finder of this vulnerability. Which values this vulnerability as akin to a Tesla Model 3 — and not even a fully decked out one.

Apply rounded corners in desktop apps for Windows 11. In some cases, rounded corners will be applied to your applications automatically, in others, here’s what you can do to make them rounded. As Apple intended.Razer Bug lets you become a Windows 10 admin by plugging in a mouse. This is a pretty easy exploit to… well.. exploit, so if you’re using Razer mouses in a corporate context, you may want to rethink that decision.The real names of features in Visual Studio. It’s a bit inside baseball, but still a wonderful walkthrough.David Fowler writes to tell us that New .NET 6 APIS [are] driven by the developer community. In this blog post, David details new APIs available in .NET 6, and highlights the fact that well, they were authored by members of the community. I’m a fan of Parallel.ForEachAsync, as that seems rather useful for my needs.This is your warning: Get out of the Dev Channel for Windows 11 unless you want to experience some turbelance. If you want stability, use the beta channel or get out of the insider program entirely. If you want to see new builds of Windows 11 that may have the stability of Windows Vista, stay in the Dev channel.Nicole Miller-Abuhakmeh is the new Community Manager for the .NET Foundation. This is a wonderful choice for CM, congrats Nicole and the .NET foundation.Looks like there’s another tactic available to exploit Proxyshell vulnerabilities. A few weeks ago, a researcher showed off an exploit of Microsoft Exchange Server dubbed ‘ProxyShell’ and it seems like the gift that keeps on giving to attackers. Bottom line: keep your Exchange servers up to date.In .NET 6, FirstOrDefault(), LastOrDefault() and SingleOrDefault() now let’s you specify a default value. Sadly it has to be a compile-time constant so you can’t have something like new Random().Next() available.Microsoft Ignite is November 2-4, 2021 and is virtual again this year because people can’t bother to vaccinate.

No releases this week; but lots of interesting tidbits nonetheless. If you read just one article this week, check out “The Myth of the Treasure Fox”. Link below, of course.

Get the Drop on Sorting. Kevlin Henney does a deep dive on the drop-sort, a sorting algorithm that sorts by dropping elements in the collection. This is not as useless as it immediately appears, and Kevlin explains why. It’s engaging and informative.In a screenshot that is strangely alluring Maarten shows off what VB looks like in the brave new world of .NET 6, with a pattern based XML Literal. If I were to rate VB on this screenshot alone, I’d give it a 12/10. Having worked in VB, I give it a 4/10. It’s slightly ahead of the readability of JavaScript 5, and slightly behind Python. These ratings are final.Chat Wars! How microsoft tried (and failed) to keep MSN compatibility with AIM. If AIM and MSN were still alive, they’d have graduated college by now and be grumbling about the state of the job market. I mean, they unemployed, strictly speaking, with AIM having been retired in 2017, and MSN Messenger having been retired in 2014..NET 5 Support of Azure Functions OpenAPI Extension Yes, now Azure Functions support .NET 5 for OpenAPI Extensions. If you, like me, have no idea what that is, then this blog post isn’t for you! (It’s becoming increasingly clear that these blog-posts with keyword laden titles are there to help hit some sort of internal Microsoft KPI related to pushing Azure). “George, you’re being unfair!”, I can hear you say. If I’m being unfair, then why aren’t these blog post titles telling you the outcomes they can help you acheive, instead of keywords of processes related to their own products?No, NVidia Didn’t Fool Everyone with a Computer-Generated CEO In case you missed this, NVidia used a Computer Generated capture of its CEO for a short scene in its presentation, but their initial blog post on the subject made it seem like they used the CG’d CEO throughout. It’s still impressive, bu tnot nearly as impressive as initially made out to be.Microsoft revamps Visual Studio JavaScript projects in forthcoming version. Visual Studio will now rely on whatever the ‘system’ has installed for JavaScript frameworks when creating a new JavaScript-ish project in Visual Studio 2022. I assume it will work seamlessly with things like nodeenv and other virtual environments, and if it doesn’t that would be a bit embarassing, wouldn’t it?.NET Optional SDK Workloads This came about because I saw the word ‘workload’ in reference to .NET, and had no idea what it meant. It means a way to extend the SDK to do other things than it’s meant to. I can’t figure out if this is a public thing (you too can write extensions for the SDK) or if this is a Microsoft Only addition, or who this is even for.A Decade Later, .NET Developers Still Fear being ‘Silverlighted’ by Microsoft. Killing Silverlight was the closest thing .NET Developers had to experiencing the Red Wedding. An entire developer stack killed overnight. I don’t claim there’s any sort of ‘guest right’ when it comes to Technology Stacks, but there’s a certain amount of creative destruction taking place that Microsoft was not known for previously. They have several hundred projects to kill to even get close to Google’s bloodthirstiness. There are, of course,

Releases

🔮 Magick.NET 8.2.0 has been released which is an image manipulation library for .NET.

📢 Windows App SDK 1.0.0-experimental has been releasedand Kevin Gallo attended the App Development Community STandup to underscore why it’s an important release. The release notes tout several experimental features, push notifications and windowing improvements.

📢 Visual Studio 2022 Preview 3 now available! This preview release includes improvements to the Dark Theme, added new JavaScript and TypeScript project types, and because of course they did, easier one click publishing to Azure DevOps.

📢 Announcing .NET 6 Preview 7. There’s new .NET SDK templates that use the latest C# features and now there’s literally a one line console application template. Everyone wants to be like Perl.

📢 .NET 5.0.9 has been released. There are several CVEs resolved in this release, including CVE-2021-34485, an information disclosure vulnerability related to crash dumps, CVE-2021-26423, a Denial of Service Vulnerability, and CVE-2021-34532 which is an ASP.ENT Core Information Disclosure Vulnerability, this time areound logging JWT tokens that are unparsable.

📢 .NET Core 3.1.18 has been released and these same vulnerability were backported from .NET 5 to this release.

🙌 Github Codespaces has been released and you can access it from any repository by pressing the period key. Yes, launch a Visual Studio Code instance, in your browser, already targetting a repository with a single keypress. That’s pretty remarkable and allows me to forgive the many sins JavaScript committed.

News and Notes

🙋‍♂️ Microsoft abandons semi-annual releases for Windows Server. Opting instead for the ‘You can have frequent updates if you want to use Azure’ which already fills this week’s bingo for requiring Azure needlessly because it’s on someone’s KPI. Joking aside, this is a dive into marrying frequent Windows Server updates with using Azure HCI (Hyper Converged Infrastructure), and it appears that Windows Container updates will now be married to that same infrastructure. Just as well, I suppose since outside of Azure, Windows containers are as rare as an honest politician.

❓ Microsoft deprecated the Snipping Tool, and asked everyone top move to Snip/Sketch and now they renamed Snip/Sketch to Snipping tool, and we’ve once again been reminded that naming is hard for Microsoft.

📹 Aaron Stannard is hosting a webinar called “Introduction to Akka.NET Streams” on August 27th. If you’re interested but your dance card is full on the 27th, you can register and watch later.

🗣 .NET Conf is November 9th-11th, 2021 and the CFPs are open. As usual I’ll be live-tweeting the interesting bits of the conference.

🎉 Jetbrains is celebrating the release of 2021.2 of Resharper and Rider with a … party? This ‘party’ is being livestreamed on August 17th, 2021 at 10:00 EDT (-4 UTC).

‼ One of the more interesting bits of Visual Studio 2022 going 64-bit is that ReSharper can now use more memory. Previously it shared the max 4GB of memory with VIsual Studio. Will performance improve? We’re given a vague “it depends”, which is… fitting.

🤷‍♀️ Windows 11 FAQ: Here’s everything you need to know says ZDNet. If you’re looking to upgrade, here’s what you need to know: Buy a computer with a new processor.

🥔 CodeMash 2022 CFP is open, and closes August 31st, 2021. I haven’t been to Codemash myself, but I’d love to attend.

🦷 .NET Core 2.1 is end of life at the end of August. It’s getting pretty long in the tooth so migrate now.

🥈💡 Getting off Microsoft Silverlight for Good Silverlight goes out of support in 57 days, and Mobilize.NET, a consultancy that helps companies migrate off of it want you to know this.

🥇 For the F# Folks, Don Syme, one of the language team members for F#, talks about active pattern matching in F# and why it’s superior to alternative forms of matching. I mean you wouldn’t expect an F# person to ever say it isn’t superior, would you?

and lastly, and because I’m obligated to report it but not because I care:

🤑 Microsoft and Amazon battle over yet another $10 billion U.S. government cloud contract. Last time Amazon protested Microsoft winning a DoD Contract worth $10 Billion, and now the shoe, as they say, is on the other foot. However, this time it’s the NSA, and I can’t find the words to care about the plight of the trillion dollar companies.

Microsoft sunsets OneNote, only to expand OneNote, and the .NET Compiler has a bit of chaos inside of it. Let’s get to it.

⛔✅ David Fowler, member of the .NET team, writes that “null checking in C# has gotten out of hand”. David’s right, of course, and a follow up tweet in that thread narrows it down to merely three methods to checking for null. Another day, another chance to tap the sign: Just because you can doesn’t mean you should. It’s felt like that ever since C# was de-coupled from the .NET Framework, the language has exploded with new syntax; and yes, while newly divorced people sometimes do go through a sowing phase, you reap what you sow.

👨‍🦯 Adam Lein breaks down the user experience and human centered design problems with Windows 11.

🚫🍆 Announcing Code of Conduct Enforcement Services for member projects!. The .NET Foundation now provides CoC enforcement across all .NET Member projects. If you’re a dick in one place, you’re going to get banned from all the places. Don’t be a dick.

💳 Techbash Tickets are now onsale Appropos of the current delta variant issues, Techbash has also kindly responded to my request for information about cancellation:

📹 Humans of Microsoft S02E01: Abel Wang You may know that ABel Wang passed away recently; but we are lucky enough to live in an age where we can hear his words even now. In this video Abel talks about life, health, and his favorite software project ever.

1️⃣1️⃣Top 11 things you can do to make your app great on Windows 11 This is a good list and it dovetails nicely with the design issues in windows 11 we spoke about previously. We never successfully got Winforms applications to be updated to WPF, and now suddenly we’re expecting three generations of old Windows applications to get updated to Windows 11. So long as software backwards compatibility remains paramount to Microsoft’s business arm, design will suffer.

🏃‍♂️ Install WSL with a single command now avialable in Windows 10 version 2004 and higher Now dropping Windows is just a command away. This reminds me of using Internet Explorer to install Chrome back in the day.

🐦 One thing I missed last week is that Random.Shared is available in .NET 6. Yes, a threadsafe Random API, as opposed to a threadsafe random API.

📃 There’s a List of Features available for all the C# versions; including what’s coming in C# 10 and C# Next and with no hint of irony at all towards the ample ways to check for null in C#, there’s a parameter null checking proposal.

⚡ There’s word that LINQ statements will be twice as fast in .NET 6 than they are in .NET 5. David focuses on performance so I have no reason to doubt his word, and apparently the benchmarks will be coming soon.

🚗 Rider 2021.2 has been released and it now includes Blazor WebAssembly debugging, support for removing redundant suppressions, support for refactorings in source generators, and lots more.

📹 The monthly .NET MAUI Community Toolkit Standup was last week.

🙃 A helpful safety tip: Stick to the Beta channel if you’re on Windows 11 Preview, with the Dev channel you can’t go back.

🧵 Infoworld’s SImmon Bisson talks about project Coyote: a way to unit-test multithreaded asynchronous C# Code You can learn more about Coyote on its project site.

🔓 Some Infosec folks looked into the ‘base’ level security in Windows 365 and were… not impressed. From cleartext password dumps, and making everyone admin, it’s a little embarassing what the out of the box settings are.

🌇 Microsoft to Sunset OneNote for Windows 10, OneNote is the Future That sentence is not a typo. Apparently there were two different applications called OneNote, and now in the future there will be one. Also, Microsoft clarified that they are not building a third application called OneNote. Just ‘evolving’ the current applications.

💥 There seem to be no end to the ways pistachios can kill, suffocation, explosion, and fire, to spoil the lede.

💁‍♂️ If you’re running ASP.NET Core on IIS, make sure you’ve enabled the UriCacheModule. It’s recommended for ASP.NET Core deployments but is not enabled by default. Let’s pour one out for everyone still running ISAPI.

💁‍♂️ Marc Gravell reminds us that not even the compiler in .NET can reliably tell he declaration order of types or members. If your product depends on that being knowable, you’re in for a world of pain. It’s also worth noting that this knowledge is about as inside baseball as it gets; and yet at least one of you has written a hack to deal with it.

🥴 Semver doesn’t mean MAJOR.MINOR.PATCH, it means FAILS.FEATURES.BUGS. No, this has nothing to do with .NET, but it is insightful and funny.

And that’s it for what happened Last Week in .NET. I’m giving a free webinar on August 18, 2021 about Event Driven architecture: Bringing Order to Chaos. If you’re thinking about breaking up your monolith or moving to microservices, this talk is for you.