Last Week in .NET

Last Week in .NET

By George StockerNewsTechnologyTech News
Download on the App Store

Last Week in .NET episodes

  • Jargonesque

    This week's newsletter is late because my wife and I were gone all weekend for our 10th anniversary. I am chagrined and refreshed all at the same time. With that said, let's get into what happened Last Week.

    🙅‍♂️ Microsoft Teams is now available for personal use. I want to have the confidence of the executive that this would be a hit. Also in a facepalm moment, you must have both a Microsoft Account and a Phone number to use Teams for personal use. Stop making Live.com a thing. It's never going to be a thing.

    ⌚ Project Reaqtor is open source and to quote the parent, it "provides a set of framework components that enable devs to build distributed event processing systems across cloud and devices". It sounds cool, but the number of use-cases that need something like this is small. You can also read about the history of Reaqtor, and @geoffreyHuntley has a twitter thread that includes the highlights.

    🥓🥞 There's a community standup concerning Project Reunion's 0.5 release. Kevin Gallo and Seth Juarez bring you the latest on Project Reunion, which sadly is not a reference to getting the actors from The Breakfast Club back together.

    🚫 Replacing Thread.Abort() in .NET 6, .NET 5, and .NET Core The story here is that Thread.Abort is not in .NET Core, and so what should you do instead? "Don't ever try to abort a thread" is apparently not the right answer.

    ☠ Microsoft is finally retiring Internet Explorer in 2022 Because money is more important than security, Edge will support ActiveX to ensure businesses don't ever have to invest money in upgrading their systems.

    ⏲ Enhanced Date, Time, and Timezone support is coming in .NET 6 Preview 4 You will now be able to have a date without a time, and vice-versa. My presidential platform remains committed to the abolishment of timezones.

    🌪 Introducing EcoQoS Microsoft is putting ecological sustainability in software because Intel will never be encouraged to dump x86.

    📚 You can now download Microsoft's Hybrid Workplace Flexibility Guide reminding us that danger comes in many forms. The form present in this 'guide' is corporate jargon. It's hard to dispute something when you can't understand what the hell they're trying to say.

    It's a light week because Build is this week; and so next week's Last Week in .NET will be all about Microsoft Build. Confused? Not as much as you would be if you tried to read the Flexibility Guide.

    4 min
  • Barn Door Security

    🔧 Dave a Brock writes on how to use Configuration with C# 9 Top Level Programs One of the nicer features of C# 9 was pulling out the ceremony of the Main method. Dave uses this blog post to show how you can use configuration in this new world of no Main method. Now if only there weren't years of documentation showing varying ways to use configuration for varying versions of .NET Core.

    📔 There's an Adobe Reader 0day vulnerability that's been exploited in the wild this is part of CVE-2021-28550, and as usual patch when you can, as soon as you can.

    💣 Fragattacks.com documents "Fragmentation and aggregation attacks" against Wifi. It's shockingly clear from the website name that no one involved ever read about the Vietnam war.

    🌼 CVE-2021-31204 is an Elevation of Privilege Vulnerability that affects Single File Deployment applications on Mac and Linux and the latest patch fixes this vulnerability; so again, patch your systems if you're on .NET Core 5.05 or lower, or .NET Core 3.1.14 or lower.

    Speaking of that latest patch,

    📢 .NET 5.0.6 has been released and includes the CVE fix I mentioned before as well as a smattering of bug fixes.

    📢 .NET Core 3.1.15 has been released and has that CVE fix and some SignalR fixes, among others.

    📢 Visual Studio 2019 Version 16.9.5 has been released and this update includes a lot of estoric sounding stuff that you'd proably not even realize was an issue. What you would probably notice is that this version now includes Xcode 12.5 support. This version also fixes the aforementioned CVE as well as CVE-2021-27068 which is a Remote Code Execution vulnerability that could affect you if you use Python.exe in a scripts subfolder. If you do use Python with Visual Studio I'd like to point out that you're rarer than an honest politician.

    🏴‍☠️ [Microsoft] Office based malware is "one of the biggest threats to companies" and yet it seemingly gets very little attention from Microsoft on how to mitigate it. Instead of making a better zipper, Microsoft chooses to tattoo "Remember to close the barn door" on people's hands.

    📈 Build is May 25-27, 2021 register now to hear three days of Azure Marketing KPIs being realized.

    📢 Speaking of Microsoft's Marketing KPIs which, Azure Static Web Apps is now GA. If you have a static website, and you aren't enamored by the plethora of other possibilities for static site generation, to include Hugo, Ghost, Netily, Github pages, you now have... Azure. The least cool (and probably most corporate) option.

    ⏩ FileStream operations are getting faster in .NET 6 to the tune of 2.5 times faster reading a 1MB file, and writing is 5.5 times faster. If you're an allocation junkie, they drop in .NET 6 from 39Kb to 192 bytes. For all you corporate behemoths out there that have corned your market, it appears that blowing everything up and starting over does have some perks.

    🛅 Microsoft is shutting down its Azure Blockchain Service which was abbreviated "BaaS", which I maintain stands for "Bullshit as a Service".

    📢 TypeScript 4.3 RC is out and this is your periodic reminder that TypeScript -- even though it transpiles down to JavaScript and uses NPM -- does not, I say again, does not support SemVer, so every release is potentially a breaking release. This release is no different, so plan accordingly. Another note, they did not drop this release with a version suffix on "Release Candidate", reminding us that Programmers are nothing if not optimistic.

    📢 Visual Studio 16.10 Preview 3 has been released and the big note here is that the compiler is now "C++20 feature-complete". I've never actually seen a masochist in the wild; but I have to believe someone that still uses C++ qualifies. For the rest of us, There are improvements in MSBuild based code-bases. I have no idea what that means but if it affects you, you probably do.

    🎁 try-convert v0.7.226301 has been released If you want to port .NET Framework projects to .NET Core, try-convert is your huckleberry. Also, holy cow does Microsoft's versioning vary among teams.

    🏫 Let's Learn .NET: Accessibility is happening on May 21, 2021. This big note here is that not only will you learn more about accessilbility in general and using ASP.NET Core, you'll also learn how to improve Accessibility in Xamarin.

    That's it for what happened Last Week in .NET, Thank you, and I'll see you next week.

    7 min
  • 49.7 First Dates

    👽 Do you live in the UFO Hotspot? Boing Boing Asks, and my answer is: "What answer gets the aliens to come and take us away from this madness we call 2021?"

    🥤📦 CVE-2020-15257 has been dubbed "Abstract Shimmer". I hear "shimmer" and I think "thirst trap". So yea. A CVE has officially been called a thirst trap. Free Association is one of the many reasons why you subscribe to this newsletter. And what is a thirst trap if not getting someone to click a link to look at what you want them to?

    🕸 Progress Delayed is Progress Denied says Alex Russell about Apple's ban of iOS apps that don't use their browser engine. This has nothing to do with .NET, except tangentially (hi, Xamarin folks). But, it's an interesting read nonetheless.

    🕹 SwiftOnSecurity has a thread about games that overwrote system memory due to ingame actions. This is not that TayTay, but it is that TayTay. If that confuses you, welcome to twitter.

    🏠🏗 Tomorrow, May 11th, 2021, Jeff Doolittle will talk about how REST Wrecks Microservices I agree but I don't know if we have the same reasoning. I'm currently snorting the Event-driven architecture powder, so I'm against inter-service communication using HTTP for that reason; but I guess we'll have to attend the talk to find out.

    ☠ Yes, there's another attack against CPU caches Short version: "Bad". Very Bad.

    ☠ Prime+Probe cache side-channel attack implemented using CSS And you thought the alien come take us away comment was weird. Now here it is in context. Not even CSS is safe.

    👬 Is the era of reflection-heavy C# libraries at an end? Marc Gravell asks, and the answer is "Yes, if you can stomach the re-work you have to do." So in reality the answer is going to be "no" for a very long time.

    💔 Bill Gates is getting a divorce in case anyone is looking for a Sugar Daddy. Be careful though, he apparently associated with Jeffrey Epstein after the truth about Epstein came to light.

    👍 Microsoft now uses the Contributer Covenant 2.0 for their open source projects.

    🚫💰 Newtonsoft.Json hits one billion downloads Billion with a "B". If Open Source were sustainable, James Newton-King should probably have millions coming to him from all the commercial entities using Newtonsoft.Json, but instead he gets to deal with Github Issues.

    🤯 Weird ways to execute unmanaged code in C# Because we need more ways to shoot ourselves in the foot.

    📅 Is your .NET application acting up every 49.7 days? If so you should read this github issue. Bug opened due to perfomance latency with JsonPlatform, and it turns out the Ticks is a signed integer that goes negative (wraps around) every 49.7 days. See? I told you it was amusing.

    🎹 David Fowler is playing name that tune with ASP.NET Core We're now down to three lines (last week it was 7) to have a running web application in C#.

    ⏏ Microsoft is finally ditching its Windows 95-era icons I would pay for a Windows 95 Remastered edition on Windows 10. That's the window manager I want, a remastered Windows 95, not this flat sh*t that I can't tell where the buttons are. Yea, I said it.

    📚 Microsoft has released a set of Incident Response playbooks I checked, and as expected they don't yet have a response to "Github and Microsoft has contracts with ICE".

    👋 The Rijndael class is now obsolete and if you know what I'm talking about then the word 'crypto' has at least two meanings to you.

    🐐 You can now pack a Readme.MD with your nuget package and have it display on nuget.org How long until Goatse makes an appearance?

    💰 Microsoft's Barry "I have a bean fetish" Dorrans releases a statement about the commercialization of Identity Server Long story short, The status quo will stay the status quo. For now. This has real Darth Vader vibes to it, if I'm being honest.

    🐍 The Virtual ML.NET Community Conference 2021 - Day 1 videos are up I try to limit my snake-oil ingestion, so I'll pass, thanks.

    That's it for this week. If you have some interesting .NET Content, reach out and let me know at [email protected]. I'll give you a plug and everyone on this list will get to share in your joy.

    7 min
  • Pour One Out for .NET Framework 4.6.1

    ☠ .NET Framework 4.5.2, 4.6, 4.6.1 will reach End of Support on April 26, 2022 At least, that's the word right now. Governments around the world are still using Windows XP, so it's not like this is a firm 'end of support'.

    🤡 Basecamp lost a third of its employees after a controversional series of blog posts last week A CEO couldn't destroy their company's reputation any faster if they tried. This is truly impressive in the depth and breadth of DHH and Jason Fried's stupidity here.

    🎁 The Developers @ Redhat blog has a blog post titled "Some more C# 9" Lots of goodies in here that people who write unsafe code will want to know about.

    🔎 .NET Interactive video up for watching Cecil Philip and crew take you through what .NET Interactive is, and how to use it.

    📅 .NET Days (produced by Jetbrains) is May 11-12, 2021 No need to attend if you can't -- the videos will be available online after.

    📢 Akka.NET 1.4.19 has been released This maintenance release, includes (quote)

     "Akka.NET v1.4.19 is a substantial release that includes a number of critical Akka.Cluster fixes, baseline Akka.NET performance improvements, and entirely new dispatcher that has shown to improve performance when used across all of the major actor groups that run both inside the /user hierarchy and the /system actor hierarchy as well."

    🛑 If You haven't updated Windows 10 in the last week, maybe wait a bit longer? Looks like last tuesday's update can cause your system to ... misbehave. Looks like the problem centers around WSL2.

    👨‍💻 The "State of .NET" on Survey is done, and the results are... not great 92% of respondents were dudes. That's embarassing.

    🌨 Easily build real-time apps with WebSockets and Azure Web PubSub—now in preview Being a cloud provider means having terrible naming

    📅 Microsoft's Build (virtual) conference is May 25th-May27th, 2021. I don't see conferences like this going back to in person. The networking is the real value (and the free stuff Microsoft gives away).

    4 min
  • Microsoft's MVP Program has a new requirement: Shilling

    Not many releases last week, but lots of shenanigans. I spelled that word on the first try which matters not a whit to anyone else but I'm proud of myself. The shenanigans themselves are an age old story: Big Corporation finds feeble consumers, and exploits them.

    🤑 Microsoft pushes MVP Influencers to Spruik Azure in Lead up to AWS: Reinvent. That's the headline, here's the story: Microsoft wants the community MVPs to shill for SQL Server on Azure and claim it's cheaper and better, when the fact that SQL Server is more expensive on AWS is due to Microsoft's own shenanigans. When an MVP called this out as the bad behavior it is, Microsoft removed them from the MVP Program.

    Microsoft seems to want MVPs to shill for Microsoft, forgetting that any of the trust these MVPs have is because they don't shill for Microsoft.

    🚚Meet the .NET Upgrade Assistant, Your .NET 5 Moving Company In this blog post, Dave Brock from Telerik

    🌊'Agile' F-35 fighter software dev techniques failed to speed up supersonic jet deliveries In other news, water is wet, and Government agency buys into marketing hype and complains when they were hoodwinked.

    🕹There's a series on building Testris in Blazor A fun way to learn blazor, no doubt.

    📢Visual Studio 2022 is announced and it includes making Visual Studio 64-bit. A lot can change in 10 years, especially when the world changes around you.

    ⬆Update existing projects to the latest release of Project Reunion The latest stable release of Project Reunion is 0.5.5, and as it says on the tin this blog post shows you how to upgrade.

    💰Octopus Deploy raises 172.5 Million in venture capital The 500K on the end seems like an odd number, doesn't it?

    🏬Microsoft is building a new app store for Windows 10 in major revitalization effort. Microsoft is, at its heart, an enterprise software company. It's the only way to explain why so many of their consumer efforts have failed. To have a successful app store, you have to give developers a compelling reason to write for it and for consumers to adopt it. As of yet, neither has happened with desktop App stores.

    💸NetEscapades.AspNetCore.SecurityHeaders 0.14.0 has been released and it supports opting out of FLoC. FloC is a Google's replacement for Third party cookies. You know Google, right? The Ad giant and owner of the web browser with 90% market share? Neither of those facts say that Google "has the best interests of its users at heart".

    🐧Windows now supports Linux GUI Apps Somewhere the founder of Lindows is crying.

    🔚David Fowler shows off how small ASP.NET Endpoints will be in the future A svelte 7 lines to get an endpoint. Of course, there's no Authentication, Authorization, or any of the database connection code, but still. 7. lines.

    ☁You can run and debug AWS Lambda from Jetbrain's Rider. I have nothing snarky to say here. This is just cool.

    🐣Intro to Uno Platform, Intelligent Virtual Agents and Cloudflare These three topics are brought to you by scattergories and the Cape Town MS Developer User Group.

    💨EF Core is now at 93.5% speed of Dapper. Well known enough for Microsoft to compare to, but not backed by enough money for Microsoft Legal to care enough to change the name of "Dapr" to something that doesn't conflict.

    7 min
  • The NSA requests you patch your stuff

    🚨🚨🚨🚨Microsoft Exchange has four new vulnerabilities with patches. CVE-2021-28480, CVE-2021-28481, CVE-2021-28482 and CVE-2021-28483. For some things the cloud does not make sense, but for the "I really don't want to deal with patching my own stuff", the cloud makes sense. Maybe it's time to migrate to O365, if you haven't already?

    By the way, this is so bad that the NSA is actually telling everyone about these flaws immediately.

    😆Schadenfruede is watching someone else try to set up Microsoft Teams @mcclure111 tries to set up Microsoft Teams to talk to a client, and all hell breaks loose. It's a fun read if you define fun as "I'm glad that isn't happening to me" and "Holy cow did Microsoft not think through their user experience?"

    📆Jetbrains ".Net Days" is May 11-12th and it's free. Scheduled talks include

    "C#, F#, GraphQL, Blazor, gRPC, Hedy, working with databases, and debugging. On top of that, we’ll discuss stereotypes around legacy code and demonstrate how to build a React app backed with Azure features."

    And Azure makes an appearance because of course Azure makes an appearance.

    🎁Visual Studio 2019 16.10 Preview 2 is out with lots of .NET goodies included.

    🎈Julia Evans releases her network debugging "Choose Your Own Adventure" game as an early draft. I played through this and it is wonderful. I highly recommend it.

    🎁Visual Studio 2019 16.9.4 has been released It patches CVE-2021-27064, CVE-2021-28313, CVE-2021-28321, CVE-2021-28322, and patches several upvoted bugs present in Visual Studio.

    🚌EventDriven.EventBus.Dapr 1.0.0 RC 1 has been released Your weekly note that we use the term "RC" because "Using Customers as our QA" has less zest to it.

    🎥The .NET foundation hosts a project spotlight on "Roslyn" which is also Microsoft owned. Would love a bit more outward focus but Roslyn is cool.

    🗣There's a new C# Standard repo that helps to standardize the language used to describe C# I don't understand it but perhaps I'm not meant to. This is about standardizing the language we use to describe the language we use?

    🧵The next version of C# will support building interpolated strings with a... builder based approach What does this look like in practice? I have no idea because the authors are more concerned with the structure of the API than showing us what that API would mean with examples.

    🚚Are you planning to migrate from UWP to WinUI 3 Desktop? These are some guidelines that Microsoft is writing. Also Microsoft promises that this is not another "Lucy with the football" moment.

    🧓Andrew Lock writes about Viewing overwritten configuration values in ASP.NET Core Environment variables are from 1979, and we still have not come up with a better to deal with this in 2021, but in true tech fashion "you can always write code for it!"

    💩Instant Feedback Is Here: Introducing Hot Reload in .NET 6 Dave Brock from Telerik shows us what Hot Reload is, and how it works in .NET. And no, this is not an urban dictionary term.

    🤖There's a Root Cause analysis out for CVE-2021-1647 That CVE, just in case you don't have them memorized, was the Windows Defender CVE. This is a shorter read than the last one I linked to, but still has good information.

    🤡Eric S. Raymond believes that it's easier to tolerate a few jerks than it is to have rules regarding toxicity in a community reaffirming the adage that if you look around the table and can't see the jerk, the jerk is you.

    💥The NSA and US Intelligence Community has affirmatively pinned the Solarwinds attack on Russia's Foreign Intelligence Service, the SVR. When people said "The 80s are back in style" I didn't think they meant the Cold War.

    📢Announcing Windows 10 Insider Preview Build 21359 Several fixes, previews, and Apparently the Timeline is not going away. I have no idea what the Timeline is, but it's not going away. Good news?

    👐The Razor Compiler no longer produces a separate Views Assembly in .NET 6 Preview 3 If this affects you, here's your notice.

    💾Git is gitting (sorry) better in Visual Studio 16.10 Preview 2. I've started to try out Git in Visual Studio, and it's not bad. I still prefer the command line, but that's because I'm a snob.

    🐅If you've made it this far you deserve a treat. Here's the story as to why He-Man rides a tiger, and I guarantee it'll take you to places you did not expect

    🕳Microsoft keeps digging itself into a hole with its MVP Program "Astro Turf for SQL Server on Azure" is a helluva strategy.

    🤵🥳Microsoft releases its Hybrid Work Strategy Program It's only a decade behind the curve.

    📚Turns out the Visual Studio logo has a backstory.

    🎁SQL Server Management Studio 18.9 is out Lots of bug fixes and improvements, as always. I used to get on release notes people for writing "Bug fixes and PErformance improvements" but now I realize I can just link to the real release notes and get away with using that term, sooo.

    🙋‍♂️Show dotnet: Build your own unit test platform? The true story of .NET nanoFramework. Sometimes I share things I'm interested in and this is that other time. I'm sure this is cool but I...

    10 min
  • ... and I would lock 10,000 schemas...

    🎁.NET 5.0.5 has been released. This release fixes an issue where dotnet restore wouldn't work on Linux.

    💸Jimmy Bogard takes you through local development on Azure Service Bus. Developers won't pay $99 a year for a tool that saves them hundreds of hours, but will happily pay to develop software in the cloud.

    🕴Leverage enterprise-scale reference implementations for your cloud adoption. I think Microsoft marketing is skimping on their KPIs: The title doesn't have the word "Azure" in it.

    🙋‍♀️Your top .NET Microservices questions answered The link itself isn't as interesting as the links available in the post. If you find yourself wanting to learn more about microservices and their structure and communication patterns, these links are a great place to start.

    📢Announcing .NET 6 Preview 3 performance improvements, more platforms supported (iOS, Apple's M1, and Android!), and plenty of bug fixes for ASP.NET Core, Entity Framework Core, and the runtime itself.

    ☠🔒Tayrn Pratt, Stack Overflow's DBA, writes about fighting with deadlocks in SQL Server when needing to generate 10,000 schemas (not a typo). Stack Overflow Teams uses an interesting mechanism for multi-tenancy: database schemas. It scales, but there are some issues. Taryn dives into those issues and how they fixed them.

    🕵️‍♂️Exploiting Windows RPC to bypass CFG mitigation: analysis of CVE-2021-26411 in-the-wild sample Sometimes we get exploits with no code samples, and other times the author goes into a deep dive into how the CVE operates, with examples. This is the latter, and we're all the better for it.

    ​ILSpy 7 RC1 is now available and the big news here is that you can now build ILSpy for .NET 5. Oh, and it has dark mode too.

    3 min
  • Microsoft is mad that Georgia is having a second piece of cake

    💣Jesse Liberty started off the week with violence by introducing his team's updated coding standards for C#. For the most part I agree with these standards, but there are a few I have problems with... which I suppose was the goal all along.

    ✒Do you author Markdown files in VS Code? If so Paige Bailey (@DynamicWebPaige on twitter) has an amazing extension you should try. This extension made for markdown authors includes linting, spellchecking, image compression + resizing, templates, and so much more. So much more is doing some lifting in that sentence. You should really check it out.

    🤡 Can we just take a moment and admire the absurdity that are cookie popups on the modern web? Government makes, what is at its core, a pretty sensible law, and in true governmental fashion the implementation looks like a 5 year old describing a platypus.

    🤿Nick Dives deep into Project Reunion and its versioning. If you do desktop development for Windows, you're going to want to read this. This blog post is the simplest explanation I've seen yet of "Project Reunion" and all the ins and outs that trying to "reunite" the APIs entails.

    💁‍♂️Scott Hanselman teaches you how to launch Windows terminal for all your shell needs. Want to have the command prompt launch Windows Terminal? How about Powershell launching in Windows Terminal? This hack can help you do that.

    ⚖Microsoft registers its 'concern' with the Atlanta Election Law. They registered 'concern' in the same way my spouse registers concern when I have a second piece of cake. In the same way, it's not going to make the Republicans rethink their actions, it'll just make them not brag about it as much.

    🍾Visual Studio Code v1.55 has been released Lots of little updates and customizations in this one because if there's one thing programmers love, it's customizing their IDEs.

    🐛Nuget has about 80 weeks to fix a bug with how it stores its download counts. Newtonsoft.Json gets 12 million downloads a week(!) and in about 80 weeks it will overflow the int32 storage defined in Nuget's download count. It is out of sheer schadenfreude that I'll point out System.Text.Json (NSJson's replacement) gets around 267,000 downloads a week.

    🟦Public preview: Azure Static Web Apps now supports deployment with Azure DevOps. Azure can mean on prem or in the cloud because I've come to conclude Microsoft's teams OKRs require them to adopt the word "Azure" for everything. Enjoy that thought.

    🔐There's a POC for the Windows Console Driver Vulnerability. CVE-2021-24098 has been patched, and if you haven't patched your systems, the usual disclaimer applies: You should.

    😜There's a new insight into the old Microsoft Coffee april fool's prank. If you remember this one, enjoy this blog post about how it all started.

    🚧Azure Portal and Azure services went down last week, and to no one's surprise the cause was DNS.

    📆Microsoft Build is virtual and is happening May 25-27, 2021.

    👮‍♀️.NET 6 will have W^X enabled for all architectures W^X is write xor execute and it provides that memory is either writable or executable, but not both. It's a lot of work, but will make .NET better when it's done.

    🤚TypeScript 4.3 has a neat addition for imports it will now auto-complete the import for you.

    6 min
  • Cross-Platform Pinky Swear

    It's a light week. Not much going on except for me being stung by the "30 is old in tech" rebuke. What happened in the world of .NET (which turned 20 this year)? Let's get to it:

    🤞Edit and Continue support for Linux? Not happening any time soon. The Jetbrains folks received complaints that Edit and Continue support for Linux wasn't available in Rider, and this particular rabbithole leads right to Microsoft's door step.

    It's indicative of a bigger problem, that the promise of cross-platform .NET is the sort of promise you'd make like 'we should get together for lunch sometime' with a friend you bump into while shopping on a saturday afternoon.

    💫Releasing Windows Feature Experience Pack 120.2212.3530.0 to the Beta & Release Preview Channels. The title is almost as long as what they actually released, to wit:

    "We are improving the reliability of displaying the candidate list for users of the Input Method Editor (IME)."

    🔨C# holds steady as the 5th most popular language according to Redmonk.

    The fact that JavaScript is number 1 is proof-positive more people are into masochism than we know.

    💾Create ZIP files on HTTP request without intermediate files using ASP.NET MVC, Razor Pages, and endpoints The take away here is that using this technique you can create zip files without writing files to disk on your server. Especially handy if you're into that cgi-bin serverless craze.

    🎁NewtonSoft.Json 13.0.1 has been released. New major version number, and it looks like the 'breaking change' is the default MaxDepth:

    Change - JsonReader and JsonSerializer MaxDepth defaults to 64

    There are a smattering of bug fixes along for the ride as well.

    It was a light week in the world of .NET, and with Easter coming up in the states, you can expect this week to be light too.

    3 min
  • Azure goes Achoo

    ☠Azure AD fell down last week, causing outages with Microsoft's Cloud properties Outlook 365, Office 365, the Azure Portal, and Teams were all affected.

    ​The root cause was a bug during key rotation, and I'll let the Azure Post Mortem team take it from here:

    Azure AD utilizes keys to support the use of OpenID and other Identity standard protocols for cryptographic signing operations. As part of standard security hygiene, an automated system, on a time-based schedule, removes keys that are no longer in use. Over the last few weeks, a particular key was marked as “retain” for longer than normal to support a complex cross-cloud migration. This exposed a bug where the automation incorrectly ignored that “retain” state, leading it to remove that particular key.

    Metadata about the signing keys is published by Azure AD to a global location in line with Internet Identity standard protocols. Once the public metadata was changed at 19:00 UTC on 15 March 2021, applications using these protocols with Azure AD began to pick up the new metadata and stopped trusting tokens/assertions signed with the key that was removed. At that point, end users were no longer able to access those applications.

    Service telemetry identified the problem, and the engineering team was automatically engaged. At 19:35 UTC on 15 March 2021, we reverted deployment of the last backend infrastructure change that was in progress. Once the key removal operation was identified as the root cause, the key metadata was rolled back to its prior state at 21:05 UTC.

    This is the second time in six months that Azure AD has gone down. This happened 6 months ago. These are growing pains for Microsoft's cloud endeavors, and the ops teams involved need #hugops. Microsoft being the "safe bet" for enterprises means in part being stable, and two enterprise outages in 6 months is a lot.

    🤑Microsoft wants to pay you to build Cloud applications on Azure. I jest, but only a little. They want you to try out their new developer experience on Azure, and get your feedback on it.

    🎁NuGet 5.9 is out and there's a nice blogpost by the nuget team on what's in it. Easier UI around version floating, a new "right click -> update", and some nice improvements in Visual Studio for NuGet.

    🎁Microsoft releases a one click Microsoft Exchange mitigation tool. Download. Click. Mitigate the vulnerability.

    📚Microsoft has Architecture guides for building .NET applications of all sorts. And of course, because Microsoft can't do anything without pushing Azure, the guides include how architect those applications in Azure. There's a reason why the Ebooks are free.

    🏫Getting Started with the Microsoft Graph Toolkit is now free on Microsoft Learn. I had to google what Microsoft Graph was, and given the ... paucity of the Wikipedia article, I'm not sure anyone knows.

    🖥Announcing Windows Community Toolkit 7.0 It includes a smattering of helpers for developing UWP apps, if that's your thing.

    🎥#Include2021 is done, but you can view the videos if you register by March 24th. Include talked about diversity with voices from different industries.

    🏰Microsoft Build is May 25th - May 27th, 2021. I don't have more info but when I do, you can guess where it'll be.

    5 min

About Last Week in .NET

From the publisher's feed

A podcast that details the happenings around the .NET ecosystem, generally a week at a time. I can neither confirm nor deny that there will be attempts at humor involved.