Last Week in .NET

Last Week in .NET - 3/13/2021

💍There's a new proposal for a "static abstract" keyword. My brain is foggy on the use-cases here; but let's go with it.

🚨 Do you use System.Text.Encodings.Web? There's a vulnerability that has been patched. The vulnerability is captured in CVE-2021-26701

This vulnerability has been patched with the release of .NET 5.0.4, and .NET Core 3.1.13.

For .NET 5.0.4, .NET 3.1.13, and .NET 2.1.26 this is a patch release that contains the CVE Fix. The usual provisos apply and patch your systems.

🎉 .NET 6.0.0 Preview 2 has been released. .NET 6.0.02 Preview 2 has been released. This release includes faster blazor compilation, CSS Isolation for ASP.NET MVC views and Razor pages, more blazor improvements, and some MAUI thrown in for good measure.

🕷👨‍⚕️ .NET 6 introduced the Priority Queue and an enterprising Khalid Abuakumah shows how it works with a nice Avengers example Black Widow and Dr. Strange are far too down on his list, but other than that it's a pretty good ranking.

🎥 There's a Windbg video series out, and as someone who has had to suffer through the blog posts and documentation, I'm glad they've taken to video. You won't need Windbg until you do, and by then you'll wish you had already watched these videos.

🕵️‍♂️ There's a nasty CVE out that details vulnerabilities in Microsoft's DNS server. You know, that server that generally serves AD environments? There's a paper out about the CVEs.

🦈 Do you remember the Exchange CVE from last week? (If you haven't patched your Exchange server, please, do so. Now.), well some security researchers published a Proof of Concept on Github (PoC) and that PoC was taken down by Microsoft. Without any word from Microsoft, I can only take this as bad behavior on their part. Exposing this research only helps the pen-testers and security research community improve their craft; and the bad guys already had this information anyway. Taking it down from Github just reminds us that Microsoft owns Github; which may not be such a good. Plan accordingly.

🧓🎁 Visual Studio now lets you remove unused references which brings it up to par with ReSharper from... 2012.

👮‍♂️ Microsoft has a security scanner that can tell you if there are backdoors installed on your server I don't know if it can find rootkits, but there is a little comfort in this tool.

🕵️‍♀️ CISA has released new info on webshells created by the Exchange exploit. Keep a look out if you're an SRE.

Jobs

💰 Microsoft has an opening for a Senior Program Manager in... Data Storage for its Azure team.

Last Week in .NET - Microsoft Ignites Exchange - Week Ending 6 March 2021

Microsoft Ignite happened last week. Its releases were all about Azure, azure, azure, and at least for the moment tangential to the work we do here. There's a playlist if that's your thing, but the first video on the list, and I am not shitting you here, is a video is titled "Faster Management Performance – Inventory and Financial Management learnings in Azure". ...and I'm already asleep.

🚨🚨🚨 Microsoft Exchange is currently being hacked. Yes. That's currently as in right now. If your organization hasn't patched your Exchange server, please stop reading this and do that now. Even cisa.gov is getting into the act.

🕵️‍♀️ The .NET Foundation snuck in a change last November that removed the "Contribution" model for Open Source projects that want to join the .NET Foundation. They just as quietly removed it, but their verbiage and their few comments on the matter push the "Assignment" model rather heavily. The Assignment model will assign the copyright of your project to the .NET Foundation. And in case you weren't aware, the .NET Foundation is controlled by Microsoft. Its paid employees are paid by Microsoft, it has a non-revocable and single-seat veto power on the Board of Directors, and now it would like you to pretty-please assign the copyright of your open source project to this 'independent' organization. 

The latest is that the Executive Director says it's not the only model, it's just the preferred model. Yes, I too would prefer other people gave me their stuff instead of having to share it. Keep your eyes on this space; as I know more, you'll know more.

🔊 Want to know more about how the .NET Foundation is set up and how it works? I covered that on a previous podcast episode of Last Week in .NET.

🗃 Adam Sitnik wants to hear from you if you use FileStream in a performance related scenario. If you use it and you have a need for speed, reach out to Adam and let him know how you're using it. "On a computer" probably isn't a good answer.

🆘 Microsoft has realized leaving Nuget to die probably isn't a good idea, and so they're finally paying attention to it. Nearly every .NET team in existence relies on Nuget, and yet it's received less love than a 12 year old dog at a pound. There are signs that Microsoft wants to change this; and that's a wonderful thing. We'll see what comes of it.

🎉 Windows Terminal Preview 1.7 has been released Speaking of showing some love, the Windows Command Prompt is the bane of sys-admins and developers everywhere; and Microsoft recognizes how lackluster its been, and to asuage us into wanting to use Windows as a Development platform, they're showing some love by replacing it with something that doesn't outright suck. Thank you, Microsoft. I mean it.

🎉 SecureString was officially deprecated in .NET 5,and some Azure libraries are catching up to this new reality. SecureString was a literal black box labeled "secure" when in reality you just needed to open the lid to peek in. It was never meant to be 'secure' and deprecating its usage helps remind any yahoos that it isn't.

🎉 Microsoft releases the .NET Upgrade Assistant Preview That's its name. Preview is just sitting on the end like that friend that comes along to dinner even though they weren't invited. I guess we're just lucky they didn't tack on "Azure" or "365" to the name. As it says on the tin, it helps you upgrade your .NET Framework projects to .NET 5 (and beyond, one assumes).

🎉 Visual Studio 16.10 Preview 1 has been released You see Microsoft? You can put a version number on a "Preview". Since the New York Times "Jetbrains" debacle (where they basically published an opinion as fact), some enterprises are moving away from Jetbrains Resharper. This is of course bad for the developer community since even in the year 2021, Microsoft's refactoring tools pale in comparison to ReSharper. In an effort to gain some ground, Microsoft has released new Refactorings in this preview. These same refactorings (with the possible exception of the "find all references for Source Generators") have been in Resharper since... well.. forever?

🎉Microsoft released a new "low code" language called "PowerFX" and no it's not on the .NET platform because a cohesive brand vision is not a thing Microsoft does.

🎉Windows Server 2022 is in preview and includes changes to make Windows Containers Smaller. They currently clock in up to 5GB; which is an order of magnitude larger than debian based images, and two orders of magnitude larger than alpine based images. Let that fact marinate.

☑ The .NET Foundation has published their "January/February 2021" newsletter. There are lots of little release goodies in here as well as another exhortation to fill out their survey. Please, take the survey.

🐦🦃 What's the difference between .NET and .NET Core? Mahesh Chand spells out the differences. In a fit of irony, the article itself is out of date, having only been released in July of 2020.

🎉Visual Studio 2019 for Mac Version 8.9 has been released and it now supports .NET 6 Preview 1 (not so hard, is it Microsoft) and debugging and running tests in Unity.

🐷Windows 10 Insider Preview Build 21327 is released and Microsoft is touting a re-designed "News and interest" section as a feature. I don't want lipstick on the pig. I don't want the pig sitting there, in my taskbar, pretending to be relevant. It's an operating system, folks. Focus on that, please.

🎉S4M for .NET It's a sta...

Releases

📢 Python for Visual Studio Code introduces its February 2021 release. TensorBoard integration , better docstring and improved go to declaration behavior have all been released as a part of this... release.

📢 TypeScript 4.2 has been released with several new features, like an abstract constructor signature, stricter checks for the 'in' Operator, smarter "Type alias preservation", and More. Yes, and more is doing a bit of heavy lifting in that sentence. Check it out and rememberr that TypeScript does not respect SemVer so upgrading from 4.1->4.2 is a breaking change. Thanks, Microsoft.

.NET News

📝 Blazor Desktop: The Electron for .NET? by Matthew MacDonald asks this question. It's an interesting way of pitching Blazor that I hadn't considered previously; and I'm excited to see where this goes. We do already have a perfectly good electron, however.

📝 Did you see the .NET Foundation speaker's directory If you want to book a speaker for your meetup, there are lots to choose from. I am also in the directory, for what that is worth.

📝 Khalid Abuhakmeh talks about 18 pitfalls you can encounter and EF Core 5 and how to avoid them I've hit just about all of these in my work; and that's either an indictment of me or of the framework itself. You choose.

📝 The four part series on building apps with Azure API Mangaement functions, Power Apps, and Logic Apps is now complete and it's clear from the title that Microsoft's KPIs for 2021 include how often Azure services are used in a blog post.

⚠ NET 6 will only support Mac OS 10.14 and up Mac OS 10.13 "High Sierra" is 4 years old at this point, so who can blame them? Thanks to Kevin Jones (@vcsjones on twitter) for the link.

👨‍💻Microsoft has a github repo devoted to WPF Samples and to my relief the only reference to azure in these code samples is the color.

🎉 Maoni Stephens made "Partner" at Microsoft Maoni has a neat video series out on the Garbage collector that I linked to a few newsletters ago. And this promotion is well deserved. Congrats Maoni!

📝 Speaking of Maoni, she also has a blog post out on the Pinned Object Heap in .NET 5. The POH is new in .NET 5, and you may want to get acqauinted with it, just in case you ever need it.

Last Week in .NET - February 20th, 2021

.NET Releases

📢 .NET 6 Preview 1 is out. Besides MAUI, there's a lot being packed into .NET 6, and what I'm looking forward to most are Single File Apps. They were 'released' in .NET 5 for Linux only, and in .NET 6 they'll be available for Windows and MacOS as well.

📢 Dapr 1.0 has been released. Dapr allows you to hot-swap microservice features like queues, data stores, authorization schemes and secrets management. It's a way to write Microservices for the least common denominator. it's like Kubernetes for Tech Stacks... and that's not a compliment.

.NET News

📝 Do you need a high performing CSV parser in .NET? Cesil has you covered and it now supports source generators. Kevin is a really smart guy and he dives deep into how to use source generators for Cesil and what they do. Thanks, Kevin.

🎥 Sam Basu joins the .NET Show to talk about MAUI. Not the island, the acryomn: Multi-platform App UI. If you want MAUI today, try out UNO Platform. Not a plug, just something that's already available... today.

📢 .NET 6 will have a priority queue, writes David Fowler. I guess interviewers will have to find a new data structure for people to try to recreate.

☑ The State of .NET Survey is going on right now. It's built to give Microsoft a sense of why more people aren't using .NET, and if you are using .NET, what parts you're using. It seems like Microsoft already has this information with their opt-out telemetry, but it's your chance to tell them how you feel nonetheless.

📘 The Introduction to Dapr for .NET Developers ebook has been released. Dapr stands for "Distributed Application Runtime", and it's not to be confused with Dapper, the Micro-ORM from the folks at Stack Overflow. Confusing, isn't it? Apparently people at Microsoft fell in love with the name and ignored complaints that it sounded like "Dapr". Anyway, the book is out.

Who's the book for? Well, that's the trickier part. It's for people who want to create Microservices from scratch; which, you probably shouldn't do.

Microsoft News

📰 Windows 10 version 21h1 will arrive with no hardware certification changes. The story never tells us why this is important, so let me hum a few bars: It means the hardware that has been certified to work on Windows 10 build 2004 will work for this version of Windows 10.

📰 Microsoft released their final update for the Solorigate Investigation. For a "final" update, it leaves a lot to be desired information-wise; and there's a lot we still don't know. These sorts of updates make it easy to think that there's more going on than is being reported. I guess we'll see.

Jobs

💰 Microsoft is looking for a Software Developer for their One Engineering System team. This role looks to be geared towards ensuring the security of Microsoft's software supply chain. A bit of a coincidence given recent events.

🎂 .NET Turned 19 on February 13th. Awwww. and I learned about it from AWS. Nice Shade.

🚨🚨🚨 Microsoft releases a whitepaper on mitigating risk when using Private package feeds This dovetails with the security researcher who wrote about how they hijack'd namespaces for private feeds; and Microsoft releases a whitepaper on this issue and how to mitigate this. This is up top because it's crucially important for teams that use private Nuget feeds. Thanks to Barry "I love Beans" Dorrans for sharing this on Twitter.

If you use Azure Artifacts to store your private packages, Microsoft has done you a solid and fixed that behavior as well.

Releases

🚨🚨🚨 Several CVEs have been fixed with new .NET Core updates, including CVE-2021-1721 (Denial of Service) and CVE-2021-24112 (Remote Code Execution).

🍾 Visual Studio 16.8.5 has been released with the two above CVEs fixed and antoher CVE, specifically CVE-2021-1639, which is a TypeScript Language Service Remote Code Execution Vulnerability. There are also a few bug fixes in this release as well.

🍾 Visual Studio Code v1.53 has been released. You can now wrap tabs instead of horizontally scrolling when you have a lot of tabs open. I feel seen.

🎂 Cake v1.0.0 has been released. It's been 112 releases to 1.0, and congrats to Cake for getting there. For those of you just hearing about Cake, it's a C# build engine in the style of Make, from where it gets its name.

🚨 .NET 5.0.3 has been released this fixes the aforementioned CVEs and bug fixes for ASP.NET Core, Entity Framework Core, the runtime, and even Winforms.

🚨 .NET Core 3.1.12 has been released with the same CVE fixes but far fewer bug fixes for the Runtime, the CoreCLR, Winforms, and ASP.NET Core.

🚨 .NET Core 2.1.25 has been released and you get the aforementioned CVE fixes but only one lone fix for ASP.NET Core.

🍾 C#/WinRT Nuget Package has been updated to 1.1.2-prerelease.210208.6 So if you want to target WinRT, check it out.

🍾 Entity Framework Core 6.0 preview 1 is coming soon and the team is currently working on compiled models, Temporal tables and investigating GraphQL. They never sleep. They can't.

🍾 Microsoft releases Windows UI Library 3 preview 4 which has a few feaures but even more bug fixes.

.NET Events

🎥 Scott Hunter, Director of Program Management for .NET, is giving a talk on the state of .NET 5 and what's coming in .NET 6. It's an MS Teams event but let's not hold that against Scott. .NET 6 has big shoes to fill: It's the first LTS release under the ".NET" moniker; and it's when MAUI is due. Special thanks to Ginny Caughey (@gcaughey on Twitter) for the link.

📆 The Event List for .NET Conf Focus on Windows has been released. Github actions, Native App development in .NET 6, Azure SignalR and Desktop apps, and running WPF/Windows forms on Arm devices all make an appearance. .NET Conf "Focus on Windows" is February 25, 2021, so sign up today.

.NET News

💍 There's a proposal to allow Emojis in C# and I was about to 😂 but that's apparently not cool any more so I'll 😭 instead.

🏫 Tess Ferrandez updates her .NET debugging deep dive Tess set up a lab to allow you to practice how to debug .NET application using tools like windbg and procdump. This is an insanely informative and clearly written set of labs on how to master runtime debugging for .NET.

📝 Do you write ASP.NET Core Middleware? Steve Collins breaks down the potential pitfalls when using dependencies and writing ASP.NET Core Middleware. This is one of those 'have it in your back pocket' blog posts for the next time you have to write middleware.

🚢 System.Speech has been shipped as part of the Windows Compatibility Pack for .NET Core. Still no cross-platform speech; but at least it's something.

🧙‍♂️ David Fowler talks about .NET APIs you probably didn't know existed, including StringBuilder.GetChunks which is not, I repeat, not, about cleaning up after a party.

📝 Jeremy Miller talks about Event Sourcing with Marten. This is relevant to the microservices and SOA Crowd.

📝 Speaking of the Microservices Crowd, Matt Ellis, Principal Software Engineer for the Azure SDK, talks about how you can create a custom event hubs event processor in .NET. This looks super confusing and I'm either too dumb to get what's going on or the people who wrote it are too smart.

📝 Andrew Lock talks about how to use source generators to find all routable components in a Blazor WebAssembly App and I've now exhausted all of the vocabulary I know about Blazor.

📝

Last Week in .NET - February 6th, 2021

No releases of note this week; but several updates in the .NET area that are useful, especially around Windows UI. Let's get to it.

Microsoft News

👐 Microsoft Open sourced the storage engine that powers Exchange Server, Office 365, and parts of Windows. They open sourced the Extensible Storage Engine, or ESE for short, and it's been a foundational part of windows since Windows NT 3.51. This is cool and I'm still holding out hope for IIS to be open sourced so I can finally figure out this 10 year old IIS bug.

🛣 The Windows UI Library Roadmap has been updated. WinUI 3 looks like the model that unifies all the different ways of creating UIs on Windows, and I'm excited to see where it goes. Currently, it reminds me of the dnx project back in the earliest days of .NET Core. As this stuff solidifies, the picture will hopefully become clearer. As for the updates, UWP support is slated for post-may and Multi-window support has been delayed. Special thanks to @dotMorten for the info.

🔮 Brent Ozar talks about the future of SQL Server with Forrest Brazeal. According to Brent, DBAs are safe for at least the next 10 years at least.

📅 Microsoft Ignite is free and it's happening from March 2-4 2021. Did I mention it's free?

🏛 Microsoft's PAC is announcing it's suspending contributions for 2022 election cycle to all members of Congress who voted to object to the certification of electors. It's important to note that they aren't ending support, only delaying it, presumably until the furor over January 6th blows over.

.NET News

📚 Updated Documentation is out about gRPC pn .NET. gRPC is an alternative to plaintest JSON based APIs and is a staticly typed wire format. It could be for you if you write APIs and you want an effecient format.

📝 Rehan Saeed covers configuring OpenTelemetry. Open Telemetry helps with tracing and logging for your .NET Core Web applications.

📢 Azure Quantum is now in Public Preview at least it is... until someone observes it. All joking aside, Quantum Computing will either be the biggest snake-oil sale of our lifetime or will literally remake the world of technology as we know it. At this point though, you get a whole 11-qubits to play with. Not bytes, bits. 11 quantum bits. Don't spend it all in one place.

📝 Mark Seemann shares his lessons learned about trying to put ASP.NET Web API Controllers under test. Unit testing controllers is a bad idea, and Mark goes through how to use an HTTP Client to test them. It's a step up from unit tests; even if it is heavier weight.

🍾 Xamarin Community Toolkit now supports native popup controls.

🤫 The ASP.NET Core team is disabling the Github Discussions feature. It makes sense that if the team can't handle the size of the backlog, there's no way they can handle that plus the Discussions.

❓ There's a video out on the .NET Show about building 'real' applications with Orleans in .NET. Orleans is a framework for building distributed applications in .NET, and this video hopefully clears up why Orleans exists.

Jobs

🦆 DuckDuckGo is hiring .NET Windows Desktop Developers. If you know WPF and have a hankering for a remote job, this job is for you.

💰 Microsoft is hiring a Principal Software Engineer in their WDX (Windows, Developers, and Experiences) team. Apparently it's not a .NET role, rather it's a C++ / Java role.

Last Week in .NET - January 30th, 2021

We're getting our first snow here in the DC area for the first time in what feels like forever; and the .NET team is pondering the true meaning of the words "Backlog management". Let's get to it.

🌎 As previously alluded to, the .NET team is closing older issues in their Github repos, and this is a cause for alarm among the folks that write these issues. If you run an open source project, sooner or later you're going to run into this if you don't have the people-power to manage your backlog. I hope the .NET team takes the time to realize this hints at a much deeper problem, and that problem isn't "too many issues are opened on Github".

📝 Stack Overflow deep dives into their May 2019 security incident. The word 'incident' has the same energy that my two-year old does when she has a poopy pull-up and decides she'd rather not wear it any more. That aside, this is a fascinating look into what actually happened, and how Stack Overflow used what the attacker searched Stack Overflow for to figure out where they were going to hit next. Using Stack Overflow to hack Stack Overflow is a new one on me.

🤼 .NET Conf Focus on Windows Desktop Development is February 25th, 2021. No speakers, no schedule, just a save the date. Cutting it kinda close, aren't we, .NET?

📝 Tired of Console applications defaulting to .NET Core 3.1 when you create them in Visual Studio and you have a perfectly good .NET 5 installation?. Me too. Also Anthony Giretti has a fix for that.

🌎 Ben Watson wants your input on breaking changes being made to Microsoft.IO.RecyclableMemoryStream It's like database connection pooling, but for the large object heap.

📢 Microsoft has released LAMBDA for Excel You would be wrong if you thought that the word LAMBDA was an acronym for something. Rather, it's because the keyboard got stuck and Marketing thought that was edgy. Now that Excel is turing complete, I await Doom being created in Excel.

🎥 Rockin' The code world with DotNetDave - Special Guest: Kendra Havens is on February 6th, 2021. Kendra is a Program Manager for Visual Studio & .NET at Microsoft, and Rockin' the Code World is not to be confused with ".NET Rocks".

☑ Microsoft has put together a new experience for feedback and now there's a new way for them to ignore your feature request.

📢 There's a Nuget Package Explorer CLI tool that can validate nuget packages This is helpful to those of you that author nuget packages, if you don't, carry on.

🐛 Nuget Package Explorer is also tripping up Norton Antivirus so if you use that, watch out for the false positive.

🎥 Brigit Murtaugh has an 8 part series on Developer docker containers Part 1 is now, Parts 2-8 are on the right hand side of now.

📝 Curious how the pre-built .NET Docker Images are created? Elton Stoneman has the answer. This is a fascinating look into how Docker images are effectively turtles all the way down. Thanks to Dee Dee Walsh for the link (@ddskier on the twitters).

📝 Codemaze updated their blogpost on Blazor Web Assembly Authentication. It is unclear what the updates are, but if you do this a lot you probably know.

📢 Microsoft announces their support for Open Web Docs Remember when Mozilla laid off the MDN team? Remember how MDN is soooo much better than W3Schools? Yea. This has to do with that. Looks like the big tech companies are coming together to make documentation a funded thing.

🎥 Elegant API Versioning in ASP .NET Core Web API I have not vetted these claims, don't @ me.

💲 Microsoft released FY21 Q2 Results. The numbers went up and to the right, but the whole stock market has been doing that, sooo.

📰 One third of tech workers admit to only working 3 to 4 hours a day, according to Fast Company, and.. this part is even more important: the other two thirds lie about it.

📝 .NET 5 Source Generators Jump Start Source generators are socially acceptable code generation tools.

📝 Speaking of Source Generators, you can now use them to create that DSL your business wants and when in two years you're stuck maintaining this DSL that about 10 people on the entire planet understand, you can give it all up to use Excel's LAMBDA. I am not bitter at all.

🚨 Github Actions is removing support for .NET Core 3.0. Update to 3.1 or .NET 5, or build everything in a docker container.

📝 The Author of cURL asks the question: "What if Github is the devil?". This being a serious subject, I will not joke and say "too Late".

🐦 I don't think the Entity Framework team ever sleeps. They've created the branch for EF Core 6.0 Preview 1; and if living on the edge is your thing, go ahead and download it.

📝 Steve Cleary continues his series on Asynchronous Messaging with Part 4: Retreiving Results. This sort of thing reminds me that we don't yet have the tooling to support Microservices in a standard way.

🗣 The .NET Foundation has put together a speaker directory Lots of Good speakers on there, although they also let me on there, which is suspect.

🚨 30% of Solarwinds hacking victims did not actually have Solarwinds installed well that's frightening.

And that's it for what happened last week in .NET. I'm George Stocker, and I'm hosting a free webinar on TDD in .NET on March 5th. When I'm not doing that, I'm helping .NET teams double their productivity through Test Driven Development. Check out more at

Last Week in .NET - January 23rd, 2021

Is it over yet? Maybe? Not sure. 2021 has certainly come in like a lion, here's hoping is goes out like a lamb. A new president here in the states, a renewed focus on science, and a bunch of things happened last week in .NET. Let's get to it.

Releases

📢Visual Studio 16.9 Preview 3 has been released We now have intellisense for PREPROCESSOR symbols (yea, that was a written pun). This is about 20 years overdue and I'm excited to see it. Not excited enough to actually inflict PREPROCESSOR symbols on anyone, mind you, but excited nonetheless.

📢Project Tye 0.6 is out If you "Microservices" solely written in .NET, you should give Tye some attention. It's 0.6, so give it the attention that versioning deserves.

📢Microsoft has automated intellisense tooling to help you write P/Invoke... invocations. If you deal with Win32 APIs, see if the Cs/Win32 nuget package helps you out. Special thanks to Claire Novotny for the link.

📢Refit v6.0-preview.84 has been released, which is a type-safe rest API library for .NET.

📢KDL Parser for .NET 1.0 has been released I didn't know about KDL Before now. Apparently it's like XML or JSON, it's a configuration language. If you use it, shoot me a note. I'm interested to know more.

.NET News and Sundries

🎥Jetbrains is hosting a webinar on the OSS project FluentValidation on January 27th Fluentvalidation is a library that provides... Fluent Validation. Ok. There's a webinar on this on Wednesday. Feels a bit like a webinar on how to use a hammer but I'm willing to be surprised.

📝Julie Lerman details the content she's released on Entity Framework Core 5 Julie is one of my favorite content creators; and I'm always happy to share her work.

🎥Konrad Kokosa has an 8-part video series coming out on the... .NET GC. In Part 1, Konrad introduces you to the internals. There's no way to really talk about the GC without wanting to fall asleep; and I applaud Konrad's effort to make it interesting. If you find yourself running into allocation/performance issues, then learning about the GC is a Good Idea, and Video is probably the least terrible way to learn about it.

📝Anthony Giretti introduces us to a ridiciously named and yet surprisingly helpful tool called "gRPCui" a visual way to see what is being sent and received through gRPC. It's like Postman but for gRPC services.

🎥Kevin Griffin is interviewed about what sort of Real world projects you can use SignalR for (including one that saves lives). Kevin also offers consulting on the world of SignalR, if that's interesting to you.

📆.NET Frontend Day is January 28th and there's still time to sign up to learn more about using .NET for the 'front end' of your application.

📝The EF Core 6.0 plan is out, and it seems like there will be no rest for the Entity Framework Team. They put together a pretty aggressive plan for features and performance improvement.

🎥David Fowler does a Part 2 to the ASP.NET Core Architecture Video These sorts of videos are fascinating to me just with the sheer number of tidbits you learn.

📝F# has a Stats library I have a fondness for F#, much like I do holiday chocolate; but I'm not going to spend all year eating chocolate.

🎥Akka.NET hosts its community standup Use Akka.NET? This is for you.

📝Dean Ward of Stack Overflow details how they (ab)use IConfiguration If you find yourself with environment and tenet configuration settings; check this post out.

🔊Jon Skeet talks about C# and Time on Adventures in .NET and yes, dealing with dates and time is an adventure in .NET.

📝Steve "Ardalis" Smith talks about how you should use the APIEndpoints project instead of MVC controllers because "MVC Controllers are Dinosaurs" What The F*ck is this Sh*t. Seriously. I've got opinions about this. The "Clean Architecture" crowd isn't going to get my sympathy by saying this sort of bullshit. "Your architure isn't clean if you don't use this rube goldberg contraption of best practices we've put together". Thank you, next.

📝Microsoft released a deep dive into the stage 2 activation malware dubbed "SOLARIWARE" in the Solar winds Hack It's undeninably bad when your malware attack gets new codenames for each attack vector.

📆.NET Conf "Focus on Windows" is February 25th, 2021 and will focus (ahem) on Windows .NET Desktop applications. No word yet on Speakers or schedules; but I'll keep an eye out and when I know you'll know.

Other Tech News

📝Jennifer Riggins talks about why Tech is still toxic for women Our best days are ahead, but we're not going to get there if we're making it impossible for half the population to be a part of tech. Read this article. Internalize it.

☑Github's Security team wants to talk to you about securing your Open Source Project Open Source (and hosted) secrets management is definitely a 'need', and if you run an Open Source project, you should reach out to Github's team. Special thanks to Dee Dee Walsh (@ddskier on Twitter) for the link.

📝Jared White writes about why Tailwind CSS isn't for him Technologies go through the Gartner Hype Cycle, and Tailwind isn't any different. What is different is that techies get pretty religious about the libraries we use. Special thanks to @SaraSoueidan on twitter for the link.

This is Last Week in .NET for the week that ended... well.. last week (January 16th, 2020). It was a rocky week last week; and more of the same expected this week for the Washington DC area, and with an inauguration and Martin Luther King day as our backdrop, let's dive into what happened last week in the world of .NET.

Releases 📢

📢 .NET 5.0.2 has been released. This release fixes CVE-2021-1723 | ASP.NET Core Denial of Service Vulnerability attack. If you run .NET Core on Kestrel, you're vulnerable to this attack, so update immediately. There are several bug fixes for ASP.NET Core, the .NET runtime, and Entity Framework Core 5 included as well.

📢 In the same vein, .NET Core 3.1.11 has been released with the same CVE 2021-1723 fix, as well as some backported fixes from .NET 5.0.2 and other fixes specific to .NET Core 3.1.

📢 Not to be left out, .NET Core 2.1.24 has also been released and at this point you can probably guess what I'm going to say: They fixed the aforementioned CVE vulnerability, as well as several backported bug fixes and bug fixes specific to .NET Core 2.1.

☠ Speaking of .NET Core 2.1: Its End of Life is August 21, 2021 As stated in the blog post,

Parenthetically, of course, I hope your upgrades go better than mine usually do. I seem to hit every upgrade problem that could exist.

📢 Windows 10 version 20H2 Build 19042.746 has been released to the beta channels and these are chock full of security fixes that probably don't matter to you and I, but matter greatly to enterprises.

📢 IdentityServer 5 has been released This is the first major release under the new company's banner, and here's to many more.

🍾 You can now write C# for embedded systems using NanoFramework THIS IS INCREDIBLE. I used C when writing the firmware for Jewelbots (Because let's be honest there were no alternatives), and I'm excited to see that .NET is now a viable option. Part of me wants to take a few weeks and rewrite the firmware in Nanoframework, just to see if it's possible, but the other part of me knows it'll have to take a backseat to my TDD courses and classes. I will add it to the list, however.

Other .NET News

🎂Nuget celebrates its 10th birthday Just three more years until it becomes a bratty teenager.

🎥The EF Core team releases a video discussing what's coming in EF Core 6 They used the survey to help guide their thoughts for EF Core 6; and while I have a personal disdain for survey-driven-development, I understand why they'd want to do it. There's also a github issue related to EF Core 6 in case watching videos to get information is not your jam.

✅There's a cheatsheet showing how to use C# 9 features from the team at Okta. Real world use cases for these features is a nice thing to show off, and I'm here for it. Special thanks to Heather Downing ([https://twitter.com/quorralyne](@quorralyne on Twitter) for the link.

💸Mobilize.NET can convert your VB and VB.NET Apps to.NET Core This seems like a neat little utility, and while there's a company behind it, if you have a VB or VB.NET application, this may be your ticket to making the migration to .NET Core (and .NET 5). Check it out and let me know how it performs for you. (special thanks to Dee Dee Walsh (@ddskier on twitter) for the link.

📝Mana Pichova shares networking improvements made in .NET 5 this is a great read but is definitely on the heavier side. If networking is your jam, give this post a read.

📝Jimmy Bogard talks about ActivitySource and Listener in .NET 5. These classes are replacements for DiagnosticSource and Listener, so if you use either of those, give this post a read.

🌟ZeroSharp - a way to compile C# to native code, has hit 1000 stars on Github this is a wonderful milestone, and while github stars don't pay the bills, it's nice to see a .NET library hit wide usage.

😲The analysis of the Solarwinds Hack digs deeper, this time into replacing MSBuild. SUNSPOT was another malware vector in the Solarwinds hack, and this article goes deep into how it was used to replace MSBuild. This thing gets scarier and scarier.

😲Speaking of scarier and scarier, nuget packages can run arbitrary code on your system, and now I'm going to lie in my bathtub and rock gently, and that fantasy of buying a mountain cabin and living off the grid grows a step closer to reality.

🤼Jetbrains is hosting an AMA on January 21st, 2021 on Reddit and you'll now have the opportunity to ask them how it feels to have Microsoft nipping at their heels for 21 years straight.

📝Khalid Abuhakmeh writes about what he's learned in his time in .NET and there are some good lessons in there. Give it a read.

💰There's a job opening for a REST API software engineer at Microsoft The only downside is it appears to be only for Redmond, Washington. In other words, not pandemic friendly.

💰There's another job opening f...

Here in the States, we recorded the first invasion of the Capitol since the war of 1812 (in 1814), the first time a sitting president has incited an insurrection, and the last time any of us will hold out hope that it being a new year will mean things get better.

With that as our backdrop, let's get down to what happened last week in the world of .NET:

🗣.NET Frontend day is January 28th, 2020. This conference goes through the various technologies you can use to build front-end applications in .NET. Expect lots of blazor.

📰CODE Magazine released an article about Blazor Updates in .NET 5. CODE Magazine was my first foray into the world of .NET (this was back in 2000), and I remember reading through the articles fondly. I think I'm going to go subscribe to the print edition again.

🍾Reed Cospey writes a beginning of year message to the F# Foundation community 2020 decimated in-person conferences, and the expectations are that it'll be August before we can even think about resuming in-person conferences, with the more likely outcome that conferences will resume in 2022. If they resume.

📝Julie Lerman blogs about using C#9 records as Domain Driven Design immutable value objects in C# 9 I love Julie's writing, and I hope you'll enjoy it too.

📝How to build Microfront ends with Blazor WebAssembly Micro-frontends are complicated and we're not there yet, but I'm glad more people are blogging about the possibilities.

🚩Do you use Serverless.com? If so, your AWS credentials are being transmitted. In a "well, fuck" moment, Serverless uses your AWS credentials to do its work. An AWS engineer even chimed in on what Serverless.com should do.

📝Rick Strahl does a deep dive into a boring topic and makes it fascinating Using his Markdown Monster application as a setting, Rick dives into String formatting.

📝Jetbrains fights back over allegations that their "Team City" product contributed to the Solarwinds intrusion. The New-York times alleged that Jetbrains "Team City" was partially responsible for the Solarwinds hack, and this rightfully ruffled some feathers at JetBrains HQ. They dive into their findings as to why Team City isn't at fault.

📝Do you use Span? If so, there's a handy chart that helps you understand what you can cast and when, not to mention a really informative article on Span itself. h/t to @DaveAGlick for the share.

🐦There's a thread of a thread about "Project Reunion", aka "Make Windows UI development not suck again". These sorts of insights are why I use twitter. Before Twitter you would have hoped for a blog post or ten, or maybe a video post-mortem; but these sorts of insights were just not available due to the cost of publishing a blog post on the subject. With tweets, the barrier to entry is low. Yea, that can be a problem, but that's a whole other problem to deal with.

📽There's a video out detailing changes you'll see in .NET 6.. If you aren't already on the ".NET updates yearly, get ready" train, you should be. Minor versions happen every month or every few months, and major versions are released yearly. Yes, .NET 6 is 11 months away, and is going to be 'the release' for large enterprises to move to .NET (core).

📝If you want Cross platform .NET UI's right now, use UNO. In this PR, Uno now supports AOT Profile filtering. No, I don't know what this means, but you probably do.

📝Nick Randolph discusses Full Trust and Partial trust and how that relates to Windows app Container. Yes, this is more for the desktop crowd but still interesting to see where Microsoft is going for its UI strategy.

And that's what happened last week in the world of .NET. I'm putting together an intro to modern day TDD webinar:

 
 Upcoming Events
FREE Intro to TDD for .NET live training - this 1 hour online webinar dives into what TDD is, why it's useful, and how to get started with it in .NET. Other services you may be interested in: (New Year, new prices!)