Last Week in .NET – Issue #12 – dotnet and .NET Please don’t do this to us again

This is Last Week in .NET for the week ending 3 October 2020. You know, Last week. There were no releases this week, but a crap-ton of goodies abound.


🔗Ed Charbeneau talks about Blazor vs. MVC on his twitch stream One bad thing about twitch is the videos disappear after 14 days so you have another 4 days to watch this one.

🔗James Newton-King wrote a Blazor WebAssembly app that shows performance benefits of gRPC-Web over JSON. Tl;dr 70% less bandwidth, 10x faster deserialization; all without gzip.

🔗David Ramel focuses on how much faster Blazor is getting Microsoft already fooled me once with Silverlight, but I’m hoping this time will be different so I’ll dump all of my attention onto blazor and cry when they inevitably abandon it.

🔗How to deploy ASP.NET Blazor WEbAssembly to Azure Static Web Apps (translation: using blazor on a static site hosted on Azure)


🔗David Fowler shows the original design principles surrounding ASP.NET Core IT’s frightening to think that at this point the idea of ASP.NET Core is 5 years old.

🔗Michael Shpilt talks about ASP.NET Middleware and stuff you should probably know but have avoided. If you’re like me you’re about 3 months away from completely abusing middleware because you need to hook into the request pipeline for a dangerous reason.

🔗TheDevTalkShow on Twitch talked with Shahed Chowduri about “ASP.NET Core from A to Z” on their twitch show.

🔗That .NET Foundation meetup about Microservices and Containerization happened and I haven’t watched this yet and the reason you know I haven’t is that I would have started this sentence with a curseword. I’m sure it’s a good presentation but I have ethical issues with Microservices. Like developers should be bound by ethics not to use Microservices.

.NET 5

🔗Have you analyzed your .NET Framework project for .NET 5 portability? You may want to do that, and they may want to update that doc to reflect that it’s now called “.NET 5” and “ASP.NET Core on .NET 5” instead of “.NET Core”.

🔗Anthony Giretti Deep Dives into the System.NET.HTTP.JSON Namespace. If you’re going to serialize JSON in .NET 5 (and you will, t least until the cool kids move to gRPC), you’ll want to pay attention to this, especially since JSON.NET is ‘mature’.

🔗Do you want to see all the new Visual Studio templates? Check that box. Also, go vote and check that box.

🔗netstandard2.0 is the most used Target Framework Moniker by far Immo Landwerth showed the stats of most used TFMs (Do you know how to Read TFMs?) and the most used TFM is netstandard2.0 followed by net45. More deeply, this means that while library authors are hoping to target both Framework 4.7+ and .NET Core 2+, they’re not diving into the netcoreapp only features yet.

Broken Stuff You should probably Patch

🔗Microsoft Exchange Servers Still open to Actively Exploited Flaw. If you’re using exchange I’m sorry and I recognize you already have problems in your life, but here’s another one: An flaw has exploints in the wild. I can’t help but notice that the exploit was patched on 11 February 2020, about a month before the US went into total lockdown mode. I wouldn’t be surprised if that hurt adoption of this patch; but regardless.


🔗dotnet Conf is 21 October 2020 and you can register here

this is not to be confused with

🔗.NET Conf is November 10th-12th, 2020 Which is totally different than dotnetconf, Also if you’re listening to the podcast version for this I’m sorry. I will be live tweeting this @gortok on twitter. Mute now, just in case.


🔗The .NET team released the results of the survey that asked people about their experiences with the .NET repositories on Github. If you like data and skewed numbers due to sample size, you’ll love this survey.

🔗PM Director of the .NET Team, Scott Hunter sits down on youtube to talk about his job. Clearly enforcing the standard that it’s spelled .NET and not dotnet is not in the job description.

🔗Is it Too-pulls or Tuh-pulls? Maira and Kendra from Channel 9 released a video on Tuples in C#

Speaking of Tuples, I scrupiously commissioned a twitter poll about how to pronounce it. It has also spawned a link to this english.stackexchange question on the subject.

Miscellanous stuff that’s interesting

🔗Brian Armstrong, CEO of Coinbase, released a reprehensible blog post about Coinbase’s mission and got thoroughly roasted for it Good. If you’re going to put profits over people in 2020 you shouldn’t expect much else.

And that’s what happend last week in the world of .NET. No releases, but overall still a busy week.

To subscribe to the Last Week in .NET Newsletter, go to https://lastweekin.NET. To listen to the audio version of the newsletter, subscribe at

UBM, and a lament for the software industry

I grew up in tech as a UBM fan. Ok, not really a fan, but a “there’s very few voices writing books about ‘how to write code well’, and this person seems to know what they’re doing, so I’m going to listen to him”. I read all his books; attended talks he gave at SCNA, and thought for a while that his way was the right way.

That, of course, was a mistake. Much like anyone else who has ideas, most of UBM’s ideas are bad, a very few are good, and then you turn the light on and realize he’s about 10 seconds away from outright fascism.

If you’ve read his tweets (don’t), he apparently has a particular affection for law and order in the form of “gosh, we apparently don’t have enough of it since there were shooting deaths over the weekend.”

And normally you’d think this would align him with the pro gun-control crowd, but it doesn’t. Instead his answer is to give the police more money, and maybe they’ll find a way to get their clockwork stat of killing 3.2 Americans a day higher.

It’s grotesque, and I normally wouldn’t spend any further typing on UBM, but I bring him up because it’s instructive of the tech bullshit that’s holding our industry back.

I got into tech because I was the first kid on my block with a computer and a LAN. I wasn’t super competitive at sports in the “I want to win” sense, although growing up in America in the 80s meant that your worth as a human being was tied to whether your team won the game. The teams I was on seemed to lose a lot more than we won, and the few times I was on winning teams I could see the Jock’s kids doing it out of some sense of devotion and attention grabbing from their dads.

My dad didn’t really give a crap about sports. He was a reporter. I love him (RIP), but he was an asshole. He liked to find the uncomfortable buttons and push them whether those buttons belonged to politicians or the local school board. It made him a good reporter. He worked for TV, several newspapers, and he was the first reporter on the scene when his eldest son, at the tender age of 7, was hit by a car in the 70s.

That was shockingly hard on him for decades to come, and the alcoholism that ensued doomed his first marriage and almost tore his second marriage apart . Ironically the Congestive Heart Failure put a quick stop to the alcoholism.

What’s that saying about frying pans and fires again? One of the things my dad used to say repeatedly to me was “it’s not the man with the answers, it’s the man with the questions.”

He also liked to say “reporters report the news, journalists make the news.” Ten year old me had no idea what that meant, and 38 year old me has no idea whether he was pro-journalist or not with that statement.

One thing he did focus on was being outside of the story. Never make yourself the story, he would say.

UBM has a volume of work much greater than most of the modern tech space. Having been working in tech longer than I’ve been alive, it’s understandable. He was also one of the agile manifesto signatories, though with the passage of time it too seems to be a relic of another era and another war.

The ire UBM draws seems to be more from his lack of empathy than anything else, and as someone whose father lacked empathy, the signs are all the same.

As of this writing, there are 941 examples of police brutality against protestors that have risen up in response to decades of police abuse and the inhumane treatment of black people and people of color that has culminated in George Floyd’s murder at the hands of police. Let us also not forget Breonna Taylor, whom the prosecutors are currently trying to justify her murder by police after the fact by trying to get her boyfriend to sign a plea deal saying she was a part of his “criminal network”.

These cases of brutality are well documented, and if you follow Radley Balko’s work, they are just the latest in the decades’ long undeclared war on the black populace by police.

It’s during this time, when pain is at its greatest, when UBM tweets, “fund the police.” To which he rightfully got scorned. Only an asshole would say “pour more fuel on the fire” when it had consumed lives, neighborhoods, and our country.

This lack of empathy is present in UBMs talks as well; he has had a constant refrain of “we are professionals and professionals do good work.” He also has some shaker woodshop view of software in calling himself a “software craftsman”, which I don’t think you could get any more white or male by referring to the best software developers as “craftsmen”.

It’s interesting to note he holds software developers to a higher standard of professionalism than police, but such is the way of the fascist. The rules apply to thee, but not to the state.

This is our software industry, and our industry is both responsible for some of today’s woes; but we can also contribute to a economic boom that no other industry can match with the amount of time it takes to become a developer.

That’s the power of being in the software industry: You can go from intern to making six figures in less than 5 years, and some are making six figures right out of school.

But there’s one thing missing: We’ve not yet conquered the racial and gender issues that hurt black people, people of color, women, transgender, and non-binary people especially. The issues that keep them from being a part of this economic boom. And as is often the case, the people in power are the cause. Whether inadvertently through a lack of empathy or intentionally, white men get to play the tech game on easy mode while everyone else has to jump through the hoops we’ve put in place. I’ve benefited from it, and I look around at the talent that we have in tech in under-represented minorities and I realize that if there were a level playing field; this industry would be far more diverse than it is now.

I’ve become rather obsessed with Hamilton, the musical. This in of itself is an odd statement, given that I am (at best) neutral on the idea of a central bank, and harbor a bit of disdain for is historical evolution; but Hamilton the musical warmed me to the understanding of Hamilton the man. A man that previously was the scorn of libertarians everywhere; and this musical humanized him.

More so than that, the Musical showed the range and depth of talent that this unique re-telling of history could bring to the table. There’s nothing quite like Hamilton out there, and there’s no way that would have ever seen the light of day with a mostly white cast and white playwright at the helm. Lin-Manuel Miranda’s work has enriched our society; and it’s past time for us to give diversity its due. His work is just a recent example; and there are dozens of others.

How many Hamilton’s have been squashed in the software industry due to gatekeeping? How many Lin-Manuel Miranda’s have been pushed away? How much oxygen have white “thought leaders” taken out of the room?

Often, when under represented minorities in tech “make it”, it’s in-spite of this climate, not because of it.

One of the things we can do is to amplify other people’s voices, and to me that’s one of the problems UBM has: He doesn’t amplify other people’s work. As someone who has spent a lifetime in the software industry and become famous, he should. He has a large following, and using it to raise others up would improve the entire industry. My disappointment with UBM starts with the idea that as a leader he has an obligation to improve the industry; but he can’t see the injustice in front of his own nose.

We’ve stopped serving humans with the software we build. We’ve stopped focusing on the humans the software affects in search of basis points of engagement to improve. We have created entire industries to serve at the pleasure of investment returns for venture funds while ignoring the costs associated with serving VCs’ interests. And all the while we’ve done this, we’ve hurt the most vulnerable among us. If you’re Anglo-saxon, there’s good money that you identify as a Christian, and Jesus framed his entire teachings around the idea of lifting up and helping those around you.

The irony abounds, and the startup founders cash another venture capital check.

We are missing out on so much by gatekeeping; even if it is unintentional. We lose nothing by adding diverse voices to our teams and we gain so much by intentionally making our teams more diverse; from our leaders on down. If we are really supposed to be the leaders of tomorrow, if software is supposed to revolutionize living, then we have to start with who gets a seat at the table, and if that table is filled with mostly white dudes, we’re never going to reach our potential as an industry or as a force for change.

We need new leaders, diverse leaders who can help evolve our industry past its roots and make it a force for good for all people, and we’re not going to get there by listening to the people who got us here.

I have no answers here, as I have very little experience with this; so I’m going to defer to someone who does.

Addressing local conference diversity (or: Why I turned down a speaking gig)

Recently I submitted for a virtual one-day free conference; and my talk was accepted.

Ordinarily, this makes me pretty happy, my rejection rate is shockingly high (or maybe it’s normal and everyone’s rejection rate is shockingly high?), and it feels good to be able to talk about a subject I think is important and under-represented.

Speaking of under-represented, I sent an email after my acceptance to ask what the makeup of the conference was, specifically what the balance of white dudes vs everyone else was. Sadly, this being a regional conference that is going virtual, the makeup was around 20 white folks (I don’t know the gender makeup), and at most a handful of people of color.

Why did I ask what the make-up of the conference was? Well, I don’t really want to contribute to the imbalance. If there’s someone out there who can represent a different point of view and speak, I’d rather hear them speak . I’m not saying all white guys have the same point of view, but we are pretty much in the same ballpark, so to speak.

I’m not naming the conference because it’s irrelevant to the conversation; but the situation is top of mind.

And that left me with a choice, do I:

A) Demur, saying “I can’t speak at this conference because there’s an imbalance in speakers”
B) Speak at the conference, because the organizer stressed that there were few if any submissions from POC, and they didn’t have control over who submitted

Let me be clear in saying this, I’m not trying to virtue signal with this blog post. “Gosh, George is a good guy for demurring because the makeup of the speaker slate was too white and too male” sounds terrible and I’d probably groan and look the other way if another guy said that, and I’m a big fan of Matthew, chapter 6. In fact, writing about it seems like I’m looking for internet points when all I’m really looking for is to get some guidance and maybe start a conversation.

Our industry is too myopic. We see this every day in the technology outcomes. Social Media and apps inadvertently allowing stalkers to harass, AI targeting black people as more likely to commit crimes, Facial recognition software showing black people as monkeys, and there are lots of other examples. I had the opportunity to hear Kesha Williams speak at RevConf 2019 on these issues, and those examples stick with you (regrettably there is no video of that talk that I can find on the internet to share with you).

Put simply, Diverse teams build better software. But even if we had those diverse teams, who is doing the speaking at our conferences? All too often, it’s people like me, who have a rather privileged past and at best would contribute to that myopia.

I can’t do much about that on my own; and I do believe there are types of outreach that aren’t zero-sum; but speaking at a conference is still zero-sum. There are a finite number of slots for a given conference. If I get a slot, that means someone else doesn’t.

But what should we do in the case where I got a slot and no one else applied? Does the same thinking still hold?

I believe it does. Outside of myself and the organizer, I’m not sure anyone else would even know that not a lot of people signed up to speak at the conference. But those aren’t the optics. The optics aren’t the context, the optics are what gets put on a web page ‘speakers’ section and burned forever in the indexes of google. No one knows that I said ‘yes’ because there was no one to turn down, they only see me, 19 other white folks, and few people of color on the speakers page.

And what does that say? Depends on who you are. To some, it says pretty clearly that I was OK with the makeup of the conference, or that at best I was indifferent to it, and to others it’s business as usual, not worthy of mention.

Here’s why I’m bothered: It should always be remarkable and concerning when our events are mostly white guys in speaking slots. But it won’t be remarkable until we start remarking about it publicly. A lot of people of color have been talking about it for a long time; but outside of the largest conferences, I haven’t seen that discussion happen at a local level. It needs to happen at all levels.

Here’s where I’m asking for your opinion. I don’t have any good answers, but I hope we can figure something out as a community; whether that’s to cancel events where there’s not enough balance in the speaker list; or whether it’s to open CFPs sooner for events (this particular CFP was pitched 6 weeks before the event was slated to begin), or whether it’s to say, “Really? You see this as a problem? We’ve got software actively destroying people’s lives and you’re writing about speaking slots at a conference?”

I don’t have a good way to end this blog post, there’s no satisfying call to action because I don’t have any answers. All I can hope for you to do is think about what it says to you when your conference speaker slate is mostly white dudes; and what under-represented voices should be speaking at those events but aren’t, and whether the makeup of the speaker slate should affect whether an event happens.

Last Week in .NET – Week ending 05 September 2020; .NET gets Half, a new Data Type.

.NET Framework September 3, 2020 Cumulative Update Preview for Windows 10 (2004) and Windows Server (2004) is now available:

WPF now will not consider ‘etc.’ and ‘e.g.’ misspellings in the WPF Textbox or the RichTextBox, so they’ve finally entered the 20th century. Congrats?

Also they fixed a bug with cleaning up something or some other with the CLR. I’m gonna copy/paste this because it’s word salad to me, but if you have to deal with this on a day-to-day basis, it looks like they fixed ‘it’ (whatever ‘it’ is):

– Addresses an issue with a crash on COM interop to properly return the hresult for the Out of Memory Exception
– Addresses an issue in some 32 bit apps where, in certain scenarios, the JIT might omit a function call
– Improved support for cleaning up private temporary certificate keys

Some more editor goodies in Visual Studio 2019 Preview:

You can have Preview installed side-by-side, and preview is the only way you can see the .NET 5 goodies. Here are some of the editor goodness they’ve added in Preview:

TypeScript 4.0 is now Generally available:

App Trimming is going to be in .NET 5. and you can customize it:

I have no idea what this does from a practical perspective; it sounds like it removes unused members, functions, methods, etc, which should lower the executable size. Great for people who deploy to user’s desktops and Microservices; but not sure in the normal ‘we deploy to our server’ instance this would be useful. Shout out if I’m wrong and let me know why.

You now have template parity between the dotnet new command and the Visual Studio project templates

As of Visual Studio 16.8 Preview 2, you can now toggle in the settings to see all the templates you’d see from the command line. I like this, but I’m probably the only one that thinks this should be the default, and not the other way around.

.NET is faster on ARM64 now

The .NET team has been working hard to improve performance for ARM64 for .NET, and I’m glad. I don’t think Intel is long for this brave new world.

This blog post rivals most Steve Yegge blog posts; but if reading nitty gritty implementation details about the ARM platform juices you, give this blog post a read.

AOP using Proxies in .NET Core

This doesn’t get enough press, and AOP doesn’t get enough love, but check this out:

NDC Minneosota starts online tomorrow

Yea, I missed this; but if you’ve got money to burn, NDC is a great place to burn it. Or you can wait 6 months for the videos to be on Youtube.

.NET Now supports the Half Datatype

I really thought this was a joke. But reading it, it isn’t. There’s the need for a Half data type, apparently?

And that’s it for what happened last week in .NET . Today is a holiday so I won’t be releasing the audio form of this newsletter.

Last Week in .NET – 29 August 2020 – Blazor is the new Silverlight?

.NET 5 preview 8 has been released:

If you want to use .NET 5 Preview 8 with Visual Studio, make sure you have the Visual Studio 2019 16.8 preview 2 release installed.

Speaking of Visual Studio 2019 16.8 Preview 2, it now supports editor config fileheaders and namespace settings. So if your company has a 1980s centric approach to file-headers, you can now offload that work to the editorconfig.

ASP.NET Core 5 Preview 8 has been released.

Lots of Blazor updates and improvements, as well as ASP.NET Core now supports Model binding and validation for C# 9 Record types.

Entity Framework Core 5 Preview 8 has been released:

They fixed a metric ton of bugs, and there are a lot of small features that may interest you.

F# 5 Preview 8 is out:

F# 5 now includes String Interpolation; a la what C# has had for a few releases now. F# 5 now also includes complete nameof implementation support, and more.

Is it .NET 5? Is it ASP.NET Core 5? Is it ASP.NET 5?

Jon Galloway gives us the answer:

ASP.NET Core name stays – you’ll either see “ASPNET Core running on .NET 5” (blog post link) or “ASPNET Core 5”.

Npgsql update for EFCore 5 Preview 8 has been released:

I’m really glad people are pinning to the version of .NET Core they support. It’s hard to keep up otherwise.

Is Blazor the future of development?

Short answer: No, it’s not going to replace JavaScript, but it will give the “We’re a Microsoft shop, we use what Microsoft supports” crowd an adoption path for their aging Webforms implementations.

Saturday Morning Cleaning

Nobody cares about clean code.


You don’t, I don’t, your boss doesn’t, and your business model especially doesn’t.

I have three kids, two cats, a dog, and a spouse. We don’t really care about a clean house when the nights are frantic and we’re busy getting ready for the next day. After all, daughter #1 has soccer, daughter #2 has ballet, and daughter #3 (the 19 month old) acts like Jack-jack from Incredibles 2. When Saturday rolls around, we look around and realize. Oh god, we live in this mess?

And so we spend part of our Saturday setting things to rights.

We didn’t care about it when we probably should have, and as such had to spend part of our Saturday cleaning instead of having fun or preparing for the next week.

And next week, it starts all over again, and it’s this way throughout the school year. When summer rolls around, things quiet down and we pledge to do better next school year. Surprise, that lasts for all of about two weeks.

It’s not that we want to live in a messy house — we emphatically don’t. But, if the choice is ‘be ready for the next day’ or “not be ready for the next day and have a clean house”, we’re gonna punt on cleanliness, every time.

Your work is the same way. If you work in a feature factory (and there’s no judgment there, I’d expect that everyone reading this has worked in one at one time or another — they’re that common), then you’re going to frantically be implementing features for the business to demo and for sales to sell (or that they’ve already sold), and when that is done you get a few weeks where things quiet down before they start up again.

It’s the Saturday morning cleaning all over again.

Why can’t we break out of this cycle?

There’s a lot of value in a clean house. It’s easier to get ready for the next day, the overall level of stress is lower, and if something comes up that demands our immediate attention (like grabbing the kids shoes next to the door so we can get out of the house if it catches fire), we know that we’ll be ready.

A clean house enables us to improve our efficiency in getting ready for the next day, and the one after that, and the one after that.

But you can’t sell your boss on improved efficiency, not unless you can tie it to what they care about.

And until we can tie the work we do to something the boss cares about, it’s hard to sell continuous improvement in the form of Test Driven Development to ourselves, let alone our management teams.

Here’s a few of those things I’ve witnessed personally:

– Projects taking weeks to launch instead of several months
– Projects pivoting faster when the feature set needs changing
– No late night rollbacks due to a regression bug
– Decreased turnover
– Decreased bug count
– Happier customers
– Happier teams
– Going home at 5pm because you know your system won’t crash on you late at night
– reduced need for ‘on-call’ rotations for developers
– Improved revenue from being able to add features without increasing bug count and burdening support

When assessing importance, look for things that are tied to your KPIs or OKRs. If it’s written down, they care about it. If they have quarterly reviews about it, they care about it.

What’s important to you and your team? What’s important to your boss?

Is the .NET foundation the interest group we need them to be?

In case you missed it, I’ve been working on and released a new podcast, Last Week in .NET. It’s based off of the weekly newsletter of the same name, off the URL pun that landed at my feet.

In yesterday’s episode, I deep dive into the .NET Foundation, how it’s set up, and whether it can be the interest group we (the .NET Community) needs them to be. Give it a listen if you work on .NET.

P.S. I was almost whispering when I recorded this, due to kids sleeping next door. I’m going to not do that again; but if I sound conspiratorial in the episode, that’s why.

TDD is an antidote for uncertainty

Everyone on a team has to buy into TDD for it to work.

That’s partly why so few teams do it.

What’s wrong with “Just build it and debug it later?” They ask.

Nothing, as long as you’re OK with being uncertain how long it will take to debug, and how long it will take to fix future bugs when you find them. Even if you’re 100% confident in that; what happens when your most junior team member draws the short straw. Are you certain they’ll find it in the same amount of time you would?

TDD is a strategy to combat uncertainty. Uncertainty in your codebase, in your team, and whether or not you’ll be woken up by a production issue at 3am on a Saturday morning.

Last Week in .NET – July 18, 2020

I don’t know if I’ll be making posting the newsletter to my blog a habit; but if you haven’t already signed up for Last Week in .NET (or the Podcast version for those of us who are reading disinclined), here’s what last week’s newsletter looks like:

We see you, Gilthub

Github, the eponymous source control collaboration system for Open Source Projects, owned by Microsoft, has been caught trying to sneakily continue its contracts with ICE — you know, the government agency that puts kids in cages — by getting a contract award from ICE through Dell Federal Systems.

Now all of this may be on the up-and-up; Dell sells Github enterprise to ICE as a reseller, Github gets plausible deniability, and ICE gets to use the cool kids source control system.

But it’s still morally bankrupt for Github to take this contract — for an amount, I might add, that totals $79,312.50, or roughly the same amount Microsoft should have paid Keivan for using his AppGet architectural work in their WinGet package manager solution.

Special thanks to Dave Copeland for making me aware of this. Twitter is sometimes a beautiful thing.

Github ‘offers’ to let Non-US employees do the same job for half the pay.

Microsoft’s github acquired NPM. They apprently “offered” to reduce non US employees compensation by up to 50%. to do the same job.

In the Year of our Lord 2020 it is very impressive that a company like Github, who are still reeling from their morally bankrupt decision to keep an ICE contract worth $79,000, would also stoop so low as to to get existing employees of NPM to quit by offering them half the money to do the same job.

When we call supporting ICE morally bankrupt, that is not meant to inspire you to be the villian, github. That’s an insult, meant to shame you into doing the right thing.

Vulnerabilities reported this week

Microsoft reported and released a fix for CVE-2020-1147, a .NET Core Remote Code Execution Vulnerability. If you accept XML input, this advisory affects you. If any of your API endpoints accept XML, this advisory affects you. .NET Core 2.1.19, .NET 3.1.5, and .NET 5 Preview 6 are all vulnerable. This is fixed in the latest version of .NET Core 3.1.6, and will hopefully be fixed when .NET 5 Preview 7 is released.

If you are running Visual Studio 16.4, you need to update SDK to 3.1.106; if you’re running Visual studio 2019 16.5 or later, update to SDK 3.1.302 and then curse version numbers loudly like I’m about to.

If you use Windows DNS Server, there’s another RCE vulnerability that is apparently “wormable”, but at least some infosec people seem to think it won’t turn into a big problem. This being 2020, I’m not holding my breath.

Self Contained Applications

One of the more interesting parts of .NET Core has become the “Self Contained Application” -> effectively the runtime, the application and its dependencies in one package. This is great for datacenter style deployments or cross platform console applications, or even potentially in .NET 6 with MAUI: Desktop applications. That same advantage of self-contained applications is also a disadvantage, as foretold in this note in the Announcement:

Additionally, if you’ve deployed self-contained applications targeting any of the impacted versions, these applications are also vulnerable and must be recompiled and redeployed.

Long story short: Not only do you need an update story for your organization’s release cadence, that cadence must also take into account vulnerabilities in the runtime.

.NET Core 2.1.20 has been released

Release Notes:…

Nick Craver talks Attacks on Stack Overflow.

Stack Overflow, the largest (that gets developer press and isn’t Microsoft owned) site built on ASP.NET MVC (and soon .NET Core), gets a lot of attacks against it as a “top 50” (according to Wikipedia) site on the internet. Nick Craver, their architectural lead; goes deep into the sorts of attacks that happen. This is a good watch. Watch it.

Improvements in .NET 5

This is the sort of thing I get jazzed about. The faster C# gets, the less we have to worry about using a language like Go or Rust for high performance situations. I don’t use Rust, but anyone that does will tell you within seconds of meeting you. They’re our Crossfitters.

Anyway, having an easy-to-use toolchain to write fast code is good for all of us; and really good for our economic prospects, if we’re being honest. The .NET team gets jazzed about performance too, and they’ve released another blog post detailing speed improvements in the forthcoming (now in Preview) .NET 5. .NET 5, remember, is just .NET Core in a trench coat. Microsoft is going directly from .NET Core 3 to .NET 5; because awkwardly, they already have a .NET 4. I have lots of jokes to make about Microsoft Marketing, but I’d like to be clear about this: Microsoft has 20 years of inertia around the .NET Framework, and there were problem dozens of internal corporate teams that were hoping that .NET Core would fail because their bread and butter was built on .NET. Luckily it didn’t fail, and luckily the group that said “Let’s unify the two” won. Over time .NET Core has had to make concessions to stay in the game, like CSProj over project.json; but those concessions have ultimately scored large wins for both .NET Framework and .NET Core. This is a narrow line to walk, and for all the grief I give them, Microsoft’s Marketing team is handling this with grace and aplomb.

BinaryFormatter will finally be tossed off a bridge

Hashing data is now two lines of code

Special thanks to Kevin Jones @vcsjones for making me aware of this. In likely .NET 5 Preview 8, you’ll have the ability to hash data in two lines of code!:

<code>ReadOnlySpan<byte> someData; byte[] hash = SHA256.HashData(somedata); //or Span<byte> hashBuffer = stackalloc byte[32]; int bytesWritten = SHA256.HashData(someData, hashBuffer); </code>

This is pretty and awesome. It’s pretty awesome. If you find yourself producing hashes of data; it can’t get much faster or easier than this.

Windows Community Toolkit 8.0.0 Preview2 for WinUI 3 Preview 2 has been released

Microsoft continues to streamline how it versions its products by overusing the word Preview. Anyway, this release lets developers kick the tires on the new WinUI, which is better known as “How you write Desktop Applications in .NET 5”. The only hope I have is since they’ve coalesced on ridiculous versioning schemes, they’ve also coalesced around one way to develop Desktop Applications in .NET 5. Developers who love XAML should love WinUI 3.…

ImageSharp passed 6 million downloads; and an exposure angel got their wings.

The creator of ImageSharp laments getting six million downloads on an open source project that obstensibly does not pay the bills. At this point in OSS, you either go APGL or you get to the point where you wish you had.


I had understood .NET MAUI to be a codename for .NET 6. It is not. Part of .NET 6 will be ‘MAUI’. It’s capitalized because it’s an acroynmn. I should have known, of course, as we’re programmers, and we love Acroymns. Anyway, MAUI stands for: Multi-platform App UI. Or for the rest of us: Cross Platform UIs!

YES. FINALLY. Something that will be faster than electron and have less users to boot! Seriously though, I’m pretty stoked that this is happening, though I hope Microsoft will take this time to realize that cross-platform UIs are probably best done in HTML, CSS, and JavaScript, and not XAML. Actually, scratch that, Cross platform UIs are terrible in HTML, CSS, and JavaScript, but it’s ubitquitous, and that’s what matters. It looks like there will be a few ‘AppModels’ supported: MVVM, RxUI, MVU, Blazor. If you don’t do Xamarin currently, RxUI and MVU will be new to you (and to the rest of us). RxUI is a “reactive” style of programming to support one-way updates from the model to the UI. and MVU is “Model View Update”, which I hear is cool but apparently every framework needs to create a new rendering pattern, and MVU is Elm’s gift to the rest of us. Programmers create their own blog engines, UI Frameworks write their own Rendering pattern.

PFCLotW (Pretty Fricking Cool Library of the Week)

If you’re using .NET (Whether Framework or Core), and you want to benchmark your code, you should be using Benchmark.NET. It’s called Benchmark because that’s what it does, and they slapped the .NET moniker on the end because that’s what library authors for .NET Do. Since this is .NET, their alternatives were NBenchmark, and BenchmarkSharp. I’m glad Benchmark.NET won.

Anyway, Benchmark.NET let’s you set up runs against your code; specifically against doing the same operation multiple ways. It then accurately benchmarks how fast the code is, what sort of memory usage it has, and a few other neat sundries about it.

If you’re using System.Timer(), don’t. Use Benchmark.NET instead. (This is not a sponsored ad, but I do have a thing for Console Applications that are amazing)

.NET Foundation Updates

The .NET Foundation has an open pull request for changes to their bylaws to allow for a seven day comment period before a change would take effect (or be voted on?). You can view it here.

The .NET Foundation also has interviews up with all of the candidates for election to the board.

If you aren’t already a member of the .NET Foundation and you’re reading this. You should be. Decisions are made by those who show up, and those decisions affect all of us that use .NET. Become a member of the .NET Foundation here](


On July 30th, there’s a .NET Conf focused on Microservices. This conference is for people who want to add “Microservices” to their resume. Save the date here. The .NET Conf is November 10th-12th, online only. It’s the 10th year of this event. You can save the date here. If you’re not a fan of sitting through three days of online events, I’ll be live-tweeting it; In preparation, you can go ahead and block me now.

And that’s what happened Last Week in .NET

Announcing the Last Week in .NET Newsletter and Podcast

I like .NET. I love to practice writing, and I want news about .NET that condenses what has been released and what’s happened into something I can scan by flicking my thumb.

Because of those three facts, I’ve decided to start a weekly newsletter called Last Week in .NET. I called it that because was available as a domain and the pun was too great to pass up. You’re welcome.

Microsoft has gone from “Meh, updates to .NET only need to happen once a year, maybe” to “HERE’S YOUR UPDATES. DO YOU LIKE UPDATES BECAUSE I HAVE MORE OF THEM”, and while the frequency is a bit frightening to behold, it makes for good newsletter fodder. I scan the releases from the .NET ecosystem, analyze them, and hum a few bars about what’s happened so you don’t have to.

If that feels like something you’re cool with hitting your inbox, subscribe here.

Oh, yea. There’s also a podcast version because I heard podcasts are all the rage now, and the extra time it takes to produce a podcast is marginal once I’ve written the newsletter. So, subscribe that too — the podcast will also drop on Mondays, but because of the way podcasts work, the first one probably won’t show up on your favorite iOS or Android podcast app until Thursday or Friday of this week. After that, it’ll show up every Monday, unless I take the week off.

The first newsletter drops tomorrow, so subscribe now!