.NET Rocks!

New Windows LegacyHive zero-day gives hackers admin privileges

How has testing changed in the era of AI? Carl and Richard talk to Debbie O'Brien in her new role at Zephyr about using LLMs to help build and validate tests - and much more. Debbie talks about joining Zephyr and using testing tools like Playwright to validate application workflows and generate documentation. This leads to a discussion about documentation being more important than ever, since LLMs will actually read it! Maintaining quality is a challenge with LLM-generated code and tests, so there's always a role for a critical eye in the process.

The Open Source Maintenance Fee is more than a year old now - how are things going? Carl and Richard catch up with Rob Mensching to discuss the OSMF and its success in supporting Rob's WiX Toolset project. Rob talks about the key aspect of the OSMF - making it part of the licensing, so that it isn't optional. Of course, you can download the source from GitHub and compile it yourself without violating any license terms, but if you're that engaged, you can contribute too. The goal with OSMF is to have folks who want to use the product...

Have you checked out Azure Container Apps lately? Carl and Richard talk to Paul Yuknewicz and Jan Kalis about how they have sped up startup time with Container Apps using a feature called Express, and then on to the big news - Sandboxes. Sandboxes let you experiment with Azure Container Apps with managed identity to access Azure Connectors to all sorts of resources, both within Azure and outside it - Salesforce, SAP, etc. It's an effective and secure strategy for building applications, but also for experimenting with agents - at no point does the agent actually have control of any...

DNSimple has a CLI! Carl and Richard talk to DNSimple CEO Anthony Eden about the evolution of the DNSimple CLI in today's software market. DNSimple provides DNS, domain registrar, and certificate services - so why does it need a CLI? Anthony talks about earlier experiments with CLIs for folks who didn't want to use the web interface. But today, large language models change the game and work best with a CLI - those specific commands mean more accurate results from LLMs, which make for a powerful natural language interface experience. The conversation covers the new tooling around LLMs, how the...

Do data centers in space make any sense? Time for a rare summer-time Geek Out! Richard chats with Carl about all the hype surrounding building orbital data centers for AI workloads. Richard points out that enthusiasm for this idea surged in the fall of 2025, when the backlash against ground data centers peaked. But could you actually make the orbital data centers work? The conversation works through a reasonable satellite design, covering off the details of power, cooling, communications, and satellite management. But how many satellites would be enough? This leads to an exploration of Kessler Syndrome, where orbital debris gets...

Can tooling make event sourcing implementations easier? Carl and Richard talk to Einar Ingebrigsten about his work on cratis.io - a set of open-source tools for implementing event sourcing in your application. Einar discusses the foundational elements of event sourcing and the common implementation patterns he developed at Cratis. With extensive support for .NET, Cratis provides tooling for data storage, event response, replay management, and much more. Also in development is Cratis Studio for collaborating visually on an event model - and generating the code in the process.

Is it time to build your own agent harness? Carl and Richard talk to Emmz Rendle about her work on Daemonic AI, which gives you more control over which models and tooling you use to build software with agents. Emmz talks about the upcoming rug pull in AI software development tools, where prices are rising, and services are being restricted. Having enough control to choose when to run locally becomes key to being productive at a reasonable price. Being able to pick-and-choose what agents and configurations to use for each of the agent roles you want to implement is super...

What settings, configurations, and workflows do you use for every .NET app? Carl and Richard talk to Scott Sauber about his list - from organizing folders by feature, to logging, security, and testing. Scott talks about enforcing rules like treating warnings as errors so you won't ignore important warnings, and validation in the build, to make applications more reliable. Each of these items represents some work, but in the end, your application will be higher quality and more reliable. Which ones are you already doing?

Large Language Models can generate a lot of text - but is it any good? Carl and Richard talk to Vishwas Lele about his ongoing efforts at pWin.ai to build tools for responding to government RFPs. Vishwas focuses on the quality problem - both the quality of the incoming RFP and the quality of the responding proposal. How do you determine the key requirements of an RFP reliably? And when it comes to the response, how do you provide measurable results for a response? The conversation digs into a change in workflow that benefits the RFP process regardless of...

Use What Works! Carl and Richard talk to Dylan Beattie about the Use What Works movement, encouraging developers to use well-maintained open-source projects available today rather than rolling their own. Dylan explains how folks go down a path of believing a library is simple until they learn enough to realize that every bit of software is more complicated than they realize. And the less code you own, the happier and more productive you are. Adding AI to the mix only makes it clearer: you need some stability in development. If you're changing every layer of code, you'll spend even more...

Ready to go nano? Carl and Richard talk to José Simões about the open source .NET nanoFramework - a community-driven project to provide .NET for embedded systems. José talks about the evolution from the .NET microFramework, to something even smaller, while at the same time, microcontrollers have gotten much more powerful. The conversation looks beyond the hobbyist and educational uses of these systems into commercial IoT applications. The development cycle is one you'll recognize, working in Visual Studio (or Visual Studio Code) and executing against an emulator, or to the actual controller via USB. And yes, you can set bre...

Recorded live at the Tavern Hall in Bellevue during the Party with Palermo for the MVP Summit, it's episode 2000! Carl and Richard take questions from the audience and play clips from past guests and listeners about their experiences with .NET, and the role that .NET Rocks has played in their careers. After two thousand shows, there are lots of stories, and plenty to celebrate. Thanks for listening!

The Y2K bug turned out to be a non-event on January 1, 2000. How did that happen? Carl and Richard bring together a number of stories from folks who were there, fixing the software and updating systems, so effectively that, ultimately, nothing much happened when the clocks rolled over. It was common practice with early software to only store two digits worth of year - back then, storage space was at a premium. For years, there had been warnings about fixing these problems, but by 1999, it was essential. These are the stories of how some folks did those fixes so effectively...

How are LLMs changing software development? Carl and Richard talk to Rob Conery about his experiences as a consultant bringing the new AI tools and techniques into companies. Rob talks about focusing on the most painful problems first to show the team quick results and make their lives better. The conversation digs into how these tools seriously change the way developers work and what it takes to embrace those changes. Lots of good thinking from a very experienced developer on how to do more than ever before!

How do you make your agents more knowledgeable about your company data? Carl and Richard talk to Ed Charbeneau about Progress Agentic RAG-as-a-Service, using NucliaDB as a vector data store to organize your company information into a form an agent can work with efficiently. Ed talks about the various approaches available today for providing timely company data to agents and the power of a dedicated data store and service model so that you spend less time on plumbing and more time building a great agentic app. The products are open source and have great .NET SDKs - check them out!

ASP.NET Core continues to evolve in 2026! Carl and Richard talk to Daniel Roth about all the goodness in the ASP.NET Core space, including MVC, Razor, and Blazor! Daniel talks about the publicly visible ASP.NET Core Roadmap on GitHub - where you can support ideas, add your own, and debate implementations! The conversation dives into the focus on Blazor - MVC and Razor aren't going away anytime soon, or perhaps ever. Still, the energy is definitely on Blazor, and its potential to provide a great development experience that scales effectively and provides the features your applications need. And...

What does secure coding look like today? Carl and Richard talk to Chris Ayers about the MITRE ATT&CK matrix, a comprehensive breakdown of the tactics, techniques, and procedures black hats use to exploit your systems. Chris talks about the role of developers in creating more secure software, starting with logging - surfacing important data about the use of applications that can help indicate when a black hat is taking advantage of it. The conversation also digs into supply chain attacks, various techniques for resisting exploits being introduced through libraries, and the ever-expanding array of threats affecting software today!

What does secure coding look like today? Carl and Richard talk to Chris Ayers about the MITRE ATT&CK matrix, a comprehensive breakdown of the tactics, techniques, and procedures black hats use to exploit your systems. Chris talks about the role of developers in creating more secure software, starting with logging - surfacing important data about the use of applications that can help indicate when a black hat is taking advantage of it. The conversation also digs into supply chain attacks, various techniques for resisting exploits being introduced through libraries, and the ever-expanding array of threats affecting software today!

Let the squad help you build your application! Carl and Richard talk to Brady Gaster about Squad, a tool for creating an AI development team using GitHub Copilot. Brady discusses creating specialist agents across various aspects of building an application to keep context as small as possible, along with token consumption. Often, agents communicate with other agents to work through project problems, generating persistent information about the project, including skills as needed. Squad continues to evolve and get more powerful - try it with your application!

Let the squad help you build your application! Carl and Richard talk to Brady Gaster about Squad, a tool for creating an AI development team using GitHub Copilot. Brady discusses creating specialist agents across various aspects of building an application to keep context as small as possible, along with token consumption. Often, agents communicate with other agents to work through project problems, generating persistent information about the project, including skills as needed. Squad continues to evolve and get more powerful - try it with your application!

Avalonia continues to evolve! Carl and Richard talk to Avalonia CEO Mike James & Matt Lacey about the latest version of Avalonia, the open source UI framework for building cross-platform applications with .NET. Mike's conversation with the Google Flutter team has led to replacing the Skia rendering engine in Avalonia with the newer Impeller Rendering Engine that Flutter itself depends on. This opens the door to excellent smartphone implementations with Avalonia, alongside its usual desktop and embedded roles. With enterprise editions and the new Avalonia Accelerate, there's more to come from the team!

Avalonia continues to evolve! Carl and Richard talk to Avalonia CEO Mike James & Matt Lacey about the latest version of Avalonia, the open source UI framework for building cross-platform applications with .NET. Mike's conversation with the Google Flutter team has led to replacing the Skia rendering engine in Avalonia with the newer Impeller Rendering Engine that Flutter itself depends on. This opens the door to excellent smartphone implementations with Avalonia, alongside its usual desktop and embedded roles. With enterprise editions and the new Avalonia Accelerate, there's more to come from the team!

Your first app interface should be a CLI! Carl and Richard talk to Kathleen Dollard about her experiences creating the .NET CLI - and how CLIs are only getting more important in the era of AI. Kathleen talks about working within the POSIX CLI standard for consistency's sake and to recognize that there will be many more CLIs in your life, so they should be as similar as possible. While CLIs may have started as configuration-as-code and DevOps practices, LLMs work well with them as long as consistency is maintained. There are several projects out there today to help you...

Your first app interface should be a CLI! Carl and Richard talk to Kathleen Dollard about her experiences creating the .NET CLI - and how CLIs are only getting more important in the era of AI. Kathleen talks about working within the POSIX CLI standard for consistency's sake and to recognize that there will be many more CLIs in your life, so they should be as similar as possible. While CLIs may have started as configuration-as-code and DevOps practices, LLMs work well with them as long as consistency is maintained. There are several projects out there today to help you...

Artificial Intelligence is changing how software development happens - how is your team coping? Carl and Richard talk to Andrew Murphy about his work leading teams struggling with AI tools. Andrew talks about Nolan Lawson's blog post We Mourn Our Craft and his blogged response about dealing with grief. Some developers are embracing these new tools - perhaps they're new to development, or very experienced. But some folks aren't having a good time with AI and are wondering what has happened to their careers. How can you help?

Artificial Intelligence is changing how software development happens - how is your team coping? Carl and Richard talk to Andrew Murphy about his work leading teams struggling with AI tools. Andrew talks about Nolan Lawson's blog post We Mourn Our Craft and his blogged response about dealing with grief. Some developers are embracing these new tools - perhaps they're new to development, or very experienced. But some folks aren't having a good time with AI and are wondering what has happened to their careers. How can you help?

It's always been challenging to make reliable software - is AI making it worse or better? Carl and Richard talk to Damian Brady about his experiences building software with AI tools and trying to bring that software up to an acceptable standard. Damian talks about leveraging LLMs' tendency toward detailed analysis to catch problems in code. It takes practice and experience to get good at using these tools, but they become more powerful over time!

It's always been challenging to make reliable software - is AI making it worse or better? Carl and Richard talk to Damien Brady about his experiences building software with AI tools and trying to bring that software up to an acceptable standard. Damien talks about leveraging LLMs' tendency toward detailed analysis to catch problems in code. It takes practice and experience to get good at using these tools, but they become more powerful over time!

How does Artificial Intelligence impact our approach to building secure software? Carl and Richard talk to Ben Dechrai about his experiences working with AI tooling and building AI apps, and how that impacts security. Ben talks about the concerns organizations have about using AI tools - what these tools might do with the code they are exposed to, as well as the code the tools generate. The conversation steers to local AI as a solution, although so far, the equipment and tools are very limited. Ben also talks about how AI tools are being used to both attack and secure...

How does Artificial Intelligence impact our approach to building secure software? Carl and Richard talk to Ben Dechrai about his experiences working with AI tooling and building AI apps, and how that impacts security. Ben talks about the concerns organizations have about using AI tools - what these tools might do with the code they are exposed to, as well as the code the tools generate. The conversation steers to local AI as a solution, although so far, the equipment and tools are very limited. Ben also talks about how AI tools are being used to both attack and secure...

Why would you write code to generate code? Carl and Richard talk with Jason Bock about his experiences using modern .NET source generators to optimize certain aspects of applications. Jason talks about treading carefully - while .NET source generation has been part of .NET since 5.0 and Roslyn, it is a special case approach to problem solving. But with specialized implementations for regex and P/Invoke, there is some huge potential in these coding techniques that you can take advantage of!

Why would you write code to generate code? Carl and Richard talk with Jason Bock about his experiences using modern .NET source generators to optimize certain aspects of applications. Jason talks about treading carefully - while .NET source generation has been part of .NET since 5.0 and Roslyn, it is a special case approach to problem solving. But with specialized implementations for regex and P/Invoke, there is some huge potential in these coding techniques that you can take advantage of!

What's coming for Aspire in 2026? Carl and Richard talk to Maddy Montaquila about her work as the product manager for Aspire, the tool that helps you build cloud-native, distributed applications in any language and on any platform. Maddy talks about moving beyond .NET, recognizing that modern applications are written in a number of languages, and the team has focused on ensuring excellent support for Python and JavaScript, as well as the .NET languages. The same is true for the cloud - Azure, AWS, GCP - Aspire works great with them all. And then there's the role of AI, both in...

What's coming for Aspire in 2026? Carl and Richard talk to Maddy Montaquila about her work as the product manager for Aspire, the tool that helps you build cloud-native, distributed applications in any language and on any platform. Maddy talks about moving beyond .NET, recognizing that modern applications are written in a number of languages, and the team has focused on ensuring excellent support for Python and JavaScript, as well as the .NET languages. The same is true for the cloud - Azure, AWS, GCP - Aspire works great with them all. And then there's the role of AI, both in...

What's happening with MAUI today? Carl and Richard talk to Gerald Versluis about the latest version of MAUI - and what's coming next! Gerald talks about the release of .NET 10 and the new features that have come to MAUI, including improvements in quality, performance, and ease of use. The conversation also digs into adjacent technologies like Uno and Avalonia and how they are collaborating with the MAUI team to make development even easier!

What's happening with MAUI today? Carl and Richard talk to Gerald Versluis about the latest version of MAUI - and what's coming next! Gerald talks about the release of .NET 10 and the new features that have come to MAUI, including improvements in quality, performance, and ease of use. The conversation also digs into adjacent technologies like Uno and Avalonia and how they are collaborating with the MAUI team to make development even easier!

How do you distribute Windows apps? Carl and Richard chat with Shmueli Englard about the power of distributing apps through the Microsoft Store. You package your app as an MSIX and can deploy it to the Microsoft Store, and then send updates through it as well. If you want to charge for the app, Microsoft will do the licensing and payment systems for you (for a fee, of course), but if your software is free, distribution through the Microsoft Store is also free! Want to do your own updates? You can do that too.

How do you distribute Windows apps? Carl and Richard chat with Shmueli Englard about the power of distributing apps through the Microsoft Store. You package your app as an MSIX and can deploy it to the Microsoft Store, and then send updates through it as well. If you want to charge for the app, Microsoft will do the licensing and payment systems for you (for a fee, of course), but if your software is free, distribution through the Microsoft Store is also free! Want to do your own updates? You can do that too.

What's happening with Uno now that .NET 10 is released? Carl and Richard talk to Jérôme Laban and Sam Basu about the latest developments in Uno, including their collaboration with Microsoft on MAUI, WASM, and more! The conversation also digs into the role of AI in the Uno Platform, bringing MCPs into play to build applications faster and make migration from legacy systems easier. A lot is going on in development today!