How'd you like to listen to dot net rocks with no ads? Easy? Become a patron for just five dollars a month. You get access to a private RSS feed where all the shows have no ads. Twenty dollars a month, we'll get you that and a special dot net Rocks patron mug. Sign up now at Patreon dot dot NetRocks dot com. Hey, welcome to dot net Rocks Live from Build. Well, it's not live to you, but it's live for us.
It turns out every time we record it's live.
We used to say that at the beginning.
From dot net rocks, what's the what's the alternative dead Dead? From dot com? It's Do Not Resuscitate otherwise known as DNR. Okay, well, it's dot ne rocks where build. We just got out of the keynote and Scott Hunter shows up and we're going to have a conversation.
Yeah, I bet we will.
And before we talk to Scott, we have to do a little thing about what happened in nineteen fifty three. Yeah, because this is show nineteen fifty three. Scott, you're welcome to join us, dive in on this, Yeah, if you want, sure, So, Mount Everest Sir Edmund Hillary have Tensing Norgay, who is his sherpa. Right, Ye became the first people to reach the summit of Mount Everest on May twenty ninth. You kind of went up Mount Everest.
I went to base camp, went to the bottom of Everest, Yeah, which is the same altitude as the top of Kills.
Also and Fuji, I have done Mount Gratton, which is inton. It's basically a recycling pile that I walked to the top of and is twenty feet all right.
Okay, but that's the thing that kills you after doing Kelly. Then you go to beverstpace camps, like I am at the bottom of this mountain and I feel like I felt getting to the top of a chilly yeah Fortal.
It's crazy that you, you know, you people go to a base camp at Everest and stay there for a couple of weeks to acclimate before they go all the way up. So it's like, you know, for Killy, we didn't really do much a lot of acclamation a little bit, a little bit, yeah, but you told me.
I think that the grade for Fuji and for Killy is a little more easy to traverse, whereas Everest is kind of a steeper grade.
Yeah, I don't know. It was very gradual getting to the base camp. I didn't go past that. But there's a bunch of different routes on Killimanjero and I think you did. You did the sixth day route too, didn't you. I did, and that has more acclamation time, which is actually important. They say, if you do the sixth day route, it's like a ninety percent summit, but if you do the four day route, it's like a fifty percent Summit's you just pushing your body too hard?
All right? Well? The Korean War officially ended in nineteen fifty three an Armis disagreement signed on July twenty seventh. DNA was discovered by James Watson and Francis Crick, building on Rosalind Franklin's work. I don't think there's a relation. According to King's College, London, Joseph Stalin died on March fifth. Dwight D. Eisenhower was sworn in as President of the United States on January twentyeth Queen Elizabeth iiO Is crowned on June second. Jesus A good year, yeah, and some
tech advancements, Richard, I'm sure we'll have more. But the US detonated the first thermo nuclear device code named Mike. Yeah, in the Central Pacific Ocean. I know Mike, who was like a thermonuclear device.
Yeah. The big one is IBM's six fifty, which was the sort of first mass produced computer. So we're finally you know, up until then, every computer was bespoke. Yeah, right, they were calm built. You know. I told that story about when they built that the first that first machine, and the Census bought it, but then they wouldn't give it to them because they didn't were afraid to take it apart. Right, So yeah, the six fifty was the first sort of reliable, rebuildable computer that they've asked.
All right, well that's just a few things that happened. But geez, what a year.
Yeah, ninety fifty three important year knowing about.
It all right? Well, as I said, Scott Hunter is here and we have to do a thing first called better no Framework roll the crazy music. Awesome what he got Our friend Simon Krawn, of course, he is a font of good stuff. He finds things. He's part of the app and X team. Also he's helped me out with some of my GitHub projects and just a great guy. So he's created z link z l huge his project. Oh no, it's not his project. He found it and yeah, so he found it and shared it with me. It's
a zero allocation link library for dot net. What does that mean, Well, allocation, zero allocations means you don't create anything on the heap, right, you don't create anything that needs to be garbage collected. So that's a good thing. And I was talking to my buddy Scott before you got here, Richard, about zero allocation. And it turns out a lot of the optimizations in dot net have been because of zero allocation.
That's been very much a move, right. I mentioned a lot of the work they did in that exotic version of Polly, which about minimizing allocation.
Right, and so then we got talking about ring buffers, which is.
I was going to say, yeah, Kestrel and dot Net. We were actually sitting in a room and building forty four one day and we're trying to figure out, obviously, how do we make the web server, you know, allocate less, Yeah, because that's the you know, the negative of garbage collection is if you allocate a lot of memory, well, the garbage collector has to go work in the background to go get rid of that memory, and that's going to
burn CPU and that's going to slow things down. And so we were trying to find you know, a lot of the early optimizations in dot net the dotin corbets were how do we reduce the allocations that we're making in the first place. And so one idea was, hey, the webserver is always turning through requests. Let's just put a ring buffer inside of there, and then we're not allocating at all, we're just reusing memory.
What's a ring buffer?
Actually, I just think it's think think of it like this, a big circle of memory. And what you do is instead of allocating memory, you just keep reusing some part of that that buffer again and again and again, going around. You know, as as things are done, they fall off the end. And but a big chunk of kestrel is basically first buffering a big ring q if you think
about it like that way. And when we first did it, we were using you know, uh unsafe sea sharp to do that because it's just memory and pointers and stuff like that. And we actually added features to c sharp later they got.
Remember remember memory created a whole framework to make it safe so we didn't have to do that sort of thing. Yes, and then he did it inside of it anyway. Anyways, that's clever.
But but then we put the sea sharp features in so we could go get rid of all that stupid stuff that we were doing. Anyways, So as.
It turns out, you know, uh remember I don't know if you remember this or if you were with dot net Rocks back then, but Chris Sells Richard uh talked about how he wanted to bring reference counting back into dot net. It was the early days, and uh, you know, yeah, he was used to reference counting in Calm, and you know, he had control over what happened and what got deallocated and when I think it was when he did that whole thing gets ten Yeah, disposed and I disposable and
all that. Yeah, but his sense man in that crusade, of course, we went into lake.
I was say, reference counting. Oh my gosh, I mean technically the garbage collector is doing that. You just don't have to see it. So it's like it is reference counting behind the scenes. You just don't else how would it work. Yeah, some are it has to go. Nobody's using this anymore. Yeah, I can now get rid of it.
And there was a there was a bake off in the early version of dot net between a reference counted implementation and the garbage collecting implementation. Patrick Dessaud did the the the garbage collected version and kicked But yeah, it was Admittedly the guy had an advantage because he'd done the Microsoft imilmentation of the JAVM, like he knew that
cold and got to do it all from scratch. Like, I don't think we can underestimate the number of benefits that dot net had from having folks from deeply familiar with JABA to say, hey, we're going to do generics right, we're going to do the type system right, and we're going to do garbage collection right.
Yeah, people forget that. You know, visual j plus plus was a thing, was it that Patrick worked on, Andrews Halsberg worked on, and so literally, you know what we call net today is kind of a fork of that thing with the different language, but it's got the same garbage collector and all that stuff. And that's where that I'm sure that's where Patrick brought the garbage collector from.
It, even if he started from scratch it. You know, it doesn't matter. He had it in his head, he thought about it, and implemented more than arguably anybody else in the world at that time.
I remember when Microsoft killed Visual j plus plus, and I can't remember who it was, and I probably wouldn't want to say their name anyway, but I said, hey, why don't you guys killed j plus plus? He said, we kept getting sued.
We sort of deserve to get sued in this particular case. So you know, we we The reason we got sued was because we had built a JVM, and we added features to our JVM that were not standard Java features. The problem is because because we have an operating system that's installed on a billion machines, our JVM with its non compliant features, is suddenly on everybody's Every Windows device in fact, is there. And so in those features, those features, commonly enough are are super important.
C sharp features.
There's delegates were one of those features. And UH the father of of p and voke which probably I think it was called jada rec back then. UH, And and so those features. Anders put those features in as he was building. UH, basically the father of of UH wind forms.
The way I've heard it described is with it. So I think Silverburg is quoted as saying this, it's like the day that Sun and Microsoft signed that agreement, both companies were in violation of it, and it just continued from there. He that he, you know, through pure force of will, and whatever I've seen of Silverberg lots force of will. He got both parties to the table to sign that thing. But he doesn't mean he was going
to change their personalities. There's only so much you could do, and so at some point they just had to call the ball on this. It's like, look, this is not what the intent was. You got to stop.
Well, it sounds like we're starting the show, but we're really still in the preheader, so I think it's your turn. You need to tell us.
Read a comment. Yeah, I got to comment off the show nineteen thirty eight when we did with Frank Suadengue and Sasha talking about the new version of Uno. Yeah, because it's a great comment, which which is from Fabian Hugil who said, I really liked that Carl relativized good word. I like that hot design and hot reload at some point I have had that. I have had very similar experiences a visual designer just cannot match what a scene graph based UI can do, you know, like HTML, like
you know said it. So for every non trivial UI you will eventually write some zammal code and as to hot reload, yeah, it's fancy, but even for non UI dot net assemblies, it often fails for even not too large changes. I mean this is a challenge long reload. You can only do a little fudge before it's like, dude, you need to compile, Like sorry.
Yeah, you need to stop and run again. But fabe my experience. Yeah sure, yeah.
Fabian goes to say, you know, I never really use it and I don't miss it, which is interesting. I mean, we put a lot of hype around hot reload, but it's like, if you've got a workflow that works for you, you don't have to go further than you know where hot.
Reload works best if you're changing CSS.
Yeah, tweaking, tweaking all that little fence posty stuff.
Change one line of code.
Oh no, it's time to read about yeah.
Usually, Yeah, we just haven't done enough work to make we can make hot reload better. It's just not good enough yet. So it's we had a huge effort, uh that we went. We first put it in the in the product, and then we kind of got busy with other stuff and it hasn't had enough love recently.
It's got to go back into the looping. It needs to go back in the loop. Bitt ten maybe so Fabian, thank you so much. You're commented. A copy of music co By is on its way to you. And if you'd like a copy of music, go buy. I write a comment on the website at dot net rocks dot com or on the books. We publish every show there and if you comment there and I read all the show, we'll sign your copy of Music to Koba.
And as Richard mentioned, music to Koba is still going strong. Music to code by dot Net We're up to twenty two tracks and you can get the entire collection in MP three, flak or wave format. And oh my god, it's Scott Hunter.
Surely me.
I'm going to introduce him for real. He is still the vice president of product for Azure Development Experience and builds all the tools dot net tools for Azure. Yeah, that's absolutely I love that. I would love to be able to get to that kind of bio someday, you know.
Just does all the things I do the things with the stuff, all the.
Things with the stuff.
You just if you work at the same company for like eighteen years, this is what happens.
Yeah, the the title gets shorter.
Yeah, and you touch all the different parts of you know, the Microsoft ecosystem over that time.
But getting back to what we were talking about zero allocations, it's not just Kestrel, but every genera, every version of dot necor dot nine and now ten before that seems just to be getting faster, less memory consumption and more scalable.
Yeah.
I was one of the cool features that you know, we talked about the garbage collector Collector earlier and uh, one of the coolest garbage culcture features that we've done recently, and I think it just went under the radar. Nobody even thinks about this is we had some I remember we had a couple of customers and they were comparing dot net to go and Rust and I think we
were winning on the performance side of it. We were you know, uh and those things, but they were complaining about the memory we used, right, and uh, we if one of these benchmarks we had and we looked and we saw that we were using roughly twice the memory that Go and Rust were using, and at the time we we didn't have We didn't really go think a lot about it. We were busy with other stuff. But uh, it.
Was was that a real test? I mean, was it a test of just loading it up and seeing what the memory usage is or over time after after three hours of use? You know?
So I don't remember the exact details.
It was.
It was the customer that brought their own benchmarks in and they'd run their own benchmarks, and then we said, hey, can we see your benchmarks?
And you bring up a great point though, carcas One of the things when I did a lot of load testing back in the day with dot net websites especially, you needed several hours for the garbage collector to mature, right, You have to have pushed enough pages through and so forth, and filled memory up and had done a couple of second gen garbage collects before you even really knew what
a site's going to look like. You could fool yourself on a fresh start with empty memory and run a quick benchmark and go, all this stuff looks great.
Yeah, like dot Net could have been pre allocating memory that it might have needed later and Go or Rust might have not and so you have to look at it after you.
That's that's that's actual we found was we have a week what I you know, Mami might kill me. Whatever termatics made up, but it's I call it a greedy, greedy garbage collector.
Right.
Hey, you know when when you when you boot the app up, the garbage colector goes how much memory does the machine have? I'm gonna go grab.
All that stuff?
Yeah, yeah, And that was the exact thing that the benchmarks these companies brought to us were showing was basically, we weren't using all that memory.
No, we were just getting ready just in case you needed We were.
Getting ready in case you needed it. And then in dotten at eight, that's where we put this behind the feature flag, a new mode where the garbage clutter is not greedy, right, And so basically we're going to start with a little bit of memory and we'll allocate more memory as as necessary.
And and you're referring to Maoni Stevens, I think the new Patrick, who was the new Patrick decide I've had conversations with that woman. That's one of the most remarkable minds I've and a company full of remarkable minds. Holy man just thinks on a different level.
She knows more about garbage collectors than you and I would ever know in our entire life.
Richards and prest I am staggered.
Staggered, that's so much to be scared.
It's just ex shredded. But again, what a specialist.
And you know Patrick still came in after he retired and still still comes in and talks to Myoni and stuff like that. And and uh, because I'm sure he still has ideas too, and I'm sure they bouncedid these. I would love to see one of those conversations because I wouldn't understand.
Any of it. You just sort of stare in awe, but.
Uh, you know, it's amazing. But she she built a new feature which is the one where we don't have the greedy allocation, and we put it in eight, but it was off behind a feature flag because before we actually put it put it on on for default, we wanted to actually run a bunch of the services we
run inside of Microsoft a while. So let's let's go run a whole bunch of the M three sixty five back end on this on this technology, uh, in this new mode and we'll get all the bugs figured out inside of Microsoft.
I wouldn't have messed with metrics just because it's calucating memory different and then showing how it's memory with nine it's on by default. Okay, so turned out to be non event.
I'm sure we fix bugs. Yeah.
But you know what, though, I would almost want the pre allocation because it's going to be faster to allocate memory when it needs it to just use it.
The uh I think the scenario that you want the non greedy ones. Are you running on like an IoT device? Yeah, okay, if you're running on something constrained. So in this case, the customers was running vms. It makes no sense to me anyways. So I think the vms are like sixty four megah this day and age sixty four megs snooze. My kids don't even know what megs are. They start with gigs yeaheah.
So it's like, uh, well, and that brings up another thing. Could there be a configuration that says, you know, what percent of available memory should the garbage collector start with?
There might be a setting for that somewhere in the system. I have no idea. There's there's probably a whole bunch of feature flags on the on the on the GC that are way beyond as.
Long as this sign the registry, and we should.
Well, nipcore can't use the registry because it runs on non Windows offerating system. So we, uh, we left that building behind, thank you. We should talk about coding agents, Carl, I.
Know we should, totally should, but we just streshed out of the keynote. Yeah, and I gotta say, you know, somebody's asked you, so what do you think it is? I think Microsoft's doing what Microsoft's best, which is building tools so the rest of us can take advantage of the new capabilities. And what was this hour and a half, but check out the new tools.
And one thing that we were talking about before we started recording was it was almost a little what was the word that I used, like it was not confusing, but it made it look simpler than it was because basically it just looked like the demos where people clicking things and typing a sentence and pressing buttons and boom, everything's there. But you know, at least I know that it can be that simple if I know what I'm doing, right, So I didn't understand it misleading, I think was the word.
I didn't understand it. I couldn't if you asked me to reproduce any of those demos right now, there's no I wouldn't even know where to start. I don't even know what in my company, which copilot tool I should use to start. So I'm a little confused.
I can try to help, but I will tell you. Even you know, Sam Altman, who saw you brought in for a little bit, yeah, kind of was kind of talking about you know, the problem with AI to day is if you're using chat GPT, Oh, there's a screen full of models, and then there's there's an even an item called more models, and you click that and you see even more.
Models nineteen and how is Joe user?
You know?
No, you know as somebody that's been using agent mode in VS code for a while. By the way, agent modes is now in Visual Studio too, so you so you get both of.
A pin in that and come back to that.
That's where this before you see the coding agent, you have to think about agent mode. And once again I laugh because it brings us back full circle. It's like agent mode is something that I think we shipped it maybe a month ago in the public builds of VS Code, and now it's in the builds of VS that were Visual Studio that were released this week. It's the forefront of what the coding agent is and so agent mode. And by the way, I laugh because it's got a
whole bunch of model selectors as well. It starts with GPT four.
But I think your point was, now you don't have to know where all these models are. It's going to select you'll.
Do sort of.
What we've seen is the coding models have gotten better at a tremendous rate. I tell my team the stuff we showed at build this morning. If you told me it would that even be possible a year ago, I would have said no.
Interesting.
And so the basically the the coding models got so much better, super fast, and it really anthropics Claude three sevens on it.
That seems to be the hot one, right.
That was the one a couple of months ago that really kind of tipped us over the edge. And it was the first time this stuff got good. I'll get there, Carl, it got good. But then then we hear, like you know, a few weeks after that, then Jim and I two five is supposed to be the best coding coding mode.
How do you measure that? Like? What makes it better?
I think you have to just triumph Richard and see what what what your result is.
And then but the idea is that these are tuned for coders.
They're tuned for coding. They're not you know, you don't ask them, you know how high is Mount kil manangero? You actually ask them the right code. But agent mode is where and this is the demo I do and I love doing this demo is I'll bring up vs code with a Blazer application and I'll just go into agent mode and say change the buttons in the web application to be around in orange. And then what happens is the ll M behind the scenes will go look
at the at my projects. So remember when we first started down this whole cold pilot journey, what did it do? It did code completions so you could press tab and it would fill in still in more stuff, or you could in the chat window you could say how does the link list work? Or show me how to write a bubbleshort in dot net, those types of things. But with these new models, now you can actually ask the thing to go change your app. And so when I went,
we just had thunderstorms. When when you go and ask, you know, I'll tell you this, Carl, when we're when we're done, you should go, you know, boot up VS or VS code and go and do this and say, go change my Blazer app. And you'll it's funny you watch it. It's like, hey, I found the web app. I noticed that your web app is a Blazer app, and I noticed it using boot Strap. Yeah, I'm going to go and add this style into the Bootstrap CSS file. Yeah, and then I'm going to go add this new element
to your items in your app. And so yes, and that's.
The best example I've heard for me the coder of what this new stuff can do.
So what I hate is when you see some of the demos where it feels like it you know, you don't have to write code anymore. Right, No, that's you know, Yeah, we'll get back to that. But that's what agent mode was. So agent mode does this. It's now not just the file you're in, it's all the files in your project.
Yeah.
And it's smart enough to go identify things like Bootstrap and so on that many of us using our web applications today.
So, like they said, it's it's sort of like having a partner that or a sous chef that's a coding partner, a coding chefs, a soup coder that you could just say, hey, go take care of this little detail.
But it's that look across the solution rather than to look at my file exactly.
It's it's not you know, the first co pilot we didn't even look at the whole file. We looked at this, you know, X number of lines because the context windows were not big enough to do more than that. But I always want to start there when I describe this. So the negative of what I just said is and this is where if I go talk to my enterprise customers, well, I don't know the did you write the code, Richard Carl write the code, or did the cloud write the code?
Who wrote the code? And so if you're in an industry where financial or whatever they want to have more controls over that, that's where the I think the coding agent takes us to the next level. So what the coding agent is is agent mode in the cloud.
And so okay, so we're out of visual studio.
Now let's let's talk about this so what I what I would do and if I want to use the coding agent, I would file an issue in my repo, and the issue would say we're going to change the look and field the website. We want to change all
the buttons to be round and orange. So now I've created the issue, and what I can do then is I assigned the issue to copilot, to your agent, and then in the cloudloud, in the get hub cloud, the engines that that same agent that we were using in chat, in VS code or VS is now running in the cloud. What's cool about that, though, is it's going to go create a PR. It's going to go put a plan in the PR. I can live watch the PR as it's going. If I want to sit there and watch it,
I can. I can watch all the actions. But the cool thing here is now, because I've made a PR, well there's a history of yes, it was done, something was done, and then I have to approve that PR. So the chat's not going to go by the agent's not going to go by itself and just go oh, you're done. No, at the end of the day, I have to go back and Scott Hunter approved that.
PR, which you can also pushed back, like you say, I don't like how this is done, or I would change.
It's just like you do with the developer, right, exactly. Yeah, and that's what I loved about that part of Sacha's demo that he said he wanted to add a feature. He had a picture of it and he said he wanted to drop down that has some blah blah blah and just with one or two cent. Then you got the googly eyes looking at it because he assigned it to the to the agent, and the agent's like looking at it. And then he came back and the polar Quest was done, and like you said, documented this is
what I did. Yes, I did this and that and this just the way real developers don't.
And then exactly, rich and then Carl approved that pr and so now it's.
Your fault and it's now thing and trains Richard's bank account.
But to Richard's point, you can actually go highlight parts of the code it wrote and say I don't like this, or put more diagnostics in here or whatever, and so you can have a back and forth. You know, I think when when people see this, and I'll be curious. You know, it just was shown on stage. We've been using this stuff inside of Microsoft for months.
Yeah.
I just saw it a half hour and you just saw it a second ago. I think people's first reaction is, you know, when I go talk to real customers, they'll be like, oh, this is going to replace my coders. I'm like, no, if you somebody has to be able to read what this thing did. They had to approve it and say it's right and so but what.
I would run it and to run it and it works well.
The agent can actually do the stuff like that too, by the way, So, but but so what I think where it changes things. When I was talking to David Fowler, like architect of dot net, yeah, you know, He's like, Scott, I have to now have to think, should I be writing this code?
Yeah?
Is this the stuff I should assign to the agent because it's just it's right, you know, small refactoring stuff. I shouldn't be doing that. I should be writing the architecting the core of dot net and figuring out how to make Aspire work and have a great published experience. You can't tell the you imagine writing an issue, Hey, make a great publishing experience for Aspire. That's that's not going to work. That's where you need developers to go do this.
But an awful but a lot of an awful lot of code is uh, stuff has been done before. Stuff that that a model is going to have a copy of that it's you know, drawn from gethub and other and other sources. So why would you write that code when it's already be written.
I give you a real world scenario that I hope the answer is he yes. So I'm working on a customer's project. This particular project has like fifty screens. Now they all do different things, but they all have the
same look and feel. They all use a bootstrap grid, right, And can I give that page or whatever that I want to use as a template to the agent and say, all right, I need a new page that has this field in that field, in this field in that field, and a calendar, and I'm putting another thing over here with you know, a table.
And I would tell you to try it. Your answer is yeah, probably probably would work. Especially you know, you can write a file inside of your project. It's kind of like an instruction files. We call this yeah, and that instruction file is where you can say these files are examples of how we build UI right, all screens will look just like these, except they'll have different fields. Yeah, make my screen look like these screens.
Can you go a step further and say, here's my data structure from my database, here's my data manager that has my you know, ado dot net code in it, or like whatever, you know. Make my thing work with the data manager.
The more context you give it, the closer it's going to be what you what you expect in any cases, but you can also iterate well exactly. We've done a lot of work. So one of the other things that we're showing I don't think it was shown in the keynote, but it'll be shown in Amanda's talk. It was after the keynote is migration tools for moving from one version of dot net to the next version of dot net, moving from a version of Java the next version of Java.
Once again, we learned a lot of these things are written with crazy AI prompts, and we just keep writing the prompts and making you know, you try it didn't work, make a better prompt to me. My analogy of this is Google Google Search. I didn't find what I like, so I write it a different way. I keep writing it a different way until I get the answer I want. And in many cases I think the AI is going to let you do the same kind of thing.
We think about the years we spent learning to write good search strings. It's going to take us time to learn to write great prompts. It will.
And so we've got some really cool tools that we're we're shipping in public preview today at build and one of them is, let's say, here's how this works. I got to I got to convert this project today. It uses rapid MQ locally, but I want to move it to use service bus because I go to put it into Azure.
Sure.
So today, what you would do is I would say, Carl, go change the whole app to move from Rabbit MQ to service bus. And it probably a lot of work for you, you know you you would do the first file and you're like, I got to figure it out now, and you would replicate that a lot of times. Well, one of the tools we released today is what you would do is I would say, Carl, I'll go fix two files and then from that commit that you're going to have, we have a thing that will convert that
to a prompt. Interesting and we call these formulas, and so so you go and make that change in a couple of files. We make the prompt and you can then run the prompt against the entire project and move.
The rest of the project. Rather try to write the prompt from scratch to do it right now. The first time, you provide an example of doing it right the code, and then it reverses that into a prompt. Yes, that allows the other examples to happen. And so one of our one of our teaching a novice developer to do something you just did yep, right.
Yep, that's all you're doing. And uh, and.
This this, this is a very fancy copy paste.
Yes, super fancy. This is like the ultimate copy paste. It won't it won't be one hundred percent perfect, but I still think it'll take You know, it would have taken it would It would have taken Carl a couple of days. And now it might take Carl a couple of hours to get to the same place.
And after the third time, it's scott work right except for a couple of fixes. So you now getting rid of all the scott work and just doing the fixes.
So we have a tool that we shipped a couple of years ago called appcat. And what appcat is. It's an app, it's a it's a it's a tool you run on your A s P, dot Net or Java app to move to the cloud. And what it does it just goes and identifies. It's got a library of like twenty things that we think you shouldn't be doing. Like, right, you're gonna have to change your connection strings for example. You know you probably shouldn't have connection screens using something
better than that. But this tool identifies a whole bunch of things that you need to do before you move your app to cloud. That the problem with that tool was in the past. It just gave you a list of Hey, Carl, here's all the work to go do.
Right.
Well, what we've done is we also took the top ten of these things and we built these formulas with this other tool. And so now you can go take the top ten things that appcats can to find and then go use these formulas to go have it go fix the app for you.
Sure.
And so our goal is, you know, we have customers tell us moving an app, an older on prem app to the cloud, can take eight months, right, I want to get that down to four months or two months, you know anything that's you know, when I was talking to some customers, they said, even thirty percent faster.
Sure is a huge Well I know pretty well, having you know, spent my time in the architect shovel. It's like there's a thousand apps. Yes, like there's a thousand apps times eight months. Yeah, So I'm sorry, we're not going to get it done.
And in most cases, I hate to say this, the developer who wrote those apps is not there anymore. So some new developers, like I have never seen this code in my entire life. You know, how do we help that developer move faster? And so I'm ex I think people will be afraid of some of this AI stuff, but it's just a tool.
And we'll talk about fear when we come back from a break, because I have a couple of questions about that, and we'll be right back. These very important messages don't go away. Did you know you can lift and shift your dot Net framework apps to virtual machines in the cloud. Use the Elastic beanstalk service to easily migrate to Amazon EC two with little or no changes. Find out more at aws dot Amazon dot com, slash, Elastic beanstalk and we're back. It's dot net Rocks. I'm Carl Franklin, I'm
Richard Campbell. That's my buddy Richard and everybody. Scott Hunter is here. And if, by the way, if you don't want to hear these ads, you can become a patron for five bucks a month get a feed that has no ads in it. Wouldn't that be awesome Patreon dot dot NetRocks dot com. All right, so I wanted to talk to me. You said the S word and it wasn't Scott, it was security. Secure. I hear this all
the time. Secure secure. One of the main features of agents and the things that makes them work is you give them permissions to your resources, whether it's you know, Azure, a d a database, you know, cloud services, all of the things that you need to go do or access. Maybe it's not just an Azure, you might have other stuff in other clouds, right, but you've got to give
these agents permission to do thy bidding. And so for me, as you know, put on my security hat because now I don't know if you know this, but I do a security podcast. Weird, it's weird.
All I do is tell jokes and ask questions, but think security people. God, yes, but you know that I know enough.
To know that that increases the attack vector serves for you, and probably your software bill of materials probably goes up exponentially without you knowing it necessarily. So I just want to have you talk a little bit about the security of all those first.
So that's why I think our earlier conversation about prs was important. Yes, that means a developer gets to see the PR and approve the PR and so there's nothing being done automatically, but there's no magic, so at least there's a human that approved whatever happened. The area that I think about the most of what you just described, Carl, is probably MCP.
Yes, an acronym I just learned this morning. Well, I didn't know anything about it. So protocol that lets agents talk to each other's.
Let's LM talk to stuff. And there's not currently a bunch of security around this thing, and so today it has to be In most cases you run it locally on your own machine. But I'll give you I'll explain the MCP scenario. You install a GIT of him CP on your machine and that means that that will let the l M be able to you can give that whatever access to your GitHub repo you want to give it to. Yes, you know you might want to you know, for databases, you might want to put a postcress MCPN
and I'll explain why that's interesting these things. Let let let you share knowledge with the l l.
M and it's a model context protocol.
That's that's the that's the protocol. And by the way, it's it's a very basic protocol at this point in time. There's anthropic. Yeah, it's it's anthropic, but we all jumped on it. Like the dot net team. They there was an open source m c p uh dot net implementation.
They took that over. They worked with that developer and took it over and that's now the official because when when MCP first came out, I think there was only Python JavaScript and there might have been a Java one there too, but we made sure there's a there's a great dot Net one VS and VS code will support m c P as well, which is very important. This agent back to this agent mode stuff again. Yeah, I can do cool things like that. In the chat. I could say file an issue one Carl about changing the
buttons in my blazer. Application to be orange and round. And if I've given that the GitHub MCP the write to create an issue, then from that chat interaction, it would go create that issue issue from I didn't have to go to the web page. I didn't to go use some other tool. I didn't have to go pull a thing up. But once again, as I said, you have to decide. You know, once again you're running the agent, so you're running the chat.
So you also said it's not very secure right now.
What I mean by that is you're going to have to go put your access token and in some form or fashion on your machine because the ll M is going to call into this protocol. It's going to run that code. That code needs access, It needs your security token to be able to actually talk to GitHub. If you want to talk to a Postcrest database, for example, well it's going to have to have a connection string and the credentials to talk to that Postcrest database. Once again,
you could give it a restricted one. And why that's interesting is if the LLM can see the database, you could then almost say you went and created a table, go building a business logic object for this new table, and then it would use MCP to go look at the postgrass database, find the columns and their types, and then build you the relevant c Sharp implementation and.
Do that stuff with prompts. Now, of course you do, but this would just.
Mean instead of having to go paste the table in somewhere, you could actually give it access to that. We also shipped, like my team built Azure function support for MCP, which means you can have a remote MCP. In my case, that means that MCP is protected by all the Azure security features.
So that's what I was looking for. And so something like key vault, you know, like that it's impenetrable, so it knows the keys but nobody else can know.
But this space is so new, it's just booting up. I mean at Something else that my team shipped today build as well, is we have a product called API Center, and it's going to have a place where you can find all all the m cps in your in your organization mp.
I center, API center, a p I center.
API, so we have API management.
Sorry, I understand what you said.
A p I center a API like API S Yeah, I got it. And mcps are in some ways APIs, and so we're going to have a place where you can uh have a list of m cps uh that you're you know, your company uses and people can find them and and so on and so on. But I said it's early times.
But I will tell you that there's a lot of promise there.
There's a lot of promise.
That's it's got to be where everything goes because.
You once again the more I mean, you and I probably written the same code a billion times, Carl, where we just write the ady O code to you know, do the database table stuff or the any of your framework core stuff to go do the same thing. And I'd love to just say, here's a new table here, you do that, Go go do it for me. Yeah, and uh put the same logging and all the other stuff in. So it's it's funny. I I I remember when we first did we shipped on in a core.
We were like, it's it's a great time to be a developer. And I will tell you that all this new tooling stuff that we can do with the AI stuff.
It's you also mentioned that does this mean my job is on the line, right, There's a lot of people think in that oh, well, you know, if a junior developer can get some AI and go out code me. What's that mean for me? And I always tell people and Richard does too, It's not the AI is going to replace your job. It's that another developer that uses AI will take your job.
I would tell you today, don't if we when we interview, if we interview new product managers or developers, we're one of the skills that we're going to want you to show us, is you know how to use AI to do your job. I think that's just a part of And I don't think it's just going to be programming. I think it's many, many jobs. It's gonna it's it's gonna come down to this.
Compan upon a time, we asked if you knew how to use email exactly, I.
Mean spell checkers. I mean know word's gotten so good these days. It'll tell you when you're using bad English. It'll actually fix it for you. You know, I would have been offended when I was first going through you know, college or high school. But I'm like, why would I not use these things?
But I will say this though. Let's say you're on a team of developers that's maybe five people, small business, right, and one of those developers decides to dive into AI and can demonstrate that he or she can do everything that the whole team can do with one person faster. Is that a real scenario.
I don't think it's a real scenario, you know, but I do think that building a you know, we've all seen the vibe coding stuff, which I'm like, you know, questionable, Oh, vibe coding, Yeah, well questionable. I do think it's a good way to build a prototype, yeah, and to prove a concept and then go and say, let's go make this real.
Yeah.
I mean, I'm sure there's plenty of there'll be a startup here there that'll do something stupid. They'll go, you know, vibe code something, and sure, already happened. I'm sure it's already happened. But at the end of the day, you you know, could you imagine shipping an app when you've never seen any need of the code?
Yeah, No, I've seen people do dumb stuff like that, you know. Yeah, that's how they've deployed prototypes that we've seen over the years that aren't secured and so forth. This is another level dumb. You know, we've been walking past the truth on this whole conversation about coding agents it's not just working out the prompt, it's then looking at the results and assessing it. So, yeah, there's the new skill of how you communicate intent to the agent, but then there's the old skill of a coding.
Review, yes, which is super important.
Yeah.
And by the way, that's the scariest part about this is you know, in some ways the coding agent could make it if you're a junior developer.
Yeah, you could tell it to do something you shouldn't do.
Well.
It's also I think it we need to somehow make sure we don't lose the skill of teaching junior developers how to become senior developers that know what's good code and what's better code. Okay, so it's in some cases the fear is my fear is, oh my gosh, we're going to lose thebility to train junior developers.
Yeah.
So that's something we inside of Microsoft talk about a whole bunch, is like we had to make sure we don't lose this skill.
That a new developer glowing up in this space is always going to be someone solution focused rather than code focused and being able to assess. They're never working from a blining screen, They're always assessing stuff and quite possibly leveraging other tools to do it.
Yes, I keep coming back because we're talking about fear. That's the the word for this half hour. I keep coming back to that Star Trek Next Generation episode. Do you remember when Data was playing Sherlock Holmes and he would go into the Holidack with Jordy and Data would always solve the crime. It was easy for him. So he was like bored, and Jordi said, computer, create a Sherlock Holmes mystery with a foe that has the ability
to outsmart Data or to outwit Data. And then it created this really intelligent Moriarity character that actually knew it was on the holid deck and could take control of the ship. And that like, you give a junior programmer a powerful tool like an ancient and the past, you know, the keys to go and affect all of the critical resources in your industry, right in your enterprise, and then that guy writes a prompt or that girl writes a
prompt like that that completely hoses everything. That is a real scenario.
But what I would tell you if I gave the same junior developer all those keys and access, they could go nuke everything anyway.
Sure, so the reality is okay.
But is it the difference of giving them a glock versus giving them an M sixteen.
I think it's I think it's the same thing. Maybe maybe they could do it faster. But but once again, that's that's why. You know, most most you know, enterprise companies don't let developers have the actual keys to the real databases and all that kind of stuff. That's the thing that we don't we never talked about probably on this on the show, you probably never talked about this is you know, most companies, I could never see the production database. Only a class of my DevOps engineers are
allowed to actually ever see the production database. Even at Microsoft, you know, we want to make sure that even if I'm debugging Azure, we're very careful about making sure that any personal information doesn't end up in logs and so on for the for the same reasons we're just going to get striving here.
It means that you have to be aware of just more things, but no and less things at the same time.
Right, But you could vibe code something that was dangerous faster with and and uh, you know, you could potentially generate a prompt as you said that would delete a datbase, right, because I tell the hey make the database faster by deleting the first million rows.
So do you have a prompt cop on staff that has to approve all the prompts that you give your AI while you're developing.
I think the bigger thing is make sure you don't you don't you don't give your AI the ability to go delete the database. That's that's the smart thing there to start with.
You gave the keys to the castles of the junior because remember one I.
Remember if you roll back I started, and that that postgrass agent or MCP. I said, give it read access. Yeah yeah, I didn't say write access for you know, because.
That's why they that's why they submit pull requests. Yes, they don't write. They only could present.
And so I would tell you everybody here be very careful, Like I'm I'm fine letting it file an incidence, you know, in GitHub.
But we have to be careful now. I mean we've had to be careful all our all our coding careers.
That was my old advice to web deevs. It's like, listen, you don't want access to the production service, then it could be your fault.
That's right.
Just don't don't even have those rights. Make your life simple.
I know stories inside of Microsoft where somebody thought they were in the development branch and they were in the production brands and they and they wiped out a bunch of stuff and thankfully we were able to restore it.
But but uh, you know, thanks to that sequel backup feature.
But I would I would be you know, oh my gosh, I mean even myself, I always where he I mean, even sending an email, make sure you don't put the wrong person on the two line.
Yeah, it's always the person you're talking about.
And sometimes sometimes what you do is you put the wrong person on the two line because you need to get their email address or something else that you can pay somewhere, and then you forget to take them off. I have done this in Microsoft. I have done this.
I'm speaking from experience.
One of the stories in the previous Security this week was a feature that Apple a feature a bug that Apple fix on the iPhone where the mute button on FaceTime didn't work. Oh so, can you imagine you're talking to your wife, you hit the mute button, It's say, hey, your husband's coming up the driveway. Put your clothes on and it didn't work.
Brilliant, all right.
That's why Mark Zuckerberg requires all cameras and METAA to be covered with black tape.
Right.
He doesn't trust that whether there's the lights on or not. He's like, I'm afraid somebody might have hacked the cameras, so it'll come on without the light.
Yeah, So be careful children, it's dangerous world out there. Don't hand out the keys to the software.
What else is on your mind?
Here?
At build twenty twenty five.
We talked about, you know, migrations, We talked about coding agents. Probably the last one which is something that thought you did show in the keynote as well, which is which we call that the Site Reliability Engineer agent. That's the SRE. Yeah, And the idea here is just imagine this real world scenario inside of Microsoft. Something starts wabbling and so you know, some of the software detects that, Hey there's sites not responding, and so what do we do today? We page Carl and Carl wakes up.
Hey, this is a real scenario. Actually, because our site, at any hour, our site before I change it was prone to this.
So we paid Carl and then Carl has to go bring up dashboards and go look, and by the time Carl gets out of bed, it might just happen that it could have been a transient issue, meaning that hey, a database just bobbled for a second and got a time out or something like that, and by the time you wake up and look at the thing, there's not really a real thing going on there.
Yeah.
Well, the SR agent can.
Do that for you.
So it can say, oh, I see that the site's not responding, and my instructions say that I'm to wait fifteen or twenty seconds before i do anything because it could be a transiit issue. Oh it's back in fifteen or twenty seconds. I'm going to log in, log it, but I'm not going to page page Carl and get Carl out. Or it could be could be the next rule could be, Hey, if we see that the site's been down for ninety seconds, the first step is, you know, we live in the world of computers.
What do you do?
You reboot? Yeah, And it could be that the first thing that the real SR agent would have done anyways is just gone and rebooted the application. So the agent can go look and go, yeah, it's still down, I'm going to reboot it, and then I'm going to look up it's back up and doing good again. Once again, Carl was not page for either of those scenarios. And so how do we take some of that grunt work?
And I can already imagine how to tick that to the next level. You give it through MCP access to your GitHub repo, and then if it still thinks there's a problem that might be code related, it can go analyze the code.
So we have that that we're going to show that today some one of the sessions. Today my session, we're going to show that exact scenario where.
That was run against dot net rocks, the dot net six version of it. It would have found a memory leak.
Well, first off, what one of the things yes or we would do is go why are you on dot net six? It would actually okay, so it because.
It worked, and it worked for a long time, but then I found a memory leak.
But our hope would be that, hey, the the agent finds that you're on dot net six, it says, I'm going to go file an issue and get hub to move the side to eight. And then Carl goes, I hate changes, go to nine, I'm just gonna go. No, you go, you go, and you say, I'm going to sign this issue to copilot, and then Copilot uses the tech I was mentioning before for doing upgrade dot net.
Dot Net upgrades, but that's the whole. It writes the PR for you and then you just approve the PR and you're on dot net.
Eight.
This is the whole idea about agency is that you now have to think like a manager, and instead of hiring somebody on the staff, you create an agent to do that. Right, I would create an agent, or I'd find an agent that's an expert in CSS, because if there's a CSS problem, I just want that age. Hey go take a look at this right and assign them the issue.
And yeah, I will tell you I love CSS, and I hate CSS.
I hate it and I love it, and so I love that the.
AI is good at CSS, it's good at HTML. So I will tell you, as you're playing with these Blazer apps, you still write the Blazer code, but you might want to have this tech help you write the CSS.
And as I said, well, I'm already doing that. It's just taking longer than I had an if I had an agent that could help or or a network of agents like this is what you have to imagine now, right, you're less of a single programmer, and now you have to think of, Okay, build your virtual staff around you that you know, with all of the access to all of the resources that you want to give each one of them that needs that ye, and then they can talk to each other.
Built next build, we're going to have these staff agents.
Sure, but I also feel like I looked at Security co Pilot and thought that's too big of a grab. This SR co pilot feels the same sort of thing, in the sense that this is going to be an evolving capability.
It would be an involving capability. We'll add more stuff to it.
Some day. You're going to get an email it said your site went down last night. I looked at your code. It sucked. Your site is written now and up.
I don't know.
That's a little we're going a little too far there. So like one of the things that SR.
Still wanted to wake me up, s SR, wake up. You've been replaced.
SR today requires a human to tell it to ever do anything to do, and it cannot be there's no autonomous mode.
I do appreciate bringing everything to the table. It's like, go go collect the logs up, do all the obvious stuff, all the stuff I do before I call Level one tech support. Anyway, Yeah, I've already rebooted it.
So one of our demos today was literally the SR agent notices the site choosing too much memory, and then we tell it, can you go get me the memory dumps? Yea, yeah, that's all the grunt work I would have done before. Now that's doing it. I'm still fixing it as a developer. I'm still looking at the actual dumps.
On your developer, what do you know about memory dumps? Most of them don't. Yeah. The only one that I know that can analyze the memory dump is test for run Days. She's like the only person, the only developer I know. We have some look at memory dump and say, oh, that's what that is.
We have crazy people at Microsoft that work on dot net bugs that take months to figure out. You know, imagine there's some weird issue that dot Net after six months does something weird. We have const as one of our engineers, and you know it's like I remember one point, you know, we had crazy metrics and they're like all of CONT's prs are open for like six months, and I'm like, yeah, this guy works on stuff that takes a long time to figure out.
Yeah.
Yeah, and you know those are people I could never do what he does. I mean these skills to just look at this stuff and see these weird you know, memory issues that take months to actually.
Yeah, one in one hundred million instances like those kinds of things. Yeah, it's a long time to chase that down. H dude. It's a crazy build, amazing set of announcements. Yes, uh, the works only getting more interesting. Yeah.
But also Scott, thank you for just like simplifying it and bring it in it to us the developer audience, and you know how it's going to impact our lives.
I would tell people please try this stuff and give us feedback. I think it's amazing. I use it every day now, and uh, you know it's great.
Thanks Scott, good to see it, Good to talk, and we'll see you next time on dot net rocks. I think bet it'll be.
From the bed.
Dot net Rocks is brought to you by Franklin's Net and produced by Pop Studios, a full service audio, video and post production facility located physically in New London, Connecticut, and of course in the cloud online at pwop dot com. Visit our website at d O T N E t R O c k S dot com for RSS feeds, downloads, mobile apps, comments, and access to the full archives going back to show number one, recorded in September two thousand and two. And make sure you check out our sponsors.
They keep us in business. Now go write some code, See you next time.
You got javans
And