Futuristic central hub connecting blue and violet computer networks

One MAUI Binary, Two Backends: Switching UAT and Production (and Detecting TestFlight Along the Way)

One MAUI binary, two backends: how a single signed app switches between UAT and Production at runtime, plus detecting TestFlight installs via StoreKit.

Gourd Alert (fictionalized while my actual app is still building up a tester base) is a .NET MAUI app that checks nearby farms for gourd availability and yells at you when the good pumpkins come in. Testing it needed a UAT backend, so testers could break things without touching production data. Apple and Google do not make that simple. App Store Connect and Google Play both expect you to promote the exact binary you tested, through TestFlight or an internal track, all the way to production. Build a separate app just to point it at a different backend, and you stop testing the artifact you are actually about to ship. What I needed was one MAUI binary, two backends, switchable without a rebuild.

Silhouetted cybersecurity professional monitoring colorful data flows and server alerts

Application Logs Are Your Friend (and How to Write Them)

Application logging done right means picking the right log level, masking PII with Serilog, and understanding how sinks route your logs.

A while back I wrote about why application logs are your friend: when something breaks in production, read your logs before you panic and roll back. That post assumed the logs were already good. It never asked the harder question: who wrote them, and did they write them well? Good application logging is a skill, not an afterthought, and most of us pick it up the hard way, one 2 AM incident at a time.

linux console

host.docker.internal Is a Liar (On Linux)

A 5-second page load survived a moved-off-Docker-Desktop UAT deploy, three red herrings (CPU governor, IPv6, disk contention), a crash-looping RabbitMQ broker, a silent Redis hang, and a one-digit port typo. The actual culprit: host.docker.internal doesn’t auto-resolve on native Linux Docker Engine like it does on Docker Desktop.

I spent two days chasing a 5-second page load that had no business existing. Along the way I blamed the CPU governor, IPv6, disk contention, and a laundry list of side projects running on the same box. All of those theories were reasonable. None of them were it. The real answer was one bad assumption baked into a couple of connection strings, and it wore three different disguises before I finally cornered it. The gist of it: host.docker.internal is a liar (on Linux).

Here’s the whole mess, in order, mistakes included.

passive aggressive open-source maintainer

How to Alienate Your Users: An Asshole’s Guide For Responding to Help Requests in Open Source

The post discusses how open-source maintainers can alienate users through poor communication strategies. Key behaviors include ignoring help requests, being condescending, defensive, vague, neglectful of documentation, lacking transparency, being inflexible, and failing to express gratitude. These actions create a negative user experience and reflect poorly on the project.

Open-source projects thrive on community participation and collaboration. As a maintainer, how you respond to help requests can make or break the user experience. Here are some key points to implement if you want to ensure you alienate your users.

authentication failed

Skip Authentication Schemes in ASP.NET Core

Authentication in ASP.NET Core is both powerful and dynamic. It provides you the power to incorporate many different schemes and augment the logged-in security principal. Authentication schemes are how we apply authentication in ASP.NET Core. What if you want to skip authentication schemes in favor of another?

security

Understanding Policy-based authorization in ASP.NET Core

Application security is a vital piece of our overall success as developers. Many of us have learned and applied role-based or claim-based authorization. Overall, this has been “good enough”. Unfortunately, there are still many use-cases it can’t handle gracefully. We call one approach that solves these use-cases policy-based authorization.

timeout

ASP.NET Core Request Timeout IIS In-Process Mode

Over the years we’ve seen .NET mature and change since v1. We’ve seen server technologies mature in many ways. Things we did yesterday don’t necessarily work the same way today. One of those things that recently struck me was how request timeouts work in IIS. If like me, you just assumed they worked the same in .NET Core then I invite you to join me on this journey. Let’s explore how to make ASP.NET Core request timeouts work properly with IIS in-process hosting mode.

Windows Authentication in NET Core: Expanding Role-Based Security

I recently wrote about implementing Windows Authentication with React and .NET Core. Given the length of that post, I found it necessary to keep it bare bones. Today we’re going to talk about expanding our Windows Authentication in NET Core by adding role-based security.