not writing about the cutting edge

I think and write slowly - often in combination.

Others are keen to talk/write/speculate about the latest shiny things.

I want to understand how the latest shiny things fit into larger trends and the overall/long term tends.

My first book followed a structure from a presentation first given 6 years earlier and then refined over that time (and the 18 months I spent writing it.)

My next book is in 3 parts.

Part I has its roots in a document I wrote over 20 years before.

Part 2 is based on my own checklist, that I've been building for more than 5 years.

Part 3 is based on a revelation I had and then spent 2 years actively trying to disprove with conversations with hundreds of developers. (Repeatedly asking people to tell me why I'm wrong - was a new, but ultimately enlightening and encouraging experience when no one had an answer.)

Anyway, there's another book coming.

Progress is slow, but I keep discovering new things that must be included and the result wouldn't have been as good if I'd missed them out or if trying to retrofit them into something already written.

Yes, this might be me trying to find excuses for not seeming to have made more progress.

Still, I'm excited for the book and look forward to sharing it's lessons in the (hopefully not too distant) future.

where did the SOCIAL in social media go?

I joined Twitter, and Facebook, and MySpace (although I was a bit late there) on the same day in 2007. Until then I didn't see the point.

MySpace was already pretty much dead by that point. Over the years Facebook became a way of keeping up with family and friends I knew locally. While Twitter became a place to connect with, meet, share, and learn from others with similar interests.

With many people and the friends and acquaintances, I'd made over the years, who had those interests, mostly gathered in one place it made keeping up with announcements, updates, and just general chit -chat possible. I found it reasonably easy to keep up with what was going on in the areas I was interested in. It was, of sorts, a community.

And then a bomb was set off under twitter.

With people leaving at different times and going off in different directions to different alternative apps. It became an impossibility to keep track of everyone who moved to a new platform/app. (Especially with the misinformation about sharing usernames and accounts on other platforms.)

I now have a "presence" in multiple apps (Mastadon, Blue sky, Instagram, Threads, and yes still X -- all profile links 😉) 

But none of them seem a patch on the community that existed before.

In each app there are a few accounts that I used to follow all in one place, but it seems an uncomfortable and unnecessary effort to keep opening and scrolling through each one on the chance of finding something important and/relevant. Plus each now has a terrible signal to noise ratio that is off-putting.

I've tried cross-posting across apps, but the expectations of content on each seems so different. Although I know others treat them as interchangeable--with varying results.

If I just feel the need to say something that I think/hope will get a response I'll go to Twitter/X, but then I'll feel bad because of all the people being vocal elsewhere about why they left and closed their accounts.

Yes, what Elon did to Twitter and what X has become are far from great, but I don't want to be another voice complaining.

How (and) can an online community be created that's anything like what we had in the past?

I know a bit about building communities IRL, but where and how are online communities really built?

Or should I just give up, pick one app, and start making connections again...

Code signing a VSIX Package with a certificate from DigiC**t

Let's avoid why you might want to do it, but if you need to sign a VSIX package with a certificate from the DigiCert KeyLocker (using their hosted Hardware module service) referenced with a certificate stored in the Windows Certificate Manager, I have important details for you.

Here's the thing.

DigiCert claim that you can use their certificates to sign a .vsix file using SignTool.exe. You can't.

SignTool does not support signing VSIX files.

Previously, the recommended way to sign a VSIX package was with VsixSignTool, but this has now been deprecated.

The current (October 2024) recommended solution is to use the Sign CLI tool instead.

That's all well and good, but there aren't any clear instructions (anywhere!) that explain how to do this with a code signing certificate hosted in a DigiCert KeyLocker.

If you're trying to do this, I'd recommend not contacting DigiCert support as they're likely to tell you something like:

It seems our documentation is correct, it is supported, but does not specify the "how". As that would be listed as a third party custom configuration, which is something that is not supported at this time.

That's not at all helpful.

They may also point you to this (devblogs) blog post, but that still doesn't contain a complete working example for this scenario.

Here's what I recommend (based on what I've managed to get working and now use--don't ask how long it took to get working as it's very depressing.):

• Set up your machine following DigiCert's instructions until you get to a point where you can successfully sign a .dll file with smctl.exe.
• Install the SIGN tool. 
• Install KeyStore Explorer.
• Use KeyStore Explorer to get the SHA256 version of the fingerprint for the certificate you wish to use. (and remove the colons between values)
• Sign the VSIX with a command like this:

sign code certificate-store {Path-to-VSIX-file} -cfp {SHA256-fingerprint} -csp "DigiCert Software Trust Manager KSP" -k {certificate-friendly-name} -u "http://timestamp.digicert.com"

e.g. (some values shortened)

sign code certificate-store "D:\output\MyExtension.vsix" -cfp 4AD4D3E4...7C2A -csp "DigiCert Software Trust Manager KSP" -k key_7...670 -u "http://timestamp.digicert.com"

I hope this helps someone.

Yes, using something like AzureKeyVault is probably preferable. If you have detailed, up-to-date instructions on how to set this up, please share them.

It's been a while

I'd guess that the majority of personal blogs in existence have a final post that talks about apologizing for not posting in a while and then promises that this will change and they'll stat posting again soon...

Yes, I've been quiet for a while. 

At the start of the year, I made plans to leave the project I was working on to spend some time reassessing what was important and what I wanted to do in the future. That time was interrupted by me rupturing the Achilles tendon in my right leg and being forced into 3 months of virtual immobility. This not only ruined my summer plans (and those for the rest of the year) but also kept me away from my desk and my computer(s). There were positives and negatives to this.

But now I'm back. As I start to get back into things I'm planning on working through the many, many draft blog posts I have and finishing and publishing them where appropriate.

If the next few posts seem very random and unrelated, that'll be why.

Developers like us pledge to support open-source

I was recently previously contributing to a project when something broke on the CI builds due to an issue with how a referenced library was misconfigured.

I didn't realize the library was being used. It was configured in a way that meant it didn't show up inside Visual Studio when working with the solution.

I also knew this library had a special (moral) license. This "required" those using it to support the project financially, but the business wasn't.

I wasn't using the functionality of the library, but when I discovered this, I did two things:

1. I made a personal financial contribution to the project.

2. I highlighted this to the business and indicated that they should be financially supporting the project if they wished to keep using the library. (The person who originally added the library pleaded ignorance--"But, it's open source, so we don't need to pay.")

People like us (developers like us):

• Support the people writing open-source software. Financially if possible (and requested).
• Respect the spirit of open-source licenses. Not just the minimum, enforceable legal requirements.

This incident raises other, bigger questions, but I'll discuss them at another time—maybe.

However, I mention this because I recently heard about the Open Source Pledge. An initiative to help encourage companies to "Do the right thing, support Open Source".

No, it's not going to solve the problem of funding and support for open source maintainers, but it will help.