标签：#net

Microsoft has released the fifth preview of .NET 11, with updates across the SDK, C#, ASP.NET Core, .NET MAUI, and EF Core. Highlights include file-based app improvements, new C# closed classes and unions, a Blazor validation wave, a large MAUI reliability rollup, and SQL Server 2022 as the default EF Core compatibility level. By Almir Vuk

Originally published at https://allcoderthings.com/en/article/csharp-generics-list-t-dictionary-tkey-tvalue In C#, generics are used to increase type safety and flexibility. Generic classes and collections eliminate the need for runtime type casting and avoid unnecessary boxing and unboxing operations, improving performance and reducing the risk of errors. Before generics were introduced, collections such as ArrayList stored elements as object . When a value type like int was added to an ArrayList , it had to be boxed (converted to object ), and later unboxed when retrieved. This boxing/unboxing process caused additional memory allocations and performance overhead. With generic collections like List<T> and Dictionary<TKey,TValue> , elements are stored in their actual types, eliminating these costs and making the code both safer and faster. List List<T> is a generic collection that dynamically stores elements of a specific type. T specifies the type of elements the list will contain. using System ; using System.Collections.Generic ; var numbers = new List < int >(); numbers . Add ( 10 ); numbers . Add ( 20 ); numbers . Add ( 30 ); foreach ( int n in numbers ) Console . WriteLine ( n ); // Output: // 10 // 20 // 30 Note: Unlike arrays, List<T> can grow and shrink dynamically. Dictionary Dictionary is a generic key–value collection. TKey specifies the type of the key, and TValue specifies the type of the value. using System ; using System.Collections.Generic ; var students = new Dictionary < int , string >(); students [ 101 ] = "John" ; students [ 102 ] = "Mary" ; students [ 103 ] = "Michael" ; foreach ( var kv in students ) Console . WriteLine ( $" { kv . Key } → { kv . Value } " ); // Output: // 101 → John // 102 → Mary // 103 → Michael Note: Each Key in a dictionary must be unique. Attempting to add the same key again will cause an error. Creating Your Own Generic Classes You can also define your own generic types, not just use built-in collections. This allows you

Introduction In this post, I'll walk you through deploying a production-ready Kubernetes cluster on Red Hat Enterprise Linux 10 using kubeadm. This lab was inspired by Anthony E. Nocentino's excellent Certified Kubernetes Administrator (CKA): Using kubadm to Install a Basic Cluster training course, which is part of the official Certified Kubernetes Administrator (CKA) path on Pluralsight . ⭐ Shout-out: Anthony is a fantastic trainer! His course uses Ubuntu 22.04 as the base OS. I adapted his approach to work on RHEL 10, adding some additional considerations specific to Red Hat's ecosystem. One intentional decision in this setup: I deployed Kubernetes v1.35 and CRI-O v1.35, which wasn't the latest version available at installation time. This was purposeful. Anthony's course includes a dedicated section on upgrading clusters, and using a slightly older baseline makes that learning path clearer. The upgrade procedures (not covered here) are what really solidify your understanding of cluster lifecycle management. Lab Infrastructure Overview Nodes Configuration Node Role RAM vCPUs IP Address rh-cp1 Control Plane 12 GiB 2 192.168.110.120 rh-node1 Worker 6 GiB 2 192.168.110.121 rh-node2 Worker 6 GiB 2 192.168.110.122 rh-node3 Worker 6 GiB 2 192.168.110.123 Note: The IP address schema is just an example and what was more convenient for me. Supporting Infrastructure A dedicated utilities VM (also RHEL 10) provides essential services: DNS (BIND/named) NTP (chrony) HTTP (Apache/httpd) DHCP (Kea) This centralized infrastructure simplifies name resolution across all cluster nodes. But this is not essential for this project. You can, instead, ensure the nodes are able to reach each other updating the file /etc/hosts on all nodes. Prerequisites & OS Preparation Before diving into Kubernetes, we need consistent node preparation across all machines . 1. System Registration and Updates $ sudo subscription-manager register --username <username> --password <password> $ sudo dnf update

This is Part 13 of my series on the Microsoft Agent Framework. You can read the original post over on lukaswalter.dev . In the previous article , we looked at workflows. Workflows make sense when the process itself needs structure: state, checkpoints, events, human approvals, and resumable execution. This post is the bridge from Agent Framework into RAG. I plan on doing a full RAG deep dive sometime later. The practical question for now is smaller: How do I connect an Agent Framework agent to private application knowledge without stuffing every document into the prompt? For agents, RAG is less about adding more text and more about giving the agent a controlled retrieval path. The agent should fetch the right context at the point where it needs it. Agents do not know your private data Your company documents, product catalog, tickets, rules, policies, runbooks, and internal knowledge base live outside the model. The model has generic knowledge. Your application has private knowledge. Treat those as separate systems. You can paste some private data into the prompt, and for a demo that may be enough. But this falls apart quickly: full documents are expensive to send repeatedly long prompts are fragile stale documents may sit next to current ones users may not be allowed to see every source long context still needs selection The last point is easy to underestimate. A larger context window lets you send more text. It does not decide which text is correct, current, relevant, or permitted. Do not give the agent all knowledge. Give it the right context at the moment it needs it. Retrieval owns that job. The minimal RAG shape The basic RAG loop is small: user question -> retrieve relevant chunks -> pass chunks to the agent -> agent answers using that context For documents, the longer pipeline usually looks like this: documents -> chunks -> embeddings -> vector store -> search -> retrieved context -> agent response Documents are split into smaller chunks. Those chunks are embe

Netflix has detailed a cloud-based system for scaling camera file processing across global film and TV workflows. The pipeline handles ingest, validation, metadata extraction, and media transformation at scale using FilmLight API and distributed compute. It standardizes workflows across editorial, VFX, and color pipelines, improving consistency and reducing manual handling across productions. By Leela Kumili

The affected include Oracle, Lenovo, FedEx, a NATO contractor, and Fortinet.

I use Neovim btw... Unfortunately, I'm also a C# developer. Anyone who has used .NET in Neovim knows that the language support is tenuous. I've spent hours tweaking my configuration to get the roslyn LSP to interact with my code editor, and I could never get the limited feature set that I wanted to feel smooth and native the way other LSPs do in Neovim... especially razor. That is... until now. A few weeks ago with this commit , the developers of the roslyn.nvim plugin made it so much easier to get up and running with the roslyn server that's officially distributed by Microsoft. Early this year, Microsoft put out a prerelease of a new dotnet CLI tool roslyn-language-server . Before this release, developers got access to the server by downloading the binaries from an obscure azure feed and pointing the Neovim plugin to the proper dll . Some adventurous and patient developers even got razor support in this method, but I was not one of them. With an officially (pre-) released tool from Microsoft, downloading roslyn is now as easy as running: dotnet tool install -g roslyn-language-server --prerelease After a month or two, the developers of roslyn.nvim updated the plugin to support the new roslyn-language-server command to setup the plugin. They even set the plugin to search for it on a fallback by default, so no configuration changes are required. My configuration for roslyn.nvim used to be about 20 lines of Lua. Here it is now: { 'seblyng/roslyn.nvim' , ---@module 'roslyn.config' ---@type RoslynNvimConfig opts = {}, }, It's Simple. It works. Large projects initialize relatively quickly, and all of the standard language server operations, like semantic highlighting, renaming, jump to definition/implementation, in-editor diagnostics, etc. are available out of the box. I'm not exactly sure what magic the developers pulled here, but as I've mentioned, I've never gotten razor syntax support. With the recent updates, razor is supported! I've been using this setup for about a

From Amazon's “Off Campus” to Netflix’s upcoming “Icebreakers,” the recent spate of hetero hockey romances shows Hollywood learned the wrong lessons from “Heated Rivalry.”

How GPU scheduling complexity and MLOps integration are forcing platform teams to rearchitect Kubernetes clusters before operational debt becomes insurmountable. As AI workloads consume roughly 40% of enterprise Kubernetes clusters by 2026, the platform's default scheduler is proving fundamentally mismatched with the topology-aware, gang-scheduled demands of GPU-intensive training and inference. Platform engineering teams that invest now in purpose-built GPU scheduling layers, multi-tenant partitioning, and FinOps-driven autoscaling will separate themselves from organizations drowning in 30-45% GPU utilization rates and mounting infrastructure costs. Why the Default Kubernetes Scheduler Fails GPU Workloads Kubernetes was designed for stateless, CPU-bound services, and its pod-by-pod bin-packing scheduler has no native awareness of GPU topology, NUMA boundaries, or NVLink interconnect bandwidth. This becomes a critical failure point with NVIDIA H100 SXM5 nodes, where achieving full-bandwidth tensor parallelism requires all 8 GPUs on a node to be scheduled as a single atomic unit. The default scheduler cannot guarantee this co-placement, meaning distributed PyTorch FSDP or MPI training jobs frequently land on suboptimal node configurations, wasting expensive NVLink bandwidth and forcing teams to over-provision GPU capacity. Idle GPU memory stranded across partially-utilized nodes is the primary driver behind the 30-45% utilization rates reported in 2025 surveys by Gradient Dissent and Weights and Biases, representing millions of dollars in annual wasted spend for mid-to-large enterprises running mixed AI workloads. Building the GPU Scheduling Stack: Volcano, KAI Scheduler, and MIG Platform teams are converging on a layered scheduling architecture that replaces or augments the default Kubernetes scheduler with GPU-aware primitives. Volcano has become the dominant choice for distributed training workloads, using its PodGroup abstraction to enforce gang scheduling across

An alleged Russian-speaking group of cybercriminals is reportedly compromising and targeting several major companies that use Fortinet Firewalls and VPNs through previously known passwords.

When managing Shared VPCs, most teams allocate dedicated IP subnets for each service project to keep firewall rules simple, but this isolation often leads to poor IP utilization — it is not uncommon to see subnet IP utilization hovering in the low teens. On the other hand, using large shared subnets requires coordinating workload deployments to ensure there is enough internal IP address space for everyone. To optimize these shared networks, you need real-time visibility. The WITH_UTILIZATION query parameter on the Method: subnetworks.list | Compute Engine API solves this by returning the exact count of allocated and free IP addresses for each subnet IP range. This capability is designed for query-time decisions. For example, if you need to deploy a GCE workload requiring 100 instances, you can search for a subnet with enough capacity. This query-time data comes directly from Google Cloud's internal IP allocator and includes both primary and secondary CIDR ranges. Automating the search with gcloud and jq To automate capacity checks before you deploy, you can script this check. The script below uses gcloud compute networks subnets list | Google Cloud SDK to grab the utilization data as JSON, and then uses jq to parse, filter, and sort the subnets based on your required capacity: #!/bin/bash # --- Configuration (Replace with your details) --- PROJECT = "<YOUR_PROJECT_ID>" NETWORK_NAME = "<YOUR_VPC_NETWORK_NAME>" REGION = "<YOUR_REGION>" REQUIRED_IP_CAPACITY = 100 echo "Searching $NETWORK_NAME in $REGION for subnets with >= $REQUIRED_IP_CAPACITY free IPs..." echo "------------------------------------------------------------------------" # Fetch subnets with utilization data, output as JSON, and pipe to jq gcloud compute networks subnets list \ --project = " $PROJECT " \ --network = " $NETWORK_NAME " \ --regions = " $REGION " \ --view = WITH_UTILIZATION \ --format = json | \ jq -r --argjson min_ips " $REQUIRED_IP_CAPACITY " ' [ .[] | { name: .name, cidr: .ipCidrRange, #

The deployment should have taken a few minutes. The application was running, DNS was configured correctly, and the domain was already pointing to the server's public IP. Caddy was configured as a reverse proxy and was listening on ports 80 and 443. Every item on my deployment checklist appeared healthy. Yet every Let's Encrypt validation attempt kept failing. The error looked simple enough: authorization failed timeout during connect likely firewall problem At first, I believed it. I checked DNS resolution, verified firewall rules, confirmed that Caddy was listening on the expected ports, and made sure the application itself was reachable. Every check came back clean. That was the first clue that the problem might not be where the logs were pointing. The Obvious Things The first assumption was DNS. I verified that the domain resolved to the correct public IP. dig +short my-domain.com Everything looked correct. Next came the firewall. sudo ufw status Ports 80 and 443 were open. There were no unexpected deny rules, and nothing suggested inbound traffic was being blocked. Then I checked whether Caddy was actually listening. sudo ss -tulpn | grep -E ':80|:443' Again, everything looked normal. The application itself was healthy too. curl http://localhost:3001 returned a valid response. At this point I had checked most of the things engineers typically check when certificate validation fails. DNS looked good, the firewall looked good, the reverse proxy was healthy, and the application was running. Yet the validation errors continued. The Part That Sent Me In The Wrong Direction The error messages kept mentioning connectivity problems and possible firewall issues. That wording influenced my thinking more than it should have. I spent time investigating firewall rules, reverse proxy configuration, TLS settings, and domain configuration. Every new hypothesis felt reasonable, but none of them explained why local tests consistently succeeded while external validation continued

I run a hosting company. I'm also a BCA student. These two things coexist somehow. GigaNodes started in 2022 as a game server hosting brand — Minecraft, FiveM, ARK, the usual. Over time it grew into a proper VPS and dedicated server operation under GigaNode Technologies Private Limited, with AMD EPYC 7C13 hardware co-located at Yotta DC Noida. Earlier this year we did something I haven't seen any other Indian hosting provider do: we deployed Cloudflare Magic Transit across our entire network. What that actually means Magic Transit is not Cloudflare CDN. It is not a proxy. It is Cloudflare's enterprise network product where your IP prefixes get announced via BGP into Cloudflare's global backbone. All traffic destined for your servers enters Cloudflare's network first, gets scrubbed for attack traffic, and clean packets get forwarded to your data center via GRE tunnel. To deploy it, your infrastructure partner needs to have BGP-level integration with Cloudflare. Individual companies can't just sign up for it. We made it work through our partnership with Advika Datacenters Private Limited (AS135682) at Yotta DC Noida. The result: DDoS traffic never reaches our hardware. Our servers don't see the attack at all. Why no other Indian provider had done this Most Indian hosting providers use blackholing. When an attack comes in, they null-route your IP. Server goes offline. Attack stops eventually. Server comes back. That is the standard. That is what "DDoS protection included" usually means in India. The difference with Magic Transit is that legitimate traffic keeps flowing while attack traffic gets dropped. Your server stays online. Players stay connected. Trades don't get interrupted. We found out pretty quickly this actually works. We took a 1.7 Tbps attack after deployment. The servers didn't notice. A 1.7 Tbps volumetric attack hit our network in May 2026. Cloudflare absorbed it at the edge. No downtime. No support tickets from customers. We found out from the Cloudfla

Class, Record, and Struct serve as blueprints for creating new objects. Classes Classes are the foundational building blocks of Object-Oriented Programming (OOP). Blueprint and instance // blueprint public class Person { public int ID { get ; set ; } public string Name { get ; set ; } } // instance var p = new Person { ID = 1 , Name = "Mirza" } Inspection Printing the class instance in the console will just display it's name: var p1 = new Person { ID = 1 , Name = "Mirza" }; Console . WriteLine ( p1 ); // Person To print the actual, we'd need print each property explicitly: Console . WriteLine ( p1 . ID ); // 1 Console . WriteLine ( p1 . Name ); // "Mirza" Mutation C# classes are mutable, meaning the originally set values can be altered: var p1 = new Person { ID = 1 , Name = "Mirza" }; Console . WriteLine ( p1 . Name ); // "Mirza" p1 . Name = "Armin" ; Console . WriteLine ( p1 . Name ); // "Armin" That said, this can be tweaked by changing the accessor the class property. public class Person { public int ID { get ; set ; } public string Name { get ; init ; } // <-- } This time around if we try to change the value of the Name property after initialization, the C# compiler will start to complain. var p1 = new Person { ID = 1 , Name = "Mirza" }; p1 . Name = "Edis" ; // ❌ The init accessor allows you to create properties that can only be assigned a value during object initialization. Memory location Classes are reference types and are allocated on the heap. If we create two distinct class objects and assign one to the other, both objects will point to the exact same reference in memory: var p1 = new Person { ID = 1 , Name = "Mirza" }; var p2 = new Person { ID = 2 , Name = "Mirza" }; p1 = p2 ; p1 . Name = "Sead" ; Console . WriteLine ( p1 . Name ); // Sead Console . WriteLine ( p2 . Name ); // Sead If we change a value in one of the objects, it will be reflected in both. Equality Two class instances (objects) aren't equal even if they share the same values: var p1 = new P

问题降临：毫无征兆 那天和往常一样，打开YouTube准备看一个英文视频。习惯性地点开字幕按钮—— 没反应。 不是字幕延迟，不是字幕错位，而是整个字幕功能像是从这个世界上蒸发了一样。原始语言的字幕不可用，点进字幕设置一看，连翻译选项都是灰的。没有原始字幕，自然也就没有任何语言的翻译字幕。 一整个功能链，从根部断裂。 第一反应：一定是扩展插件搞的鬼 作为一个浏览器里装了不少扩展和油猴脚本的用户，我的第一直觉非常明确—— 肯定是哪个插件冲突了。 这个判断合情合理。浏览器扩展劫持页面元素、油猴脚本注入自定义代码，这些操作干扰YouTube的正常功能，实在是太常见了。之前遇到过播放器界面异常、按钮消失之类的问题，十次有八次都是扩展惹的祸。 于是我开始了标准排障流程： 禁用所有油猴脚本 → 刷新 → 字幕依然不可用 禁用所有浏览器扩展 → 刷新 → 字幕依然不可用 开无痕模式 （彻底排除扩展和缓存影响）→ 字幕依然不可用 三轮操作下来，扩展插件的嫌疑被彻底洗清。 但这还不是最让人困惑的部分。 真正的诡异之处：薛定谔的字幕 在反复测试的过程中，我发现了一个极其反直觉的现象： 字幕的可用性是随机的。 开着所有扩展 → 有时候字幕 有 ，有时候 没有 关掉所有扩展 → 有时候字幕 有 ，有时候 没有 这完全打破了因果逻辑。如果问题出在扩展上，那么"关掉扩展"就应该稳定地解决问题。但现实是，开和关都呈现随机状态，说明扩展根本不是变量—— 真正的变量藏在别的地方。 这种"薛定谔的字幕"状态让我一度非常迷茫。你没办法用常规的控制变量法去定位一个表现为随机的问题，除非你能找到那个真正在变化的隐藏变量。 灵光一闪：换个节点试试？ 在排除了浏览器层面的所有可能之后，我突然想到了一个平时根本不会和"字幕"联系在一起的东西—— 网络节点。 抱着试一试的心态，我切换了代理节点，选了一个不同地区的服务器。 刷新页面。 字幕回来了。 原始字幕、自动翻译、多语言选项——一切恢复正常，仿佛之前的问题从未发生过。 我又切回原来的节点——字幕消失了。再切到新节点——字幕回来了。反复测试了好几次，结果完全一致。 真相大白：问题出在节点上。 恍然大悟：视频和字幕，原来是两套系统 这次经历让我意识到一个之前从未注意到的事实： YouTube的视频流和字幕数据，很可能是由不同的服务器（或CDN节点）分别提供的。 这意味着： 视频能正常播放 ≠ 字幕能正常加载 你的网络可以顺畅地连接到视频服务器，但与此同时，字幕服务器可能对你当前的IP/地区/节点不可达或响应异常 不同的代理节点连接到的Google后端服务器不同，某些节点恰好无法正常获取字幕数据 这也完美解释了之前"随机可用"的现象。我在测试扩展的过程中，代理工具可能在后台自动切换了节点（很多代理工具有负载均衡或自动切换功能），导致有时碰巧连上了能提供字幕的服务器，有时则没有。我一直以为变量是"扩展的开关"，实际上真正在暗中变化的是"网络节点"。 技术推测 虽然Google没有公开YouTube的完整架构细节，但根据这次经历可以合理推测： YouTube使用分布式CDN架构 ，视频内容、字幕数据、评论、推荐信息等可能分布在不同的微服务和服务器集群上 字幕API的端点 可能与视频流的端点不同，它们的可用性、地理限制、负载状况都是独立的 某些地区的某些IP段可能因为各种原因（服务器维护、区域限制、DNS解析差异、临时故障）无法正常访问字幕服务 这种问题具有 高度的偶发性和地域性 ，这也是为什么它如此小众，在网上几乎搜不到相关讨论 写在最后 这大概是我遇到过的最小众、最反直觉的技术问题之一。 它小众到什么程度呢？你去搜索"YouTube字幕不可用"，得到的答案几乎都是：清除缓存、禁用扩展、检查字幕是否被上传者关闭、换个浏览器试试。 没有人会告诉你"换个代理节点"。 因为在绝大多数人的认知里，"视频都能看"就等于"网络没问题"，不会有人把字幕缺失和网络节点联系在一起。 但事实就是这么奇怪： 视频能播放，不代表字幕能加载，因为它们根本就不在同一条路上。 这次经历也给了我一个教训：当排障陷入死胡同的时候，不要只盯着最明显的嫌疑犯。真正的问题，有时候藏在你认为"完全不可能"的地方。 下次再遇到YouTube的某个功能莫名其妙消失，而视频本身却能正常播放的时候——先换个节点试试。说不定，答案就在那里。

A CloudNativePG cluster that sits in Setting up primary forever, with zero error events on the Cluster resource and a perfectly healthy operator, is one of the more frustrating ways to spend an afternoon. The operator says it's working. The pods never appear. And the actual cause has nothing to do with the database at all. Running stateful databases on Kubernetes used to be the thing everyone told you not to do. CloudNativePG (CNPG) changed that calculus for a lot of people, including me. It's a proper operator: it handles failover, backups, connection routing, and rolling upgrades through native Kubernetes primitives instead of bolting Postgres onto a StatefulSet and praying. If you run a hardened cluster with admission controllers, network policies, and least-privilege RBAC, this post is about the friction you'll hit that the quickstart never mentions. Who should care If your cluster is vanilla, kubectl apply the operator and a Cluster manifest, and you're done in ten minutes. The CNPG docs are genuinely good for that path. This is for the rest of us: people running Kyverno or OPA Gatekeeper, self-signed cert chains, and the kind of policy-as-code setup where every workload has to justify its existence. That's where CNPG stops being a ten-minute install and starts being an integration project. What I tried first The first instinct, when a CNPG cluster hangs, is to assume you got the database config wrong. So you go read your Cluster manifest line by line. You check the storage class. You check that the PVC bound. You bump the operator log level and watch it cheerfully report that it's reconciling, over and over, with no complaints. Here's the trap: the CNPG operator doesn't run initdb itself. It creates a Kubernetes Job to bootstrap the primary. That Job spawns a Pod. And in a hardened cluster, the Pod is where everything dies, because your admission controller is judging it against policies the operator's own Pods were exempted from but the bootstrap Job was not.

I had a write that spanned two physically separate databases. A rename that had to propagate across several tables in one database and a couple of tables in another, and the two had to stay consistent. No distributed transaction coordinator was available to me. So I did the obvious thing: opened a transaction on each, did the work, and committed them one after the other inside a try/catch with rollbacks on both sides. It felt safe. It compiled. It passed tests. Then I drew the failure on a whiteboard, and the safety evaporated. The window that ruins everything Here's the structure, simplified: await using var txA = await dbA . Database . BeginTransactionAsync (); await using var txB = await dbB . Database . BeginTransactionAsync (); await DoWorkOnA ( dbA ); await DoWorkOnB ( dbB ); await txA . CommitAsync (); // <-- succeeds await txB . CommitAsync (); // <-- what if this throws? Two transactions do not make one atomic operation. CommitAsync is a point of no return, and there are two of them. Between the first commit returning and the second one starting, there is a window. If txB fails in that window — the connection drops, the process is killed, the database hiccups — then A is permanently committed and B never happens. Your rollback in the catch block is useless: you can't roll back txA , it's already durable. The two databases now disagree, and nothing in your code will heal that on its own. This is the dual-write problem , and it's not a bug you can fix by being more careful with try/catch. The atomicity you want simply isn't available from two independent commits. Ordering them, nesting them, wrapping them — none of it closes the window, because the window is inherent to having two commit points. Why "it's never failed" isn't reassurance The seductive thing about this pattern is that the window is small, so in practice it almost never triggers. You can run it for a year and never see an inconsistency. That's exactly what makes it dangerous: it trains you to tr

Sometimes you genuinely need the set of columns to update to be data, not code. An operator maps configuration fields to database columns, and you want to honor that mapping without redeploying every time it changes. The naive solution — build an UPDATE string from those column names — is also one of the easiest ways to hand-write a SQL injection vulnerability. This is how to get the flexibility without the hole. We'll build it up in three layers: make it work, make it safe, then count the cost. Layer 1: The dynamic update, the wrong way The tempting version concatenates column names into SQL: // DO NOT do this. var sql = $"UPDATE products SET { columnName } = { value } WHERE id = { id } " ; If columnName comes from configuration that an operator can edit, you've just made your schema writable by whoever controls that config. A value of name = 'x'; DROP TABLE products; -- is now your problem. Even "trusted" config is an injection surface the moment it flows into a SQL string. Layer 2: The same feature with EF.Property EF Core's ExecuteUpdateAsync lets you set a property by name without ever building SQL yourself. EF.Property<T> takes the property name as a string, and EF parameterizes the value and validates the property against the model: await db . Products . Where ( p => p . Id == id ) . ExecuteUpdateAsync ( setters => setters . SetProperty ( p => EF . Property < float ?>( p , columnName ), value )); This is already a different security posture: the value is a parameter, not interpolated text, and EF will throw rather than emit SQL if columnName isn't a real mapped property. But "EF will throw" is a runtime backstop, not a policy. We want to reject bad names before they reach the database, fail closed, and control exactly which columns are writable. Layer 3: Reflection as a whitelist The guard is to validate every incoming column name against the entity's actual properties, using reflection, and to keep an explicit blacklist of fields that must never be touched d

Modern software delivery pipelines can deploy code dozens or even hundreds of times per day. Traditional penetration testing models, where security teams perform assessments quarterly or before major releases, simply cannot keep pace. Attackers do not wait for the next security review. Every pull request, dependency update, infrastructure change, or container image introduces potential risk. Integrating penetration testing into CI/CD enables organizations to identify vulnerabilities before they reach production. The goal is not replacing human penetration testers. The goal is automating everything that can be automated so security experts can focus on complex attack paths and business logic flaws. Understanding Security Testing Layers in CI/CD Security testing is often misunderstood because multiple categories overlap. Testing Type Purpose SAST Analyze source code SCA Detect vulnerable dependencies DAST Test running applications IAST Runtime security analysis Penetration Testing Simulate attacker behavior Penetration testing combines elements of all these approaches. A mature CI/CD pipeline continuously performs automated penetration testing while reserving manual testing for sophisticated attack scenarios. Designing a Security-First CI/CD Architecture A security-centric pipeline typically looks like: Developer Commit ↓ Pre-Commit Security Checks ↓ Pull Request Validation ↓ Build Stage ↓ Container Security Scan ↓ Infrastructure Validation ↓ Deploy to Staging ↓ Automated Penetration Testing ↓ Security Gate ↓ Production Deployment Each stage eliminates vulnerabilities before they become more expensive to fix. Stage 1: Pre-Commit Security Controls The cheapest vulnerability is the one that never reaches Git. Secret Detection Install TruffleHog or Gitleaks before code reaches the repository. repos : - repo : https://github.com/gitleaks/gitleaks rev : v8.20.0 hooks : - id : gitleaks Developer installation: pip install pre-commit pre-commit install Now every commit is aut

Check this out: i run four monetization channels side by side. Sponsored posts, display ads, YouTube ad revenue, and affiliate links. After eighteen months of tracking every dollar in a spreadsheet I built myself, I can tell you with brutal honesty: affiliate income is the only one that scales without me having to constantly produce more content or chase the next brand deal. But the math only works if you pick the right program. Most affiliates I know are promoting garbage with terrible retention, and they have no idea they're burning their audience's trust for a $9 one-time payout. Let me walk you through how I evaluate affiliate programs, what I've learned from running real funnels, and why the AI API category has quietly become the most lucrative vertical for tech creators in 2026. My Monetization Stack After 18 Months of Testing Here's a snapshot of my monthly revenue from a tech newsletter with around 34,000 subscribers and a YouTube channel sitting at 88,000 subscribers: Sponsored posts: $2,100 per placement, but I can only land maybe 2-3 per month without annoying my list Display ads: $1,800 per month from Mediavine, but this number barely moves regardless of how hard I work YouTube ad revenue: $2,400 per month, capped by watch time and RPMs Affiliate income: $6,800 per month, and it grows every single month even when I publish nothing That last number is what got my attention. Affiliate income compounds. When I published a tutorial in February recommending a tool, that single piece of content still earned me $340 in May because users stayed subscribed. No other channel behaves like that. No other channel lets a piece of content from four months ago keep paying you. But here's the catch that took me a while to figure out: not all affiliate programs are built the same way. And the difference between a good program and a bad one can be 10x in lifetime earnings per referred user. # # How I Score an Affiliate Program (The Growth Hacker Scorecard) Before I promote