Recent content on Jamie Magee
You’re about to ship a product. Legal asks for the third-party notices, so you generate an SBOM, and half the dependencies come back as NOASSERTION . You can’t put that in a NOTICE file, and legal won’t sign off on it. I’ve spent a lot of late nights writing those files by hand, so this is the talk I gave about the project that saves me from most of them: ClearlyDefined.
When NuGet finds a vulnerable package in your project, it tells you. NU1901 through NU1904 have warned about CVEs in your dependencies for a while now. The SDK that runs the build, though? That’s been a blind spot. You can sit on a perfectly patched set of packages and still be running dotnet build with an SDK that went end of life last May. That always struck me as a gap worth closing. So I…
I ride a Specialized Vado SL 4.0. It has a TCU (Turbo Connect Unit) that broadcasts telemetry over Bluetooth Low Energy — battery level, speed, motor power, cadence, temperature, the works. Specialized has their own Mission Control app for this, but I wanted the data in Home Assistant. So I built a custom integration. The protocol Specialized’s BLE protocol isn’t documented anywhere…
Back in January 2020, Google open sourced Wombat Dressing Room , an npm proxy that solved a real problem: how do you maintain two-factor authentication for npm packages while still using automation? For teams managing dozens or hundreds of packages, manually entering 2FA codes for every publish wasn’t just inconvenient, it was a dealbreaker. Fast forward to 2025, and npm has finally…
When you create a new .NET project and start writing code, you might find yourself using classes like System.Text.Json.JsonSerializer without ever explicitly adding a reference to System.Text.Json in your .csproj file. This isn’t magic—it’s because these Base Class Libraries (BCLs) are shipped as part of the .NET runtime itself, making them implicit references that are automatically…
Have you ever wondered what lies beneath the surface of an npm package? At its heart, it’s nothing more than a gzipped tarball. Working in software development, source code and binary artifacts are nearly always shipped as .tar.gz or .tgz files. And gzip compression is supported by every HTTP server and web browser out there. caniuse.com doesn’t even give statistics for support, it just says “…
When it comes to Linux containers, there are plenty of tools out there that can scan container images, generate Software Bill of Materials (SBOM), or list vulnerabilities. However, Windows container images are more like the forgotten stepchild in the container ecosystem. And that means we’re forgetting the countless developers using Windows containers, too. Instead of allowing this gap to widen…
Is your Jest test suite failing you? You might not be using the testing framework’s full potential, especially when it comes to preventing state leakage between tests. The Jest settings clearMocks , resetMocks , restoreMocks , and resetModules are set to false by default. If you haven’t changed these defaults, your tests might be fragile, order-dependent, or just downright wrong. In this…
One big advantage that Arch Linux has over other distributions, apart from being able to say “BTW I use Arch.”, is the Arch User Repository (AUR). It’s a community-driven repository with over 80,000 packages. If you’re looking for a package, chances are you’ll find it in the AUR. Keeping all those packages up to date, takes a lot of manual effort by a lot of volunteers. People have created…
When it comes to Linux containers, there are plenty of tools out there that can scan container images, generate Software Bill of Materials (SBOM), or list vulnerabilities. However, Windows container images are more like the forgotten stepchild in the container ecosystem. And that means we’re forgetting the countless developers using Windows containers, too. I wanted to see what I’d need to make…
The GitHub documentation has a lot of good advice about rate limits for its API, and how to make the most of them. However, since using the GitHub API, there are some things I’ve discovered that the documentation doesn’t cover, or doesn’t cover so well. Conditional requests This topic is actually covered very well in the GitHub documentation . To summarise, all REST API requests will return ETag…
For a while now the Octokit libraries for .NET have lagged behind the JavaScript libraries, especially when it comes to webhooks. Unfortunately, I needed a GitHub webhook client for an internal project, so I had to write my own. It wasn’t too much extra effort to open source it, and thus Octokit.Webhooks was born! I wanted to give a quick example of how to get up and running with Octokit.Webhooks…
At its heart, Netlify is a platform for hosting static websites. I initially started using it as an alternative to GitHub Pages , and features like Netlify CMS and preview deploys really won me over. However, I recently got bit by preview deploys and the build minutes pricing. I had a few GitHub repos set up to automatically deploy to Netlify previews from pull requests. I had also configured…
#10YearChallenge has been trending for a while, so I thought it would be fun to do a 10 year challenge for programming and take a look at the technology I used back in 2010. 2010 10 years ago covers my final year in high school, and my first year in university. Both used completely different programming languages and tech stacks, so it’s an interesting place to look back at. I was running…
Following on from part one , here’s some more of the most common pitfalls I’ve come across—either myself, colleagues and friends, or examples in documentation—and how to avoid them. ‘Fake’-sync is not async If the method you are calling is synchronous, even in an async method, then call it like any other synchronous method. If you want to yield the thread, then you should…
The .NET Framework provides a great programming model that enables high performance code using an easy to understand syntax. However, this can often give developers a false sense of security, and the language and runtime aren’t without pitfalls. Ideally static analysers, like the Microsoft.VisualStudio.Threading.Analyzers Roslyn analysers , would catch all these issues at build time. While…
Getting Zwift to run on Linux was a journey I started just over a year ago . I didn’t get very far with my effort, but since then a lot of progress has been made by the Wine developers and others in the community, and Zwift is now (mostly) playable on Linux. I’ll admit there are some workarounds required. Like having to use the Zwift companion app to connect sensors. But on the whole,…
Since the release of Helm 3, the official helm/charts repository has been deprecated in favour of Helm Hub . While it’s great for decentralization and the long term sustainability of the project, I think there’s a lot more that is lost. Where is the best place to go for of the expert advice now? Installing Helm now requires you to manually add each repository you use. And there’s…
Over the past year I’ve moved from working mainly in Java, to working mainly in C#. To be honest, Java and C# have more in common than not, but one of the major differences is async/await. It’s a really powerful tool if used correctly, but also a very quick way to shoot yourself in the foot. Asynchronous programming looks very similar to synchronous programming. However, there are some…
At CopenhagenJS in August I was able to share my work on Renovate —a universal dependency update tool—and how you can use it to save time and improve security in software projects. If you want to find out more about Renovate you can find us on GitHub . Watch on YouTube: "Automated Dependency Updates with Renovate"
Recently I discovered Hack The Box , an online platform to hone your cyber security skills by practising on vulnerable VMs. The first box I solved is called Access . In this blog post I’ll walk through how I solved it. If you don’t want any spoilers, look away now! Information gathering Let’s start with an nmap scan to see what services are running on the box. 1 # nmap -n -v -Pn…
Have you ever tweeted out a hastag, and discovered a small image attached to the side of it? It could be for #StPatricksDay , #MarchForOurLives , or whatever #白白白白白白白白白白 is meant to be. These are hashflags. A hashflag, sometimes called Twitter emoji, is a small image that appears after a #hashtag for special events. They are not regular emoji, and you can only use them on the Twitter website, or…
In part one of this article, I collected robots.txt from the top 1 million sites on the web. In this article I’m going to do some analysis, and see if there’s anything interesting to find from all the files I’ve collected. First we’ll start with some setup. 1 % matplotlib inline 2 3 import pandas as pd 4 import numpy as np 5 import glob 6 import os 7 import matplotlib Next…
After reading CollinMorris’s analysis of favicons of the top 1 million sites on the web, I thought it would be interesting to do the same for other common parts of websites that often get overlooked. The robots.txt file is a plain text file found at on most websites which communicates information to web crawlers and spiders about how to scan a website.. For example, here’s an excerpt…
Late last year I set about building a new NAS to replace my aging HP ProLiant MicroServer N36L (though that’s a story for a different post). I decided to go with unRAID as my OS, over FreeNAS that I’d been running previously, mostly due to the simpler configuration, ease of expanding an array, and support for Docker and KVM. Docker support makes it a lot easier to run some of the web…
I recently saw an article on /r/programming called Do you really want “bank grade” security in your SSL? Here’s how Aussie banks fare . The author used the Qualys SSL Labs test to determine how good Aussie banks’ SSL implementations really are. I thought the article was great, and gave good, actionable feedback. At the time of writing this two of the banks listed have…
I’ve been thinking about writing a blog for a while now, but there are just so many blogging platforms out there to choose from. I finally settled on Jekyll as it’s really lightweight (compared to platforms like Wordpress), it has an active development community, and you can write all your articles in Markdown. Many Jekyll users host their Jekyll sites through GitHub Pages, and there…
I’m a principal software engineer at Microsoft focusing on open source software and supply chain security. You can find me hanging out in the OpenSSF or working on Renovate in my spare time. This site is my online home for all things code, or otherwise… …but mainly code.