>> The Log4j Vulnerability along with my favorite things of 2021
including a great VSCode extension you
don't want to miss this week on the Download.
>> [MUSIC].
>> Welcome back to another episode of
the Download I'm your host Christina Warren,
Senior Cloud Advocate at Microsoft.
Since this is our final episode of 2021 I had
to read my Taylor Swift merged to say farewell in style.
This episode is going to be a little bit
different rather than recapping the news of the week I
wanted to share some of my favorite projects news
and announcements from 2021.
A year that I think we can all agree was a little bit challenging.
But before we get into that I
did want to lead off with a little bit of
real news because this is extensively what we do here.
First up real quick,
I just want to make comments about
the ongoing long Log4Shell vulnerabilities.
It's a debacle catastrophe disaster you know what,
whatever adjective you want to use it is bad.
Log4j is
an incredibly popular and ubiquitous logging framework for Java.
It's used in countless projects and
runs probably tens of millions of web servers.
On December 9th a zero-day vulnerability was disclosed in
Log4j that's really bad, real bad.
Basically it takes advantage of a feature in Log4j and it allows
requests to arbitrary held up in
GD&I servers without checking for responses.
This can allow attackers to execute arbitrary Java code on
a server or another computer or to leak sensitive information.
It was first discovered in Minecraft servers of
all places but it's spread to services across the globe.
There's been a number of patches to
the vulnerability and then patches to those patches but the TLDR
is that you need to check your projects and update
your servers in the event that you are vulnerable
because attackers are taking advantage of this already
with ransomware and malware and worse.
I've got links in the show notes and the description to
some excellent Log4shell resources from Luna sec
and some other resources out on the Internet as well.
GitHub has actually posted
some tools and information about how you can use
its security tools to identify Log4j exposure in your codebases.
The official Microsoft Security blogs have some resources too
as well as a WAF definitions list for the Azure Firewall.
Again I've got links in the show notes and the description.
Be vigilant check your code and patch.
Enough of nightmares let's get to
some fun stuff aka my favorite things of 2021.
First up, first thing I wanted to talk about
this year was GitHub Copilot.
GitHub Copilot which is still in
private preview but you can sign up should be let in is
an amazing new VSCode extension that takes advantage of GPT3 which
is a very impressive AI algorithm to
basically help you write your code, it's magic.
The way that this works is basically it's scanned a bunch of
code repositories and it learns
the next thing you might want to write in your code.
It's a really good place to start things out.
If you're like me and you've ever spent a lot of time using
StackOverflow and other tools
in Google while you're trying to code,
this is a resource that is really going to come in handy.
It's really impressive,
the way that I've seen it automatically insert
various functions when I'm trying to write something new.
It's been really impressive, it's improving all the time.
I'm really impressed with what the Copilot team is doing,
that is a huge thing.
GitHub Copilot is definitely one of my first picks of the year.
Next up, I wanted to talk about Hippo which
is the WebAssembly pass or Platform as a Service.
Our friends in Deus labs introduced
a really great new project this year and it is called Hippo.
As I said it is a WebAssembly pass.
Hippo is an open source platform
as a service and it's designed to make it
easier to deploy and manage applications
following modern Cloud need of best practices.
It includes capabilities for
building and deploying applications from source,
simple application configuration,
automatically deploying unrolling fact releases,
managing domain names,
fighting seamless edge routing,
log aggregation and sharing
applications with other teams and all of this is
exposed through a really beautiful web interface
and simple to use developer tooling.
It's available now to deploy locally and to
test things out and the code is obviously on GitHub.
As someone who's really excited by
WebAssembly and the capabilities there,
this is a really great use case of
the tech but it's also a really cool pass.
Huge fan contracts that they esteem.
Next up, I wanted to talk about
Windows 11 which was a massive release this year.
There were lots of great new features in
Windows 11 for users but also for developers.
There's the new WinSDK,
the new WinUI framework,
there's also some great new design
features the new fluent language just looks awesome.
The Microsoft Store has
actually really been improved meaning that you
can submit applications from
lots of different sources you can even
bring your own peanut processor,
a lot of the stuff is really good.
I also personally love some of
the new fonts as if there's some
some variable with fonts that are there.
It's really great Windows 11 is available now,
big fan so check
the links the show notes the description for more resources.
Next up, I wanted to talk about.Net6.
Now,.Net6 launched about six weeks ago,
we've talked a lot about it here on
the show that it is really worth mentioning.
It is a long-term servicing release which means that they
will have support for years into the future.
Then this is a big deal because this is
a big unification release of all the disparate parts of.
Net past one long-term service release.
It's a really big deal it also adds new features,
Hot Reload which has a lot of people really
excited and it's cross-platform obviously.
There's a lot of great stuff the.Net
Conf took place about a month and-a-half ago.
We'll have links in the show notes down below for that but.
Net6 is available now and it's great.
Next I want to talk about
the coolest extension that I saw all year.
This is from Microsoft MVP Ilio strophe
and it's called Front Matter.
It's a hetho CMS for static site generators like Hugo or
Gatsby [inaudible] it isn't a VSCode exception.
Basically you can manage your static sites
including page's posts media
whatever for really easy to use
dashboard experience inside VSCode.
You don't need to run an actual server you don't need to
manage the database you will just do it all on VSCode.
Is a great use of the tech I'm
really big fan and it's open source,
it's in the GitHub marketplace.
Ilio, thank you and congratulations.
This is one of the projects that I love and I
love to see people who doing things with.
Now it is time for my pick of the week year I guess whatever.
Longtime viewers of the show will know that
I'm a huge Taylor Switch fan clearly.
At Taylor Swift we
did not release any new music this year but she did
re-release two of her previous albums including Red,
which is the greatest album that she's ever released.
She did her own version of
re-recorded as well as some vault tracks.
There's a 10 minute version of all to well.
It's the best genuinely and so Christina's version pick
of the year is Taylor Swift's.
I love that.
Well that does it for me for
this episode the Download and for this year.
Let me know your favorite things that you saw in 2021,
whether I mentioned them or not in the comments
down below and also let me know what you thought of my pics.
If you hate Taylor Swift that's
completely okay but just let me know.
If you like this video go and give us a
like on YouTube because it really does help.
I would say give us a but no one can see
the counter anymore so it doesn't do anything.
If you want more nerd content
subscribe to Microsoft Developer for all of your needs.
We will see you next time have a safe and happy end
of the year and happy 2022. See you next time.
>> [MUSIC]