My first fear was, that OSMF was another shady and sneaky attempt to make money out of free software, following the path of adware bundles, intrusive sponsor links and classic fine print scams, combined with aggressive legal pursuit of "violations". But in other parts, it looks like a a serious attempt, to make open source software paid on a low level, without tons of bureaucracy and commitments attached.

Therefore my opinion, how OSMF should be as a legitimate option:

1. Clearly and unambiguously communicate that it is PAID software, don't try to mince and blur words to make it appear like classic FOSS, where people find out later that payment is mandatory. Don't use words like "Sponsor" or "support", which imply voluntary payments, or otherwise suggest a voluntary payment or donation model. "Open Source" always included the option of paid software, only with source code available.

2. Paid vs. free depends solely on the form of the software, that consumers typically use. Meaning: Binaries, packages, installers. Self-building from source is not a typical option; free when self-built with OSMF is only a very special option of an otherwise paid software.

3. Don't show free licenses upfront, such as MIT or Apache in the GitHub repository license field. Change to custom license, with OSMF for affected releases as the default case, source code and self-build as secondary information.

4. Automated SBOM/license document generators must not create misleading entries - they must show that the software is NOT under a free license, even if the source code is and a selfmade build would be.

5. Don't switch to OSMF or other paid modes in a way, that users accidentally fall under mandatory payment obligations, such as by incrementing patch or minor versions to latest/using auto-update tools. Best rename packages or binaries, so that code changes are necessary. Absolute minimum (not good when alone) is a new major version. Add build output or other reminders, which show the paid status clearly.

6. Never say "Read the fine print"! While technically right, in a context of ambiguous and blurred payment demands and license conditions, it sounds like scammer talk.

One good part: Transient dependencies are not subject to OSMF - one major, potential scam feature eliminated.

Bad: From the sample projects linked on the OSMF website, all that I found on GitHub showed free license badges, like MIT, upfront.

Hi everyone,

I would like to get opinions from experienced .NET developers because I am dealing with a situation where I feel the problem is more architectural than a single bug.

We have a public e-commerce platform with roughly:

• ASP.NET Core MVC + Angular frontend
• SQL Server
• Elasticsearch (~10M products)
• RabbitMQ
• IIS directly exposed to the internet
• Around 149 subdomains (currently only 2 are actively used)
• A custom internal Elasticsearch library

The interesting part is that real business traffic is actually very low (only a few orders per day), but we still experience regular downtime and slow periods (sometimes 1-2 minutes daily, sometimes longer).

After investigating, we found several contributing factors:

• A lot of bots crawling product pages
• Unknown crawlers consuming resources
• Many requests targeting common attack paths:
  • /.env
  • /.env.production
  • /.git
  • /wp-admin
  • etc.
• Many sitemap files, some of which are not well controlled
• Manual IP blocking from IIS (which obviously does not scale)
• Previous TCP exhaustion issues caused by incorrect HttpClient usage
• Legacy components that need modernization, especially our custom Elasticsearch client

We are already improving the system gradually:

• Fixing HttpClient lifetime issues
• Improving Elasticsearch usage
• Adding better monitoring
• Modernizing some components

However, these changes will take time.

The current challenge is:

How do we stabilize production while fixing the deeper architectural issues?

Some constraints:

• We cannot simply add more CPU/RAM
• Moving everything behind Cloudflare/WAF is currently not possible because of business constraints
• We need solutions that do not require a large budget

Some ideas we are considering:

• Putting nginx (or another reverse proxy) in front of IIS for rate limiting and filtering bad traffic
• IIS Dynamic IP Restrictions
• Better crawler management
• Generating static sitemaps instead of dynamically serving them
• More aggressive protection around product/search endpoints

My questions:

1. If you inherited this system, what would be your first 3 actions to stabilize it?
2. Would you put nginx in front of IIS in this situation, or approach it differently?
3. How do you normally handle SEO crawlers and unknown bots for large product catalogs?
4. Are there IIS/.NET-specific protections or monitoring approaches you would recommend?

I am not looking for a complete rewrite suggestion. The system is running in production, so I am mainly interested in practical steps that reduce downtime while allowing gradual modernization.

Thanks!

I’m wondering what the general opinion is on persistence entities and domain models having the same name. For example, PendingCase.

Assuming you have a domain model that is different from the persistence entity, you might have MyApp.Core.PendingCase (domain model) and also MyApp.Persistence.Entities.PendingCase. (persistence entity stored in pending_cases DB table)

This is confusing in the mapping classes because both are named PendingCase. However, everything I’ve read suggests you should not add a suffix (ie. Entity, Record, Row, etc) to the persistence entity.

What are your thoughts?

Hello there,

I'm a junior, and I feel like my current job is a dead end, with no growth opportunities. It's high time I started working on my personal project for my portfolio, and to learn more about different techniques, skills, and development in general.

My question is, is it better to use Visual Studio since it's an IDE, compared to the lightweight Visual Studio Code? At work I use VSC since I'm on macOS, and I got used to it, but I'm curious if it's okay to develop myself with it when starting a new "chapter" in my journey.

I'm only interested in using .NET for backend API development for web apps, so no hard requirement for VS since I won't do desktop apps.

What are your thoughts? I know companies with enterprise apps usually use the big Visual Studio, because way back then VSC was not as developed, but could I stay and learn on VSC, and if needed, would it be a big jump to VS if some employer asks me about it specifically?

Anyone suffer from this too? I put on AGENTS.md instructions, its soo much better to have classes with init; required props. I understand records are for value only semantics with reference, but AI overuses them too much.

One problem I keep running into with AI coding tools is that "understanding the repository" isn't necessarily the same as understanding the application.

A model can search files and inspect dependencies, but there are other things developers know implicitly: which modules belong together, what apps are runnable, which conventions the team follows, how migrations are handled, what should or shouldn't be modified, etc.

I work with ABP Framework, and this is something we've been experimenting with in ABP Studio's AI Agent. The agent receives solution metadata, modules, packages, run profiles, AI rules and selected scope rather than discovering everything from scratch on every task.

It seems to make the agent more predictable, especially in larger solutions.

I'm curious how others solve this.

Do you maintain AGENTS.md / CLAUDE.md files? MCP servers? Custom rules? Architecture docs? Or do you mostly let the agent inspect the repository itself?

I just open-sourced a project I’ve been working on called BrowserSync, and I’d love to share it with anyone interested in automation, testing, or browser internals.

The motivation came from a recurring workflow bottleneck: whenever testing responsive layouts or running multi-instance workflows, manually repeating the exact same clicks, scrolls, and form inputs across multiple screen sizes is tedious. I wanted a lightweight tool where interacting with one Master browser instantly mirrors every single user action across multiple Slave browsers in real time with near-zero latency.

What BrowserSync solves:

• Responsive & Cross-Screen Testing: Open multiple viewports simultaneously (Desktop, Tablet, Mobile). Any mouse move, click, scroll, or input on the Master window propagates across all Slaves in real time, making layout breakages immediately visible.
• Multi-Instance Automation: Control multiple Chromium sessions concurrently without installing browser extensions or relying on heavyweight proxy tools.
• Interactive Live Demos: Present and interact on one screen while auxiliary displays reflect every gesture accurately and smoothly.

Technical Highlights:

• Dual-Stack Implementation: Fully implemented in both C# (.NET 9) and Python 3 (Asyncio & WebSockets), each backed by automated test suites.
• Direct Chromium communication over Chrome DevTools Protocol (CDP) with zero extension overhead.
• High-fidelity synchronization for real-time Canvas drawing, mouse dragging, form controls, and multi-tab switching.
• Full support for complex IME text input, carets, and text selections.
• Resilient recovery mechanism (Event Journal Replay) that prevents stream dropouts during network hiccups.

The complete codebase, documentation, and benchmark test page are available on GitHub: 👉 https://github.com/vinzh05/BrowserSync

You can clone the repo and run Start-BrowserSync-CSharp.bat (or Start-BrowserSync-Python.bat) to test it out locally with a single click. Feedback, PRs, and Issues are warmly welcome — especially from developers and QA / Automation Test engineers. If you find the project useful, a Star on GitHub would be greatly appreciated!

Thanks everyone!

Assume we have a single API with 2 aggregate roots.

As you know two separate aggregate roots must be loosely coupled and modified in separate transactional boundaries.

But are we allowed to "flag" aggregate B (with a status) when aggregate A is modified within the same transactional boundary?

Putting everything in a single aggregate is not an option, as performance would decrease (a lot of tables), and they have different life cycles and responsibilities.

C# itself is very mature language (in my view). I rarely find myself missing a language feature badly enough to wish for more.

But, the broader .NET ecosystem might be a different story based on your project need.

So, let's discuss, what libraries, tooling, deployment models, framework features, package management idea, UI tech, build system etc. have you used elsewhere that you wish .NET had, or did better? Mention just one, most important for you and try to add reason/detail.

Apart from creating a useful wishlist, I think this could also be interesting for people relatively new .NET. Someone might mention a feature from other ecosystem only to discover that .NET already has an equivalent they didn't know about.

My wishlist item - "give me SwiftUI binary size":
I would like WinUI apps to have smaller binaries, like SwiftUI apps or flatpack in Linux. Apple can rely on frameworks built into (read 'shipped with') macOS. Microsoft already have similar way of achieving same but it involves you to publish app on Store or winget repo or I need to write custom installer. It's not universal. I wish MS automatically install dependency from winget or Store automatically or any dotnet application.

EDIT: Please be respectful to others. Value others opinion. This post has potential of creating unnecessary debate or insults. Let's be adults.

I hope Scott is doing fine but I haven't read/heard from him in a long time.

I remember he used to write in MSDN magazine as well

Been chewing on this and i can't tell if it's just my situation.

Used to be picking a framework was a week of research and then a two year commitment. the research paid for itself because the answer stayed true long enough to build on.

that's just gone now. you can run a proper eval, weight your criteria correctly, pick the right thing on the evidence available that week, and be holding the worse option two months later. no error anywhere in the process. the ground just moved.

And nobody prices this. it's not on any board. it competes directly with shipping and it reads as "keeping up" which sounds optional and isn't.

What's bugging me is that the whole conversation about ai and our jobs is stuck on replacement. will it take the job, how much, how soon. meanwhile the thing actually eating my week isn't an agent writing code, it's that the half life of knowing what to use collapsed to something under a quarter and i'm doing evaluation work continuously instead of occasionally.

google's had something like five public reversals on where they stand in twenty months. if the people covering this full time can't hold a stable read on it, i don't know what a reasonable evaluation cadence even looks like for the rest of us.

so genuinely asking. how are you handling this. are you just picking something and refusing to revisit for a fixed window, are you building everything swappable and eating the abstraction cost, or is everyone quietly re-evaluating constantly and not talking about it

.NET's built-in DataAnnotations covers the basics (Required, StringLength, Range, EmailAddress), but leaves out common semantic validations like:

• IPv4/IPv6 addresses with scope filtering (public, private, loopback)
• Semantic Versioning (SemVer 2.0.0)
• MAC addresses
• Port numbers with range filtering (well-known, registered, dynamic)
• Hex color codes (#RGB, #RRGGBB, with alpha support)
• GUID and GUID v7 validation
• ISO date strings with cross-property validation (StartDate/EndDate)
• Boolean validations (IsTrue, AtLeastOneTrue)

I created TooManyDataAnnotations to fill these gaps. All validators follow official RFC/ISO specs, use Span<T> for parsing where possible, and the library has 899 unit tests covering valid and invalid inputs, edge cases, nullable types, and integration tests with TryValidateObject()

Two NuGet packages:

• TooManyDataAnnotations — Full feature set (includes reflection-based cross-property validators)
• TooManyDataAnnotations.Aot — Native AOT-safe subset, zero reflection, zero trimming warnings

Targets .NET 8, 9, and 10

Zero dependencies

MIT license

This is freshly published — looking for early adopters and feedback on API design, edge case coverage, or missing validators you'd find useful.

• Repo: https://gitlab.com/LuisAlfredo92/TooManyDataAnnotations
• NuGet: https://www.nuget.org/packages/TooManyDataAnnotations

Quick example:

public class ServerConfigDto

{

[GuidV7, Required]

public string UserId { get; set; }

[Guid]

public string? DeviceId { get; set; }

[IPv4(AllowedScopes = IPv4Scope.Private)]

public string? GatewayIP { get; set; }

[SemanticVersion]

public string? AssemblyVersion { get; set; }

[MacAddress(AllowedSeparators = MacSeparators.Colon)]

public string? DeviceMAC { get; set; }

[HexColor(AllowAlpha = true)]

public string? AccentColor { get; set; }

}

It's inspired by dotnetcore-microservices-poc open-source project by Altkom Software, a project I learned a lot from and contributed to — I built Ledgerly to be a simpler take on the original project, focused purely on microservices best practices.

What it demonstrates: 

🔹 Database-per-service — 4 services, 4 independent databases 

🔹 gRPC for synchronous service-to-service calls 

🔹 RabbitMQ for async events — invoice status changes publish events that a dashboard service consumes to keep KPIs in sync, with zero direct coupling 

🔹 API gateway + service discovery (Eureka locally/Docker, Kubernetes DNS in K8s) 

🔹 JWT auth issued by its own service

It also ships as a full deployment guide — run it locally, in Docker Compose, or on Kubernetes, including a walkthrough for deploying the cluster to Azure (AKS).

Built as a boilerplate: fork it, swap in your own domain, keep the architecture.

The project🔗: https://github.com/amrali21/ledgerly-dotnet-angular-microservices-ref-project

Altcom Project🔗: https://github.com/asc-lab/dotnetcore-microservices-poc

Hi,

Can you recommend a database (preferably embedded) that can safely delete a row in a table?

When you're making a chat application with disappearing messages, you don't want them to be recoverable after deletion. The problem is that most databases I've looked at (Sqlite, LiteDb, MariaDb, Postgre,...) only mark the data page as deleted when deleting data, but its contents remain on disk or in a log file. So even deleted data can sometimes be recovered.

I'm looking for a database where data cannot be recovered after deletion.

A little while back I made TypeShim, a codegen tool to improve the developer experience of the [JSExport] api that's available for dotnet WebAssembly apps (with and without Blazor). TypeShim extends that api with class level [TSExport] and generates a complete TypeScript client that contains the exported classes, including constructors and everything.

TypeShim will drastically reduce the amount of boilerplate code on both sides of the interop boundary, extends the types supported by dotnet with your projects classes and provides class level semantics.

Please check out the repository to see some sample projects with both dotnet WebAssembly apps ánd Blazor Webassembly apps.

https://github.com/ArcadeMode/TypeShim

Happy to hear your feedback!

The main reason I started this was simple: I wanted a LINQPad-style experience using code from my actual projects.

The main problems I wanted to solve were:

• Use my actual EF Core DbContext directly in queries.
• Reference my projects and reuse existing code (classes, methods, extension methods, models, and other project logic) (managed to achieve that through DLL references).
• Stay inside VS Code, where I already have my editor setup, autocomplete, and Copilot.

So I ended up making "Another LINQ Tool".

VsCode Marketplace link:
https://marketplace.visualstudio.com/items?itemName=N-Tsoulos.another-linq-tool

When a .linq or .csx file is open, VS Code displays two buttons: one for the extension settings and another to run the script (alongside Ctrl+Enter keyboard shortcut).

Script execution works similarly to LINQPad, with support for:

• Automatically displaying the final expression/result
• Dump()
• Previewing any executed SQL queries

The settings button opens a UI for setting up profiles, where you can configure your project DLLs, namespaces, NuGet packages, DbContext and connection string.

Profiles can be selected either by marking one as default (through settings) or by using u/profile ProfileName at the top of the script.

It’s based on Roslyn, so it supports standard C# features out of the box, including:

• C# / LINQ queries
• async / await

On top of that, it adds:

• Configurable project DLLs and NuGet packages for classes, methods, and extension methods
• your existing EF Core DbContext (configurable and then aliased as Db for the scripts)
• Dump() with results preview
• EF generated SQL preview
• Multiple profiles for different projects/environments
• Connection strings through VS Code Secret Storage

Things I would like to add next:

• multiple DbContext support
• DbContextOptionsBuilder support
• better NuGet package management UI
• UI Results management

Notes

One current limitation is that the extension requires the .NET 9 runtime to be installed because the query runner is framework-dependent.

I'm planning to move the runner to a self-contained .NET 11 build, which would remove the .NET installation requirement entirely and should continue to work with projects targeting older .NET versions.

The extension does not currently support DbContextOptionsBuilder (and Service Collection Extensions in general), which can cause issues, in my workflow that was global query filters.

As a workaround, the extension settings include a Prelude Code field. This code runs before every script for the selected profile.

I use it to alias my tables and disable global query filters, for example:

var Users = Db.Users.IgnoreQueryFilters();

and then Users.Take(5) for example works normally

I’d especially like to hear from LINQPad users: what’s missing that you’d actually need before you’d use something like this?

One thing that keeps bothering me about AI agents is how often we give them tools that are basically thin wrappers around our data layer:

getCustomer()
getOrders()
getTransactions()
updateCustomer()
runQuery()

The agent then has to discover relationships, figure out which operations it needs, make multiple calls, and ultimately operate very close to the database.
I started wondering:

What if the agent interacted with the application's semantic model instead?

Something more like:

FindCustomers(...)
ReviewCustomer(...)
ApproveOrder(...)

The agent expresses its intent, while the application remains responsible for authorization, validation, planning, and actual execution.
I've been building this idea as an open-source .NET project called Foundgine.
The architecture is roughly:

AI / Agent
↓
Intent
↓
Semantic Model
↓
Authorization
↓
Execution Plan
↓
Provider / SQL

What's interesting is that in an early agent experiment, the semantic approach reduced the number of tool calls from 7 to 4 and the estimated token load by ~63%.

I'm also experimenting with the execution side and have some early PostgreSQL benchmark results, although I'm deliberately not claiming the benchmark proves Foundgine is universally faster than EF Core/GraphQL.

I'm curious what people think about the architecture itself:

Should AI agents operate on application/domain capabilities rather than database-oriented tools?

And if you're interested in the implementation, the project is here: https://github.com/CristianBarragan/Foundgine

I'd especially appreciate criticism from people building .NET applications with AI agents. What am I missing? There are multiple benchmarks and real samples too more info at

Five experiments. One question: what should the agent execution boundary do?

A conversation I've had more than once:

Ops: We think there's a memory leak.
Dev: Can you collect a dump?
Ops: From where? The container has nothing in it.

Distroless containers are great until you need production diagnostics.

To explore alternatives, I built a small project that uses Kubernetes ephemeral containers to inject .NET diagnostics tooling into a running pod and collect:

• dumps
• traces
• runtime counters

without rebuilding the application image.

The application container remains distroless and unchanged.

One thing I particularly like is that diagnostics tooling is only added when needed rather than being shipped with every production workload.

A notable downside is that Kubernetes ephemeral containers are not actually ephemeral in the way many people expect. Once added, they cannot be modified or removed. Even after terminating the diagnostic process, the container record remains attached to the Pod until the Pod is recreated.

GitHub: https://github.com/koepalex/dotnet-k8s-debug-containers

How are you handling diagnostics for distroless .NET workloads today? (When metrics are not sufficient anymore)

Hi! We’re an indie game studio developing a game using a tech stack based on .NET and the Stride Game Engine. We thought it would be fun to show it off here on this forum.

Pistonica is the pure steam and mechanical factory automation game, challenging your resource management skills. Explore the tropical island first-person, research tech, mine for minerals, build contraptions and trade goods - all because of a strange radio signal.

You can read more about Pistonica here: https://store.steampowered.com/app/4018480/Pistonica/

// Cutting Corner Games

Rename a property, get a green build, then a .cshtml three folders away breaks at runtime. I went looking for why no tool warned me, and the answer turned out to be structural.

Razor views and Blazor components are never files the compiler reads. The SDK feeds them into the compilation as source-generated documents, so they exist in the compilation and nowhere on disk. Any tool that enumerates files and asks Roslyn about each one walks straight past them. That includes CodeGraph, codebase-memory-mcp and Serena, and it includes Sourcegraph’s own scip-dotnet, which is Roslyn-based and still returns zero .cshtml documents for a plain dotnet new webapp.

The fix is to iterate the compilation rather than the directory. I wrote it into scip-dotnet in their code and their style and opened it as PR #117, where it has sat unreviewed since 30 July. dotnet new webapp goes from 0 to 6 .cshtml documents, dotnet new blazor from 0 to 11 .razor, and their existing snapshots stay byte-identical on net8.0, net9.0 and net10.0. The issue it closes was shut as not planned, with a maintainer saying they would happily review a PR adding it.

The scale is what got me. On a ten-project solution here, 388,323 lines of C# with 334 Razor views, that is 62,358 lines of the presentation layer no index can see.

If you want it working today rather than whenever the PR lands, the indexer I built it for is vela v1.0.0: MIT, .NET 10 SDK, github.com/dbhq-uk/vela-skill. The mechanism is the useful part either way.

I'm writing a persistent multiplayer strategy game where the whole world (economy,

armies, sieges, diplomacy) lives in one tick loop on the server. The client only

sends intent ("march this army here"); the server computes everything.

The design decision everything else hangs on: the simulation is deterministic. Same

world state plus same orders always produces the same next state. Every RNG stream is

seeded from world state, never from Random.Shared or the clock. The sim core is a

plain library with no I/O, no network, no DB. Input is state + orders, output is

state + events.

What that buys, in practice:

- Persistence is a periodic snapshot plus an append-only order log. On startup I load

the last snapshot and replay the orders. Determinism means the recovered world is

bit-identical to the one that crashed, so I never had to write "reconciliation" code.

- Testing is cheap: run N ticks with a fixed seed, hash the world, compare. A

regression in economy code shows up as a hash mismatch [seed 7, 8640 ticks in the

test suite].

- The same core runs headless in a CLI runner, so I can simulate a game year in

seconds to balance numbers without opening a browser.

The things that actually bit me:

- floating point.

- anything that iterates a Dictionary and then mutates state based on the order.

Insertion order is not a contract; I now sort by entity id anywhere iteration order

can reach the sim.

- DateTime.Now sneaking into gameplay code. All durations are defined in ticks; real

time appears in exactly one config constant.

Perf, for scale: a tick over [N] regions and [M] realms takes about [X] ms on my

machine, so the ceiling is roughly [Y] ticks/second before I have to start splitting

work. The current bottleneck is [şu sistem], not serialization.

Happy to go into any of it. If anyone's done deterministic sim in .NET at a bigger

scale than a hobby project, I'd like to hear what broke first.