/tags/development/ Recent content in Development on scarbrough.co.uk Hugo en-us Tue, 21 Jul 2026 00:00:00 +0000 /post/reworking-azure-function-apps/ Tue, 21 Jul 2026 00:00:00 +0000 /post/reworking-azure-function-apps/ It seemed like a strange request, when a colleague asked me to look into upgrading our Function Apps to use .NET 10, ‘isolated worker’. Since when was it possible to change their runtime version ourselves? And what on God’s Green Earth was an ‘isolated worker’? It was time to investigate. There are a couple of important things to remember about Function Apps, as a starting point. Firstly, my colleagues and I had developed Function Apps exclusively as custom Logic App components, to handle more cumbersome data transforms. /post/vim-developer-environment/ Mon, 11 May 2026 00:00:00 +0000 /post/vim-developer-environment/ In the last post, I covered some very basic stuff for editing text in Vim. There are a few more advanced features I picked up while using it as an actual code editor. Basic keybindings Use ‘Esc’ key to enter visual mode. Select text, use ‘v’ and ‘Ctrl+Right’ Cut text: ‘d’ Copy text: ‘y’ Paste text: ‘p’ Line numbers Either use the :set number command, or add it to /etc/vim/vimrc. /post/going-back-to-vim/ Sun, 10 May 2026 00:00:00 +0000 /post/going-back-to-vim/ Microsoft earned itself the rather descriptive name ‘Microslop’ in recent months, on account of having infested virtually all its products with ‘AI’/Co-Pilot stuff that nobody asked for and few want. It’s especially insidious and invasive enough in Windows 11 that one shouldn’t expect any privacy when using it. Visual Studio Code was a decent editor that I’d been using since Atom got deprecated. Now it’s primarily an ‘open source AI code editor’, its official Web site declares. /post/going-full-indyweb/ Wed, 17 Dec 2025 00:00:00 +0000 /post/going-full-indyweb/ Although Substack was never designed to be just a newsletter service for something else, it can be pretty useful for that. I’ve been increasingly less inclined to use it since it became more of a ‘social’ media platform, with certain authors being promoted by The Algorithm. What really did it for me, though, was an email sent to authors the other week, which stated: ‘Substack is introducing age verification steps for those in the UK. /post/development/generative-technical-debt/ Thu, 20 Nov 2025 00:00:00 +0000 /post/development/generative-technical-debt/ I’m somewhat in agreement with the first half of Jamie Lord’s post on Nearly Right (Engineering leaders demand systems design skills as AI coding assistants produce mounting technical debt), and Jason Gorman made a good point about unreadable code being a form of technical debt (he coined the term ‘codemanship’, which I’m going to borrow). In my opinion, ‘AI’ generated code absolutely should not find its way into the codebase of critical software, unchecked, regardless of what some bastardised implementation of Agile might demand. /post/development/sql-server-file-recovery/ Sat, 08 Nov 2025 00:00:00 +0000 /post/development/sql-server-file-recovery/ Someone wanted files retrieved from a legacy database export. In this case, they were Word documents and PDFs stored as hex strings in an IMAGE column. The hex strings, of course, are representations of the bytes that make up the files. Now, there is a way of recovering files from this, using a native stored procedure, but I didn’t have admin-level access to this particular database. I also couldn’t use the online conversion sites, as the data was too sensitive. /post/development/low-code-the-way-forward/ Wed, 08 Oct 2025 00:00:00 +0000 /post/development/low-code-the-way-forward/ I’ve worked with several ’low code’ platforms in recent years. Some are better than others, but I’m always asking one question: What problems are they supposed to solve? The biggest of them is ’technical debt’. Dependencies become outdated and unmaintained, updates sometimes have breaking changes that require code to be reworked, additional code gets tacked on over the years by various people, amateur code makes that harder, etc. Technical debt might be an inevitability for an organisation that’s been developing software in-house for long enough. /post/development/project-loading-anypoint-studio/ Wed, 16 Jul 2025 00:00:00 +0000 /post/development/project-loading-anypoint-studio/ Typically I find that some troubleshooting and configuration is required to get an imported project to a state where it builds and the unit tests run, and the reasons usually aren’t obvious. Importing a project Most Mulesoft developers would have made the mistake, at least once, of trying to import a project using one of the options under the ‘General’ section, as that’s the first displayed in the import options window. /post/development/mulesoft-api-paging/ Fri, 28 Feb 2025 00:00:00 +0000 /post/development/mulesoft-api-paging/ Recently I’d been developing a Mulesoft application that uses another as a source API. The response from the source API looks something like this: { "nextLink": "https://server:port/external-api/endpoint?page=1", "nextOffset": 1000, "morePages": true, "totalRows": 12345, "totalPages": 13, "results": [ {...} ] } There are a few things that could potentially be used for paging the response data. As a .NET engineer, I would have approached it by using a While or Until loop on ‘morePages: true’, used the nextLink URI and appended the response payload to a typed list. /post/first-post-of-2025/ Wed, 26 Feb 2025 00:00:00 +0000 /post/first-post-of-2025/ After a very busy and difficult couple of months, the system I’d been working on is about to go live to ~27,000 users, and I’m feeling slightly pleased with myself. What should have been a simple integration morphed into a complex Mulesoft project. What a learning curve that was! The following is my experience with Mulesoft so far. I think the one advantage Mulesoft has over other platforms - and maybe its selling point - is that the Anypoint portal provides us with a single place from which numerous integrations, API specifications and deployment environments can be managed. /post/security/mulesoft-oauth/ Tue, 05 Nov 2024 00:00:00 +0000 /post/security/mulesoft-oauth/ Getting software to work with OAuth is usually one of the easiest things a developer could be tasked with, if s/hehas done it a few times: Create an HTTP client method that sends four values to an OAuth provider, then pass the response to the next HTTP client method as a variable to be used in the Authorization header. Doing that in Anypoint Studio, for a Mulesoft application, was an uphill struggle of resolving one error message after another. /post/development/azure-logic-app-thread-safety/ Wed, 18 Sep 2024 00:00:00 +0000 /post/development/azure-logic-app-thread-safety/ After resolving the previous issue with the Content-Type defect in the Azure Logic App’s storage connector, I ran into a second problem: The Web pages being generated were populated with the correct content type, but the incorrect content. I quickly discovered that was partly caused by a race condition and with how memory is managed by Azure. By default, a Logic App will run up to twenty instances of a ‘For Each’ loop in parallel, but this is multi-threading instead of true parallel processing. /post/development/azure-content-type-bug/ Tue, 17 Sep 2024 00:00:00 +0000 /post/development/azure-content-type-bug/ One of our Logic Apps, which we developed as a static site generator, began writing the Web pages to the storage account as octet stream files, and I narrowed down the problem to a defect in the storage account connector. I believe (but I’m not 100% certain yet) Microsoft’s developers hadn’t implemented the ‘"headers": {"Content-Type": "text/html"}’ code for the storage account connectors, and the file type, therefore, always defaults to octet stream. /post/development/agile-and-innovation/ Sat, 17 Aug 2024 00:00:00 +0000 /post/development/agile-and-innovation/ One of the central claims made by Moxie Marlinspike, during his discussion at the Black Hat conference appears nonsensical, because he referred to two entirely different meanings of ‘abstraction’, and was thus comparing two entirely different things: ‘We spent the past 20 years onboarding people into software by putting them into black box abstraction layers, and then putting them into organizations composed of black box abstraction layers, […] Marlinspike posited that security researchers, who routinely probe beneath surface-level abstractions, are better positioned to drive innovation in software development. /post/senior-position/ Sat, 16 Mar 2024 00:00:00 +0000 /post/senior-position/ Something unexpected happened this week: I was offered my first senior engineer position. I’ll be focussed mainly on the project management and planning side of things, and I’m being encouraged to delegate the software development work. I’m still prepared to get my hands dirty with the coding and systems administration, if anyone gets stuck on a tricky problem, and I’ll likely be working on a couple of .NET applications as personal projects. /post/security/authenticating-requests-to-logic-app/ Thu, 22 Feb 2024 00:00:00 +0000 /post/security/authenticating-requests-to-logic-app/ One of my Logic Apps originally had just three steps: HTTP trigger Deserialise HTTP request JSON payload Send objects from the request payload to a Service Bus queue Another Logic App would read the objects from the Service Bus queue, use them to query another source for data, then send a email to whatever address was in the initial request. I used this approach because there could be more requests than a Logic App can handle concurrently, and it made sense, therefore, to queue the requests. /post/security/authenticating-api-requests-azure/ Sat, 09 Dec 2023 00:00:00 +0000 /post/security/authenticating-api-requests-azure/ One way to help understand how Active Directory, App Registrations, managed identities and Key Vaults work in Microsoft Azure is to look at a typical Logic App that authenticates itself with an API that provides data only to services registered with the organisation’s Active Directory. The basic sequence for the authentication part of the Logic App here is this: Get a password from an Azure Key Vault. Get an OAuth token for the Logic App from Active Directory. /post/security/azure-key-vault-security/ Sun, 17 Sep 2023 00:00:00 +0000 /post/security/azure-key-vault-security/ Azure Key Vault is designed to store (and protect) secrets such as API keys, passwords, cryptographic keys, connection strings, etc. It can store the following categories of data: Keys Certificates Secrets The Secrets storage can store arbitrary plaintext values, so Key Vault could potentially be used as a means of centrally managing a collection of usernames and passwords that could be copied and pasted straight from the Azure Portal. Is this a safe method of password management, though? /post/development/power-bi-report-builder/ Tue, 12 Sep 2023 00:00:00 +0000 /post/development/power-bi-report-builder/ My brief encounter with Power BI began after one of the project managers had the idea of using Power BI Report Builder as a means for generating archived versions of what’s displayed on a site I developed not long ago, because he wanted a PDF export feature for that. ‘Why not just copy a couple of the API methods and add a PDF converter to them?’, I wondered, with the feeling I’d end up needing to do that anyway. /post/development/microsoft-graph/ Wed, 03 May 2023 00:00:00 +0000 /post/development/microsoft-graph/ Recently I was tasked with implementing role-based security for a .NET API, based on the Active Directory groups the user is a member of. Easy, I thought initially, as there’s a well-documented way of doing this by adding [Authorize] annotations to controller methods. The first problem I ran into was the API was designed to be used by a Node.js/React application. In this case (and this is a simplified description), users obviously don’t authenticate themselves directly with the API, but instead with the React application, via Active Directory Single Sign-On. /post/development/coding-principles/ Sat, 29 Apr 2023 00:00:00 +0000 /post/development/coding-principles/ Notes initially published on my Bear Blog site. A decade of software development and engineering taught me there are two design principles that I’d argue are more important than any particular pattern or design approach: Code should be readable and self-explanatory. Each function or method (I use these terms interchangeably) should have a single, well-defined purpose. Code should be readable Programming languages are designed to provide human-readable abstractions of software, and, as such, code should be intelligible and relatively easy to work with. /post/development/hugo-and-mainroad/ Sat, 01 Oct 2022 00:00:00 +0000 /post/development/hugo-and-mainroad/ I think I’ve found the ideal theme for my Hugo site. Mainroad is relatively simple in design, the layout is roughly what I was looking for, and it’s easier to customise. It still has tags and categories features that are essential for a site hosting technical documentation. I spent around six hours learning how the template works, re-arranging the content and tweaking the CSS to make it as clean as my MkDocs site.