What you don’t know can hurt you, especially when it comes to code. Dependency chains can tend to have more security considerations than most people realize. In fact, most dependencies have far more abilities than most developers realize …

I previously mentioned that it’s possible to force a release build to act like a debug build. To do this, we need to understand how .NET knows when to treat an assembly as a debug build or a release build (hint: it’s not the AssemblyConfiguration attribute!). We also need to understand the options that the runtime provides for overriding the default settings. Time to explore how that process is implemented and the configuration options available for overriding those settings.

A few weeks ago I went in for some simple tests as we tried to uncover the root cause of a sudden heartburn. With each test I took, we discovered that my condition was substantially worse than it seemed. I was running out of time quickly, and the doctors had to act fast.

If you’re not completely sure about the differences between Debug and Release builds in .NET, you’re not alone. Like PDBs, there’s lots of myths and half-true stories coloring our views. Most developers know that they use debug builds when they are creating code. But what is .NET really doing that’s so different? They know they should use release builds for production, but they don’t necessarily understand why. Think the code is better optimized by the compiler? That’s not entirely true (or at least it’s not true if we’re speaking about Roslyn or MSBuild). This post will explore what’s happening under the covers with Roslyn and the just-in-time (JIT) compiler.

In part three of our discussion of PDBs and debugging, we explore an improvement to the debugging experience: SourceLink. Instead of using the symbol server tools to source index our PDBs, we can use an open source, standardized approach to map our symbols back to the files in source control that were used to build our binaries.