I Need Coffee - Episode 219 - Weekly BC Review! (August 7, 2026)

1. Utah Trip & Home Maintenance (1,600+ miles / ~2,575 km)
   - Primary trigger: misbehaving sprinklers. Turned out to be a reset timer + unplugged wires; only one physical valve issue. Avoided digging 1-inch residential PVC.
   - Saw Tanya; worked from dining table, strategic planning, fresh cherries.
   - Temporary folding desk + daughter’s old IKEA chair at Airbnb proved uncomfortable → designing a sturdier, larger, closet-folding desk in SketchUp.
   - Utah “data center” upgrade: retired paint-bucket server rack; installed proper shelf/mounting plate. Also installed a clean two-zone radon abatement system (common in high-radon areas; excellent local install that preserves future basement finishing).
   - Family dinner at YGF Malatang (Chinese-style hot-pot buffet) after an 11-hour drive.

2. Marketing & SEO / AIO Progress (with Daniela)
   - Full-time marketing associate is driving accountability (“chop chop”).
   - Claude-drafted SEO + AIO project plan after scanning the site against best practices.
   - Key insight: modern SEO is mostly housekeeping (proper structure, meta tags, structured data) rather than keyword stuffing. Search engines already detect pricing but flag missing frequency (one-time / monthly / annual).
   - Set up Google Search Console and Bing Webmaster Tools; submitted sitemap.
   - Built monthly scorecard: 10 questions run across top AI search engines (Perplexity, Claude, Copilot, Gemini, GPT, etc.) and results matrixed.
   - Host presenting “Marketing Without a Marketing Team” (low-budget guerrilla approach that avoids ~$60k cash outlay) at Partner Vibe 2.0.

3. Azure Artifact Signing
   - Organization identity verification finally approved after 14 calendar days.
   - Certificate profiles are ephemeral (create → use once → expire in ~3 days), similar to Let’s Encrypt model.
   - $10/month; strongly recommended for anyone in US / Canada / UK / EU who needs code signing. Cleaner and far cheaper than traditional providers.

4. Business Central Web API Key Incident (Security)
   - Third party was given BC web API keys / app registration credentials with essentially zero security practices (keys at high risk of exposure to crawlers/bots).
   - Host treated it as a cybersecurity incident, pushed the partner to inform the customer, revoke keys, and delete the app registration.
   - Creating a formal incident report + standardized Web API Authorization form (customer + third party must sign; security procedures required before keys are issued).
   - Blog post published: “Reducing the risk of Business Central web API secrets through education” (includes the form and process).
   - Goal: document everything so the host cannot later be accused of negligence for failing to escalate.

5. Azure DevOps Quirk
   - Variable groups linked to Key Vault stopped working in one old project.
   - Root cause buried deep in Azure Resource Manager service connections at the project level. “Rotate secret” instantly fixed it. Reminder that Azure DevOps still has obscure corners.

6. Internal Tooling – Blue Dragonfly Bulk Data Import
   - Consulting team exhausted by Configuration Packages (slow, error-prone, painful corrections) and only partially satisfied with Insight Works power tool.
   - Decision: build an in-house general-journal-focused bulk import utility (will expand to master data, fixed assets, etc.).
   - Claude produced a combined ~14-page FRD/PRD. Franklin to vibe-code v1 once feedback arrives.
   - Classic “reinventing the wheel” calculus has flipped in the AI era: low cost to try building something better tailored to exact needs.

7. Claude Language Degradation / AI Slop
   - Extended rant on current Claude output: dense, unnatural phrases (“ground truth loadbearing first-class feedback-instrumented auto-enriched permissions posture,” “dormant schema,” “seed-free graceful degradation,” etc.).
   - Non-native English speakers often find it completely opaque; some others claim it “makes sense.”
   - Explanation circulating (Kungchen / Guidedon): shift from RLHF (human preference) to RLVR (Reinforcement Learning with Verifiable Rewards). Models are optimized for verifiable correctness by other models and are actually penalized for human-likable language (“alignment tax”).
   - Growing discussion that agents may develop an internal language subset separate from human-facing output.
   - Real-world example: public PR from a multi-billion-dollar software company full of unreadable AI-generated text that no human appears to have reviewed.

8. Entra ID / MFA Neglect
   - Partner still using SMS/voice verification (Microsoft has been pushing to disable this since before Sept 2025).
   - Microsoft blocks SMS and voice MFA to El Salvador numbers by default.
   - Passkeys become the default experience; Microsoft-provided SMS/voice authentication retires 1 Feb 2027.
   - Red flag on the partner’s overall security hygiene.

9. Other Observations
   - GitHub relative dates (“two weeks ago”) instead of actual timestamps remain terrible UX (must hover to see the real date).
   - Context switching across multiple Claude sessions / projects is still cognitively expensive.
   - Hand-coding is increasingly “supervising” AI-generated change requests and development plans.
   - People regularly burning through $200/month Claude Max plans are almost certainly using tokens inefficiently; deterministic scripts + smaller models (Haiku etc.) should handle bulk work.

10. Cybersecurity – Hardware Wallet RNG Failure
    - Popular “high-security” Bitcoin hardware wallet shipped firmware that replaced its RNG with a flawed open-source Python library (pseudonymous author). Fell back to deterministic test RNG.
    - Foundation of the security pyramid (true entropy) was sand. Wallets were pre-identified, sorted by balance, and swept starting hours before public disclosure.
    - Attacker appears unsophisticated (funds sent to traceable wallets rather than properly laundered). Classic lesson: cryptography is only as strong as its random-number generation.

11. Team Updates
    - Joselyn: Financials / GL work; continuing MB-800 study.
    - David: Passed MB-800; fighting customer/contact/vendor import and posting-group issues.
    - Ronald: New cohort for Berlin English Academy + ongoing ERP Academy curriculum (quizzes, enrichment, Monday calls).
    - Franklin: PTE bug fix (classic pattern: internal testing misses what a consultant/customer finds in five minutes).
    - Fatima: Experimenting with Claude + Teams Planner + VTT transcripts to auto-generate meeting notes and project docs.
    - Daniela: SEO/AIO execution and preparing first marketing campaign.
    - Eloar Christmas festival planning kicked off with local organizers.

12. Upcoming Events
    - Partner Vibe 2.0 — Provo, Utah, 21–23 September. Host presenting on marketing without a marketing team. Contact via steveendo.com for possible discount code.
    - Summit NA — Nashville, 11–15 October (summitna.com).
    - Dynamics Con Regionals: Columbus (Aug), Montreal (Sept), Frankfurt (Oct), Houston (Nov) — verify exact dates as some listings are inconsistent.