I Need Coffee - Episode 220 - Weekly BC Review! (August 14, 2026)

1. Claude Code Auto-Approval
   - Anthropic now recommends the auto-approval setting in the VS Code extension.
   - Host previously avoided it after bad experiences with GitHub Copilot.
   - Switched after constant trivial “Can I run this?” approvals became meaningless.
   - Caution: in auto mode the agent can independently decide to commit, push, and open a draft PR even when you only asked a question. Stay vigilant.

2. .NET MAUI Passphrase Generator Rewrite
   - Legacy .NET Framework passphrase generator (manual typing of long random passwords is painful) rewritten in .NET MAUI for Windows x64 / ARM64 (future macOS potential).
   - Fable/Claude one-shotted the rewrite in ~45 continuous minutes, fixed a race-condition hang-on-close, switched to proper cryptographic RNG, and bluntly criticized the original code quality.
   - Host’s rationale for multi-word passphrases: longer length can still provide strong search-space resistance despite lower entropy per character; practical cracking attempts on an RTX 3070 Ti were unsuccessful for realistic multi-word + digits + symbols combinations.

3. SpreadsheetML for Formatted Excel Exports from Business Central
   - Customer needed complex calculated reports exported as ready-to-use Excel (titles, dates, headers, freeze panes, proper column widths).
   - Claude used SpreadsheetML (Open XML) from AL — something the host had never heard of — and delivered a fully formatted file in ~2 minutes (commit + draft PR).
   - Users loved it; no more manual reformatting. Changes are now trivial (“make this cell purple”).

4. BC Telemetry Onboarding Form
   - Structured form to capture everything needed before enabling telemetry: tenant ID, version, licenses, companies, key user IDs + telemetry GUIDs, etc.
   - Recommended practice so analysis is purposeful instead of “we turned it on… now what?”.

5. ERP Academy
   - Wrapping up Week 4 of the 18+ month program (10 hours/week self-study + Monday evening group calls).
   - Breakout rooms discussed core business functions (finance, sales, purchasing, warehousing, etc.). Ronald continues heavy curriculum and facilitation work.

6. Sandbox Point-in-Time Restore Tip
   - Useful when customers repeatedly request clean sandboxes for testing.
   - Leverage Azure SQL point-in-time restore; timestamp a known-good state and restore into a new environment name as needed.
   - Limits: 10 restores per environment per month; requires a free environment slot (temporarily consumes two slots).

7. Email Delivery Mystery Solved (Barracuda)
   - Weeks of troubleshooting bounced emails to a customer who insisted “it’s not us.”
   - Claude DNS/MX analysis revealed Barracuda spam filtering at the edge. Customer had zero visibility or control.
   - Host wrote a 15-page diagnostic procedure for the customer’s IT. Adding a sender exclusion rule (for unclear reasons) finally resolved it.

8. Full Account Takeover via Auth Bypass
   - Host’s account on an old marketplace site was fully taken over (password + TOTP reset). Site later admitted a complete OAuth/authentication system weakness affecting many accounts.
   - Another data point in the rising wave of compromised web applications.

9. AIO Theory – Documentation as Marketing Asset
   - Emerging hypothesis: well-written user guides and documentation may outperform the main marketing website for AI-optimized search (AIO) results.
   - Some AI answers already cite the doc site and specific Blue Dragonfly apps.
   - Consequence: prioritising additional high-quality user guides for better AIO visibility.
   - Broader learning: modern SEO/AIO is largely about proper structure, metadata, and crawlability rather than keyword stuffing. Structured pricing data (one-time vs monthly vs annual) is a concrete example of the level of detail required.

10. Latent Bug Discovery – Unwired Setup Toggle
    - While updating a user guide, the rigorous verification prompt revealed that a setup toggle (“Allow changes to approved documents”) present since v1.0 had never been wired into any application code.
    - Survived months of development, multiple developers (host + Franklin), AI code reviews, and releases.
    - Lesson: assume every existing app may contain “skeleton” features; perform full code reviews of older codebases with no assumptions.

11. $9.5 Billion High-Precision Report
    - Complex PTE report: ≥236 dimension values, >50 rows, >50,000 calculations, totaling $9.5 billion.
    - Had to match customer’s historical Excel reports to the penny despite rounding differences.
    - Key insight: Excel’s 15 significant-digit limit (not just decimal places). Business Central’s higher precision was actually *too* precise and produced different rounding.
    - Added configurable percent-rounding precision; report now matches historical numbers exactly. Customer is discovering and correcting their own prior misclassifications.

12. Pangram AI Detection & Authenticity Discussion
    - Subscribed to Pangram (first AI-detection tool the host finds reasonably accurate). Browser extension now tags posts on X/LinkedIn.
    - LinkedIn is saturated with high-percentage AI-generated content; Microsoft marketing emails also score partially AI.
    - Open philosophical question: where is the line of authenticity? Meeting notes and wireframes feel acceptable; personal “I learned this lesson…” stories or LinkedIn engagement posts generated by AI feel disingenuous. Marketing content is more tolerated than personal voice.

13. Crypto-JS Open-Source Security Failure
    - Once-popular JavaScript crypto library (16.4k stars, 15.6 million weekly npm downloads) is discontinued, known-insecure, and still widely used.
    - Clear cryptographic implementation flaws; README lacks strong warnings. Classic illustration that “open source = secure” is outdated.

14. Team Updates
    - Joselyn: Passed MB-800 — now two certified Business Central consultants in Berlin, El Salvador (population ~15–16k). Continuing financials work.
    - Ronald: Leading ERP Academy + second English Academy cohort; starting Continia Document Capture implementations.
    - Fatima: Organizing next El Salvador Doug meetup (Spanish, Wed 19th); resuming El Coyolar Christmas festival planning (team is pushing hard for pupusas for ~200 people).
    - David: Continuing data-import challenges.
    - Franklin: App bug research and PTE work.
    - Daniela: Driving SEO/AIO, analytics, and content production.