Niels Tanis

A NuGet package runs with the same permissions as your process. Now we let AI agents run commands too. What could possibly go wrong? I looked at MXC, Microsoft's open source sandbox with a .NET SDK. Deny by default! blog.fennec.dev/sandboxing/2... #dotnet #appsec

Going live soon with @niels.fennec.dev, hosted by Tomáš Herceg 🔴 Today on #HypelessAI: finding, testing, and fixing security flaws in .NET apps with AI. Starts at 13:00 CEST, with a live Q&A. Join us: www.hypeless-ai.net

One week to go. ⏳ AI helps us build faster — but it can also help attackers find vulnerabilities faster. Join @niels.fennec.dev for practical .NET AppSec demos, AI-assisted security testing, and live Q&A. Sep 24, 1 PM CEST: www.hypeless-ai.net #HypelessAI

Security is built or broken with every development decision. Meet the #UCP26 experts bringing practical insights into software security: 👉 @programmeral.com, Sander Molenkamp, Christian Schabetsberger and @niels.fennec.dev Explore their sessions: prague.updateconference.net/en/2026/sche...

Want to know what’s coming in the next #HypelessAI episode? Hear it directly from @niels.fennec.dev. 👇 Join us live on September 24 and learn how #AI can help you uncover and fix vulnerabilities in your .NET applications before attackers do. Get your spot 👉 www.hypeless-ai.net #AppSec #Dotnet

What happens when #AI makes your code faster, but your #security risks grow faster too? Find out in the next #HypelessAI livestream, featuring 🎙️ @niels.fennec.dev, Microsoft MVP and software security expert. 📅 Thursday, Sep 24 👉 Save the date and register here: hypeless-ai.updateconf.net

Trusted publishing is the way to go if you can

It definitely was a year of change and that makes me really happy to see that I got renewed as MVP! Community and public speaking is the thing I still enjoy a lot and will continue on doing! Congratulations to all other MVP's that got renewed as well! #mvpbuzz

In amongst today's big chungus of a patch Tuesday there are some .NET updates, so let's begin #dotnet #aspnetcore #patchTuesday

If you're using MessagePack-CSharp directly you should update your dependency, as they've fixed 12 vulnerabilities today. github.com/MessagePack-...

shipped three new build warnings so your dotnet SDK can finally tell on itself. you're welcome jamiemagee.co.uk/blog/a-new-w...

🚀 NuGet Pruning is cleaner restores and fewer false positives. Better security signals. In .NET 10, NuGet package pruning removes platform-provided dependencies from your graph, so you only see what actually matters: actionable alerts. Learn more: devblogs.microsoft.com/dotnet/nuget...

NDC Copenhagen is only 3 weeks away! 4 days, 55 speakers, 65 sessions, 7 workshops. All happening 1-4 June at Øksnehallen in Copenhagen. Whether you're into AI, .NET, architecture, security, or modern software practices, there's a track for you there! Tickets 👉 ndccopenhagen.com

📣.NET 10.0.7 Out-of-Band Security Update - .NET Blog Microsoft released .NET 10.0.7 as an out-of-band security update to address CVE-2026-40372. hubs.li/Q04dbWjB0 #dotnet

.NET has an out of band update today to fix CVE-2026-40372, an Elevation of Privilege, which, in some cases, could allow an attacker to forge authentication tickets, or decode authentication tickets or other protected data. github.com/dotnet/annou...

Glasswing et al present a moral hazard to bug bounties. What I've seen recently is a significant increase in AI generated, or assisted vulnerability reports that are not vulnerabilities. (1/6)

I’m excited to let you know that the talks from [un]prompted—the AI Security Practitioner Conference—are now live on YouTube. No fluff, no hype—just real-world AI security from people actually doing the work. www.youtube.com/playlist?lis...

That is not what a 0-day is. It is a .NET CVE, it *does not* effect .NET Framework. 🙄

It's not that I mind AI written vulnerability reports for .NET, but there are a few problems we're seeing 1) Simply submitting the output from your favourite AI without testing the code it says demonstrates the vulnerability is bad. (1/4)

#BSidesLDN2025 videos are now live on our YouTube channel. Don’t forget to like and subscribe, we only publish once a year, your support makes a real difference! www.youtube.com/@Securitybsi... Huge thanks to @ministraitor.bsky.social & all our presenters for sharing their time and expertise!

𝐓𝐡𝐢𝐬 𝐭𝐢𝐦𝐞 𝐰𝐞’𝐫𝐞 𝐠𝐨𝐢𝐧𝐠 𝐞𝐯𝐞𝐧 𝐝𝐞𝐞𝐩𝐞𝐫! #UCK26 👉 krakow.updateconf.net #UpdateConference #Krakow @davidortinau.com & @konradkokosa.bsky.social & @codrina.bsky.social & @jfversluis.dev & @louella.dev & @niels.fennec.dev

Aspire beyond the basics. Aspire goes beyond its defaults once you understand the ideas underneath it. That foundation opens the door to extending Aspire in meaningful ways. Watch the full session from VSLive! Orlando youtu.be/rZQbhDfj7ek

The NDC Copenhagen Agenda is out 🇩🇰 See the full agenda and secure your Early Bird tickets before 27 Feb 👉 ndccopenhagen.com #ndccph

Like many services, as Signal grows, it becomes a more appealing place for scammers to try and cause harm. We've put together tips to help you protect yourself from phishing, scams, & impersonation attempts. Plus info about how Signal support communicates. support.signal.org/hc/en-us/art...

📢 The NDC Copenhagen #CFP ends this Sunday, 1 February! We welcome all subjects relevant to software developers. If you have something to say, then speak up! 📅 Deadline: 1 February 👉 Submit: ndccopenhagen.com/call-for-pap... #ndccopenhagen

After a bit of trial and error, I finally made an agent that does exactly what I want. No hallucinations. Runs locally. And costs almost nothing. #! /bin/bash // Do exactly this one task and nothing else. // If it doesn't work, wait 30 seconds and try // again. If that fails, log a message. doTask

On 9 January 2026 mine and my family's lives changed forever. I tell the full story in this video: youtu.be/mNEPSWcOheY If you want to support my family as well as our local community, consider sharing this post, or donating here: www.gofundme.com/f/we-lost-al...

If 2025 was the year of vibe coding, 2026 will be the year of vibe maintenance and security.

It's that time of the season again, time for BsidesLondon! Let me know if you're around!

We’re headed to Toronto! 🇨🇦 We’re excited to partner up with @cppnorth.bsky.social for an incredible 4-day event you don’t want to miss. We’re currently booking speakers, and the CFP is open → ndctoronto.com

Generating SBOMs for .NET apps and NuGet packages with Microsoft.Sbom.Targets

I recently did a talk on internet safety for parents/guardians and it was well received by those in the room. Its honestly the toughest talk I have researched and given. It might help you if you have kids or you are the local tech support for people with small humans. www.youtube.com/watch?v=UgF5...

The call for papers for NDC Security ends tomorrow. Come do your talk in Oslo: ndcsecurity.com/call-for-pap...

I think this is not the type of “tampering” Matt Blaze was concerned with

If you missed Aleksander Stensby's 2-day workshop on MCP and RAG at NDC AI last week, don’t worry - you can still join the online workshop on 1–2 December! event.checkin.no/206017/ndc-o...

The details of .NET's PQ algorithms, and their APIs are available devblogs.microsoft.com/dotnet/post-...

🎤 Meet one of our VISUG XL 2025 speakers: 𝐍𝐢𝐞𝐥𝐬 𝐓𝐚𝐧𝐢𝐬! We’re excited to welcome 𝐍𝐢𝐞𝐥𝐬 this year at Visug XL, our yearly, free, community-driven .NET conference. 📅 November 28, 2025 📍 UCLL Leuven 👉 More information and tickets: www.visug.be/Events/102 #VisugXL #DotNet #Community #Conference

With 80% of modern #apps built on third-party #code, supply chain #security has become critical. Don't miss @niels.fennec.dev "Beyond Trust: Building Community-Driven Security Analysis for Your .NET Software Supply Chain" at #NDCManchester! ndcmanchester.com/agenda/beyon...

Chatbots — LLMs — do not know facts and are not designed to be able to accurately answer factual questions. They are designed to find and mimic patterns of words, probabilistically. When they’re “right” it’s because correct things are often written down, so those patterns are frequent. That’s all.

We are increasing the length of support offered for .NET Standard Term Support (STS) releases from 18 months to 24 months. This change is effective starting with .NET 9 and there is no change for LTS releases. Get all the details you need: msft.it/63328t6MeM

Microsoft is expanding transparency in vulnerability management. We are now publishing VEX (Vulnerability Exploitability eXchange) attestations for third-party CVEs associated with the Azure Linux Distribution (formerly CBL-Mariner). Learn why VEX matters in our blog post: msft.it/6014shEmn

"A new and ongoing supply-chain attack is targeting developers on the OpenVSX and Microsoft Visual Studio marketplaces with self-spreading malware called #GlassWorm that has been installed an estimated 35,800 times." #CyberSecurity #VSCode #SupplyChainAttack www.bleepingcomputer.com/news/securit...

"Researchers [...] said today that it takes only 250 specially crafted documents to force a generative AI model to spit out gibberish when presented with a certain trigger phrase." #AI #LLM #GenAI #ModelPoisoning #AISecurity #CyberSecurity www.theregister.com/2025/10/09/i...

It's Patch Tuesday and ASP.NET Core has a doozy, with a CVSS score of 9.9, our highest ever. Let's examine why. The bug enables http request smuggling, which on its own for ASP.NET Core would be nowhere near that high, but that's not how we rate things... * Thread- (1/7)

And while we're talking about .NET security we have another announcement. Do you build and distribute your own version of .NET? Then you wanted to get early access to upcoming patch information sooner to protect your customers at the same time as we release patches.

⏳ #𝐕𝐢𝐬𝐮𝐠𝐗𝐋 𝟐𝟎𝟐𝟓 is approaching! We’re gearing up for our annual 𝐜𝐨𝐦𝐦𝐮𝐧𝐢𝐭𝐲-𝐝𝐫𝐢𝐯𝐞𝐧 .𝐍𝐄𝐓 𝐜𝐨𝐧𝐟𝐞𝐫𝐞𝐧𝐜𝐞! 💜 The 𝐚𝐠𝐞𝐧𝐝𝐚 𝐢𝐬 𝐚𝐥𝐦𝐨𝐬𝐭 𝐫𝐞𝐚𝐝𝐲, and we can’t wait to share the amazing lineup with you soon! 📅 𝐍𝐨𝐯𝐞𝐦𝐛𝐞𝐫 𝟐𝟖, 𝟐𝟎𝟐𝟓 — 𝐔𝐂𝐋𝐋 𝐋𝐞𝐮𝐯𝐞𝐧 🎟️ Get your 𝐭𝐢𝐜𝐤𝐞𝐭𝐬 here 👉 www.visug.be/Events/102

Was this DEFCON eBPF bug talk hallucinated? www.thestack.technology/defcon-ebpf-...

For the SecurityConversations show, I interviewed appsec and software supply chain security expert Chris Eng @ceng.bsky.social LISTEN securityconversations.com/episode/chri...

"We want AI agents that can discover like we can, not which contain what we have discovered. Building in our discoveries only makes it harder to see how the discovering process can be done." - The Bitter Lesson (2019), by Rich Sutton www.incompleteideas.net/IncIdeas/Bit...

I'm hiring! Looking for an #aspnetcore dev, ideally with identity/oidc experience. Role is support, tech presales, advisory, docs, ... East coast US ideally for timezone overlap in the team Small team and company, big ambition. Reach out if you're interested! duendesoftware.com/careers/cust...