Ramblings from a .NET Security PM

Over the last week Dependabot has had more burr than usual, including a bunch of GitHub workflow updates for CodeQL.

Recently, we’ve seen an increase in .NET vulnerability reports that fall into what we would call “bug-bug” territory rather than security vulnerability territory.

This started with an email Sahad NK over in Azure Security about an unexpected behaviour when comparing Guid types in .NET.

A couple of weeks ago a friend asked what Server-Side Request Forgery (SSRF) was, how worried they should be, and how to fix it, as GitHub Copilot had told them that their application was vulnerable.

Software Bill of Materials, or SBOMs, are those files everyone wants, and no-one knows what to do with.

Isn't this pretty?

Now you have a GitHub Action configured to sign your code and your nupkgs you can take it a little further and publish to nuget.org without the need to create, rotate and otherwise manage API keys.

Updated 2nd Feb 2006 to reflect the rebrand to Azure Artifact Signing from Azure Trusted Signing Introduction This guide will walk you through signing .NET assemblies, EXEs and NuGet packages using a combination of GitHub actions and Entra managed identit…

.NET 10 saw the addition of post quantum primitives, ML-KEM, ML-DSA, SLH-DSA and Composite ML-KEM, with help from our friends over in GitHub Security Services who helped the class design and implemented ML-KEM.

At .NET Conf this year I got the opportunity to breakdown the year in .NET CVEs, including the code that caused the vulnerability, the fixes, and links to the GitHub PRs or commits that fixed the issues.