Rico Suter

Understanding the worst .NET vulnerability ever: request smuggling and CVE-2025-55315 In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it

Blogged: Understanding the worst .NET vulnerability ever: request smuggling and CVE-2025-55315

andrewlock.net/understandin...

In this post I discuss request smuggling, the recent vulnerability in ASP.NET Core with a severity score of 9.9, and how attackers could exploit it

#dotnet #aspnetcore

How I Almost Got Pwned — A Tale of Supply Chain Attacks and GitHub Actions Gone Wrong Or: “That time someone tried to turn my innocent Node.js repo into a credential-harvesting machine”

itnext.io/how-i-almost...

One of the biggest threats to many companies today is supply chain attacks with software. We all depend on so many open source third-party tools as foundations to our products. Bad actors have figured out this is a soft target. An interesting read on this below. (1️⃣/3️⃣)

🧵

GitHub - modelcontextprotocol/csharp-sdk: The official C# SDK for Model Context Protocol servers and clients, maintained by Microsoft The official C# SDK for Model Context Protocol servers and clients, maintained by Microsoft - modelcontextprotocol/csharp-sdk

I have been playing around with the new C# MCP SDK allowing you to easily create servers and clients in minutes.

It is fantastic!

github.com/modelcontext...

#mcp #mcpserver #csharp #dotnet

NSwag v14.3.0, an OpenAPI toolchain for .NET, and NJsonSchema v11.2.0 have been released. The updates contain many improvements and fixes. Please update and report any problems.

- github.com/RicoSuter/NS...
- github.com/RicoSuter/NJ...

Well I think I've fully come around to the idea that LLMs are computers. So I wrote about that. I guess this is my most bombastic blog post www.phillipcarter.dev/posts/llms-c...

This is still one of my go-to ways to describe what programmers do. And yes, it is accurate.

Problem is that it would still be hard to get funding for bigger maintenance tasks (eg migrate a big OSS project from newtonsoft to system.text.json, etc.)

(Note: I think it was bountysource some years ago but it seems this does not exist anymore, github.com/bountysource...)

Totally agree. There was an external page where you could do that and it integrated into GitHub. But as long as its not a gh first feature it wont get enough attention i suppose

Thx

Pls add me as well (.NET MVP)

Cross-Origin-Opener-Policy: preventing attacks from popups: Understanding cross-origin security headers - Part 1 In this post I describe the vulnerabilities in window.opener and window.open() and how to protect yourself with Cross-Origin-Opener-Policy

Blogged: Understanding cross-origin security headers - Part 1 - Cross-Origin-Opener-Policy: preventing attacks from popups

andrewlock.net/understandin...

In this post I describe how to protect yourself from vulnerabilities in JS APIs with the Cross-Origin-Opener-Policy header

#aspnetcore #appsec

GitHub - RicoSuter/NSwag: The Swagger/OpenAPI toolchain for .NET, ASP.NET Core and TypeScript. The Swagger/OpenAPI toolchain for .NET, ASP.NET Core and TypeScript. - GitHub - RicoSuter/NSwag: The Swagger/OpenAPI toolchain for .NET, ASP.NET Core and TypeScript.

NSwag v14.2.0 with .NET 9 support has been released!
#dotnet #nswag #dotnet9

github.com/RicoSuter/NS...