Build security @Fencer_Security
San Francisco, CA
Joined September 2009
- Tweets331
- Following182
- Followers169
- Likes114
Tim Olshansky retweeted
🚨Python friends, upgrade (or have your agent upgrade) every certifi package across all your projects and machines!
uv self update
uv lock --upgrade-package certifi
Private keys from 8 intermediate CA certs have been compromised!
teapawt.org/astuyve/status/2112559…
Some other things to upgrade:
* Go: 1.27.3 or 1.26.10, then rebuild your Go programs
* rustls-webpki: 0.103.16
* webpki-roots / webpki-root-certs: 1.0.10
* Electron: 44.9.1, 43.8.1 or 42.11.16
* NSS: 3.131.1
* Firefox: 158.0.1 (ESR: 153.5.1 or 115.43.1)
* Ubuntu ca-certificates: 20260816ubuntu0.<release>.1 (for 22.04, 24.04, 26.04 and 26.10)
* Homebrew ca-certificates: 2026-09-25_1
* Chrome, Apple, Windows: nothing to do, they’re blocked automatically
Still waiting for a fix:
* Debian ca-certificates: disable the two roots by hand
Node.js
* Composer ca-bundle
* macOS /usr/bin/curl: remove the two roots from /etc/ssl/cert.pem by hand
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
Tim Olshansky retweeted
"Will my auditor accept an AI pen test?"
SOC 2 doesn't prescribe methodology. Auditors judge the report: scope, recognized methodology, severity-rated findings, and proof each one is exploitable.
Fencer's AI pen testing reports document the full attack path, the fix, and the retest that confirmed closure.
Learn more here: fencer.dev/blog/introducing-…
Tim Olshansky retweeted
@dok2001 I've noticed that SNI and host overrides are still in enterprise plan (developers.cloudflare.com/ru…) - any chance we can get that in other plans too given your very generous policy of everything in every plan (blog.cloudflare.com/enterpri…)? 🙏🙇☺️
Tim Olshansky retweeted
Make sure to always reuse your botoclients. Initializing a fresh one on each task has A LOT of overhead!
Tim Olshansky retweeted
Engineering capacity at a startup is finite. Security is one of the things asking for a piece of it.
Here's Tim Olshansky on how to stop running security as a parallel program to product and start budgeting it as part of engineering capacity instead:
fencer.dev/blog/security-as-…
Tim Olshansky retweeted
New: a field guide on running security at a startup, from someone who lived it.
Our co-founder @timolsh was a CTO at a startup before he built Fencer. He built and ran the security program himself. Led the company through SOC 2 with no security team to hand it to.
He wrote down what he wishes someone had handed him then.
Startup Security: A Field Guide for CTOs covers:
👉 When security stops being a "someday" problem
👉 Where your hours actually go when you're the one doing the work
👉 What to put in place first
👉 How to run security operations without burning out the team
👉 Considerations for startups in the AI era
Read it here: fencer.dev/startup-security-…
Tim Olshansky retweeted
Trust me chat. Forget about Glasswing spamming 0days in your software, you're already cooked with current models.
I've hacked hundreds of global orgs, including governments (legally) over the last 10 years, and the amount of times I required a 0day to do so was exactly 0 times.
Being worried about Glasswing is like living in Europe and being worried about Northrup Grumman having lethal space lasers while you're more likely to get stabbed by a crazy person walking through the streets.
Introducing Project Glasswing: an urgent initiative to help secure the world’s most critical software.
It’s powered by our newest frontier model, Claude Mythos Preview, which can find software vulnerabilities better than all but the most skilled humans.
anthropic.com/glasswing
Tim Olshansky retweeted
With recent Python supply chain attacks (Trivy/LiteLLM), it’s worth mentioning uv’s `exclude-newer = "x days"` config.
It forces uv to only installs packages published more than x days ago, reducing risks since problematic packages should be yanked by then.
Tim Olshansky retweeted
If you were impacted by the recent Delve issues and want to harden your security posture, we (@fencer_security ) will be happy to help you out.
For anyone that signs up in the next two weeks, we will give you 15% off an annual subscription and provide white glove onboarding ourselves. This will include our full platform of code, infrastructure, runtime protection, static code analysis (SAST), dynamic application security testing (DAST), identity management and SIEM.
We typically work with software companies between 20 and 500 employees.
While we don’t ourselves do the compliance part, we integrate with many of the large vendors in the industry (Vanta, Drata, etc.)
Feel free to DM me or comment below.
Tim Olshansky retweeted
Huge milestone today for Zenput as we announce our Series C funding round! 🎉 We’re incredibly grateful to our customers who trust us to help them drive quality execution every day, in every store. Read more in our press release here: ow.ly/5SP950FzVhV
Tim Olshansky retweeted
🔥Hot off the press: Issue #95 of Level Up, a curated newsletter for leaders in tech #cto #vpeng #engmanager #techlead w/content from @timolsh @Barryovereem @robverger @a_greenberg @ericfossas @spolsky @jchyip @poyark & more! See levelup.patkua.com/issues/le…
ALT Level Up Issue #95 out now
Tim Olshansky retweeted
Tim Olshansky on Career Paths for Technologists who don’t want to Manage People bit.ly/3vuLJiw by Tim Olshansky
Tim Olshansky retweeted
We talked with @timolsh, EVP of Product and Engineering at @Zenput, about how remote work can make it harder for Engineers to advance in their careers. Olshansky offered 3 tips for Engineers to accelerate their professional growth during COVID:
hubs.la/H0CMZPg0
Tim Olshansky retweeted
We recently talked again with @timolsh, EVP of Product and Engineering at @Zenput about the tools, including @Loom, @figmadesign, and @productboard, their Engineering and Product teams have adopted to boost collaboration during COVID:
hubs.la/H0CCntD0
Tim Olshansky retweeted
here we go......again.
Number of IPOs that have doubled on day one, per year
2010: 0
2011: 1
2012: 1
2013: 6
2014:6
2015: 5
2016: 1
2017: 1
2018: 1
2019: 3
2020: 19
More on @SquawkCNBC at 8:30 a.m. tomorrow
Tim Olshansky retweeted
@timolsh is EVP of Product and Engineering at @zenput, where he recently celebrated his two-year anniversary. “It's been a wild ride,” Tim said. We recently Zoomed with Tim about how he’s finding some work/life balance while sheltering in place for COVID: hubs.la/H0ClNtx0