iiinova — where your digital self keeps evolving

Pete Markowsky @plm.bsky.social · 21/05/2026

Lots of the hardening in this release came from us proactively auditing Santa w/LLMs If you're responsible for any OSS, I highly recommend doing the same. You want to be the one finding the bugs first Very happy we invested heavily in design, least privilege & invariants

000

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 13/05/2026

Happy to report we got our SOC 2 Type II in April of 2026. We've been so busy getting the next versions of Santa and Workshop together we forgot to share the good news.

001

Pete Markowsky @plm.bsky.social · 24/12/2025

CEL has a lot of features and is often a good way to remove unneeded functionality e.g. preventing users to run Electron apps with --inspect or Chrome with remote debugging. You can also block env vars so if you need to stop the DYLD_ env vars you can. More CEL functionality to come.

000

Pete Markowsky @plm.bsky.social · 23/12/2025

A fun little entry where we can use network extension entitlements to flag remote access tools and VPNs. macOS entitlements are kinda slept on for detection & prevention It's not a silver bullet, but it certainly gets you a lot of coverage without maintaining a list.

010

Pete Markowsky @plm.bsky.social · 22/12/2025

Other fun things we posted over the weekend @northpolesec.bsky.social - Day 21: macOS insecurity - blocking dump-keychain northpole.security/blog/2025-ad... - Day 20: Where's the remote - blocking users from enabling SSH & remote apple events via systemsetup northpole.security/blog/2025-ad...

000

Pete Markowsky @plm.bsky.social · 22/12/2025

This is another old one & a classic from @theevilbit.bsky.social's Beyond Good Ol' LaunchAgents theevilbit.github.io/beyond/beyon... Workshop and Santa's File access rules were built to allow you to lock down directories like this to just the apps that need it & quickly get legitimate approvals.

000

Pete Markowsky @plm.bsky.social · 12/12/2025

This is probably the most common, known & least stealthy option for malware to persist This year Kristin Smith gave a solid talk at BSides Canberra on using models & our file access rules to find anomalous creation LaunchDaemons You can see the talk here youtube.com/watch?v=YJWf...

youtube.com

Is this binary Naughty or Nice? How Google leverages ML and Santa to detect persistence on MacOS

YouTube video by BSides Canberra

010

Pete Markowsky @plm.bsky.social · 10/12/2025

This is a super common technique for infostealers e.g. Huntress blogged about this yesterday www.huntress.com/blog/amos-st... just blogged about AMOS doing this yesterday, after tricking users to install their malware via AI generated instructions to use bash and curl.

000

Pete Markowsky @plm.bsky.social · 08/12/2025

One thing I like about our system is that it's easy to make these kinda trip wires where you can lock these things down. But quickly make an exception if you need to allow something and then dial it back off.

000

Pete Markowsky @plm.bsky.social · 07/12/2025

This is another simple but powerful control. You almost never need to disable Gatekeeper. And if you do you should be able to handle that on a case by case basis.

000

Pete Markowsky @plm.bsky.social · 06/12/2025

Stopping things like infostealers by locking down the cookie jar to just the signed browser processes is a simple but powerful control While Chrome is working on Device Bound Session Credentials (DBSC). You can deploy this today. Also if you use another browser like Firefox, it'll still work.

011

Pete Markowsky @plm.bsky.social · 01/12/2025

This is a great feature that I'm using daily. Honestly feels like we found a solid way to close the monitor mode is always on for devs gap. Super proud of the team @northpolesec.bsky.social for landing this

020

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 09/10/2025

Join us in celebrating North Pole Security's first anniversary! 🎉 Reflect on a year of innovation, growth, & unwavering commitment to livable security with Santa and Workshop. Read about our journey and what's next! #FirstAnniversary #Santa #Workshop northpole.security/blog/one-yea...

001

Pete Markowsky @plm.bsky.social · 03/08/2025

Headed to hacker summer camp looking first to seeing people and sharing @northpolesec.bsky.social’s Workshop with people.

010

Pete Markowsky @plm.bsky.social · 31/07/2025

It's not just one release, it's two!

120

Pete Markowsky @plm.bsky.social · 30/07/2025

It's been an 11 month journey to build Workshop, the integrated backend Santa always deserved Lots of things we'd always wanted at Google are now real The MVP's already powerful & we're just getting started Thank you to Zane & the team at A16Z, Royal Hansen and the team @northpolesec.bsky.social

020

Pete Markowsky @plm.bsky.social · 29/07/2025

I made this gist gist.github.com/pmarkowsky/9... to show how @northpolesec.bsky.social Santa FAA rules lockdown the Spotlight importers used in Sploitlight microsoft.com/en-us/securi... & @theevilbit.bsky.social's persistence trick. I also added an example rule for blocking access to the DBs.

gist.github.com

Santa FAA rule to prevent spotlight plugins from being registered

Santa FAA rule to prevent spotlight plugins from being registered - sploitlight.md

010

Pete Markowsky @plm.bsky.social · 24/07/2025

Going to be attending @bsideslv.org and around. Summer camp. If you’re around say hello.

110

Pete Markowsky @plm.bsky.social · 08/07/2025

This was a big release. Getting CEL in opens up so many possibilities and like all good things it's a take what you need. Really looking forward to seeing what people do with this.

010

Pete Markowsky @plm.bsky.social · 29/05/2025

Lots of great features in 2025.5. Santa is now easier to use without having to drop to the command line. Be sure to check out the videos in the 🧵

110

Pete Markowsky @plm.bsky.social · 08/05/2025

Have to admit it's exciting to see years of work coming together.

000

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 08/05/2025

Very exciting to see Santa called out as a tool that works in the @specterops.io SO-Con talk on Modern macOS Red Teaming Tactics by Lance Cain and @werdhaihai.bsky.social www.youtube.com/watch?v=t_L2...

youtube.com

Modern macOS Red Teaming Tactics | SO-CON 2025

YouTube video by SpecterOps

021

Pete Markowsky @plm.bsky.social · 31/03/2025

In order to learn MCP I wrote a quick server on top of @northpolesec.bsky.social's Santa github.com/pmarkowsky/s... it provides readonly functionality and debugging.

github.com

GitHub - pmarkowsky/santa-mcp: A PoC MCP Server for Santa

A PoC MCP Server for Santa. Contribute to pmarkowsky/santa-mcp development by creating an account on GitHub.

000

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 05/03/2025

We agree with CISA and think you should use Santa too www.cisa.gov/sites/defaul...

Snippet of the CISA guide recommending that you use Santa to stop living off the land attacks on macOS

001

Pete Markowsky @plm.bsky.social · 03/03/2025

Today in adventures in open source. We've had one user make a PR to update docs 🎉 And on a call a user said thank you for what you folks are doing in the community. Not gonna lie this is pretty great to be on the receiving end of this.

010

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 28/02/2025

📣 We’ve just released Santa v2025.2 on GitHub. github.com/northpolesec... Some highlights include: - Process-centric File Access Authorization rules are now in Beta! This means FAA rules can now target all access from a given process without knowing the files that will be accessed ahead of time.

github.com

Release v2025.2 · northpolesec/santa

Notes If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade. Santa documentation can be found at northpole.dev. Announcements 📣 Opt-In Stats Collection...

111

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 28/01/2025

Last night we released Santa 2025.1 github.com/northpolesec... Notable features include: Entitlements in the Sync Protocol This allows you to avoid authorizing or see which applications are disabling code signing on libraries.

github.com

Release v2025.1 · northpolesec/santa

Notes If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade. Santa documentation can be found at northpole.dev. Fixed ❗ Fixed an issue where santactl c...

111

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 10/12/2024

Today we're excited to release Santa v2024.11! github.com/northpolesec... Highlights: 1. Our initial beta for standalone mode: This lets you authorize binaries using TouchID. So you can live in lockdown mode. www.youtube.com/watch?v=Hd4t...

youtube.com

Santa Standalone Mode w/Swift UI

YouTube video by Pete Markowsky

112

Pete Markowsky @plm.bsky.social · 29/11/2024

Le sigh, I clearly need an edit button. The typos will continue until my ADHD subsides.

000

Pete Markowsky @plm.bsky.social · 27/11/2024

I want to see the next startup show in which the first thing a founder does is go oh shit how do I setup quickbooks and payroll? We need a company credit card!?

040

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 20/11/2024

Today is Santa's 10th Birthday 🎂🎉. The first commit was from Russell Hancox at 4:23 PM

011

Pete Markowsky @plm.bsky.social · 15/11/2024

This was really really interesting dynomight.net/chess/ TL;DR one model out of the set does well the rest do very poorly vs. the Chess AI stockfish on the lowest setting. I didn't expect chat-gpt-3.5-turbo-instruct to do so well.

dynomight.net

Something weird is happening with LLMs and chess

are they good or bad?

010

Pete Markowsky @plm.bsky.social · 13/11/2024

As seen from @ddz.bsky.social on X: The entire 3rd-edition of Ross Anderson's "Security Engineering" is available free as PDFs now! cl.cam.ac.uk/archive/rja1...

cl.cam.ac.uk

011

Pete Markowsky @plm.bsky.social · 11/11/2024

Really proud to be working with the team on this.

052

Pete Markowsky @plm.bsky.social · 10/11/2024

Heard a rumor that infosec folks are moving over here now. Hope it’s true.

3301

Pete Markowsky @plm.bsky.social · 24/09/2024

Once more unto the breach dear friends.

000

Pete Markowsky @plm.bsky.social · 18/09/2024

Bluesky now has over 10 million users, and I was #140,839!

000

Pete Markowsky @plm.bsky.social · 11/05/2024

I’d tell you a funny joke about Actaeon but my dogs are barking.

010

Pete Markowsky @plm.bsky.social · 11/07/2023

Anyone going to summercon?

100

Pete Markowsky @plm.bsky.social · 08/07/2023

Trying to rebuild the timeline of people I follow on Twitter here and ran into an interesting bug browsing someone’s followers. Seems to pick one every time I scroll.

000

Pete Markowsky @plm.bsky.social · 02/07/2023

So far I like the interface of this better than I liked mastodon. The odd flashing on refresh bug seems to have stopped.

000

Pete Markowsky @plm.bsky.social · 23/06/2023

Is anyone else seeing the app for this glitch?

180