iiinova — where your digital self keeps evolving

Pete Markowsky @plm.bsky.social · 21/05/2026

Lots of the hardening in this release came from us proactively auditing Santa w/LLMs If you're responsible for any OSS, I highly recommend doing the same. You want to be the one finding the bugs first Very happy we invested heavily in design, least privilege & invariants

000

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 13/05/2026

Happy to report we got our SOC 2 Type II in April of 2026. We've been so busy getting the next versions of Santa and Workshop together we forgot to share the good news.

001

Pete Markowsky @plm.bsky.social · 24/12/2025

CEL has a lot of features and is often a good way to remove unneeded functionality e.g. preventing users to run Electron apps with --inspect or Chrome with remote debugging. You can also block env vars so if you need to stop the DYLD_ env vars you can. More CEL functionality to come.

000

Pete Markowsky @plm.bsky.social · 23/12/2025

A fun little entry where we can use network extension entitlements to flag remote access tools and VPNs. macOS entitlements are kinda slept on for detection & prevention It's not a silver bullet, but it certainly gets you a lot of coverage without maintaining a list.

Pete Markowsky @plm.bsky.social · 22/12/2025

Other fun things we posted over the weekend @northpolesec.bsky.social - Day 21: macOS insecurity - blocking dump-keychain northpole.security/blog/2025-ad... - Day 20: Where's the remote - blocking users from enabling SSH & remote apple events via systemsetup northpole.security/blog/2025-ad...

000

Pete Markowsky @plm.bsky.social · 22/12/2025

This is another old one & a classic from @theevilbit.bsky.social's Beyond Good Ol' LaunchAgents theevilbit.github.io/beyond/beyon... Workshop and Santa's File access rules were built to allow you to lock down directories like this to just the apps that need it & quickly get legitimate approvals.

000

Pete Markowsky @plm.bsky.social · 12/12/2025

This is probably the most common, known & least stealthy option for malware to persist This year Kristin Smith gave a solid talk at BSides Canberra on using models & our file access rules to find anomalous creation LaunchDaemons You can see the talk here youtube.com/watch?v=YJWf...

youtube.com

Is this binary Naughty or Nice? How Google leverages ML and Santa to detect persistence on MacOS

YouTube video by BSides Canberra

Pete Markowsky @plm.bsky.social · 10/12/2025

This is a super common technique for infostealers e.g. Huntress blogged about this yesterday www.huntress.com/blog/amos-st... just blogged about AMOS doing this yesterday, after tricking users to install their malware via AI generated instructions to use bash and curl.

000

Pete Markowsky @plm.bsky.social · 10/12/2025

Always enjoy your set lists. Thanks

Pete Markowsky @plm.bsky.social · 08/12/2025

One thing I like about our system is that it's easy to make these kinda trip wires where you can lock these things down. But quickly make an exception if you need to allow something and then dial it back off.

000

Pete Markowsky @plm.bsky.social · 07/12/2025

This is another simple but powerful control. You almost never need to disable Gatekeeper. And if you do you should be able to handle that on a case by case basis.

000

Pete Markowsky @plm.bsky.social · 06/12/2025

Stopping things like infostealers by locking down the cookie jar to just the signed browser processes is a simple but powerful control While Chrome is working on Device Bound Session Credentials (DBSC). You can deploy this today. Also if you use another browser like Firefox, it'll still work.

011

Pete Markowsky @plm.bsky.social · 01/12/2025

This is a great feature that I'm using daily. Honestly feels like we found a solid way to close the monitor mode is always on for devs gap. Super proud of the team @northpolesec.bsky.social for landing this

Pete Markowsky @plm.bsky.social · 24/10/2025

What about the imaginary CISO?

030

Pete Markowsky @plm.bsky.social · 11/10/2025

Will be curious to get your thoughts on it. The soundtrack is great. But something feels off about it for me.

120

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 09/10/2025

Join us in celebrating North Pole Security's first anniversary! 🎉 Reflect on a year of innovation, growth, & unwavering commitment to livable security with Santa and Workshop. Read about our journey and what's next! #FirstAnniversary #Santa #Workshop northpole.security/blog/one-yea...

001

Pete Markowsky @plm.bsky.social · 03/08/2025

m.media-amazon.com/images/I/71m...

Pete Markowsky @plm.bsky.social · 03/08/2025

Headed to hacker summer camp looking first to seeing people and sharing @northpolesec.bsky.social’s Workshop with people.

Pete Markowsky @plm.bsky.social · 03/08/2025

Tbh I did it because it seems to get the word out to folks who’ve split from Twitter, to Bluesky and mastodon. LinkedIn seems to be one of the few common spots. Also I’m stuck on the plane.

100

Pete Markowsky @plm.bsky.social · 31/07/2025

In case you see me. Yes this is why I look so exhausted. 😂

Pete Markowsky @plm.bsky.social · 31/07/2025

It's not just one release, it's two!

120

Pete Markowsky @plm.bsky.social · 30/07/2025

It's been an 11 month journey to build Workshop, the integrated backend Santa always deserved Lots of things we'd always wanted at Google are now real The MVP's already powerful & we're just getting started Thank you to Zane & the team at A16Z, Royal Hansen and the team @northpolesec.bsky.social

Pete Markowsky @plm.bsky.social · 29/07/2025

I made this gist gist.github.com/pmarkowsky/9... to show how @northpolesec.bsky.social Santa FAA rules lockdown the Spotlight importers used in Sploitlight microsoft.com/en-us/securi... & @theevilbit.bsky.social's persistence trick. I also added an example rule for blocking access to the DBs.

gist.github.com

Santa FAA rule to prevent spotlight plugins from being registered

Santa FAA rule to prevent spotlight plugins from being registered - sploitlight.md

Pete Markowsky @plm.bsky.social · 24/07/2025

Going to be attending @bsideslv.org and around. Summer camp. If you’re around say hello.

Pete Markowsky @plm.bsky.social · 08/07/2025

This was a big release. Getting CEL in opens up so many possibilities and like all good things it's a take what you need. Really looking forward to seeing what people do with this.

Pete Markowsky @plm.bsky.social · 29/05/2025

Lots of great features in 2025.5. Santa is now easier to use without having to drop to the command line. Be sure to check out the videos in the 🧵

Pete Markowsky @plm.bsky.social · 14/05/2025

It’s something that feels like the sci-fi future media promised us as kids

Pete Markowsky @plm.bsky.social · 11/05/2025

Yikes. Got any other FRs? Asking for a friend…

000

Pete Markowsky @plm.bsky.social · 08/05/2025

Have to admit it's exciting to see years of work coming together.

000

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 08/05/2025

Very exciting to see Santa called out as a tool that works in the @specterops.io SO-Con talk on Modern macOS Red Teaming Tactics by Lance Cain and @werdhaihai.bsky.social www.youtube.com/watch?v=t_L2...

youtube.com

Modern macOS Red Teaming Tactics | SO-CON 2025

YouTube video by SpecterOps

021

Pete Markowsky @plm.bsky.social · 07/05/2025

I hear it’s straight fire🔥… I’ll see myself out.

Pete Markowsky @plm.bsky.social · 23/04/2025

I keep saying these advances are more like electric power tools than fully autonomous. Still means massive productivity gains and chat is now a first class interface in a way it wasn’t feasible previously

000

Pete Markowsky @plm.bsky.social · 16/04/2025

I’m still kinda angry about the whole matter tbh

000

Pete Markowsky @plm.bsky.social · 09/04/2025

I mean I get the fascination it’s pure tech and a narrative that’s often a combo of how clever someone is versus the defenses in place. On the other hand brute forcing passwords, out of date applications and simple malware are still problems for people. So I’m with you.

100

Pete Markowsky @plm.bsky.social · 31/03/2025

In order to learn MCP I wrote a quick server on top of @northpolesec.bsky.social's Santa github.com/pmarkowsky/s... it provides readonly functionality and debugging.

github.com

GitHub - pmarkowsky/santa-mcp: A PoC MCP Server for Santa

A PoC MCP Server for Santa. Contribute to pmarkowsky/santa-mcp development by creating an account on GitHub.

000

Pete Markowsky @plm.bsky.social · 26/03/2025

Good thing it has that builtin stack overflow www.geoffchappell.com/notes/securi...

geoffchappell.com

America Online Exploits Bug In Own Software

000

Pete Markowsky @plm.bsky.social · 26/03/2025

Got sent this from a friend and admittedly I'm still chuckling.

000

Reposted by Pete Markowsky

North Pole Security @northpolesec.bsky.social · 05/03/2025

We agree with CISA and think you should use Santa too www.cisa.gov/sites/defaul...

Snippet of the CISA guide recommending that you use Santa to stop living off the land attacks on macOS

001

Pete Markowsky @plm.bsky.social · 03/03/2025

Today in adventures in open source. We've had one user make a PR to update docs 🎉 And on a call a user said thank you for what you folks are doing in the community. Not gonna lie this is pretty great to be on the receiving end of this.