iiinova — where your digital self keeps evolving

TC Fox 💻 @tech.tc.nz · 20/08/2025

The performance difference between 7zip and Window’s own built-in extractor is pretty astounding 😳

TC Fox 💻 @tech.tc.nz · 17/08/2025

Getting a personal Authenticode certificate for the first time in over a decade, and wow, Microsoft really needs to sort this ecosystem out Crazy expensive, insane requirements (I need an auditor to attest I’m using Key Vault properly?!), bizarre trust model with janky 3rd-parties, this sucks

310

Reposted by TC Fox 💻

TC Foxtaur 🐾 @tc.nz · 31/07/2025

Apologies for the extended break by the way. Had a rough couple of years. In a much better place now but it’s taking a lot longer for me to get my stride back than I realised. Doing the social is hard for me right now, I’m just taking life gently for a while.

071

TC Fox 💻 @tech.tc.nz · 27/05/2025

The “Mozilla” browser, on Windows NT or Win64 or x64 or something, running on AppleWebKit (like KHTML except actually Gecko) except that’s a lie it’s actually Chrome which is like Safari (which is actually AppleWebKit again) but that’s also a lie because it’s actually Edge I love User-Agent strings

121

Reposted by TC Fox 💻

TC Foxtaur 🐾 @tc.nz · 18/05/2025

TIL that service accounts, machine accounts etc are sometimes referred to as “Non-Human Identities” and I’m like Yeah

1203

Reposted by TC Fox 💻

TC Foxtaur 🐾 @tc.nz · 04/03/2025

Firefox’s ambiguously worded legal document means it could be interpreted that they might steal my data? Guess I have to switch to *checks notes* Google

101

TC Fox 💻 @tech.tc.nz · 04/03/2025

Is anyone able to explain to me what parts of Microsoft is a 365, what a Copilot is, and what Windows does? Because I’m finding examples where 365 is sometimes not a cloud thing, Copilot is sometimes not an AI thing, and Windows sometimes is not an OS, and I’m thoroughly fucking confused

110

TC Fox 💻 @tech.tc.nz · 16/02/2025

I get that there’s a lot of security/privacy reasons for the complexity of FedCM on the IdP’s end, but I am seriously worried it’s gonna harm adoption if IdP’s have to jump through so many hoops to support it. I have a hunch this is going to supported by Google, Google’s FedCM demo, and nobody else

200

Reposted by TC Fox 💻

Luke Knox @lukeknox.me · 06/02/2025

this haptic display absolutely rocks. basketball is for everyone.

244211856784

TC Fox 💻 @tech.tc.nz · 22/01/2025

Sorry I’ve been so quiet on this account lately! There’s so much I want to talk about and 99% of it is “oops that’s related to a pentesting client for work, can’t talk about that” 😒

230

TC Fox 💻 @tech.tc.nz · 31/12/2024

Definitely been taking a while to get the Wellington OWASP meets back up again, but ducks are now in a row and only thing left is to present something! Currently making progress on my presso to get the ball rolling, should be ready for a (tentatively!) February meetup! Watch this space!

010

TC Fox 💻 @tech.tc.nz · 21/12/2024

Interviewer: Can you explain this gap in your resume? Pentester: It’s called time-based blind SQL injection.

031

TC Fox 💻 @tech.tc.nz · 18/12/2024

It’s exhausting having to push back against security arguments that boil down to “You’re safe if you don’t make mistakes”. If the tools you work with require manual, iterative and individual protections against exploitation multiple times, they’re shit tools.

130

TC Fox 💻 @tech.tc.nz · 21/11/2024

Looking forward to seeing lots of you at #chcon tomorrow!

000

Reposted by TC Fox 💻

SwiftOnSecurity @swiftonsecurity.com · 14/11/2024

Something ingrained, that I realize now others do not have, is knowing the solution to failure is offering a better solution. I have tried shame I have endured compliance. I ground this axe years. You need the market to decide you've won. I sold modern policy baselines to fix user experience. I won.

826627

TC Fox 💻 @tech.tc.nz · 23/10/2024

So glad that Apple moved away from that weird arse design pattern where windows could not be maximised and toolboxes were just floating there and just appeared/disappeared depending on which window had focus, was a pain in the arse 😅

000

Reposted by TC Fox 💻

SUDO @sudo.pink · 18/09/2024

A developer conference running in parallel with a furry convention is pure comedy

Photograph of entrance of Congress Center Hamburg, showing two banners hanging, one on the left is code.talks, and the one on the right is Eurofurence.

610021

TC Fox 💻 @tech.tc.nz · 12/09/2024

HL7: The healthcare “standard” that people “follow”

021

TC Fox 💻 @tech.tc.nz · 06/09/2024

Had a good time at OWASP New Zealand Day this year! Had a lot of awesome conversations with many interesting people, and definitely inspired to get another talk done soon! Also working through the initial plans for an interesting contribution to the AppSec scene, watch this space!

020

Reposted by TC Fox 💻

Opal @opalescentopal.bsky.social · 29/08/2024

It's only a one-time pad if it comes from the Padua region of Italy. Otherwise, it's just sparkling preshared key.

043

TC Fox 💻 @tech.tc.nz · 29/08/2024

If I got a dollar for every time someone launched a training VM for a workshop on a t2/t3/t4 EC2 instance, I would have some dollars 🤦 I wonder why all the exercises suddenly perform like arse 2-3 hours into the workshop, hmmmmm

020

TC Fox 💻 @tech.tc.nz · 16/07/2024

How did I ever live with dial-up as a kid? I’m currently sucking down ~100MB over a connection that gets me around 500KB/s, and I’m soooooo borrrrrred

130

Reposted by TC Fox 💻

Randall Munroe @xkcd.com · 12/07/2024

Hatchery xkcd.com/2958

281791235

TC Fox 💻 @tech.tc.nz · 11/07/2024

While VMWare seem to go out of their way to make this as hard as possible to discover, VMWare Workstation Pro is in fact free for Personal Use! Came real in handy when a friend of mine had troubles with VMWare Player while doing labs for his PJPT, got him all upgrades to use the better networking 😁

110

Reposted by TC Fox 💻

SwiftOnSecurity @swiftonsecurity.com · 10/07/2024

Overcoming the incentive to dunk on “users” behavior is an important element in maturing your security understanding. You have a set of levers to pull. Human nature is not one of them. Deal with that or be a righteous failure.

421719

TC Fox 💻 @tech.tc.nz · 30/06/2024

Kinda feel guilty that I haven’t subbed to AppSec New Zealand Day 2024, but I am definitely lacking the energy at the moment. *Maybe* I can pull myself together enough to get to CHCon this year, will see.

120

TC Fox 💻 @tech.tc.nz · 30/06/2024

I shouldn’t have to say this: 👏KALI👏IS👏NOT👏A👏DAILY👏USE👏OS👏 Fuck’s sake, it’s not even all that secure, *by design*. For example, theres no limits on listening on ports <1024 by default. Kernel logs are also readable by any user. Its just a disposable, pre-built VM for pentesting, nothing more 🙄

130

TC Fox 💻 @tech.tc.nz · 26/06/2024

The pamphlet: “Hacking is such an awe-inspiring and exciting career!” My imagination: *Matrix noises* My career as a consultant 5 years later:

media.tenor.com

Plate Spinning GIF

ALT: Plate Spinning GIF

342

TC Fox 💻 @tech.tc.nz · 23/05/2024

Hollywood Hacking: If I use the Warhead ThunderSmash virus I should be able to hack the Gibson… oh no! They’re hiding behind 7 proxies and using a CyberSecure 5000 Firewall! *furious typing* Pentesting, today, in actual reality: nmap -Pn -sS -p- 192.168.1.0/24 *makes some tea, thinks about lunch*

243

Reposted by TC Fox 💻

kat cosgrove @kat.lol · 18/04/2024

yes it's called uwubernetes, yes i did it to pander to terminally online furries and to make rich old white guys have to say uwu. yw

33504138

Reposted by TC Fox 💻

Matthew Garrett @mjg59.eicar-test-file.zip · 18/03/2024

"Enshittification", except it describes the inevitable misuse of neologisms such that they entirely lose their original meaning and actually just become synonyms for an existing term (in this case, "change I don't like")

39523

TC Fox 💻 @tech.tc.nz · 14/02/2024

Hey, security peeps? Telling users that their password manager is insecure, then screaming this nonsense at them is why people give up on security. I work at a *security firm* and I'll bet some of them don't know about KDF iterations, parallelism and memory in Argon2id. Your CFO sure as shit won't.

Low KDF Iterations

Update your encryption settings to meet new security recommendations and improve account protection.

Encryption key settings

Warning
Proceeding will log you out of all active sessions. You will need to log back in and complete two-step login setup. We recommend exporting your vault before changing your encryption settings to prevent data loss.

Higher KDF iterations can help protect your master password from being brute forced by an attacker. We recommend a value of 600,000 or more.

Warning
Setting your KDF iterations too high could result in poor performance when logging into (and unlocking) Bitwarden on slower or older devices. We recommend that you increase the value in increments of 100,000 and then test all of your devices.

110

TC Fox 💻 @tech.tc.nz · 02/02/2024

I swear, the only times I’ve ever come across Apache Struts is in the context of some new highly exploitable unauthenticated RCE. And I hear about that *a lot*. What the hell even is this thing

000

TC Fox 💻 @tech.tc.nz · 08/01/2024

The thing that’s disappointing about ChatGPT for me is that nobody’s excited because this is technically fascinating, or entertaining in a novel way, but they’re excited because it might be really really profitable Not only is it really not, it’s also such a painfully boring outlook for new tech 😢

110

TC Fox 💻 @tech.tc.nz · 22/11/2023

OH: “It’s not a disclosure, it’s a discussion that has a CVE number”

131

TC Fox 💻 @tech.tc.nz · 31/10/2023

Oh thank fuck, I passed my OSCP. NEVER. AGAIN.

240

TC Fox 💻 @tech.tc.nz · 31/10/2023

Have a very scary Halloween! 👻

13114

Reposted by TC Fox 💻

The C Programming Language @c-official.bsky.social · 11/10/2023

'No Way To Prevent This' Says Only Language Where It Regularly Happens

Github issue in the curl repo, announcing:
"Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

We are cutting the release cycle short and will release curl 8.4.0 on October 11, including fixes for a severity HIGH CVE and one severity LOW. The one rated HIGH is probably the worst curl security flaw in a long time."

06918

TC Fox 💻 @tech.tc.nz · 11/10/2023

I’m actually really excited that we’ve finally got something along the lines of SVC DNS records for HTTP. There is so much human and compute effort wasted on the simple problem of hosting multiple websites on the same IP address, or the same website across multiple servers, it’s not even funny

110

TC Fox 💻 @tech.tc.nz · 05/10/2023

Hey, web app developers: if your Multi-Factor Authentication login sends a code to the same email address as where you reset your password, IT’S NOT MULTIPLE FUCKING FACTORS, IS IT 🤦

1103