iiinova — where your digital self keeps evolving

And don’t get me started on Linux, code signing on that platform is a fucking shitshow. No, some random PGP key I made is not what I call sufficient validation, it’s akin to “just trust me bro” self-signed TLS certs (but given how Linux treats SSH keys this isn’t unexpected)

100

Seriously, how hard could it be for Microsoft to verify my RealMe ID, issue me a cert, and if absolutely needed, and verify an attestation I’m using a Key Vault or some compliant key store?

100

Was looking at Azure Trust Signing which solves two-ish out of three of these issues, but it’s only available in the US and Canada and only available for organisations not individuals so fuck me I guess

100

TC Foxtaur 🐾 @tc.nz · 31/07/2025

Getting a personal Authenticode certificate for the first time in over a decade, and wow, Microsoft really needs to sort this ecosystem out Crazy expensive, insane requirements (I need an auditor to attest I’m using Key Vault properly?!), bizarre trust model with janky 3rd-parties, this sucks

310

Reposted by TC Fox 💻

Apologies for the extended break by the way. Had a rough couple of years. In a much better place now but it’s taking a lot longer for me to get my stride back than I realised. Doing the social is hard for me right now, I’m just taking life gently for a while.

071

TC Fox 💻 @tech.tc.nz · 27/05/2025

GET / HTTP/1.1 User-Agent: HI I CAN BE WHOEVER YOU WANT ME TO BE PLEASE LOVE ME

TC Fox 💻 @tech.tc.nz · 27/05/2025

The “Mozilla” browser, on Windows NT or Win64 or x64 or something, running on AppleWebKit (like KHTML except actually Gecko) except that’s a lie it’s actually Chrome which is like Safari (which is actually AppleWebKit again) but that’s also a lie because it’s actually Edge I love User-Agent strings

121

Reposted by TC Fox 💻

TC Foxtaur 🐾 @tc.nz · 18/05/2025

TIL that service accounts, machine accounts etc are sometimes referred to as “Non-Human Identities” and I’m like Yeah

1203

TC Fox 💻 @tech.tc.nz · 29/04/2025

lol, younger users of the internet are not going to take those seriously. *Especially* mumble, c’mon Spacebar looks to be a promising alternative from what I could see, and if Matrix sorts its jank arse user experience and dodgy cryptography out I agree it could be a solid option

100

TC Fox 💻 @tech.tc.nz · 15/04/2025

This has occurred to me on more than one occasion. 🤔

000

TC Fox 💻 @tech.tc.nz · 03/04/2025

Legitimately incredibly useful. I don’t normally do this but Tailscale is genuinely an awesome product for helping control access to things while *also* making the complexities of networking easier for me to deal with. #5yearsofTailscale

000

Reposted by TC Fox 💻

TC Foxtaur 🐾 @tc.nz · 04/03/2025

Firefox’s ambiguously worded legal document means it could be interpreted that they might steal my data? Guess I have to switch to *checks notes* Google

101

TC Fox 💻 @tech.tc.nz · 04/03/2025

Is anyone able to explain to me what parts of Microsoft is a 365, what a Copilot is, and what Windows does? Because I’m finding examples where 365 is sometimes not a cloud thing, Copilot is sometimes not an AI thing, and Windows sometimes is not an OS, and I’m thoroughly fucking confused

TC Fox 💻 @tech.tc.nz · 16/02/2025

I’m probably getting ahead of myself though, given that isn’t not even supported by *Firefox or Safari* yet 🙃

000

TC Fox 💻 @tech.tc.nz · 16/02/2025

I get that there’s a lot of security/privacy reasons for the complexity of FedCM on the IdP’s end, but I am seriously worried it’s gonna harm adoption if IdP’s have to jump through so many hoops to support it. I have a hunch this is going to supported by Google, Google’s FedCM demo, and nobody else

200

Reposted by TC Fox 💻

Luke Knox @lukeknox.me · 06/02/2025

this haptic display absolutely rocks. basketball is for everyone.

244211866783

TC Fox 💻 @tech.tc.nz · 22/01/2025

Sorry I’ve been so quiet on this account lately! There’s so much I want to talk about and 99% of it is “oops that’s related to a pentesting client for work, can’t talk about that” 😒

230

TC Fox 💻 @tech.tc.nz · 31/12/2024

Definitely been taking a while to get the Wellington OWASP meets back up again, but ducks are now in a row and only thing left is to present something! Currently making progress on my presso to get the ball rolling, should be ready for a (tentatively!) February meetup! Watch this space!

TC Fox 💻 @tech.tc.nz · 21/12/2024

Interviewer: Can you explain this gap in your resume? Pentester: It’s called time-based blind SQL injection.

031

TC Fox 💻 @tech.tc.nz · 18/12/2024

Yes, I’m largely referencing vanilla PHP here, the “individually sanitise every single time and if you forget that’s your fault” attitude still seems to prevail there. But they’re not the only ones at fault of this.

000

TC Fox 💻 @tech.tc.nz · 18/12/2024

It’s exhausting having to push back against security arguments that boil down to “You’re safe if you don’t make mistakes”. If the tools you work with require manual, iterative and individual protections against exploitation multiple times, they’re shit tools.

130

TC Fox 💻 @tech.tc.nz · 21/11/2024

Looking forward to seeing lots of you at #chcon tomorrow!

000

Reposted by TC Fox 💻

SwiftOnSecurity @swiftonsecurity.com · 14/11/2024

Something ingrained, that I realize now others do not have, is knowing the solution to failure is offering a better solution. I have tried shame I have endured compliance. I ground this axe years. You need the market to decide you've won. I sold modern policy baselines to fix user experience. I won.

826627

TC Fox 💻 @tech.tc.nz · 23/10/2024

So glad that Apple moved away from that weird arse design pattern where windows could not be maximised and toolboxes were just floating there and just appeared/disappeared depending on which window had focus, was a pain in the arse 😅

000

Reposted by TC Fox 💻

SUDO @sudo.pink · 18/09/2024

A developer conference running in parallel with a furry convention is pure comedy

Photograph of entrance of Congress Center Hamburg, showing two banners hanging, one on the left is code.talks, and the one on the right is Eurofurence.

610021

TC Fox 💻 @tech.tc.nz · 12/09/2024

HL7: The healthcare “standard” that people “follow”

021

TC Fox 💻 @tech.tc.nz · 10/09/2024

Apple is definitely having a gap year. iOS 18 has been a total snoozefest too, ah well. At least they’ve done a little catch up on some small areas where they’ve been lagging behind competition.

TC Fox 💻 @tech.tc.nz · 06/09/2024

Security and foxes is a disaster recipe that will result in all of your chicken/eggs being stolen Ɛ:

030

TC Fox 💻 @tech.tc.nz · 06/09/2024

Two hobbies crossing over is where the interesting stuff happens! Especially security and anything else

130

TC Fox 💻 @tech.tc.nz · 06/09/2024

Had a good time at OWASP New Zealand Day this year! Had a lot of awesome conversations with many interesting people, and definitely inspired to get another talk done soon! Also working through the initial plans for an interesting contribution to the AppSec scene, watch this space!

020

TC Fox 💻 @tech.tc.nz · 30/08/2024

Is this the tcpip.sys RCE thing potentially?

000

Reposted by TC Fox 💻

Opal @opalescentopal.bsky.social · 29/08/2024

It's only a one-time pad if it comes from the Padua region of Italy. Otherwise, it's just sparkling preshared key.

043

TC Fox 💻 @tech.tc.nz · 29/08/2024

If I got a dollar for every time someone launched a training VM for a workshop on a t2/t3/t4 EC2 instance, I would have some dollars 🤦 I wonder why all the exercises suddenly perform like arse 2-3 hours into the workshop, hmmmmm

020

TC Fox 💻 @tech.tc.nz · 14/08/2024

People who just learned about the XY Problem and are attempting to shoehorn it into every query is a bit frustrating, yeah. I usually head these off with a “given that I’m doing it this way because reasons, how best do I do X?”

210

TC Fox 💻 @tech.tc.nz · 29/07/2024

I think I’m the only person ever who seems to *enjoy* being confused by computer! Computer is weird, but computer is like a complex puzzle. Puzzles are fun because puzzles are hard! If I sit back, I would far rather be challenged by computer than by most other things in life. 😊

TC Fox 💻 @tech.tc.nz · 16/07/2024

I guess the answer is “you rarely tried downloading more than 2-3MB files at a time over dial-up” 🙃

210

TC Fox 💻 @tech.tc.nz · 16/07/2024

How did I ever live with dial-up as a kid? I’m currently sucking down ~100MB over a connection that gets me around 500KB/s, and I’m soooooo borrrrrred

130

Reposted by TC Fox 💻

Randall Munroe @xkcd.com · 12/07/2024

Hatchery xkcd.com/2958

281791235

TC Fox 💻 @tech.tc.nz · 11/07/2024

While VMWare seem to go out of their way to make this as hard as possible to discover, VMWare Workstation Pro is in fact free for Personal Use! Came real in handy when a friend of mine had troubles with VMWare Player while doing labs for his PJPT, got him all upgrades to use the better networking 😁

SwiftOnSecurity @swiftonsecurity.com · 10/07/2024

Reposted by TC Fox 💻

Overcoming the incentive to dunk on “users” behavior is an important element in maturing your security understanding. You have a set of levers to pull. Human nature is not one of them. Deal with that or be a righteous failure.

421719

TC Fox 💻 @tech.tc.nz · 01/07/2024

I will *definitely* be at CHCon, speaker or not 😊

TC Fox 💻 @tech.tc.nz · 30/06/2024

Kinda feel guilty that I haven’t subbed to AppSec New Zealand Day 2024, but I am definitely lacking the energy at the moment. *Maybe* I can pull myself together enough to get to CHCon this year, will see.

120

TC Fox 💻 @tech.tc.nz · 30/06/2024

I mean, pretty much! There’s nothing special about Kali that you can’t achieve with any other distro, it just comes preloaded with stuff and configured a specific way for convenience, particularly as a disposable VM that you use once for each engagement. 🤷