TC Fox 💻

Apologies for the extended break by the way. Had a rough couple of years. In a much better place now but it’s taking a lot longer for me to get my stride back than I realised.

Doing the social is hard for me right now, I’m just taking life gently for a while.

GET / HTTP/1.1
User-Agent: HI I CAN BE WHOEVER YOU WANT ME TO BE PLEASE LOVE ME

The “Mozilla” browser, on Windows NT or Win64 or x64 or something, running on AppleWebKit (like KHTML except actually Gecko) except that’s a lie it’s actually Chrome which is like Safari (which is actually AppleWebKit again) but that’s also a lie because it’s actually Edge

I love User-Agent strings

TIL that service accounts, machine accounts etc are sometimes referred to as “Non-Human Identities” and I’m like

Yeah

lol, younger users of the internet are not going to take those seriously. *Especially* mumble, c’mon

Spacebar looks to be a promising alternative from what I could see, and if Matrix sorts its jank arse user experience and dodgy cryptography out I agree it could be a solid option

This has occurred to me on more than one occasion. 🤔

The Reg translates Oracle's weak breach confession letter : TL;DR: Move along, still nothing to see here - an idea that leaves infosec pros aghast

This might actually be the lamest vendor response I’ve ever seen: www.theregister.com/2025/04/10/o...

Legitimately incredibly useful. I don’t normally do this but Tailscale is genuinely an awesome product for helping control access to things while *also* making the complexities of networking easier for me to deal with. #5yearsofTailscale

Firefox’s ambiguously worded legal document means it could be interpreted that they might steal my data? Guess I have to switch to *checks notes* Google

Is anyone able to explain to me what parts of Microsoft is a 365, what a Copilot is, and what Windows does?

Because I’m finding examples where 365 is sometimes not a cloud thing, Copilot is sometimes not an AI thing, and Windows sometimes is not an OS, and I’m thoroughly fucking confused

I’m probably getting ahead of myself though, given that isn’t not even supported by *Firefox or Safari* yet 🙃

I get that there’s a lot of security/privacy reasons for the complexity of FedCM on the IdP’s end, but I am seriously worried it’s gonna harm adoption if IdP’s have to jump through so many hoops to support it.

I have a hunch this is going to supported by Google, Google’s FedCM demo, and nobody else

this haptic display absolutely rocks. basketball is for everyone.

Sorry I’ve been so quiet on this account lately! There’s so much I want to talk about and 99% of it is “oops that’s related to a pentesting client for work, can’t talk about that” 😒

Definitely been taking a while to get the Wellington OWASP meets back up again, but ducks are now in a row and only thing left is to present something!

Currently making progress on my presso to get the ball rolling, should be ready for a (tentatively!) February meetup! Watch this space!

Interviewer: Can you explain this gap in your resume?

Pentester: It’s called time-based blind SQL injection.

Yes, I’m largely referencing vanilla PHP here, the “individually sanitise every single time and if you forget that’s your fault” attitude still seems to prevail there. But they’re not the only ones at fault of this.

It’s exhausting having to push back against security arguments that boil down to “You’re safe if you don’t make mistakes”.

If the tools you work with require manual, iterative and individual protections against exploitation multiple times, they’re shit tools.

Looking forward to seeing lots of you at #chcon tomorrow!

Something ingrained, that I realize now others do not have, is knowing the solution to failure is offering a better solution. I have tried shame I have endured compliance. I ground this axe years. You need the market to decide you've won. I sold modern policy baselines to fix user experience. I won.

So glad that Apple moved away from that weird arse design pattern where windows could not be maximised and toolboxes were just floating there and just appeared/disappeared depending on which window had focus, was a pain in the arse 😅

Photograph of entrance of Congress Center Hamburg, showing two banners hanging, one on the left is code.talks, and the one on the right is Eurofurence.

A developer conference running in parallel with a furry convention is pure comedy

HL7: The healthcare “standard” that people “follow”

Apple is definitely having a gap year. iOS 18 has been a total snoozefest too, ah well.

At least they’ve done a little catch up on some small areas where they’ve been lagging behind competition.

Security and foxes is a disaster recipe that will result in all of your chicken/eggs being stolen Ɛ:

Two hobbies crossing over is where the interesting stuff happens! Especially security and anything else

Had a good time at OWASP New Zealand Day this year! Had a lot of awesome conversations with many interesting people, and definitely inspired to get another talk done soon!

Also working through the initial plans for an interesting contribution to the AppSec scene, watch this space!

Is this the tcpip.sys RCE thing potentially?

It's only a one-time pad if it comes from the Padua region of Italy. Otherwise, it's just sparkling preshared key.