Pete Markowsky

m.media-amazon.com/images/I/71m...

Headed to hacker summer camp looking first to seeing people and sharing @northpolesec.bsky.social’s Workshop with people.

Tbh I did it because it seems to get the word out to folks who’ve split from Twitter, to Bluesky and mastodon.

LinkedIn seems to be one of the few common spots.

Also I’m stuck on the plane.

In case you see me. Yes this is why I look so exhausted. 😂

It's not just one release, it's two!

It's been an 11 month journey to build Workshop, the integrated backend Santa always deserved

Lots of things we'd always wanted at Google are now real

The MVP's already powerful & we're just getting started

Thank you to Zane & the team at A16Z, Royal Hansen and the team @northpolesec.bsky.social

Santa FAA rule to prevent spotlight plugins from being registered Santa FAA rule to prevent spotlight plugins from being registered - sploitlight.md

I made this gist gist.github.com/pmarkowsky/9... to show how @northpolesec.bsky.social Santa FAA rules lockdown the Spotlight importers used in Sploitlight microsoft.com/en-us/securi... &
@theevilbit.bsky.social's persistence trick.

I also added an example rule for blocking access to the DBs.

Going to be attending @bsideslv.org and around. Summer camp.

If you’re around say hello.

This was a big release. Getting CEL in opens up so many possibilities and like all good things it's a take what you need.

Really looking forward to seeing what people do with this.

Lots of great features in 2025.5.

Santa is now easier to use without having to drop to the command line.

Be sure to check out the videos in the 🧵

It’s something that feels like the sci-fi future media promised us as kids

Yikes. Got any other FRs? Asking for a friend…

Have to admit it's exciting to see years of work coming together.

YouTube video by SpecterOps Modern macOS Red Teaming Tactics | SO-CON 2025

Very exciting to see Santa called out as a tool that works in the
@specterops.io SO-Con talk on Modern macOS Red Teaming Tactics by Lance Cain and @werdhaihai.bsky.social

www.youtube.com/watch?v=t_L2...

I hear it’s straight fire🔥… I’ll see myself out.

Release v2025.4 · northpolesec/santa Notes If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade. Santa documentation can be found at northpole.dev. Announcements 📣 Opt-In Stats Collection...

📢 Last week we released Santa v2025.4 github.com/northpolesec...

Along with some big changes 🧵

I keep saying these advances are more like electric power tools than fully autonomous. Still means massive productivity gains and chat is now a first class interface in a way it wasn’t feasible previously

I’m still kinda angry about the whole matter tbh

a man in a suit and tie stands in front of a sign that says the work is mysterious ALT: a man in a suit and tie stands in front of a sign that says the work is mysterious

Also re:0-day

I mean I get the fascination it’s pure tech and a narrative that’s often a combo of how clever someone is versus the defenses in place.

On the other hand brute forcing passwords, out of date applications and simple malware are still problems for people. So I’m with you.

Arm me with harmony

Release v2025.3 · northpolesec/santa Notes If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade. Santa documentation can be found at northpole.dev. Announcements 📣 Opt-In Stats Collection...

Today we released Santa v2025.3 on GitHub github.com/northpolesec....

This release includes a handful of new features.

GitHub - pmarkowsky/santa-mcp: A PoC MCP Server for Santa A PoC MCP Server for Santa. Contribute to pmarkowsky/santa-mcp development by creating an account on GitHub.

In order to learn MCP I wrote a quick server on top of
@northpolesec.bsky.social's Santa github.com/pmarkowsky/s... it provides readonly functionality and debugging.

Oh?

Good thing it has that builtin stack overflow www.geoffchappell.com/notes/securi...

Got sent this from a friend and admittedly I'm still chuckling.

Snippet of the CISA guide recommending that you use Santa to stop living off the land attacks on macOS

We agree with CISA and think you should use Santa too

www.cisa.gov/sites/defaul...

Today in adventures in open source. We've had one user make a PR to update docs 🎉

And on a call a user said thank you for what you folks are doing in the community.

Not gonna lie this is pretty great to be on the receiving end of this.

Release v2025.2 · northpolesec/santa Notes If you're migrating from Google Santa, please see the Migration Guide for details on how to upgrade. Santa documentation can be found at northpole.dev. Announcements 📣 Opt-In Stats Collection...

📣 We’ve just released Santa v2025.2 on GitHub. github.com/northpolesec...

Some highlights include:

- Process-centric File Access Authorization rules are now in Beta!

This means FAA rules can now target all access from a given process without knowing the files that will be accessed ahead of time.

Shmoo was an amazing con. Sad to have missed the final as I went to the first one and it was the first con I ever spoke at