Cofounder & CEO @northpolesec Prev: @google working on Security Agents including Santa. Cofounder and Chief Architect @capsule8 (tweets are my own.)
Brooklyn, NY
Joined January 2009
- Tweets7.1K
- Following609
- Followers899
- Likes8.8K
One thing I do fear out of all the change is compliance teams not keeping up with the rate of change and actually making you more vulnerable.
I’ve had one team say to me that AI audits are static analysis only and that distroless containers should be rethought so you can add AV / EDR.
Every other year I keep looking back at Akin's Laws of Space craft design as adages for software
e.g. 20. A bad design with a good presentation is doomed eventually. A good design with a bad presentation is doomed immediately.
Rings very true.
Pete Markowsky retweeted
Apple made a list. Santa still checks it twice. 🎅
macOS 27's App Settings validates what we've said for 10+ years: Macs need execution control.
But running it across a fleet takes more than a static list.
northpole.security/blog/maco…
Pete Markowsky retweeted
Santa and Workshop 2026.8 are out.
Santa has always answered "what is allowed to run." This release adds "when." One rule can allow an app during working hours and block it the rest of the week, with an optional kill when the window closes.
northpole.security/blog/rele…
We made it possible for Santa to stop the pid_suspend call against a client. SIGKILL and SIGSTOP still left as an exercise for the reader because legitimate updaters still use these.
Longer form explainer here northpole.security/blog/edr-…
Thanks for calling this out @patrickwardle
Reminder: 🍎-security tools subscribing to ES AUTH_* events must respond before an ES deadline (~15s) or the kernel kills them ...& they stay ☠️
Privileged attacker? SIGSTOP the tool ...⏳💥😂
Mitigation (per @PeteMarkowsky) subscribe to/block signals!
docs.google.com/presentation…
Been enjoying this version of @kendricklamar 's Squabble Up with 2000s hits as the backing tracks
youtube.com/watch?app=deskto…
Pete Markowsky retweeted
Today we passed a milestone: more PRs merged into Santa at North Pole Security than in ten years at Google.
Huge respect for Santa's decade @Google, but it's been amazing to watch this team move.
Lots of things I agree with in here.
In particular the idea that we should be working more on invariants and measuring deviations from them rather than playing whack a mole with patching.
dadrian.io/blog/posts/whack-…
Very excited for @northpolesec to sponsor OBTS. It’s one of the best conferences and communities out there.
Santa was even featured in an OBTS v1 talk objectivebythesea.org/v1/tal…
It’s great to be able to give back.
Stoked that @northpolesec is now an official Friend of Objective-See, supporting our Apple security conference (#OBTS), free open-source tools, and many other community efforts!
Mahalo for your support of our mission & the Apple security community! 🤗♥️
northpole.security
Time to head home.
It was great meeting with customers and friends both new and old.
Until next time.
Going to @defcon for the first time in a decade plus.
What should I look for? Any advice?
