🎙️ For the @MDOYVR podcast, we added a complete transcription to increase its accessibility. We use @auphonic's AI transcription feature to bring this to the pod and have been impressed with the ease.

🗣️ Check out our latest conversation 😎 Mat X and I had with Kandji's @theevilbit. Join us June 11-13, 2025, in Vancouver, BC 🇨🇦 to continue the conversation with speakers like Csaba and more!

📝 Have you seen the transcripts? What do you think? https://mdopod.com/researching-vulnerabilities-with-csaba-fitzl/

I've recently been working to understand what triggers certain TCC prompts on macOS. During this investigation I noticed something that many prior analyses of TCC overlook: TCC prompts can be triggered not only by system frameworks, but by the Sandbox kernel extension in response to rules defined by the platform sandbox policy.

My latest blog post documents the sandbox features behind this and provides examples of some of the responsible sandbox policies.

https://bdash.net.nz/posts/tcc-and-the-platform-sandbox-policy/

Oh interesting, as part of Private Cloud Compute source code, Apple also open sourced (of sorts) the Endpoint Security API client that they seem to be running on PCC:

https://github.com/apple/security-pcc/blob/main/SecurityMonitorLite/securitymonitorlited/ESClient.swift

The Apple Security Research blog now has an RSS feed, though it’s not properly advertised.

https://security.apple.com/blog/feed.rss

I'm super excited to share that we've launched the Private Cloud Compute Security Guide and Virtual Research Environment. This is a huge step forward for cloud AI compute and I'm looking forward to the broader security community digging in!

https://security.apple.com/blog/pcc-security-research