7 min read
App Store Connect API 4.5.1 Touches Nothing Your Identity Stack Depends On
No change to Sign in with Apple's token endpoints, App Attest, or signing requirements. But the reflex to skim and assume it…
Azure · Cybersecurity · AI
Enterprise IT, rewritten in real time.
Field notes on Azure, identity, and the AI shift changing how enterprise IT actually runs — from someone shipping the fixes, not just the takes.
The latest
Recent writing, newest first.
4 min read
Domain Validation Is Dead. Certificate Transparency Won.
Attackers took over three country-code domain registries and issued valid HTTPS certificates for Google domains. Every validation method the CAs checked passed—because…
2 min read
The Import-Export API Reaches Group Mailbox Folders the Mail API Won’t Touch
Point Graph's /messages endpoint at a Microsoft 365 group and you'll get the Inbox. Sent Items, Drafts, and custom folders require the…
4 min read
Three things to check before you trust Teams’ new impersonation warning
Display-name spoofing has let attackers join Teams meetings as fake executives for years. Microsoft's new Impersonation Protection flags mismatched names against Entra…
5 min read
I gave an ETL account bulkadmin for a week — it’s not the least-privilege win everyone’s selling
SQL Server 2025 CU9 and 2022 CU27 finally bring bulkadmin to Linux, but the server-wide filesystem access it grants isn't the clean…
4 min read
Apple Ships XProtect Updates With No Release Notes. The Diff Is the Changelog.
When XProtect 5366 landed October 6th, I went hunting for the threat it addressed. Twenty minutes later I learned Apple ships these…