building solutions to secure worlds. all thoughts / opinions (if at all) are my own. labs @thinkstcanary - prev. founder @deceptiq_ (acq.)
London, England.
Joined April 2022
- Tweets1.2K
- Following88
- Followers10.4K
- Likes6.2K
Pinned Tweet
Linux deserves the same care every other platform gets.
lindm v0.1.0: a self-hosted, open-source MDM for Linux fleets. Your server, your devices.
github.com/radkawar/lindm
You remember seeing it. You don’t remember where.
Screenlogger remembers.
0.2.0 brings a fresh UI, less disk usage, and search powered by local @googlegemma embeddings.
An always-on screen recorder for Mac. Describe what you saw. Find it again.
All on your Mac.
I've open-sourced lindm: a self-hosted MDM for Linux fleets:
- Enroll devices,
- Push profiles with staged rollouts,
- TPM disk encryption with escrowed keys,
- Lock and Wipe,
- OS update windows,
- And remote assistance with user consent.
github.com/radkawar/lindm
Rad retweeted
You can watch the full talk here:
youtube.com/watch?v=dNtqZJmt…
Diaspore can now run itself which is a wild accomplishment.
In the image:
- the playground installs diaspore from PyPI
- compiles a workflow
- pauses it into JSON and resumes it
- all in your browser.
Check it out for yourself...
radkawar.github.io/diaspore/…
Write Python, ship JSON, run it anywhere, sandboxed.
Think WASM but extra steps!
- embed it in Go, Node, Lua or Python
- compile Python without Python
- durable execution across runtimes
Source: github.com/radkawar/diaspore
Playground: radkawar.github.io/diaspore
Write Python, ship JSON, run it anywhere, sandboxed.
Think WASM but extra steps!
- embed it in Go, Node, Lua or Python
- compile Python without Python
- durable execution across runtimes
Source: github.com/radkawar/diaspore
Playground: radkawar.github.io/diaspore
I've been using stackd a lot to throw agents in this AWS sandbox and see what they do - but they love cheating.
As a start to making it harder for them to cheat:
Finally: opt-in native networking for stackd!
Get resource hostnames, local HTTPS with a scoped dev CA, and DNS inside Lambda/ECS/CodeBuild.
Automatic, reversible host split DNS all without replacing your normal DNS or disabling TLS verification.
Is it magic - no it's just stackd!
stackd is out: AWS on your own machine, running a very good approximation of the real thing.
Existing AWS emulators weren't enough for me, especially for what I wanted from Organizations, CloudTrail and EventBridge.
I've had a lot of fun on the data plane. For example:
- EC2: RunInstances boots actual QEMU/KVM VMs
- EKS: real k3s clusters with add-ons and audit logs
- ECS and CodeBuild: real Docker containers
Naturally, the control plane gets just as much attention:
- IAM policy evaluation with SCPs, RCPs, permission boundaries and session policies
- AWS Organizations: delegated admins, effective policies, cross-account access
- STS, SAML/OIDC federation, Identity Center, KMS
Every call is recorded. CloudTrail trails can deliver to S3 or CloudWatch Logs, or (my favourite) to EventBridge, where rules are matched and events dispatched to their targets.
You can follow a single API call end to end:
IAM -> resource -> audit log -> event rule -> target
One Go binary, fully offline, with optional SQLite persistence so you can fork state.
70+ services so far, covering the main ones, with more coverage coming over the next few months.
Still early days, but it's already fun to use. Excited to see where it goes.
github.com/radkawar/stackd
Try it out & file feature gaps as issues etc and I'll get right on it
github.com/radkawar/stackd
in for a penny, in for a pound.
That being said, while @grok did get like everyone in the wrong tiers.
Two friends it did not get wrong for the top tier are:
- @BouncyHat
- @UNC1739
I suggest following bot; I learn and have learnt an outstanding amount from them.
stackd is out: AWS on your own machine, running a very good approximation of the real thing.
Existing AWS emulators weren't enough for me, especially for what I wanted from Organizations, CloudTrail and EventBridge.
I've had a lot of fun on the data plane. For example:
- EC2: RunInstances boots actual QEMU/KVM VMs
- EKS: real k3s clusters with add-ons and audit logs
- ECS and CodeBuild: real Docker containers
Naturally, the control plane gets just as much attention:
- IAM policy evaluation with SCPs, RCPs, permission boundaries and session policies
- AWS Organizations: delegated admins, effective policies, cross-account access
- STS, SAML/OIDC federation, Identity Center, KMS
Every call is recorded. CloudTrail trails can deliver to S3 or CloudWatch Logs, or (my favourite) to EventBridge, where rules are matched and events dispatched to their targets.
You can follow a single API call end to end:
IAM -> resource -> audit log -> event rule -> target
One Go binary, fully offline, with optional SQLite persistence so you can fork state.
70+ services so far, covering the main ones, with more coverage coming over the next few months.
Still early days, but it's already fun to use. Excited to see where it goes.
github.com/radkawar/stackd
Attackers only have to get it right once. Defenders have to get it right every time.
At #HumanX, @nikesharora explains why that imbalance and vulnerabilities across enterprise infrastructure will drive a major IT overhaul in the years ahead.
if you're looking at a new (security) product one of the first things I do is go to
crt.sh / dnsdumpster and look or check csp responses to find dev instances
many such cases where security products will have source maps still enabled!
another fun and common thing is that a lot of them hide documentation "behind auth" but as e.g they use a react markdown plugin they end up embedding the markdown in the bundled js assets -_-
as a funny tidbit - tines's new 3b product had source maps when I last looked! (and it wasn't even a dev instance!?)