tmaher

Tom Maher (he/him) 🏳️‍🌈🏴🐻 in Dublin
Signal: tmaher.43

.: https://github.com/tmaher
..: https://www.linkedin.com/in/god-emperor

Last Notes

2026-10-23 15:04:18 GMT

- reply

congrats!

2026-10-21 09:50:09 GMT

- reply

happy anniversary

2026-10-20 20:50:40 GMT

- reply

I will die angry that x509 name constraints never caught on. It wouldn’t have prevented the random number fail, but sure could have limited the blast radius.
https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10

2026-10-14 20:00:53 GMT

- reply

this is what I’m afraid of for Ireland’s new naturalization civics test they just announced.

2026-09-25 12:14:55 GMT

- reply

This post raises my Ire

2026-08-14 11:37:07 GMT

- reply

thank you for the breakdown. I am trying really hard to fix my American biases, and I’m grateful for the reassurance this isn’t one of those times I’m biased. The signs are legit confusing !

2026-08-10 09:52:56 GMT

- reply

preferred currency?

2026-08-04 12:20:52 GMT

- reply

The big red eye looks like it’s in a broken summoning circle. This is beautiful.

2026-07-07 21:15:14 GMT

- reply

oh I see https://www.itu.int/rec/dologin_pub.asp?lang=e&id=T-REC-X.680-202102-I!!PDF-E&type=items
In the data structures themselves. Yea I would be very interested in an example of it being Turing complete

2026-07-07 20:29:06 GMT

- reply

maximum gayness in all things.
I don’t think it is. There’s no branching or flow control that I know of. Maybe there’s some trick in the module import feature that gets you to recursion accidentally. I’m very much not a theorist, though.
What’s the Yes argument?

2025-09-18 16:46:54 GMT

- reply

where are you seeing reference to symmetric keys?
In the Technical Details section on Actor Tokens, it says “These hybrid setups used to provision a certificate credential on the Exchange Online Service Principal (SP) in the tenant, with which it can perform authentication.” . Adversary would then use the (x509) cert (and private key) to authN to eSTS (the Entra IdP), get one of these wacky “Actor Tokens” that AAD Graph doesn’t validate properly.
eSTS does support both x509 and client secrets for an SP to authN, but client secrets are just CSPRNG-generated passwords. They’re bearer tokens, not symmetric AES or RC4 keys.
I’d argue the causes were the ad-hoc “Actor Tokens” for impersonation (wrapping in an unsigned JWT: what the heck?), and that AAD Graph still hasn’t been shut down. It’s been deprecated since before I joined MS Identity in 2020, and has been a steady source of vulns