Nostr notes by G :donor: :Tick:

Nostr event nevent1qqstsx998vd0tp4mh6vpsmz7c5xmmkjsc3pwrkgespkp2t9tldqweegzyrtygr5rq6lqu3789g96mp06ftltcfltlccdmu2n7ehs5pxzsufevu528hw

2026-11-01T13:39:11Z

Nostr event nevent1qqsggh8l5s5s6p9sswq2fd69m5fpsxf35v7mr90p8arv073vcmrgmtqzyrtygr5rq6lqu3789g96mp06ftltcfltlccdmu2n7ehs5pxzsufevysk9ql

2026-10-20T21:31:12Z

Public GitHub API responses show 49 Azure repositories were ...

2026-06-05T18:59:46Z

In reply to nevent1q…4h5e
_________________________

Public GitHub API responses show 49 Azure repositories were blocked under GitHub ToS enforcement between 16:00:50 and 16:02:35 UTC on 2026-06-05. The affected repositories are heavily concentrated around Azure Functions, WebJobs, Durable Task, language workers, extensions, connectors, and related runtime/tooling components. This indicates a coordinated bulk block of a product/platform ecosystem rather than isolated repository actions.

Nostr event nevent1qqs2vm5cg5v2qrm8rvyx2m77yclxde0q7uvwuyre8qnsz4kccqf26lqzyrtygr5rq6lqu3789g96mp06ftltcfltlccdmu2n7ehs5pxzsufevdaxnnt

2026-06-05T18:45:03Z

In reply to nevent1q…q5j0
_________________________

So a mate had 8 repos disabled by GitHub that aren't ...

2026-06-05T18:40:32Z

So a mate had 8 repos disabled by GitHub that aren't offensive tooling or exploits but are forks of Azure Functions stuff.

The ones I know of aren’t offensive tooling or exploits - they are all related to azure functions…

I wondered if is related to the durabletask stuff being compromised as part of the GitHub breach the other week.

DurableTask is largely used by azure functions.

3 versions of it were pushed with malware in.

So I wondered if this is an incident response action.

Scanning the Azure org using gh CLI for disabled repos.

The timestamps are unnaturally clustered
Every single repo shows:

updated_at ≈ 2026-06-05 16:00 UTC
pushed_at ≈ 2026-06-05 02:00-07:00 UTC

That’s not organic project activity.

That looks like a bulk operation touching all repos in the set at roughly the same time.

This is clearly not just DurableTask
The blast radius includes:

Core Functions runtimeAll language workersAll durable extensionsCore ToolsWebJobs SDKDocker imagesGitHub ActionsExtension bundlesOpenAI extensionMCP extensionConnector SDKsAgent runtime
This is basically:

“everything related to Azure Functions as a platform”

The stars matter
Some of these are not obscure repos:

Repo Stars
azure-functions-host 2010
durabletask 1718
azure-functions-core-tools 1450
azure-webjobs-sdk 752
durable-extension 764

You don’t casually disable the flagship repos of a major cloud service.

The newer additions are fascinating
These jumped out:

azure-functions-openai-extension
azure-functions-mcp-extension
azure-functions-agents-runtime

Those are AI-era additions.

Which suggests the disablement logic wasn’t:

“disable the historically compromised repo”

It looks more like:

“disable the entire Functions ecosystem”

The Connectors repos are weird
These:

Connectors-NET-SDK
Connectors-NET-LSP
Connectors-NodeJS-SDK
connectors-python-sdk

have:

stars = 0

and are still disabled.

That argues against popularity, malware reports, forks, or stars being the trigger.

They’re simply part of the same family.

fixed it ...

2026-05-20T18:06:19Z

In reply to nevent1q…dhrw
_________________________

fixed it

Nostr event nevent1qqsq98lj6hrffszyyl2h36e6uz4d2ep4ys6q9etw0mpd07j566q4w9czyrtygr5rq6lqu3789g96mp06ftltcfltlccdmu2n7ehs5pxzsufevmqm20u

2026-01-16T15:22:20Z

Hard agree! Love his solo stiff too! Current rotation: ...

2025-09-28T20:49:39Z

In reply to nevent1q…mutf
_________________________

Hard agree! Love his solo stiff too!
Current rotation:

See I started with rock. Then my intro to metal as Iron Maiden. ...

2025-09-28T20:46:09Z

In reply to nevent1q…2zzp
_________________________

See I started with rock. Then my intro to metal as Iron Maiden. So until maybe the last few years I wouldn’t listen to scream/roar/full on harsh vocals. That’s changed as I’ve aged - I still don’t enjoy all roar all the time but I do enjoy it along as there are still discernible lyrics and rhythm/melody.

Depends on mood, I tend to gravitate towards symphonic, goth, ...

2025-09-28T20:37:52Z

In reply to nevent1q…tf2m
_________________________

Depends on mood, I tend to gravitate towards symphonic, goth, NWOBHM, but then also Gojira etc too.

🚨 𝗢𝘂𝘁𝘁𝗮𝗧𝘂𝗻𝗲: 𝗧𝗵𝗲 ...

2025-08-04T21:40:28Z

🚨 𝗢𝘂𝘁𝘁𝗮𝗧𝘂𝗻𝗲: 𝗧𝗵𝗲 𝘀𝗼𝗿𝘁𝗮, 𝗻𝗼𝘁-𝗿𝗲𝗮𝗹𝗹𝘆, 𝗳𝗶𝘅

Earlier this year, I disclosed a security flaw in Microsoft Intune’s Conditional Access device filtering — where attackers with local admin rights could 𝙨𝙥𝙤𝙤𝙛 𝙙𝙚𝙫𝙞𝙘𝙚 𝙥𝙧𝙤𝙥𝙚𝙧𝙩𝙞𝙚𝙨 like device.model to 𝙗𝙮𝙥𝙖𝙨𝙨 𝙥𝙤𝙡𝙞𝙘𝙮 𝙚𝙣𝙛𝙤𝙧𝙘𝙚𝙢𝙚𝙣𝙩.

At first, it was marked “𝘽𝙮 𝘿𝙚𝙨𝙞𝙜𝙣.”
Then “𝙈𝙤𝙙𝙚𝙧𝙖𝙩𝙚 𝙨𝙚𝙫𝙚𝙧𝙞𝙩𝙮.”
Now, Microsoft says it’s “𝙛𝙞𝙭𝙚𝙙.”

🩹 𝗪𝗵𝗮𝘁 𝗰𝗵𝗮𝗻𝗴𝗲𝗱?
• Documentation now warns that 𝙨𝙤𝙢𝙚 𝙙𝙚𝙫𝙞𝙘𝙚 𝙥𝙧𝙤𝙥𝙚𝙧𝙩𝙞𝙚𝙨 𝙖𝙧𝙚 𝙪𝙣𝙩𝙧𝙪𝙨𝙩𝙚𝙙
• UX nudges were added in the CA policy editor and dashboard
• My name will appear in the MSRC researcher acknowledgements

🔐 𝗪𝗵𝗮𝘁 𝗱𝗶𝗱𝗻’𝘁 𝗰𝗵𝗮𝗻𝗴𝗲?
• 𝙉𝙤 𝙩𝙚𝙘𝙝𝙣𝙞𝙘𝙖𝙡 𝙘𝙤𝙣𝙩𝙧𝙤𝙡𝙨 prevent tampering
• Attackers can still 𝙢𝙤𝙙𝙞𝙛𝙮 𝙧𝙚𝙜𝙞𝙨𝙩𝙧𝙮 𝙫𝙖𝙡𝙪𝙚𝙨 and pass Conditional Access checks
• 𝘿𝙚𝙫𝙞𝙘𝙚 𝙩𝙧𝙪𝙨𝙩 𝙞𝙨 𝙨𝙩𝙞𝙡𝙡 𝙬𝙧𝙞𝙩𝙖𝙗𝙡𝙚 𝙗𝙮 𝙩𝙝𝙚 𝙙𝙚𝙫𝙞𝙘𝙚

New blog post here →
🔗 https://cirriustech.co.uk/blog/outtatune-tunedout/

If you rely on Intune or Entra for Zero Trust enforcement, 𝗿𝗲𝗮𝗱 𝘁𝗵𝗶𝘀.
And maybe… stop trusting the registry.

#Microsoft #Intune #Entra #ConditionalAccess #EndpointSecurity #OuttaTune #CyberSecurity #Bypass #ZeroTrust #DefenseEvasion

They're responding really well! Quick, clear, decisive!

2025-05-10T22:46:32Z

In reply to nevent1q…eguc
_________________________

They're responding really well! Quick, clear, decisive!

If anyone has cyber security contacts at Celebrity Cruises let me ...

2025-05-10T09:17:22Z

If anyone has cyber security contacts at Celebrity Cruises let me know please

I uncovered a trivial to execute bypass of Conditional Access via ...

2025-04-28T21:37:08Z

I uncovered a trivial to execute bypass of Conditional Access via Microsoft Intune - if you are using device filters, you need to read this now!

#Microsoft #Entra #Intune #ConditionalAccess #SecurityFeatureBypass #SecurityVulnerability #MSRC

https://cirriustech.co.uk/blog/outtatune-vulnerability/

This is kinda cool - my #Azure #VaultRecon vulnerability (that ...

2025-03-23T12:38:34Z

This is kinda cool - my #Azure #VaultRecon vulnerability (that #Microsoft say is by design and is not a vulnerability) is now listed in the #CloudVulnDB 🤩 #SecurityResearch —#CloudSecurity #KeyVault #Enumeration #SharingIsSecuring #WeAllWinTogether 🤘🏻💪🏻

https://www.cloudvulndb.org/azure-vault-recon-keyvault-secret-metadata-control-plane-exfiltration

It’s being sunsetted on December 1st 2025 BTW: ...

2025-02-22T00:04:50Z

In reply to nevent1q…4mc6
_________________________

It’s being sunsetted on December 1st 2025 BTW: https://help.clearbit.com/hc/en-us/articles/6987867587607-Legacy-Logo-API-I-FAQ

Thing is, just as you’re within your rights to object to them, ...

2025-02-16T22:45:40Z

In reply to nevent1q…ep9n
_________________________

Thing is, just as you’re within your rights to object to them, I’m within my rights to use them.

I get the reasons you might have for boycotting AI imagery or even AI full stop.

My content is still written by me if that matters.

What if the author just has no artistic talent? I used to use ...

2025-02-16T22:05:40Z

In reply to nevent1q…07g4
_________________________

What if the author just has no artistic talent?
I used to use unsplash images but I do find I use AI generated images for my blog hero image more often as time goes on.

Timeline cleanse ...

2025-02-16T21:16:17Z

Timeline cleanse