There’s a semi-infrequent-but-frequent-enough-to-be-annoying manual task at $DAYJOB that involves extracting a particular set of strings (identifiable by a fairly benign set of regular expressions) from various interactive text sources (so, not static documents or documents easily scrape-able). Rather than hack something onto Sublime Text or VS Code I made a small macOS app in SwiftUI… Continue reading
Making macOS Universal Apps in Swift with Universal Golang Static Libraries
There are a plethora of amazingly useful Golang libraries, and it has been possible for quite some time to use Go libraries with Swift. The advent of the release of the new Apple Silicon/M1/arm64 architecture for macOS created the need for a new round of “fat”/”universal” binaries and libraries to bridge the gap between legacy… Continue reading
Avoiding The mdls Command Line Round Trip With swiftr::swift_function()
The last post showed how to work with the macOS mdls command line XML output, but with {swiftr} we can avoid the command line round trip by bridging the low-level Spotlight API (which mdls uses) directly in R via Swift. If you’ve already played with {swiftr} before but were somewhat annoyed at various boilerplate elements… Continue reading
Quick Hit: Processing macOS Application Metadata Weirdly Fast with mdls and R
(reminder: Quick Hits have minimal explanatory blathering, but I can elaborate on anything if folks submit a comment). I’m playing around with Screen Time on xOS again and noticed mdls (macOS command line utility for getting file metadata) has a -plist option (it probably has for a while & I just never noticed it). I… Continue reading
Check ‘Developer Tools’ First To Avoid Heavy-ish Dependencies
Guillaume Pressiat (@GuillaumePressiat) did a solid post & video on using Selenium to scrape a paginated table from understat[.]com/league/EPL/2020 (I just cannot bring myself to provide an active link to any SportsBall site). He does a great job walking folks through acquiring & orchestrating the heavy dependency that is Selenium. I did a quick “look… Continue reading
Help Your Mac Stand Between The Darkness And The Light with GreyWatch
Greynoise helps security teams focus on potential threats by reducing the noise from logs, alerts, and SIEMs. They constantly watch for badly behaving internet hosts, keep track of the benign ones, and use this research to classify IP addresses. Teams can use these classifications to only focus on things that (potentially) matter. They also have… Continue reading
Retrieve Process Run-time Architecture on Apple Silicon Macs On The Command Line with `archinfo`
Apple M1/Apple Silicon/arm64 macOS can run x86_64 programs via Rosetta and most M1 systems currently (~March 2021) very likely run a mix of x86_64 and arm64 processes. Activity Monitor can show the architecture: but command line tools such as ps and top do not due to Apple hiding the details of the proper sysctl() incantations… Continue reading
Brimming With Possibilities: Query zqd & Mine Logs with zq from R
Brim Security maintains a free, Electron-based desktop GUI for exploration of PCAPs and select cybersecurity logs: along with a broad ecosystem of tools which can be used independently of the GUI. The standalone or embedded zqd server, as well as the zq command line utility let analysts run ZQL (a domain-specific query language) queries on… Continue reading