oss-security - Re: Poppy: XPC Observability & Fault Injection

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260515205707.GA23012@openwall.com>
Date: Fri, 15 May 2026 22:57:07 +0200
From: Solar Designer <solar@...nwall.com>
To: Stuart Thomas <stuartpaulthomas@...il.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Poppy: XPC Observability & Fault Injection

On Fri, May 15, 2026 at 09:21:47PM +0100, Stuart Thomas wrote:
> Poppy: XPC Observability & Fault Injection
> 
> Dynamic analysis toolkit for macOS daemons. Trace XPC messages, map
> entitlement checks in real-time, and perform targeted fault injection via
> Frida and DTrace.
> 
> https://github.com/jetnoir/poppy

As a moderator, I let this through as an exception.  We do allow
occasional announcements of new security tools in here, and even
major version updates (but not minor ones).  However, the tools have to
be Open Source, and this one is not exactly that - it has source code
available for non-commercial use, which wouldn't qualify as Open Source.
So strictly speaking, this is off-topic, and I don't intend to accept
messages announcing further updates of this tool.

Similarly, for vulnerability reports generally the affected component
has to be Open Source, but occasional exceptions are possible when there
is other relevance to open source (e.g., for hardware or proprietary
platform vulnerabilities that we mitigate in Open Source software).

I am posting this follow-up in part due to the overall increase of
activity here.  New people join and/or try to post without knowing what
this list is about.  I end up rejecting some messages, sometimes after
research and/or off-list discussion with the sender.  This takes time.
Just now it looks like I'll need to discuss another submission by Stuart
with him off-list before deciding on it.

So please check the list charter before starting to post:

https://oss-security.openwall.org/wiki/mailing-lists/oss-security

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.