Jason Parker

Punycode/IDN testing.

See primary account: @north

Creator of https://v.jeltz.org, a free Mastodon verification system that allows any user to get a verified link in their profile - no setup/registration required.

https://ဪ.com
https://ㆲ.com
https://የ.com
https://ގ.com
https://ჷ.com
https://ꩳ.com *
https://ꩰ.com *
https://ྌ.com *
https://ㆴ.com
https://ۦ.com

(*=Mastodon bug)

Public Key

npub17csmz6jrsukee599d54v88l56a79med2zaeyq5psf0hj6jrkmatsnlxk5s

NIP-05 Address

north_at_xn--8r9a.com@mostr.pub

Profile Code

nprofile1qqs0vgd3dfpcwtvu6zjk62krnl6dwlzauk4pwujq2qcyhmedfpmd74cnadn4q

Author Public Key

npub17csmz6jrsukee599d54v88l56a79med2zaeyq5psf0hj6jrkmatsnlxk5s

Show more details

Last Notes

2024-10-01 13:22:25

- reply

@npub1527…eh7n it used to. If I went to a person's comment, it would grab a bunch of replies. Now it just shows me this.
https://xn--8r9a.com/system/media_attachments/files/113/232/375/907/179/475/original/fa8b80614c436106.png

2024-10-01 13:16:59

Does Mastodon 4.3 no longer fetch remote comments?

2024-09-26 16:52:24

Another #cybersecurity #vulnerability #disclosure for today: Granicus GovQA.
Several critical vulnerabilities were identified in Granicus's GovQA, a platform used by government agencies for case and document management. These vulnerabilities included the leakage of usernames and emails, the ability to reset passwords without answering security questions, and the capability to reset any password without knowing the username.
https://govtech.cc/README-2024-09-26-granicus-govqa.md
#infosec

2024-09-26 14:12:44

Another day, another #cybersecurity #vulnerability #disclosure: Thomson Reuters C-Track #court eFiling.
An insufficient permission check vulnerability in the C-Track eFiling system allowed users to assign themselves privileged roles, such as "Clerk," during the registration process. By manipulating form data, attackers could gain unauthorized access to administrative functionalities and sensitive court data.
https://govtech.cc/README-2024-09-26-thomson-reuters-ctrack.md
(For those counting, this marks the thirteenth vulnerable court platform.)
#infosec

2024-09-20 13:27:10

- reply

@npub1vcl…k6t3 That could be expanded from RSS to Fedi posts too, no?

2024-09-18 22:14:30

"The people of Georgia and, really, the whole United States owe you a huge debt of gratitude. But unfortunately they'll never even know that." -a lawyer I've been engaged with
As much as I'd love to share this one, I can't. Maybe I'll be able to talk about it some day, but if you've been following me for a while, you can probably read between the lines.
What I can say is that this is a really fucking weird feeling.

2024-09-11 14:06:16

I called the support department of a vendor for a platform I found some vulns in (after emails to security@<domain> bounced and support@<domain> went ignored). I explained who I was and that I was trying to figure out how to report the vulns. They hung up on me. Twice.
Emails to the CISO, CEO, and legal dept have thus far gone ignored.
Fun.

2024-09-11 00:47:48

- reply

@npub1527…eh7n I just had to deal with this today!
In your .env files, set ALLOWED_PRIVATE_ADDRESSES=192.168.0.0/16 (or whatever)

2024-09-06 00:21:41

⁂ is a terrible symbol to use for the #Fediverse because it can't be used as a subdomain. You should be able to make ⁂.foo.social, just as you can mastodon.foo.social and pleroma.foo.social. People will definitely try it and it won't work out for them; they'll end up just seeing xn--kwg.foo.social, which is stupid.
(I think I'm safe to consider myself the authority on Unicode domain names.)

2024-09-04 17:16:28

We've all seen the various gender selection forms. How about we just go with this?
🟩 Male
🟩 Female
🟩 It's Complicated

2024-08-15 13:45:05

I start my first job in #cybersecurity in about a week and a half. What are some tips you wish people would have told you?

2024-08-14 14:43:22

Developers: Stop using sequential numbers for IDs; just use a UUID. Please?

2024-08-12 13:29:47

They cited my research! I was (and, honestly, still am) unbelievably excited when I saw this.
https://www.lawyerscommittee.org/wp-content/uploads/2024/08/Notice-Letter-Pursuant-to-the-NVRA-Re-Voter-Cancellaton-Portal.0806204.pdf
(Originally posted by @npub1scj…pdxj while this instance was down for several days.)

2024-08-12 00:40:57

No, you moved and took your Mastodon server down for 4 days.

2024-08-05 22:31:48

- reply

And on Atlanta News First -- with a demo video by yours truly!
https://www.atlantanewsfirst.com/2024/08/05/security-flaw-allowed-anyone-request-cancellation-georgia-voter-registrations/

2024-08-05 22:16:26

https://www.propublica.org/article/cybersecurity-expert-finds-another-flaw-in-georgia-voter-portal
Oh hey, that's me!

2024-08-05 17:01:54

Is there a navigation app that takes vehicle clearance into account? I'll be driving a 16' truck with an 11' (I think) clearance on a ~1,000 mile trip. Neither Google Maps nor Waze allow you to set that.

2024-08-05 14:10:53

@npub14qs…qwuh Is there a better schedule link than https://forum.defcon.org/calendar ?
It freezes and never loads on multiple browsers and has for at least a week.

2024-08-05 11:21:27

A little birdie tells me that the Georgia Secretary of State is going to learn all about my findings this morning.
Can't find a way to report vulnerabilities? Let the media do it!

2024-08-03 05:33:47

I just discovered that I can bypass the SSN / DL requirement on Georgia's #voter deregistration (wtf?) page at https://cancelmyregistration.sos.ga.gov/s/
All an attacker needs is name, county of residence, and birthdate.
#cybersecurity #infosec #georgia #GA #election

2024-08-02 18:51:36

I'll soon be able to call myself a #cybersecurity professional. I just received word that this company, to whom I've sent 6-8 vulnerabilities, will be sending me an offer for a mid-level position some time next week.
I'll no longer be doing software development (primarily -- there will still be a little bit), after 20 years.

2024-08-02 17:36:23

- reply

also SMS is not 2FA

2024-08-02 17:32:01

I signed up for an account somewhere the other day.
When I log in, I have two options for 2FA. Email or SMS. I never gave them my phone number.
When I select email, it sends the code to the login email, as expected.
When I select SMS, I asks me which phone number I'd like to use to set it up. It then sends me a code, which allows me to completes the login.
That's...uhh...

2024-07-26 01:02:14

I was just talking to my car insurance company and they asked me what gender was listed on my license. It occurred to me that men and women have different rates at different age ranges.
But what about non-binary (or, more specifically, people with an X on their license) people?
I'd be very curious to hear from any trans and non-binary folks about whether car insurance rates were affected once license was switched over.

2024-07-25 23:12:39

My 19 year old is going to start a cybersecurity/IT degree this fall, after doing a year in music education.
His first step was getting his Security+ cert a few days ago (along with a few Cloud Security certs on Coursera). That's more than I have and I'm actively looking for a job in the field (*ahem* #GetFediHired).
He's always had his shit way more together than I ever have. I guess that makes me an okay parent?

2024-07-19 14:01:03

Tip: If your IT dept says that under no circumstances should you reboot your computer, you can take the entire day off by rebooting your computer.
#CrowdStrike

2024-07-19 13:09:27

- reply

@npub1vcl…k6t3 This is why I never patch my systems.

2024-06-27 13:22:19

A vulnerability (discovered by me) in NYPD's public office profile site allowed attackers to serve malware and modify disciplinary records.
https://www.cityandstateny.com/politics/2024/06/nypd-officer-database-had-security-flaws-could-have-let-hackers-covertly-modify-officer-data/397688/
#infosec #cybersecurity #nypd

2024-06-18 13:54:21

It isn't often that you wake up to your work being the Forbes cover story.
https://www.forbes.com/sites/emilybaker-white/2024/06/18/sealed-records-courts-breach/
#infosec #cybersecurity #law

2024-05-28 01:54:50

https://arstechnica.com/security/2024/05/crooks-plant-backdoor-in-software-used-by-courtrooms-around-the-world/
"Disorder in the Court" is a clever tagline, @npub1hyp…aehm 🤨
https://govtech.cc/README-2023-11-30-disorder-in-the-court.md
Please change it.
#infosec

2024-05-23 15:06:30

I just managed to score a meeting with staff for the Senate Judiciary Committee in ~2 weeks. Things could get very interesting, very quickly. Now I just need to figure out which #vulnerability I can demonstrate.
#infosec

2024-05-20 16:10:51

An unspecified vulnerability was discovered in an unspecified platform from an unspecified vendor. The vulnerability allowed an attacker to do something.
Yeah, fuck that. It's been beyond my control, for other reasons, but I'll likely be publishing this tomorrow.
I am never working with Synack / ResponsibleDisclosure.com ever again.
#infosec
https://xn--8r9a.com/system/media_attachments/files/112/474/271/346/425/994/original/b6a913318513e0b1.png

2024-05-19 15:50:59

I'm working on a game thing.
I could use some testing from those so inclined, especially if they have a gamepad connected to their PC (though keyboard is also supported). It does nothing right now except move a sprite around an empty screen, but I need to check a few things.
https://e.ꩰ.com:1444/viewer/viewer_overlay.html?userId=
(optionally add a userId)
Edit: For keyboard, you can use up/down/left/right or wasd. Gamepad is dpad or left stick.

2024-05-16 22:28:32

I received a batshit email as service on Georgia v. Trump. It's a Motion to Intervene from a random person. It was apparently rejected by the clerk (for good reason), so they decided to send it to us individually.
It's a total of 59 pages plus an appendix of 594 pages (that is not a typo). The Table of Contents for the Motion is three full pages.
https://xn--8r9a.com/system/media_attachments/files/112/453/119/923/125/139/original/0fe92fda52ba825a.png

2024-05-11 19:49:37

I decided to buy https://govtech.cc and just 302 redirect it to my disclosures page on GitHub. I wonder what I can do to #SEO it.
#infosec

2024-05-11 14:03:10

I love it when people point me to new and interesting platforms. :sip:
#infosec #nypd

2024-05-08 19:02:06

I'll give this a shot.
I'm looking to #GetFediHired for a role in #cybersecurity. I've done both offensive (see e.g. https://github.com/qwell/disclosures/) and defensive security work, and have over 20 years of software development experience in many different languages.
ISC2 CC
DMs always open.
#FediHire #FediHired (we should pick a hashtag and stick with it) #InfoSec

2024-05-08 12:24:08

https://www.law360.com/articles/1834080/cybersecurity-flaws-uncovered-in-3-states-e-filing-systems (paywalled, trial available)
About my latest #infosec findings.

2024-05-07 13:07:59

I'm looking to borrow (it's $200 and I'm not buying it) a copy of an extremely niche book from a law school library for a week or so. It's called "Cybersecurity and the Courthouse: Safeguarding the Judicial Process".
It should be very useful for all of my recent #cybersecurity work in that area (see https://github.com/qwell/disclosures/).
If you, dear reader, have access to such things, I'd like to have a chat to see what we can figure out.
Boosts highly appreciated.
#infosec #law #library