Why Nostr? What is Njump?

Jason Parker (he/they)

https://xn--8r9a.com/@north

#infosec researcher | independent #journalist | software developer | #telephony #engineer | #opensource contributor

ISC² Certified in Cybersecurity (CC)

The foremost expert on court #cybersecurity vulnerabilities? https://govtech.cc

https://en.wikipedia.org/wiki/Jason_Parker_(security_researcher)

#IDN/#Punycode testing.

https://ဪ.com
https://ㆲ.com
https://የ.com
https://ގ.com
https://ჷ.com
https://ꩳ.com *
https://ꩰ.com *
https://ྌ.com *
https://ㆴ.com
https://ۦ.com
https://ۦ.ws
https://ӿ.social *

(* = Mastodon bug)

Verifibation™️: https://v.jeltz.org
Jeltz: https://jeltz.org
Disclosures: https://govtech.cc
Linktree: https://linktr.ee/northantara
Muck Rack: https://muckrack.com/northantara
IDN: https://ꩰ.com
IDN: https://ဪ.com
IDN: https://ㆲ.com
IDN: https://የ.com
IDN: https://ގ.com
IDN: https://ჷ.com
IDN: https://ꩳ.com
IDN: https://ㆴ.com
IDN: https://ۦ.com
IDN: https://ۦ.ws
IDN: https://ྌ.com
Gravitar: https://gravatar.com/northantara
Oink: https://oink.ing

Public Key

npub1re49l7uznmsuxchckysh23gd7qcrm33qlkzttqulxzwth9jwh7rq0amq7d

NIP-05 Address

north_at_xn--8r9a.com@momostr.pink

Profile Code

nprofile1qqspu6jllwpfacwrvtutzgt4g5xlqvpaccs0mp94sw0np89mje8tlpspr9mhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt9uq3samnwvaz7tmjv4kxz7fwd4hk6mmnw3ezuurfde4scvthxl

Publishing to

relay.momostr.pink

relay.primal.net

Author Public Key

npub1re49l7uznmsuxchckysh23gd7qcrm33qlkzttqulxzwth9jwh7rq0amq7d

Show more details

Published at

2024-09-24T08:27:20Z

Kind type

Event JSON

{ "id": "aca38e64ab0617c8f1285109142e76f7aabf555bf00bbfa18559a42ae2778efe", "pubkey": "1e6a5ffb829ee1c362f8b12175450df0303dc620fd84b5839f309cbb964ebf86", "created_at": 1727166440, "kind": 0, "tags": [ [ "t", "journalist" ], [ "t", "infosec" ], [ "t", "opensource" ], [ "t", "cybersecurity" ], [ "t", "idn" ], [ "t", "telephony" ], [ "t", "engineer" ], [ "proxy", "https://xn--8r9a.com/users/north", "activitypub" ], [ "L", "pink.momostr" ], [ "l", "pink.momostr.activitypub:https://xn--8r9a.com/users/north", "pink.momostr" ], [ "-" ] ], "content": "{\"name\":\"Jason Parker (he/they)\",\"about\":\"#infosec researcher | independent #journalist | software developer | #telephony #engineer | #opensource contributor\\n\\nISC² Certified in Cybersecurity (CC)\\n\\nThe foremost expert on court #cybersecurity vulnerabilities? https://govtech.cc\\n\\nhttps://en.wikipedia.org/wiki/Jason_Parker_(security_researcher)\\n\\n#IDN/#Punycode testing.\\n\\nhttps://ဪ.com\\nhttps://ㆲ.com\\nhttps://የ.com\\nhttps://ގ.com\\nhttps://ჷ.com\\nhttps://ꩳ.com *\\nhttps://ꩰ.com *\\nhttps://ྌ.com *\\nhttps://ㆴ.com\\nhttps://ۦ.com\\nhttps://ۦ.ws\\nhttps://ӿ.social *\\n\\n(* = Mastodon bug)\\n\\nVerifibation™️: https://v.jeltz.org\\nJeltz: https://jeltz.org\\nDisclosures: https://govtech.cc\\nLinktree: https://linktr.ee/northantara\\nMuck Rack: https://muckrack.com/northantara\\nIDN: https://ꩰ.com\\nIDN: https://ဪ.com\\nIDN: https://ㆲ.com\\nIDN: https://የ.com\\nIDN: https://ގ.com\\nIDN: https://ჷ.com\\nIDN: https://ꩳ.com\\nIDN: https://ㆴ.com\\nIDN: https://ۦ.com\\nIDN: https://ۦ.ws\\nIDN: https://ྌ.com\\nGravitar: https://gravatar.com/northantara\\nOink: https://oink.ing\\n\",\"website\":\"https://xn--8r9a.com/@north\",\"picture\":\"https://xn--8r9a.com/system/accounts/avatars/109/335/353/934/802/546/original/e7cd6918af1ff1f8.jpg\",\"banner\":\"https://xn--8r9a.com/system/accounts/headers/109/335/353/934/802/546/original/2873e284f2aca5aa.jpg\",\"nip05\":\"north_at_xn--8r9a.com@momostr.pink\"}", "sig": "58bcdf8e290a3d2e8615a24c25037fbfa7804acf1cc0757af6f7f80efb8d489bb808231a821b135304207737fe3a762fabb1ecbe63069dac3842c83a6fd77c1a" }

Last Notes

2024-09-21 15:33:04

#Discord told me on #HackerOne that this isn't a security #vulnerability, so cool, I'll talk about it publicly.
You can disable 2FA¹ on another person's account if you get access to their phone momentarily.
All you have to do is create a new account and put their phone number in as the login; if you verify the code, it strips it from the other account with no warning, and they can't take it back.
So have fun I guess?
¹ SMS is not #2FA
#infosec

2024-09-20 16:52:21

- reply

Yes and it happens often.

2024-09-19 02:07:16

- reply

any idea how difficult it is, and if it's reversable, to switch to glitch-soc?

2024-09-19 02:00:05

Do you still have the official AIM client installed?

2024-09-10 17:50:15

- reply

Are you able to link here, at https://ꩰ.com ?

2024-09-10 17:47:57

- reply

That may be my custom patch though? I think it only affects stuff I link.
https://xn--8r9a.com/system/media_attachments/files/113/114/509/885/784/102/original/db9165fe6ffb2ba3.png

2024-09-10 17:45:23

- reply

There are lots of ஃ.tld domains available too.

2024-09-10 17:21:07

So anyways, I clearly don't like ⁂ as the #Fediverse #Logo

2024-09-10 17:18:11

- reply

See https://ꩰ.com/@north/113114276375076602
I also just realized that I can't even tag that user.

2024-09-10 17:11:27

I have far too many instances now.
@npub1re4…mq7d
@north@⁂.ꩰ.com
[@north@ӿ.social](https://xn--56a.social/@north )
[@north@ⴭ.ws](https://xn--1lj.ws/@north )
Maybe I should open up registrations on one of them.

2024-09-10 16:48:03

- reply

@⁂.ꩰ.com There, I did it. If you click (or hover) the following link, you can see how broken this is in the address bar (or hover).
https://⁂.ꩰ.com/@north/113114269189204421
Edit: Even linking this properly requires a custom patch in Mastodon.

2024-09-09 23:34:21

I'm going to give away my secret, publicly, for the first time.
If you want a symbol that can (possibly) be used in a domain name, this is a good starting point. Many of these will still not render in address bars however, especially those that are Latin look-alikes, so a lot of trial and error is required.
https://util.unicode.org/UnicodeJsps/list-unicodeset.jsp?a=%5B%5B%3ABlock%3D%2F%28Arabic%7CArmenian%7CAvestan%7CAzerbaijani%7CBalinese%7CBamum%7CBatak%7CBelarusian%7CBengali%7CBopomofo%7CBrahmi%7CBuginese%7CBuhid%7CBulgarian%7CCarian%7CCham%7CCherokee%7CChinese%7CCoptic%7CCyrillic%7CDevanagari%7CEgyptian+hieroglyphs%7CEthiopic%7CGeorgian%7CGlagolitic%7CGreek%7CGreek%7CGujarati%7CGurmukhi%7CHan%7CHangul%7CHanunoo%7CHebrew%7CHiragana%7CImperial+Aramaic%7CInscriptional+Pahlavi%7CInscriptional+Parthian%7CJapanese%7CJavanese%7CKaithi%7CKannada%7CKatakana%7CKayah+Li%7CKharoshthi%7CKhmer%7CKorean%7CKurdish%7CLao%7CLatin%7CLepcha%7CLimbu%7CLisu%7CLycian%7CLydian%7CMacedonian%7CMalayalam%7CMandaic%7CMeitei+Mayek%7CMoldavian%7CMongolian%7CMyanmar%7CNew+Tai+Lue%7COgham%7COl+Chiki%7COld+Persian%7COld+South+Arabian%7COld+Turkic%7COriya%7CPhags-pa%7CPhoenician%7CPolish%7CRejang%7CRunic%7CRussian%7CSamaritan%7CSaurashtra%7CSinhala%7CSumero-Akkadian+cuneiform%7CSundanese%7CSyloti+Nagri%7CSyriac%7CTagalog%7CTagbanwa%7CTai+Le%7CTai+Tham%7CTai+Viet%7CTamil%7CTelugu%7CThaana%7CThai%7CTibetan%7CTifinagh%7CUkrainian%7CUnified+Canadian+Aboriginal+Syllabics%7CVai%7CYi%29%2F%3A%5D%26%5B%3AXID_START%3DYes%3A%5D%26%5B%3AIdentifierStatus%3DAllowed%3A%5D%5D%0D%0A&g=&i=
Edit: @npub1tzj…dfrk
#Fediverse #Logo #Symbol

2024-09-09 23:21:36

I should spin up a ⁂.ꩰ.com instance, just so I can show how broken it would be.
#Fediverse #Symbol #Asterism

2024-09-09 12:57:26

- reply

no it's okay, 2001 was only 13 years ago

2024-09-06 00:21:41

⁂ is a terrible symbol to use for the #Fediverse because it can't be used as a subdomain. You should be able to make ⁂.foo.social, just as you can mastodon.foo.social and pleroma.foo.social. People will definitely try it and it won't work out for them; they'll end up just seeing xn--kwg.foo.social, which is stupid.
(I think I'm safe to consider myself the authority on Unicode domain names.)

2024-08-31 16:31:03

- reply

That actually makes sense!

2024-08-31 13:39:03

- reply

Why not just `start_date = end_date = -1` then?

2024-08-31 04:58:09

I came across some intern code yesterday and I can't wrap my mind around it (neither the intent nor the expected result). C#
start_date = end_date = "" + -1

2024-08-16 12:09:44

- reply

I doubt it's that he can't pronounce it. It seems very intentional.

2024-08-15 13:45:05

I start my first job in #cybersecurity in about a week and a half. What are some tips you wish people would have told you?

2024-08-05 11:33:28

I have trouble waking up some mornings, so I have alarm clock that makes me do math questions. I often regret that.
https://xn--8r9a.com/system/media_attachments/files/112/909/193/368/111/690/original/e540f9584fe0eb86.png

2024-08-03 05:43:41

- reply

Reported to #CISA for help reporting and coordinating with GA Secretary of State. This is really, really bad.

2024-08-03 05:33:47

I just discovered that I can bypass the SSN / DL requirement on Georgia's #voter deregistration (wtf?) page at https://cancelmyregistration.sos.ga.gov/s/
All an attacker needs is name, county of residence, and birthdate.
#cybersecurity #infosec #georgia #GA #election

2024-05-22 11:22:29

- reply

DMA pointers pointing to nowhere seems like something that could be exploitable, no?

2024-05-07 13:07:59

I'm looking to borrow (it's $200 and I'm not buying it) a copy of an extremely niche book from a law school library for a week or so. It's called "Cybersecurity and the Courthouse: Safeguarding the Judicial Process".
It should be very useful for all of my recent #cybersecurity work in that area (see https://github.com/qwell/disclosures/).
If you, dear reader, have access to such things, I'd like to have a chat to see what we can figure out.
Boosts highly appreciated.
#infosec #law #library

2024-04-30 12:49:38

- reply

This tab is up all day every day, front and center. I may be a little ashamed to admit that. I read everything that hits the Home timeline, and on my other account, as much of the #fedifirehose as I can. It's a problem.

2024-04-30 12:45:40

- reply

I see everything. 😜

2024-04-30 12:37:07

- reply

Do other people not do that due diligence before boosting?

2024-04-30 12:31:14

Boosts are endorsements. Why the hell else would I boost something?

2024-04-04 18:11:06

If I were to create a #webfinger #fediverse alias system with my funky domains, would there be any interest? The usernames would be like:
@alice @ۦ.ws
@bob @ۦ.ws

2024-03-29 00:05:57

- reply

stux.net would make for a great instance domain. I wonder if the owner would sell it for a reasonable price.