@gamesdonequick.com Hey, is the venue / hotel info for AGDQ 2026 supposed to be public yet? If not, you should email me, because reasons... #cybersecurity [email protected]

I have something I need to come clean about. On Dec 31, 1999, I shut off the power to my trailer park at exactly midnight.

@piratesoftware.live Would you consider linking to the Fediverse/Mastodon, by following ap.brid.gy? I know there are a lot of people there who would follow you through the bridge.

@good.as.hell.domains @pfrazee.com You made me do this. IDN support soon?

Fedi test?

@alexrkonrad.bsky.social @katiegeeks.bsky.social My timeline. Serendipity.

A #vulnerability in the #Georgia #voter registration website that is still active as of today. infosec.exchange/@abreacher/1... #infosec #cybersecurity #election #uspol

A #vulnerability in the #Georgia #voter registration website that is still active as of today. infosec.exchange/@abreacher/1... #infosec #cybersecurity #election #uspol

GC7 Bluesky. Welcome. It is I.

so like does the Bluesky web app still really not do browser notifications or automatic notification refreshes?

@bnewbold.net IDN username support soon? *copium* I'll let you borrow one! How about ӿ.social? I can't stay invalid.handle forever. (or can I?)

I decided it was time that I write up an article on all of my govtech vulnerabilities. northantara.medium.com/critical-fla...

According to Discord on HackerOne, this isn't a vulnerability. Sure, okay. xn--8r9a.com/@north/11317...

So, this happened... en.wikipedia.org/wiki/Jason_P...

🤔

@pfrazee.com Please Unicode domains? ꩰ.com deserves a chance at life here. 👉👈 I could let you borrow ӿ.social for testing.

New vulnerability from me. Coverage: www.propublica.org/article/cybe... and www.atlantanewsfirst.com/2024/08/05/s...

I just discovered that I can bypass the SSN / DL requirement on Georgia's #voter deregistration (wtf?) page at cancelmyregistration.sos.ga.gov/s/ All an attacker needs is name, county of residence, and birthdate. #cybersecurity #infosec #georgia #GA #election

These vulnerabilities, discovered by security researcher Jason Parker (untaggable but here: bsky.app/profile/did:...) mean that potentially millions of sealed, confidential records could have been captured by identity thieves, extortionists, or foreign governments. www.forbes.com/sites/emilyb...

In Florida, California, and more than 48 other state and local jurisdictions, court system vulnerabilities exposed medical records from child abuse victims, body cam footage, and other sealed documents through unsecured websites. www.forbes.com/sites/emilyb...

I've compiled all of my govtech disclosures into one place. This is now the canonical URL for all of them. govtech.cc

xn--8r9a.com/@north/11222... v.jeltz.org/canary

In the light of the #BritishLibrary hack, one wonders if there really is the will to enforce proper IT security: Security flaws in court record systems used in five US states exposed sensitive legal documents techcrunch.com/2023/11/30/u...

I'm on the service list for Georgia v. Trump, so I get stuff well before any media. drive.google.com/file/d/17lBw...

@dholms.xyz If you supported IDN usernames, I could offer <user>.ӿ.social aliases. Food for thought.

So like... am I just allowed to keep "Invalid Handle" forever, or...?

@timcarvell.bsky.social Want to see something really wild? bsky.app/profile/did:... Cybersecurity in a dozen or more court platforms. You have no idea how deep this rabbit hole goes. For more info, see jeltz.org/blog.html or github.com/qwell/disclo... Signal: north.01 Email: [email protected]

This is some damning stuff.

Use PACER? Install RECAP. We’ll make permanent, scalable, reliable links for you in seconds.

Disclosure day! Insufficient permission check vulnerabilities in Granicus's GovQA allowed unauthorized access to view, edit, and change ownership of open records requests, including restricted-access confidential records. github.com/qwell/disclo... www.nextgov.com/cybersecurit...

On the public response to my U.S. court platform disclosures and the future:

Disorder in the Court Insufficient permission check vulnerabilities in public court record platforms from multiple vendors allowed unauthorized public access to sealed, confidential, unredacted, and/or otherwise restricted case documents. More info: github.com/qwell/disord...

@pogue.omg.lol I remembered. 20 minutes.

Oh, hey, they fixed RTL fuckiness with user's names. Also, damn.

I finally have a concrete publication date for my next set of vulnerabilities -- Nov 30, 2023. Eight platforms from eight separate vendors that leak data with life threatening consequences. I can't wait.

I really need to spend more time working on jeltz.org at some point.

Lets exploit link cards and make them say whatever we want, for fun and profit. I tried to report this; I was ignored. Details: https://github.com/qwell/bsky-exploits

As expected, a vulnerability I reported to #bluesky (see bsky.app/security.txt) >3/mo ago is now an easily exploitable DDoS. They acknowledged the report via email and then...nothing. We've exceeded reasonable CVD timelines at this point. So now what? Full disclosure is usually the next step.

@good.as.hell.domains Does fuckin' invalid as hell qualify as fuckin' good as hell?

@handle.invalid

Once again, I've done a thing. I am the proud new owner of ӿ.social. Why am I like this?

This is fine.

Why am I like this?

Can I mute myself? Let's find out.

@why.bsky.team @bnewbold.bsky.team @ansh.bsky.team So, like, this seems not ideal. The good news, however, is that I found a workaround to my Punycode issue. 😏

@why.bsky.team @support.bsky.team No Punycode support when displaying handles? :( Related: xn--2lb .com is even less happy. That one makes the server throw a 500 error for some reason.