@north@xn--8r9a.com
@north@xn--8r9a.com avatar

north

@north@xn--8r9a.com

independent #journalist | software developer | telephony engineer | #opensource contributor | #infosec researcher

The foremost expert on court #cybersecurity vulnerabilities?

On the service list in Georgia v. Trump for some reason.

ISC² Certified in Cybersecurity (CC)

#IDN/#Punycode testing.

https://ဪ.com
https://ㆲ.com
https://የ.com
https://ގ.com
https://ჷ.com
https://ꩳ.com *
https://ꩰ.com *
https://ྌ.com *
https://ㆴ.com
https://ۦ.com
https://ۦ.ws
https://ӿ.social *

(* = Mastodon bug)

This profile is from a federated server and may be incomplete. Browse more on the original instance.

north, to random
@north@xn--8r9a.com avatar

If anybody ever forks Go, they should call it Vroom. You can have that one for free.

Follow for more stupid insights.

north, to Cybersecurity
@north@xn--8r9a.com avatar

I'll give this a shot.

I'm looking to #GetFediHired for a role in #cybersecurity. I've done both offensive (see e.g. https://github.com/qwell/disclosures/) and defensive security work, and have over 20 years of software development experience in many different languages.

ISC2 CC

DMs always open.

#FediHire #FediHired (we should pick a hashtag and stick with it) #InfoSec

north, to Cybersecurity
@north@xn--8r9a.com avatar

I'm looking to borrow (it's $200 and I'm not buying it) a copy of an extremely niche book from a law school library for a week or so. It's called "Cybersecurity and the Courthouse: Safeguarding the Judicial Process".

It should be very useful for all of my recent #cybersecurity work in that area (see https://github.com/qwell/disclosures/).

If you, dear reader, have access to such things, I'd like to have a chat to see what we can figure out.

Boosts highly appreciated.

#infosec #law #library

north, to fediverse
@north@xn--8r9a.com avatar

If I were to create a alias system, would there be any interest? The usernames would be like:

@alice @ۦ.ws
@bob @ۦ.ws

north, to random
@north@xn--8r9a.com avatar

Remember how I said I'm on the service list in Georgia v. Trump? Well, this is the fun stuff I get earlier than any media.

Edit: https://drive.google.com/file/d/17lBwE-Q1ePRHW65cWNyqzuyIzEnj3oWS/view

north,
@north@xn--8r9a.com avatar

CC @GottaLaff

north,
@north@xn--8r9a.com avatar

@GottaLaff Sadly, I was on a call and couldn't get it up sooner, but I had it about 30 minutes before that. :( Next time!

north,
@north@xn--8r9a.com avatar

@GottaLaff I just discovered something interesting. My version and the version you posted are slightly different. I have no idea what the differences are, but the timestamps and filesizes don't match. Weird.

Edit: The documents themselves seem to be identical otherwise.

Mine is the 12:06:22PM.

image/png

north, to fediverse
@north@xn--8r9a.com avatar

Do you create platforms?

Do you have any interest in testing your (Internationalized Domain Name) support?

If so, hit me up, I've got some really evil ones I can create subdomains on.

pixelfed, to Pixelfed
@pixelfed@mastodon.social avatar

Our Wikipedia page is at risk of being deleted because it may not meet notability guidelines.

Can we get some help?

We're not that familiar with Wikipedia or its processes, but we think our project is notable enough for inclusion.

https://en.wikipedia.org/wiki/Pixelfed

#pixelfed #wikipedia

north,
@north@xn--8r9a.com avatar

@pixelfed The notability tag has to be removed manually -- it won't ever get removed automatically. I have no clue whether it'll be reverted, but that many independent and reliable references whose subject is not Pixelfed, clearly shows its notability, so I removed it.

north,
@north@xn--8r9a.com avatar

@strypey @aloxe the reason the tag was added had long since been resolved

north, to Cybersecurity
@north@xn--8r9a.com avatar

Look, reporters, I'm not going to beg you to cover my #court #cybersecurity #vulnerabilities, but I'm not above it either.

For the three reporters who have written articles about this, and the one who provided invaluable guidance, my gratitude is endless. This post doesn't apply to you, nor "the feds", the cybersecurity experts, or #lawyers (including and especially @eff), who were extremely helpful. The rest, however, should take note.

I've willingly laid my neck on a chopping block, unprotected, for over six months.

My outreach has been exhaustive:

• Attempted to engage with over 150 journalists and #news organizations,
• Coordinated frequently with the Cybersecurity and Infrastructure Security Agency (#CISA or "the feds"),
• Consulted with numerous cybersecurity experts,
• Sought advice from multiple lawyers,
• Spoke with ten state and state court CISOs,
• Attempted to talk to several dozen state and county court clerks and judges,
• Sent emails to every Florida State Senator, State Representative, and Supreme Court justice, and to multiple governors,
• Discussed with the staff of multiple U.S. Senators and U.S. Representatives,
• Contacted twelve vendors and over 40 employees

I've offered to write articles -- for free.

I've had no fewer than eight background checks done on me.

I've been cyberstalked by the Arizona Supreme Court.

I've put my job and my family's livelihood at risk in more ways than one.

I've made a grand total of $0; in fact, I've invested several hundred.

When I'm able to sleep, it's with one eye open, always waiting for "that" knock on the door.

After my first #disclosure, I prepared for a week to deal with what I expected to be a #media circus. What I received was one preemptive email from a state court #CISO (who was not affected) and one kind person (who is not a #journalist) on the #fediverse.

I've spent over 900 hours discovering, documenting, reporting, and disclosing vulnerabilities, trying to get this fixed on a mass scale, and attempting to contact the above list. I see no signs of this slowing down any time soon. All of this for what is merely a #hobby.

I've done my part. It's time for reporters to step up. The real-world harm these vulnerabilities have caused — and continue to cause — cannot be overstated. The need for widespread awareness and action is urgent.

Context: https://github.com/qwell/disclosures/

Email: north@ꩰ.com
Signal: north.01

#infosec #govtech #privacy #technology #law #journalism

north,
@north@xn--8r9a.com avatar

Just to clarify things a bit, so people understand the scale of this...

As of today, I've discovered and reported vulnerabilities in court platforms from eleven(!) separate vendors, with another in a records request platform by one of the same vendors.

There are a large number of vulnerabilities in four(?) more platforms from some of those same vendors that will be reported this weekend.

The consequences of these vulnerabilities are exceptionally severe. I'll avoid the need for a content warning by saying that some of the documents that are available are life-threatening and some involve children; a reply to this post will have such a content warning.

There is a dire need for publicity of this knowledge, so that people can protect themselves, vendors can be held accountable, and real change can be made to solve these systemic problems.

It's still shocking to me that so many people and organizations turn down covering this story or outright ignore me. I've been told several times to call a reporter once it's being actively exploited. If you've been in the industry for very long (as they have), you know that we must assume, with or without direct evidence, that if we've found something -- trivially, I'll add -- that somebody else more nefarious already has as well, and will be abusing it to the fullest.

atomicpoet, to random

No one is using using Truth Social. It’s on the stock market entirely so that Trump can cash out and thus deal with his legal problems. DWAC interest is at 11% which means a whole lot of people expect it to crash.

It’s worth noting, though, that Truth Social is almost entirely based on Fediverse software – though it doesn’t federate – and its current valuation is around $5 billion.

Remember that for the next time someone says your Fediverse server isn’t worth anything.

https://finance.yahoo.com/news/trumps-truth-social-stock-soars-in-first-day-of-trading-133705717.html

north,
@north@xn--8r9a.com avatar

@atomicpoet My instance has 1 user with 850 followers. That should be worth at least like $8 million, right?

Investors, hit me up.

molly0xfff, to random
@molly0xfff@hachyderm.io avatar

In case it might be useful to anyone else, I just wrote a quick Chrome extension to download all PDFs on CourtListener when there are multiple attachments to one docket entry.

https://github.com/molly/courtlistener-download

#CourtListener #PACER

north,
@north@xn--8r9a.com avatar

@molly0xfff for others who see this:

If you buy documents from PACER, please install the RECAP extension from the Free Law Project (who is behind CourtListener).

drewharwell, to random
@drewharwell@mastodon.social avatar

With Threads' entry into the fediverse, I'll be posting and playing around with two accounts now.

This one, on Mastodon.social: @drewharwell

And this one, on Threads: @drewharwell

How are y'all planning to do it?

north,
@north@xn--8r9a.com avatar

@drewharwell @Bam @randahl Given that, I would just disable the fediverse option, as comments otherwise get lost -- people can reply to your Threads posts here, but you'll never see them. How does that problem get solved?

north,
@north@xn--8r9a.com avatar

@Bam @drewharwell @randahl The problem isn't next week or next month though -- it's a new problem that exists now.

It's going to leave a bad taste in people's mouths (on both sides). Who will they blame for it? I have no idea.

Edit: I guess my point is that it shouldn't be possible to even try to post replies here.

north, to random
@north@xn--8r9a.com avatar

I just received the first one, so I figured I would share.

I now get served with documents any time anything gets posted to the docket on Georgia v. Trump, et al.

(Don't ask...)

north,
@north@xn--8r9a.com avatar

DEFENDANTS’ JOINT MOTION FOR A CERTIFICATE OF IMMEDIATE REVIEW

https://drive.google.com/file/d/1SG1qfN4WwHQWHIH0SHRGPLZ7k6AhGpbx/view

north,
@north@xn--8r9a.com avatar

@GottaLaff might find this interesting.

north,
@north@xn--8r9a.com avatar

@GottaLaff quick FYI, if you care. That Georgia v. Trump, et al., appeal motion about the DA was granted.

vaurora, to random
@vaurora@wandering.shop avatar

Call for interviews! I'm working on an article about an example policy for contributions to open source projects. The goal is for all the contributors to a project, new and old, to have the same expectations regarding credit, reviews, requests for changes, etc. to reduce conflict.

Do you want to share your experiences with conflict over contributions (of any kind) to an open source project? Reply to this post or fill out this form:

https://forms.gle/FJzAvy4MFjqViECv5

Thank you!

north,
@north@xn--8r9a.com avatar

@vaurora @fredposner @jcolp @bagder @grimmy You would all have some good opinions about this, I'd think.

north,
@north@xn--8r9a.com avatar

@bagder @vaurora In your case, I wondered if maybe some of the non-sense security vulnerability reports had ever led to something like that.

CmdrTaco, to random
@CmdrTaco@federated.press avatar

I tried to use a voice assistant to turn off the “rec room” lights but “rec” sounds like “rack” so it decided to turn off the switches in the room “rack” which just so happens to be where I put the ad blocker, the kids internet toggle, and… the wifi. So I got that going for me. Which is nice.

north,
@north@xn--8r9a.com avatar

@CmdrTaco That's one way to implement STONITH, I guess?

north, to random
@north@xn--8r9a.com avatar

Disclosure day!

Insufficient permission check vulnerabilities in Granicus's GovQA allowed unauthorized access to view, edit, and change ownership of open records requests, including restricted-access confidential records. By changing ownership of a request, an attacker could effectively deny a legitimate user's access to that request. The vulnerabilities affected various deployments, including numerous Departments of Children and Family Services or their equivalents, which handle highly sensitive records of domestic violence and sexual abuse allegations against children.

Details:
https://github.com/qwell/disclosure-granicus-govqa/

Coverage:
https://www.nextgov.com/cybersecurity/2024/03/flaws-public-records-management-tool-could-let-hackers-nab-sensitive-data-linked-requests/394755/

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • anitta
  • khanakhh
  • mdbf
  • InstantRegret
  • Durango
  • Youngstown
  • rosin
  • slotface
  • thenastyranch
  • osvaldo12
  • ngwrru68w68
  • kavyap
  • cisconetworking
  • DreamBathrooms
  • megavids
  • magazineikmin
  • cubers
  • vwfavf
  • modclub
  • everett
  • ethstaker
  • normalnudes
  • tacticalgear
  • tester
  • provamag3
  • GTA5RPClips
  • Leos
  • JUstTest
  • All magazines
    •