Remote

iam-py-test

@iampytest1@infosec.exchange

mastodon 4.8.0-alpha.3+glitch

Pre-transition trans girl interested in cybersecurity, content filtering, and law. Assistant maintainer of the Actually Legitimate URL Shortener. Trekkie.
Not legal/medical advice. All posts are final agency action.

Profile picture: truncated screenshot of a WINE error message. The error message is titled "Download failed". The message reads "Download Failed: Success. Check your connection and click 'Retry' to try downloading the files again, or click 'Next' to continue installing anyway." There is only one button labeled "OK".

Header image: A Windows error message against the default Windows wallpaper. The error message reads "Windows cannot find iam-py-test. Make sure you typed the name correctly, and then try again."

Alts: @iam_py_test@mstdn.social @ipt@mastodon.social @iampytest@infosec.exchange

282 Followers

444 Following

50 Posts

Joined April 04, 2023

About me:

https://iam-py-test.github.io/about.html

GitHub:

https://github.com/iam-py-test

Pronouns:

she/her

Dream job title:

Head of Security and Hacking (legal and ethical)

Testing this out:

https://justmytoots.com/@iampytest1@infosec.exchange

@iampytest1@infosec.exchange

· 2w ago

Megalodon has removed the defunct Memento search. The HTTP Framework for Time-Based Access to Resource States, also known as Memento, is a protocol for searching for snapshots of a website across different archives. In 2025, the Memento TimeTravel—which was used by Megalodon—shut down citing "budget and organizational refocusing". Megalodon now shows links to the Wayback Machine, archive.today, Japan's National Diet Library Web Archiving Project, Ghostarchive, and the Portuguese arquivo.pt. These links are shown regardless of if the listed service has a copy of the page requested. #Memento #Megalodon

groups.google.com

Memento TimeTravel sunset

2

1

0

0

@iampytest1@infosec.exchange

· 3mo ago

Replying to

@burritosec@infosec.exchange uBlock Origin's badware list has specific filters to protect against ClickFix: https://github.com/uBlockOrigin/uAssets/blob/30fba85746695c324fe1f6bed9243ca5f46bd675/filters/badware.txt#L2611 I don't know how well they work.

13

2

6

1

@iampytest1@infosec.exchange

· 3mo ago

Replying to

Edit: I retract my statement in re Gaza Verified as it is defamatory and lacks a factual basis @briankrebs@infosec.exchange The top two are obviously fake, and the bottom one looks to be a scammer who unfortunately is taking advantage of the Gaza genocide and somehow tricked Gaza Verified. What's wrong with the second to last one? Looks like a real person who happened to be mistakenly flagged: @awildfaerie@gaygeek.social

6

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

Replying to

@Viss@mastodon.social @da_667@infosec.exchange Firstly, even if you have not encountered issues yet, there is a high likelihood of problems and uBlock Origin's developer explicitly tells people not to use multiple ad blockers. For example, uBlock Origin often has fixes for breakage or adblocker detection. Running another adblocker alongside it will break these fixes. Even more complex ads require fixes which other adblockers can interfere with. Secondly, using multiple adblockers doesn't make you safer; it's an illusion. Three adblockers doesn't make you three times better protected from ads. The majority of the ad and tracker blocking in all three comes from two lists named EasyList and EasyPrivacy. What is blocked by one will likely be blocked by the other two. For the rest of the blocking, there is still a high level of overlap. The benefit of running two extra adblockers is minimal, and the the downsides in terms of conflicts are great.

4

9

1

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to

@startrekgifs@friendsofdesoto.social Cracked Mirror

2

0

1

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to

@NebulaTide@mastodon.bsd.cafe @evacide@hachyderm.io This has never been tested at SCOTUS, but given I think there's a circuit split, it's possible they'd grant cert. In any case, this type of legal issue should be argued in court, not with agents on the border.

2

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

Replying to

Edit: I retract the statements made in this post, as they lack a factual basis @MikeImBack@disabled.social @briankrebs@infosec.exchange it's unfortunate, since there are legitimate people in Gaza seeking aid. However, I've seen many Gaza Verified accounts which act extremely suspicious or outright spam, such as the one in the original post. Gaza Verified sounds like it is well intended, and they say they do checks, so I don't know why so many suspicious accounts are approved (as in actually listed on their website; anyone can put whatever in their profile). It's hard to prove these accounts are fake.

4

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

Replying to

@Viss@mastodon.social @da_667@infosec.exchange It is strongly recommended to not run multiple adblockers/content filters at the same time. They will conflict, and moreover, are redundant. Pick on adblocker and run that alongside Firefox's tracking protection.

3

1

0

0

@iampytest1@infosec.exchange

· 4mo ago

Replying to

@0xabad1dea@infosec.exchange I don't think passwords were compromised, as per Instructure's FAQ: https://www.instructure.com/incident_update That is supported by an email one impacted college sent to students: Instructure has found no evidence that passwords, dates of birth, government identifiers (e.g. Social Security Number, A-Number), or financial information were involved. However: The breach included names, email addresses, student ID numbers, and private messages sent through the Canvas inbox, according to Instructure. I haven't heard of anyone having their account compromised as a result of the Canvas breach. Even if she used the exact same password everywhere & it was compromised via the Canvas breach, it seems unlikely all her accounts would get compromised at once. I concur with others that its probably a stealer; having every account compromised at once sounds like a stealer from my experience reading malware support forums.

Security Incident Update & FAQs

Security Incident Update & FAQs

6

0

0

0

@iampytest1@infosec.exchange

· 4mo ago

I don't think a lot of people realize it is possible to copy a key from a photo; I didn't until I saw a recording of one of @deviantollam@defcon.social's talks a year or two ago. https://youtu.be/XkfjWoniybU?t=2665 (I imagine most of the people on infosec fedi already know this; it's pretty well known, but figured I'd share it anyway) #OPSEC

3

0

2

0

@iampytest1@infosec.exchange

· 5mo ago

Replying to

My responses to some of the common criticisms. I'm not trying to attack specific people, but instead address these broader arguments. Why add pronouns? I can guess someone's gender from their name. Really? What gender is an iam-py-test? Even in terms of real names, there are so many gender neutral names, and even gendered names aren't a good predictor. My deadname was almost always shortened to a nickname which is gender neutral. That fact was used against me by the transphobes to support not recognizing my name change. Or, in other words, what gender is Michael Burnham. Why add pronouns? I can guess someone's gender from their appearance. Even if trans people didn't exist, there are plenty of cis people who either don't perfectly meet the stereotypes of their assigned sex as birth or just generally look ambiguous. But even if cis people perfectly looked liked their assigned sex at birth, trans people do exist (allegedly). If I don't know what your pronouns are, I'm just going to refer to you by they/them. Using gender neutral pronouns is the safest option unless I have explicit self-identification or a plurality of independent sources.

3

0

1

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to

@ifin@infosec.exchange I love the fake DS9 title card.

1

1

0

0

@iampytest1@infosec.exchange

· 3mo ago

Replying to

@Viss@mastodon.social Which claim? uBlock Origin's own developer has on numerous occasions recommended against using uBo with other content filtering extensions (like AdGuard, AdBlock, Privacy Badger, etc), citing breakage. I've contributed to uBlock Origin and AdGuard (along with at least 20 other filterlists), and I help maintain lists used in all three extensions. I know how uBlock Origin and these other extensions work, and I know how filterlist maintainers address breakage and anti-adblock. Nothing is a 100% guarantee; people do run uBo alongside Privacy Badger or other extensions without problems. But based on my experience, there are cases where these different extensions can and do conflict. Here is a recent example with Ghostery and uBlock Origin: https://infosec.exchange/@iampytest1/116720830367295050 In internal chat logs which I have seen, members of Ghostery and uBo's teams explicitly stated that people shouldn't use the two extensions together. When addressing the issue at the request of Ghostery, a member of uBo's team explicitly stated "They should not use multiple blockers at the same time but ok". Ghostery acknowledged that, saying they try to educate their users to not use multiple blockers.

infosec.exchange

1

2

0

0

@iampytest1@infosec.exchange

· 4mo ago

According to a post on Telegram, 313 Team has launched a DDoS attack on Spotify.

Spotify's website appears online but slow.

313 Team said their attack should last one hour.

#Spotify #SpotifyDown #313Team

infosec.exchange

2

2

1

1

@iampytest1@infosec.exchange

· 4mo ago

According to a post on Telegram, 313 Team has taken down wordpress.com with a DDoS attack.
While the wordpress.com homepage is online, attempting to login or create an account results in an error message.

Wordpress' status page shows all systems are operational.

https://automatticstatus.com/

#Wordpress #313Team

automatticstatus.com

1

0

0

2

@iampytest1@infosec.exchange

· 2mo ago

How does the current legal landscape harm security research? A study published earlier last month aimed to document the impact of legal risk on security researchers, focusing on the US and UK. The study was conducted by Sunoo Park (New York University, US) and Daniel R. Thomas (University of Strathclyde, UK). Article: https://www.lawfaremedia.org/article/the-legal-risks-that-chill-good-faith-security-research Study: https://eprint.iacr.org/2026/1207 The authors intend to present at the 35th USENIX Security Symposium: https://www.usenix.org/conference/usenixsecurity26/presentation/park The study is based on interviews with 36 security researchers and 8 "professionals who support researchers affected by legal risks, such as lawyers".

lawfaremedia.org

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to

This is related to https://cyberplace.social/@GossiTheDog/116968523424168330

Quoting

@GossiTheDog@cyberplace.social

StickerHub have been compromised.

Open quoted post

cyberplace.social

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

PSA: btdig[.]com appears to now be redirecting to a variety of advertising sites, and pornography. I haven't seen any evidence of anything outright malicious yet, but I would avoid btdig[.]com for now. See https://www.reddit.com/r/torrents/comments/1ut7n25/btdigcom_domain_takeover/ https://en.wikipedia.org/wiki/Talk:BTDigg#special:diff/1364087436 Sandbox: https://urlscan.io/result/019f6c4c-0ba0-77f6-8b07-be609b803a24/ Video: https://video.infosec.exchange/w/i6qG7TDif2HycNYwbqGyxz

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

I wonder how this will impact the ongoing litigation against Suno, which is currently in discovery. https://kolektiva.social/@ddosecrets/117003379075632338

kolektiva.social

0

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

My family members ask me for privacy and infosec advice, and I just don't know what to say.

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to

@transworld@masto.ai It appears that (as many of us have suspected for years) Amnesty believes certain kinds of humans don’t deserve rights: women, girls and those who are proudly same-sex attracted Every word in that sentence applies to JKR herself far better than it applies to Amnesty (which isn't a perfect organization to be clear). She's repeatedly attacked lesbians and bisexual women who don't meet her standards for being a real woman. She isn't a feminist. She's an agent of the patriarchy.

0

0

0

0

@iampytest1@infosec.exchange

· 4mo ago

RE: @iampytest1@infosec.exchange

Update from 313 Team:

The attack on WordPress servers has been stopped due to the activation of multiple layers of protection, including browser verification to filter out overload. We may resume the attack soon or move to another target.

infosec.exchange

0

0

0

0

@iampytest1@infosec.exchange

· 5mo ago

An update on the project to remove archive.today from Wikipedia.

https://en.wikipedia.org/wiki/Wikipedia_talk:Archive.today_guidance#c-GreenC-20260510040300-6%_done

I haven't been following this effort at all, so I can't really comment on it.

#Wikipedia #archiveToday

en.wikipedia.org

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to on m.ai6yr.org

@ai6yr@m.ai6yr.org I've heard the name but no idea who they are (I count that as a "no" and voted accordingly). TV person, maybe? I don't watch TV.

0

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

Replying to

@Lucario1829@infosec.exchange None of those filters were included in uBoL. The reason for this is that last week uBoL added the ability to add custom filters. Unless you added one of those filters as a custom filterlist during that short period of time, you shouldn't be impacted. For Legit URL specifically, uBoL includes AdGuard URL Tracking Protection, which does the same thing and in my opinion does a fairly good job (AdGuard's people coordinate with Imre and me so there's a lot of overlap). As for Imre's other lists, none were included in uBoL, and most already wouldn't work in uBoL if added.

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

Credit to @tante@tldr.nettime.org Codeberg has greatly restricted AI generated code on their platform, banning all projects which "mostly consist of code written by generative AI-tools". https://codeberg.org/Codeberg/org/pulls/1253 The actual discussion and vote was only available to members of Codeberg. Codeberg has said this change will not be immediately enforced. #Codeberg #AI

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to

@piratzbrna@mastodonczech.cz @janvlug@mastodon.social I am not a lawyer, but I believe that is incorrect. He is charged with violating 18 U.S.C. § 2232(a): https://storage.courtlistener.com/recap/gov.uscourts.gand.351975/gov.uscourts.gand.351975.1.0.pdf 18 U.S.C. § 2232(a) criminalizes knowingly destroying property in order to prevent or impair a search. It does not require there to actually have been evidence of a crime destroyed. "An actor is liable only if he removes or destroys the property with the purpose of preventing seizure. [citation omitted] An essential element of § 2232 is that the defendant have the specific intent to prevent the seizure of the goods" (Gasho v. US.

storage.courtlistener.com

0

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

On 25 June, pro-Iran hacktivist group 313 Team claimed responsibility for taking down Reddit with a DDoS attack. According to messages in their Telegram channel, 313 Team is now using a platform known as Elite Stress to conduct their DDoS attacks. 313 Team previously used a controversial service known as Beamed.su: https://infosec.exchange/@iampytest1/116774693782663286 #313Team #EliteStress

infosec.exchange

0

0

0

0

@iampytest1@infosec.exchange

· 1mo ago

Replying to

re: Personal

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

According to posts on Telegram, 313 Team has claimed responsibility for taking down Saudi Arabia's Qiwa platform with a DDoS attack. The attack began yesterday (Central Time), but was extended into today. #Qiwa #313Team

0

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

The Actually Legitimate URL Shortener—along with Dandelion Sprout's other filterlists—do not and will not support any Manifest Version 3 content filtering extension. This decision was made by Imre—after consulting with me and with my full support. These lists will not function in MV3 extensions; they will exclude all rules from being enforced when loaded in an MV3 extension. Moreover, uBlock Origin Lite does not currently support one of the critical features used by Legit URL: regex removeparam. These filters take up around 2% of the list, but include some of the most prolific tracking parameters like utm_source. #ActuallyLegitimateURLShortener #MV3 #uBlockOriginLite #AdGuardMV3

0

0

0

0

@iampytest1@infosec.exchange

· 1mo ago

Replying to

re: Personal

0

1

0

0

@iampytest1@infosec.exchange

· 2mo ago

The Discord account of Minecraft YouTuber avatardotpng has been compromised, according to a post in his official Discord server and posts in Kenadian's Discord server. Fellow YouTuber Stayed is at present in control of avatar's Discord server, as avatar gave her ownership prior to the compromise. She has muted the compromised account. According to a message from avatar's friend Adder, his computer was infected with malware. #avatardotpng #Discord

0

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

Replying to

@froge@social.glitched.systems @Viss@mastodon.social It can work, but it is explicitly recommended against by the developers and maintainers. If you want to improve the protection from uBlock Origin or AdGuard, the solution is to install more filterlists (which can also cause breakage or conflicts, to be clear). Adding additional content filtering extensions is not a very effective way to increase your protection, given the redundancy and potential for breakage.

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

313 Team has launched an attack on OVHcloud. 313 Team said the attack disabled OVH's internal servers and login.

0

0

0

0

@iampytest1@infosec.exchange

· 2w ago

Replying to

@catsalad@infosec.exchange based on their changelog, it seems to be still maintained: https://affility.co.jp/gyotc/

お知らせ（ウェブ魚拓） | アフィリティー

アフィリティーからのお知らせ一覧（ウェブ魚拓）

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

Since early July, 313 Team has used DDoS service Cypher to conduct their attacks. 313 Team has also promoted Cypher on their Telegram. According to Cypher's owner, they provide their services to 313 Team in exchange for 313 Team promoting Cypher. The owner said they started working with 313 Team while the group used their previous service. According to the owner, Cypher has over 100 active users, including 313 Team.

0

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

Something on my computer keeps trying to access Microsoft Copilot, fails because its not installed, and writes an error to the Windows Event Log. Every second. On loop. Forever.

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

RE: https://cyberplace.social/@GossiTheDog/116968523424168330 sk8tinglife.co.uk has removed the leak message. The site's owners did not respond to a request for comment, but Wayback Machine archives suggest it was removed on the 24th. An archived copy can be found here: https://megalodon.jp/2026-0723-2312-43/https://sk8tinglife.co.uk:443/stickerhub/ The alleged leaked data is also archived on the Wayback Machine.

Quoting

@GossiTheDog@cyberplace.social

StickerHub have been compromised.

Open quoted post

cyberplace.social

0

0

0

0

@iampytest1@infosec.exchange

· 4mo ago

RE: @iampytest1@infosec.exchange

In a post on their Telegram channel about the DDoS of Spotify, 313 Team said this and other attacks were in retaliation of the US and Israel's killing of Iran's Supreme Leader Ali Khamenei.

Spotify is a Swedish company, and it is unclear why they are being targeted.

313 Team also said they increased the severity of their attack, taking down Spotify's login page. I have been unable to confirm this.

infosec.exchange

0

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

Replying to

@chingalamigra@kolektiva.social As I understand it, yes. Also, if I recall correctly most of Privacy Badger's features are redundant with uBlock Origin and Firefox.

0

6

0

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to

@GossiTheDog@cyberplace.social Any idea why is the message from the attackers on sk8tinglife[.]co[.]uk?

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to

US Politics

0

0

0

0

@iampytest1@infosec.exchange

· 2mo ago

Replying to on social.woefdram.nl

@hans Not because there's anything illegal or incriminating on it, it's the principle: this is private, this is mine, and I'll do with it what I please. Not a lawyer. Wiping your phone in order to prevent law enforcement from searching it would probably be illegal, regardless of if there is evidence on the phone itself. In Federal law, this falls under 18 U.S. Code § 2232. Different states have their own statutes for destruction of evidence, e.g. Ohio. I don't think this is a US-specific thing either; I would imagine most countries would consider this illegal, though I have not researched it. I would talk to a lawyer with subject matter expertise about this if it's something you are seriously considering. Don't assume something is legal based on your lay interpretation of the law, especially in regard to interactions with border security.

0

0

0

0

@iampytest1@infosec.exchange

· 3mo ago

RE: https://masto.ai/@transworld/116824552438170757 In making this film, what surprised us most was not anti-trans opposition, but silence from our own community and industry. People and institutions that express support privately, but will not support it publicly. This project has taught us that the opposite of courage isn’t fear, it’s silence.

0

0

0

0

@iampytest1@infosec.exchange

· 4mo ago

Instructure has published a statement on the Shiny Hunters breach and the status of their recovery.

https://www.instructure.com/incident_update

Instructure says they will be publishing a summary of the forensics report in the coming days.

Security Incident Update & FAQs

Security Incident Update & FAQs

0

0

0

0