Jerry on Mastodon

Admin/owner of this Mastodon server. I play around with Linux.

I also own:
Phanpy: https://phanpy.hear-me.social
Peertube: https://my-sunshine.video
Pixelfed: https://gr8.pics
Piefed: https://feddit.online
XMPP (Jabber): https://between-us.online
Matrix: https://secure-channel.net
Bluesky PDS: https://blue-ocean.social
Mobilizon: https://my-group.events

verification: https://hear-me.social/verifyme.html

Public Key

npub1xssg2gmk85x32t8m9khcfufxy2e4n5xm86dkv0ukadr04v8vhfyqcqv2en

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsrggy9ydmr6rg49najmtuy7ynz9v6e6rdnaxmx87twk3h6krkt5jqprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmnt6yfmr5

Publishing to

relay.momostr.pink

Author Public Key

npub1xssg2gmk85x32t8m9khcfufxy2e4n5xm86dkv0ukadr04v8vhfyqcqv2en

Show more details

Last Notes

2026-10-27 02:08:30 GMT

#Firefox is remembering when the Internet was fun.
https://www.youtube.com/watch?v=E2AoYIKwJqM

2026-10-12 11:19:54 GMT

Raccoons in Minnesota are attempting to break into Cybertrucks, mistaking them for dumpsters. Experts agree.
The headline is not sarcasm
https://cowboystatedaily.com/2024/08/06/raccoons-mistake-cybertruck-for-dumpster-and-wyoming-auto-experts-agree
#tesla #cybertruck #racoons

2026-09-09 21:48:52 GMT

I just got this phishing email FROM THE OFFICIAL #TREZOR newsletter account.
Of course there's a link to a website meant to steal the seed phrase.
This is the 3rd time Trezor's newsletter account has been taken over. And they did promise after the other incidents that they would keep their mailing list to themselves. Promise broken.
Mailchimp Incident (April 2022): Attackers breached Mailchimp, exporting Trezor's subscriber lists, and they broadcast legitimate-looking, SPF/DKIM-aligned emails claiming Trezor had experienced a security breach and that users needed to download an update to secure their seeds. After, Trezor pledged to reconsider reliance on third-party newsletter tools.
MailerLite / Support Incidents (2024): In early 2024, a third-party support portal was unauthorizedly accessed, exposing the contact info of tens of thousands of users. This led to a similar DKIM-signed phishing blast.
The Current Incident (Brevo / Sendinblue): Instead of moving everything in-house, Trezor migrated their bulk communications to Brevo (Sendinblue, visible via mailing.trezor.io and the X-Mailer: Sendinblue headers). This email is the result of that third-party mailing integration being compromised, allowing attackers to abuse Trezor's verified sending domain and DKIM keys to push this "STM32 Entropy" lure to the list.
#Scam
https://files.hear-me.social/media_attachments/files/117/243/247/157/436/020/original/5bc4ee0fb1a9d5aa.png

2026-03-29 16:51:54 GMT

- reply

Yeah it does. But maybe more than purity.
Enabling an old authentication capability like Dialback opens a new attack vector on the server, for not a whole lot of good reasons.
Also, when people signed up, they chose a Category A server. Perhaps there's someone using it who would be endangered if I suddenly lowered the security shield just to talk to an outdated server. That person is expecting the server to maintain a Category A security capability.
I decided to stay Category D if it means leaving the server as secure as possible.
I'll wait for the providers and other servers to update.

2026-03-29 12:43:30 GMT

- reply

Good suggestion, but one doubt.
I do have mod_dialback turned off because I thought the xmpp-providers auditor strictly requires certificate-based authentication to be a Category A provider.
So while enabling mode_dialback may allow connections to chat.xmpp-providers.org again, I believe it would prevent the server from ever becoming category A again, if my understanding is correct.

2026-03-29 10:53:24 GMT

[@xmpp_providers](https://fosstodon.org/@xmpp_providers )
My XMPP server, chat.between-us.online, fell off the Category A list about a week ago, and the reasons I see each day are inconsistent. I also can no longer connect with chat.xmpp-providers.org. I get "Could not authenticate remote servers". Other than this, my server seems to have no problems connecting to any other server, as far as I can tell.
It seems to have happened coincident with getting updated Let's Encrypt certificates.
Let's Encrypt no longer creates dual-use certificates; they dropped ClientAuth from their certificates. I tried switching to ZeroSSL certificates, but they too have dropped ClientAuth.
Is the certificate change coincidental, or do you know if there's another explanation?
If it is the certificates, what do I do? Prosody does not yet have an ability to serve different certificates for inbound and outbound server connections, and so I cannot present a certificate with ClientAuth any longer.
#XMPP

2025-10-15 15:44:22 GMT

The #Signal App gets only a 9 out of 10 for #Privacy protection, and it's not just because it requires a phone number.
"While most of Google’s analytics are turned off in the Signal app, it still uses the Google Maps API to handle location data. Calls to Google Maps turn over a bunch of metadata, including the IP you’re connecting from. For a project that’s so invested in privacy, it’s surprising that Signal doesn’t use an open source alternative such as Open Street Map."
They call a Google API with location data and hand over the IP? Seriously?
https://www.mozillafoundation.org/en/nothing-personal/signal-privacy-review/#good-and-bad
#cybersecurity

2025-09-27 02:43:47 GMT

Go #Massachusetts!
On Thursday, September 25, the Massachusetts Senate unanimously (40-0) passed a comprehensive data privacy bill known as the Massachusetts Data Privacy Act. It had complete bipartisan support.
The bill is considered one of the strongest in the nation.
* Data Minimization: Limits the amount of personal data that companies can collect to only what is reasonably necessary to provide a product or service.
* Protection for Minors: Includes enhanced protections for children's data, prohibiting the sale of their personal information and its use for targeted advertising.
* Prohibition on Sensitive Data Sales: Bans the sale of sensitive data, such as location data, health information, and biometric data.
* Consumer Rights: It gives residents the right to access, correct, delete, and opt out of having their data sold or used for targeted advertising.
The bill now moves to the Massachusetts House of Representatives for further consideration.
#Privacy #OnelineRights

2025-09-21 16:40:30 GMT

- reply

Right. Lockdown mode will disable 2G, along with other features. No other way on an iPhone.

2025-09-21 16:36:07 GMT

Turn off 2G on your phone!
Fake cell towers (CSS) operating on 2G are now inexpensive. Your country no longer has any 2G towers. 2G uses plain text. A CSS forcing your phone onto 2G, a simple maneuver, has control of your phone. It's called a Stingray attack.
All your SMS messages are in plain text, so they see them. They can listen to your phone calls. If they know your email address, they can take over your email by intercepting the 2FA code. Then they can get access to your bank accounts after this.
They can also send you malicious text messages that your carrier would have discarded. This has become common. It's called SMS Blasting.
Nobody knows how many account takeovers result from CSS attacks because there's no evidence left behind. But, there must be many.
If you have Android 12 or later, turn on 2G protection (or disable 2G), whatever the wording.
If you have an iPhone, sorry. You can only use the nuclear Lockdown Mode, which may have undesirable side effects as it disables many more things.
https://solcyber.com/how-scammers-abuse-mobile-phone-interceptors-and-what-you-can-do/
#CyberSecurity

2025-09-02 00:01:21 GMT

My Pixel 10 warned me that there was a rogue connection made on my phone.
A concerning thing happened today while I was walking through my building. I have a #Pixel 10 Pro XL phone, which may be the first phone to give warnings when the phone connects to a rogue cellphone tower or IMSI catcher. The OS cannot block it; it can only tell you that someone read information, and it presents an alert. It says,
"Your data may be at risk. Device ID accessed. At 6:57 PM a nearby network recorded your device's unique ID (IMSI or IMEI) while using your T-Mobile SIM. This means that your location, activity, or identity has been logged."
I didn't ever get an alert before walking through the building, but this time, during a 30-minute walk through the building, I got about 8 alerts, ranging between 1 and 3 minutes apart.
Using this information from repeated connections, someone can follow my movements and location; they can identify it's me because the IMSI number is unique to my phone, so it can be an indication that someone was collecting all the cellphone information in the area, most likely law enforcement.
It can also mean that I was connecting to a rogue cell phone tower, not just an IMSI catcher, and it was an attempted Stingray attack, likely also law enforcement. If successful, they can try to see and hear what I'm doing on my phone, as my phone won't know that it's a fake cellphone tower.
Be aware that a rogue tower will try to negotiate your phone's connection down to a 2G connection, which is unencrypted, providing them with access to everything that you are doing and saying. Please go into your phone's settings and disable 2G!!
It's been believed for some time that this technology has been used by law enforcement secretly and consistently. This is creepy and unnerving.
Turning off the phone, by the way, doesn't stop an IMSI catcher. Your phone still responds. You need to keep the phone in a Faraday bag if you're really concerned.
It's a good thing that phones are now starting to inform people that they are being watched and that people will begin to see how much of an issue this is. You can assume that your local law enforcement knows where you are all the time.
#CyberSecurity #LawEnforcement #PoliceAbuse #Privacy #surveillance

2025-08-23 11:28:06 GMT

I just received this #scam email targeting hear-me.social users, trying to get them to log in using a malicious link so their accounts can be stolen.
I hope nobody would be fooled by this.
I will never send an email asking anyone to sign into their accounts and provide a link to do so. I will never provide a link to the login page.
My email address is made public so they are probably only targeting those who have posted their email addresses.
Other #MastoAdmin take notice, as I'm sure other instances are being targeted.
#HearMeSocial #Mastodon #scam
https://files.hear-me.social/media_attachments/files/115/077/839/889/810/958/original/f2b30e3da9908456.png

2024-10-27 14:32:20 GMT

This is so well said.
#USpol #USPolitics
https://files.hear-me.social/media_attachments/files/113/379/867/691/550/507/original/9db8e8face7d23db.png

2024-10-26 01:37:50 GMT

Turns out Democracy dies in the light as well. I canceled my Washington Post subscription because it turns out Democracy is not important to them.
#washingtonpost #USPol #USPolitics #CancelWP
https://files.hear-me.social/media_attachments/files/113/371/163/469/800/835/original/44327d049d0b5b08.png

2024-10-02 23:59:38 GMT

Want a piece of PieFed? I'm now running a PieFed instance: https://feddit.online
A long time ago I had a #KBIN instance, feddit.online. KBIN is part of the "threadiverse", a Reddit replacement.
When KBIN was abandoned, I shut it down. KBIN became #MBIN and Jerry Bell opened a fantastic MBIN instance, fedia.io, to go along with the mother ship instance. I didn't see a reason to open yet another MBIN instance. So feddit.online remained parked ... until now.
Ending its time in beta, there is a new #Reddit #Fediverse replacement, #PieFed, which is similar to MBIN in how it works, but is built with different technology.
While MBIN is mainly written in PHP and Node, and uses RabbitMQ for queuing, PieFed is written using Flask/Python, with Celery for queuing.
I'm much more familiar with Python than PHP, and so PieFed is particularly interesting to me. I might even be able to contribute to the project someday when I get through learning the codebase and learning Flask.
More information about PieFed is here: https://join.piefed.social/features/ and https://blog.elenarossini.com/the-future-of-social-is-here-a-show-and-tell-part-4-lemmy-piefed-mbin/
Want to play with PieFed?
https://feddit.online is available now. Registration is immediately available while I'm available to watch, but restricted when I'm not watching. If restricted, you just need to give a quick reason for joining and then be patient.
Also, some email providers have an issue with email addresses ending in .social, especially that come from a mail server hosted on Digital Ocean. If joining, check your spam filter and white list [email protected]
Remember, it's beta. So there may be issues and there may be downtime at times to address upgrades and what not. Also, I've been so busy bringing up the server that I haven't had a chance to learn everything yet about it, so I may not have answers to questions.
It seems to run efficiently, but I'm unsure if I sized the server optimally. I will grow it if need be.
Welcome to anyone interested in checking out PieFed!
@npub1vtx…e7wk [@rimu](https://mastodon.nzoss.nz/@rimu ) [@_elena](https://mastodon.social/@_elena )
#Fediverse #Lemmy

2024-09-01 01:14:42 GMT

- reply

I don't block threads on my instance. I limit them because I think as they build out more integration, spammers will begin posting from there, given that it will take longer to remove them on Threads than on a Mastodon server. I have no plans to ever block Threads.
But, I have unlimited many Threads accounts individually, as exceptions, that I know are real and safe, and will do so on request.

2024-08-14 16:29:08 GMT

@npub193d…pywh @npub1mjk…m4ma
"This person will be suspended/blocked for hear-me.social"
This is untrue. The person has been reported to hear-me.social, but has not been suspended/blocked from hear-me.social.

2024-08-13 20:08:40 GMT

- reply

Which 2 blocked you? Sorry, I've gotten lost in the discussions.

2024-08-13 12:32:29 GMT

- reply

Whew! Thank you for clarifying and revoking the offer to lunduke.

2024-08-11 15:31:51 GMT

Curious. Would appreciate boosts.
Would you knowingly hire someone for a professional job if they support #Trump?
#USPol #USPolitics #poll

2024-08-10 02:07:41 GMT

- reply

They de-federated me too, but wouldn't tell me why. I think I posted once and it was nothing special. Trust me. It's not you. It's them. They don't see reality. They have the problem. Just ignore it, like I did.

2024-08-10 02:01:48 GMT

- reply

Yeah. When they blocked this server, I think it was the first week or so. I don't think I posted more than one message. There was nobody here but me. They refused to tell me why.

2024-08-07 01:43:33 GMT

- reply

Could just be Mastodon in general. I see a lot less traffic hitting my queues than a few months back. Possible?

2024-08-06 20:09:54 GMT

- reply

Silenced by an individual or an entire instance? What size instance? That should only happen to raving lunatics. You're not a raving lunatic.

2022-12-23 01:20:24 GMT

My daughter, Miyu, created a graphic for my #Mastodon instance. I love it! Can you tell I'm a Star Trek fan?
https://hear-me.social/about
#startrek @npub1dck…0u0f @npub1n4k…0k9d @npub1zhf…09ve @npub1q0t…tqvn @npub14lf…fvf2 @npub1hsg…dcwf
https://files.hear-me.social/media_attachments/files/109/560/359/861/889/592/original/255daed56435f397.png