Organic Intellectual | Founder/CTO @teamohanahq | ⌨️ Clojure | عاشقِ ریختہ | বাংলা | 🏋🏽♂️🏃🏾♂️🚣🏽♂️ | Previously: Co-founder & CTO @Helpshift | he/him
Here, now.
Joined March 2007
- Tweets21.1K
- Following937
- Followers3.3K
- Likes19.9K
Pinned Tweet
I grew up on FreeNode. Strangers became collaborators. No onboarding, no invitation. Just a nickname and a conversation. Then Slack and Discord happened, and IRC quietly disappeared. Last weekend, I brought it back, but the participants aren't just people anymore. 🧵👇
ALT pi-irc-messenger is an extension for pi-coding-agent. It allows agents to collaborate with each other over IRC.
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Goodbye @haricm 😔
mediatinker.com/2026/10/21/h…
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Has anyone looked into @eMudhra 's ISO27001 and SOC2 certifications?
Their ISO/IEC 27001:2022 (Information Security Management System) seems to have expired on 04-May-2026.
Is there a newer one @eMudhra? Can you share your SOC2 status too?
resources.emudhra.com/Corpor…
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
In response to the eMudhra / emSign certificate security incident we've published guidance for Python users to update CA certificates: discuss.python.org/t/informa…
#security #Python #pki
discuss.python.org/t/informa…
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
I read this and I'm terrified, the situation seems intractable.
In the python ecosystem alone every cpython install, venv, UV is at risk.
Don't get my started on npm, pnpm, yarn, go, rust.
My current 2026 security posture: stay home and only connect to the internet from a trusted ISP.
The winter is coming.
discuss.python.org/t/informa…
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Sorry everyone... We're announcing a 0-Day vuln in QUIC that allows anyone to remotely turn off a server running these libraries. I swear we didn't plan this.
foxio.io/blog/header-accordi…
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Railway is compromised, rotate all API keys as soon as possible
Deployments are down so don’t wait to redeploy
Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack
Stay safe friends
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Fallout of e-Mudhra cert compromise, all indian govt websites using them won't be accessible on major browsers except for Desi browsers. Remember MeiTY browser challenge where Zoho won some award? Building shitty tech & calling it sovereignty is what we do. Desi Tech Zindabad
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
MeITy which is very quick in responding to blocking instagram, twitter handles has not responded at all over eMudhra. Under CERT-IN rules all of this should have been communicated to them by Oct 17th within 6 hrs. We block innovation and promote sovereignty, we have neither now.
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
All major browsers Firefox, Chrome, Safari, Internet explorer have all blocked eMudhra - Indian CA TLS certs for websites because they used a very generic private key {literally - 4} to issue crypto certs. Govt websites will be hard to access in India 😂
arstechnica.com/security/202…
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
The TiDB leaks
fulcrumsec.vg/pingcap/
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
From @TheAthleticFC: Erling Haaland is the latest convert to mate, a drink that has long taken football and the wider world by storm. nyti.ms/3UFkLX4
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Few days/weeks is very optimistic.
Vulnerable log4j instances were around for many years after log4shell RCE was disclosed.
These certificates are in way more places than log4j.
Pretty much every docker/$container image that ships with bare bones OS trusts these certs.
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Millions of IoT devices, Docker containers, forgotten Linux machines, unmaintained CLI tools, etc. are all going to be relentlessly hacked via safely signed malware for the next several years or maybe indefinitely.
eMudhra hack might be the most important event of the year.
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Can't wait for Modi sarkar's vehement denial that nothing was compromised as they have double checked and triple verified that these private keys are still very much available with eMudhra #DigitalIndia.
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
emudhra.we-have-a-problem.co…
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
eMudhra private key was just “4”
Wtf? What an unserious CA.
This 13-foot wall ecosystem of India continues to do cybersecurity from kindergarten
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
Following the discovery that eight eMudhra intermediate certificates use weak keys, Cloudflare is deploying mitigations and releasing client updates. We explain the impact, our response, and what customers and developers should do next. cfl.re/487DNbG
ʙᴀɪꜱʜᴀᴍᴘᴀʏᴀɴ ɢʜᴏꜱᴇ retweeted
We just released uv 0.13.4, which updates our bundled certs in response to the eMudra incident.
This is a huge deal, and not unique to uv! It affects much of open source due to bundled CAs in certifi, webpki-root-certs, etc. Please upgrade anything that bundles CA certs.
