My superpower is wondering “what happens if I do this” and then somehow causing epic drama.
Bangalore, India
Joined February 2007
- Tweets86K
- Following2.9K
- Followers20.4K
- Likes10.4K
Kiran Jonnalagadda retweeted
The X account of betting platform @Polymarket account is now withheld in India.
This development has no relation to the fact that they ran below poll during the CJP protests in Delhi
Kiran Jonnalagadda retweeted
The first step towards dealing with a colossal fuckup is to acknowledge that it is a colossal fuckup, instead of trying to weasel out of it with ad hominem against ppl explaining the seriousness of this colossal fuckup.
Our bureaucrats treat Yes Minister as guidance not parody.
Kiran Jonnalagadda retweeted
you're just going about your day and you now get to read stuff like "Trump says Sundar Pichai talked him out of renaming the Atlantic Ocean" and you just have to nod and move on with your day.
“Oceans are different, sir.” lmao
theverge.com/policy/1016751/…
Kiran Jonnalagadda retweeted
The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. vanityfair.com/story/jared-k…
Kiran Jonnalagadda retweeted
I suspect the real reason eMudhra is exiting the SSL business is Google indicated it is most likely going to drop eMudhra from being trusted by Chrome AT ALL, after observing inexplicable incompetence in how they mis-generated their private key for the CA certificate.
Kiran Jonnalagadda retweeted
BREAKING: eMudhra exits SSL/TLS certificate business, blames social media instead of incompetence for the same
Kiran Jonnalagadda retweeted
So this is an interesting story. How eMudhra became the foundation of global internet. Im surprised that no news channels are digging up the root CA history. Maybe people dont know that this is public information.
groups.google.com/g/mozilla.…
So this is the discussion list for mozilla security policy back in 2018. When emudhra first applied for inclusion as a root ca.
One of the maintainers questions eMudhra's credentials as an "Indian co".
The filing in response is very interesting.
"eMudhra has been a licensed CA under
Controller of Certifying Authorities which operates the Indian
Government Root for more than 10 years and is also a licensed CA in
Mauritius under Ministry of IT, Mauritius. eMudhra has issued over 35
million digital certificates (3% of India’s population).
eMudhra is a critical partner to Digital India and supports the usage of
digital signatures on a variety of eGovernance platforms for
Government of India including Company Law Board, Income Tax, Goods
and Service Tax (GST / VAT), eProcurement, Travel Portals, Customs,
Banking etc. eMudhra’s solutions power digital signature and other
multifactor authentication for over 35 Banks which include domestic
and global Banks. eMudhra also has a proprietary CA solution which is
today used by the Indian Army and other defense establishments."
Eventually mozilla HAD to accept, because emudhra claimed publicly - "But this was not a complete Webtrust audited setup. Rather, it is under Government of India." – at San Francisco, CA
Kiran Jonnalagadda retweeted
The important thing with incidents like @eMudhra is to proceed openly and by engaging with the communit… ah crap
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
Kiran Jonnalagadda retweeted
Indian govt can't secure shit: emudhra, aadhaar, the list is endless. CERT-IN issues advisories, protects nothing.
But Home Min & DOT will shove stupid ideas down our throats be of their god complex.
They have no idea how much will break, & can't be bothered to figure out
Breaking :
SIM Binding will be Operational from 1st of January
#WhatsApp and Telegram Messenger will require a Physical Sim to operate.
#Apple has made necessary changes in its iOS to support Sim binding
A software patch was released in September to detect the absence of a Sim card in the iPhone.
Snapchat not required to follow Sim binding rules.
Signal App has not responded to govt notices on Sim Binding rules.
Details Here.
Kiran Jonnalagadda retweeted
the certificates were issued a long time ago, and are embedded in many IoT devices. in that time, the ability to intercept encrypted emails and SMS meant that many challenge/response logins were wide open.
so there could be backdoors in place across the ENTIRE internet.
Think like a state backed red team.
Every single system exposed to the 'net needs to be examined for breaches. including ISP hardware.
Nobody in India is surprised. Just look at eMudhra's official statements. We call this "Digital Public Infrastructure".
Kiran Jonnalagadda retweeted
> The revoked intermediates themselves have no customer impact. They never issued a certificate, so no certificate in use anywhere relied on them.
This is a listed company whose business is digital signatures, completely missing the point. 🤦♂️
Everyone who either had emudhra's certs in their trust store or communicates with such entities who had that, is impacted - not just emudhra "customers". Because many web browsers, operating systems, and cloud provides included these, almost everyone in the world is impacted.
Cloudflare explains the seriousness of the problem:
Global TLS Intermediate CA incident: We’ve updated our incident page with how it happened, who is affected (one US customer ecosystem), what’s not affected, and what we’re putting in place. We will publish the root cause once our investigation is complete.
👉emudhra.com/en/post/certific…
Readers added context they thought people might want to know
eMudhra minimizes the scope by claiming only "one US customer ecosystem" is affected. In reality, 8 of its CA certificates had catastrophically weak private keys (one being simply the number 4), allowing anyone to forge trusted HTTPS certificates for any website on the internet.blog.google/security/prote…
Class A is too large. ISPs and large networks tend to use it, so their netmask becomes my LAN bridging problem. Class C preferred. I find myself setting up small LANs often (<10 devices).
That reminds me of someone who made great comics before making world-changing software. 🫡 @rough__sea
Good obscure choice. Must have a story? I find myself setting up LANs a lot and bridging needs unique subnets, so that needs a generator. No 0, 1, 2 or 100. Maybe based on door number? Today's new series is great! eMudhra private key numbers are all uncommon for LANs.
Kiran Jonnalagadda retweeted
I read this and I'm terrified, the situation seems intractable.
In the python ecosystem alone every cpython install, venv, UV is at risk.
Don't get my started on npm, pnpm, yarn, go, rust.
My current 2026 security posture: stay home and only connect to the internet from a trusted ISP.
The winter is coming.
discuss.python.org/t/informa…
