My superpower is wondering “what happens if I do this” and then somehow causing epic drama.
Bangalore, India
Joined February 2007
- Tweets86K
- Following2.9K
- Followers20.4K
- Likes10.4K
Kiran Jonnalagadda retweeted
I'm so glad that we have LLMs to make computers more expensive for the first time since they were invented while also taking my job and making everyone illiterate
Kiran Jonnalagadda retweeted
eMudhra login to download customer's certs can be cracked
Their 1FA login generates a OTP & sends it. It also sends a RSA public key to front end
They haven't rate limited checks, so you can offline brute force 0 to 9999 encrypted with public key & find the OTP
@ni5arga
Kiran Jonnalagadda retweeted
I don’t think people realize how selfless and wonderful the StackOverflow’s founders were.
Unlike reddit, x etc they insisted ALL of their content will be 100% open, nothing will ever be locked up in walled garden.
They made it a point by even offering structured data downloads!
They didn’t cared people cloning the website. They didn’t worry about putting the whole monetization thing at risk.
It was a true hacker spirit in it’s purest form.
Most folks won’t be able to grasp how hard this is. You are on top of the world. Millions of people depend on you daily. You have the rarest opportunity to rack in billions. And you still stay true to your principles.
This exactly in turn later enabled AI revolution. I still remember downloading entire SO archives and preparing it for pre-training while Reddit and others went onto lawfare and firewalling the content. Note that this was the content their users - not reddit employees - had created for free and voluntarily to help others and the world. But they locked it all up for profiting from it personally.
SO did none of that. I think they knew they will be sacrificed at the altar. Yet it will exactly serve the intent of their founding principles to help others and the world, now through AI, even at bigger scale.
All of today’s models are built upon efforts of such true pure hackers who spent their days and years to create training data for AIs. I was a proud SO contributer for many years and there are couple of times while testing models I did felt that models might have used my answers 😇.
Hats off to @codinghorror and @spolsky and so many builders and hackers at SO for moving the world forward, one revolution at a time 🫡.
Huh, did Ather just convince me to never buy an Ather? WTF is this pride in making spyware?
Travelling after a long time, so I had to rediscover the concept from first principles and make something called luggage.
Kiran Jonnalagadda retweeted
Schrödinger’s Supreme Court.
'Logical Discrepancy' Category Allowed In Bengal SIR As Interim Arrangement, Its Legality Yet To Be Decided : Supreme Court |@DebbyJain
How can a person already in 2003 voter list be categorised as 'logical discrepancy'?, #SupremeCourt Court asked.
livelaw.in/top-stories/logic…
Kiran Jonnalagadda retweeted
eMudhra has been blocking curl/wget/python urllib User-Agent headers from accessing CRLs
bugzilla.mozilla.org/show_bu…
Kiran Jonnalagadda retweeted
Yeah. Finmin has really screwed up, and the govt is screwing up too.
What you're also seeing as a citizen is:
1. Corruption all around and increasing power of a few entities.
2. Party in power cares only for election results, not national interest
3. Extractive taxation policies and increasing complexity in doing business.
4. Zero accountability among ministers and bureaucrats.
5. Massive uncertainty in and irrationality of govt policies.
They've gone full UPA2 on us.
Additionally given the geopolitical environment, businesses are not focusing on capex. This quarters earnings and forecasts are going to point towards a dire scenario
Never seen such dismay: Why a 36-year market veteran is warning India msn.com/en-in/money/economy/…
Kiran Jonnalagadda retweeted
Umar Khalid's thesis was removed from IISER Pune library. Their BoG chair described its inclusion as "shocking" and a "mischief."
Bit of a strong reaction to a book whose subject is the effect of British colonial administration on Adivasi communities between 1830-1897.
Kiran Jonnalagadda retweeted
It’s deeply disrespectful to us Brazilians, who spent 20 days mobilizing across the country, standing up to Big Tech and imperialist forces, to credit our victory as a nation to an American billionaire who said absolutely nothing about our elections. Delete this shit, @Variety.
Lula’s Election Win: How Taylor’s Swift’s Advice to Fandom Helped Him to a Historic Victory and Defeat for Trump variety.com/2026/film/global…
Kiran Jonnalagadda retweeted
Bolsonaro lost because several Brazilian models are actually in Indian voter rolls electing our far right
Kiran Jonnalagadda retweeted
Do they have police permission?
They announced at night for next day.
They should take permission 10 days before like it's expected from students.
Won't this effect traders and their businesses?
They should postpone the protest after the festival.
The BJP has announced a nationwide protest on Monday (October 26, 2026) against Congress president Mallikarjun Kharge's "indecent and offensive" remarks targeting Prime Minister Narendra Modi.
thehindu.com/news/national/b…
Kiran Jonnalagadda retweeted
For code to be considered law, it has to be open. But codification of law with software is resulting in black box governance, where one won't know what is the code? We are ending up with Kafka's trial where you are punished because they won't tell you what the law is.
Kiran Jonnalagadda retweeted
I got this joke when I was 8.
The internet revealed to me that there are now 20 years old who don’t get it.
Kiran Jonnalagadda retweeted
PSA for macOS users:
1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.
2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.
3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.
4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.
4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.
5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:
“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”
Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.
I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
PSA for Codex CLI users:
1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates.
2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands.
3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions.
4. To check your codex version run "codex --version". It should be at least 0.164.0.
5. To patch the vulnerability, run "codex update".
6. Apps that bundle their own Codex copy must also be checked.