Kiran Jonnalagadda (@jackerhack) header
Kiran Jonnalagadda (@jackerhack) profile picture

My superpower is wondering “what happens if I do this” and then somehow causing epic drama.

Bangalore, India
Joined February 2007
Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)Photo by Kiran Jonnalagadda (@jackerhack)
Kiran Jonnalagadda retweeted
I'm so glad that we have LLMs to make computers more expensive for the first time since they were invented while also taking my job and making everyone illiterate
41
560
7
6,703
78,065
Kiran Jonnalagadda retweeted
Nigga ain't you dead too?
Rest in peace, Sir Patrick Stewart... you will be greatly missed by the world.
950
31,781
612
491,102
7,044,254
Kiran Jonnalagadda retweeted
eMudhra login to download customer's certs can be cracked Their 1FA login generates a OTP & sends it. It also sends a RSA public key to front end They haven't rate limited checks, so you can offline brute force 0 to 9999 encrypted with public key & find the OTP @ni5arga
45
228
44
3,850
295,820
Kiran Jonnalagadda retweeted
I don’t think people realize how selfless and wonderful the StackOverflow’s founders were. Unlike reddit, x etc they insisted ALL of their content will be 100% open, nothing will ever be locked up in walled garden. They made it a point by even offering structured data downloads! They didn’t cared people cloning the website. They didn’t worry about putting the whole monetization thing at risk. It was a true hacker spirit in it’s purest form. Most folks won’t be able to grasp how hard this is. You are on top of the world. Millions of people depend on you daily. You have the rarest opportunity to rack in billions. And you still stay true to your principles. This exactly in turn later enabled AI revolution. I still remember downloading entire SO archives and preparing it for pre-training while Reddit and others went onto lawfare and firewalling the content. Note that this was the content their users - not reddit employees - had created for free and voluntarily to help others and the world. But they locked it all up for profiting from it personally. SO did none of that. I think they knew they will be sacrificed at the altar. Yet it will exactly serve the intent of their founding principles to help others and the world, now through AI, even at bigger scale. All of today’s models are built upon efforts of such true pure hackers who spent their days and years to create training data for AIs. I was a proud SO contributer for many years and there are couple of times while testing models I did felt that models might have used my answers 😇. Hats off to @codinghorror and @spolsky and so many builders and hackers at SO for moving the world forward, one revolution at a time 🫡.
New record for Stack Overflow: <1000 questions posted last month
103
405
41
4,872
184,719
Kiran Jonnalagadda retweeted
Schrödinger’s Supreme Court.
'Logical Discrepancy' Category Allowed In Bengal SIR As Interim Arrangement, Its Legality Yet To Be Decided : Supreme Court |@DebbyJain How can a person already in 2003 voter list be categorised as 'logical discrepancy'?, #SupremeCourt Court asked. livelaw.in/top-stories/logic…
12
191
5
822
16,056
Who made this?
212
1,047
130
6,643
462,234
Kiran Jonnalagadda retweeted
eMudhra has been blocking curl/wget/python urllib User-Agent headers from accessing CRLs bugzilla.mozilla.org/show_bu…
23
106
20
1,528
79,786
Kiran Jonnalagadda retweeted
Yeah. Finmin has really screwed up, and the govt is screwing up too. What you're also seeing as a citizen is: 1. Corruption all around and increasing power of a few entities. 2. Party in power cares only for election results, not national interest 3. Extractive taxation policies and increasing complexity in doing business. 4. Zero accountability among ministers and bureaucrats. 5. Massive uncertainty in and irrationality of govt policies. They've gone full UPA2 on us. Additionally given the geopolitical environment, businesses are not focusing on capex. This quarters earnings and forecasts are going to point towards a dire scenario
Never seen such dismay: Why a 36-year market veteran is warning India msn.com/en-in/money/economy/…
14
62
8
212
15,724
Kiran Jonnalagadda retweeted
Umar Khalid's thesis was removed from IISER Pune library. Their BoG chair described its inclusion as "shocking" and a "mischief." Bit of a strong reaction to a book whose subject is the effect of British colonial administration on Adivasi communities between 1830-1897.
4
246
6
1,584
21,512
Kiran Jonnalagadda retweeted
It’s deeply disrespectful to us Brazilians, who spent 20 days mobilizing across the country, standing up to Big Tech and imperialist forces, to credit our victory as a nation to an American billionaire who said absolutely nothing about our elections. Delete this shit, @Variety.
90
16,051
140
119,331
1,210,906
Kiran Jonnalagadda retweeted
I’m dead ☠️☠️☠️
102
615
73
4,271
355,538
Kiran Jonnalagadda retweeted
Bolsonaro lost because several Brazilian models are actually in Indian voter rolls electing our far right
38
545
54
4,829
57,808
Kiran Jonnalagadda retweeted
Do they have police permission? They announced at night for next day. They should take permission 10 days before like it's expected from students. Won't this effect traders and their businesses? They should postpone the protest after the festival.
The BJP has announced a nationwide protest on Monday (October 26, 2026) against Congress president Mallikarjun Kharge's "indecent and offensive" remarks targeting Prime Minister Narendra Modi. thehindu.com/news/national/b…
30
694
4
3,935
41,897
Kiran Jonnalagadda retweeted
For code to be considered law, it has to be open. But codification of law with software is resulting in black box governance, where one won't know what is the code? We are ending up with Kafka's trial where you are punished because they won't tell you what the law is.
8
205
9
484
10,231
Hotdogs are made of dog flesh. It's literally in the name of the food!
Hitler was a far left socialist. Literally in the name of his party!
163
564
13
7,586
83,519
Kiran Jonnalagadda retweeted
I got this joke when I was 8. The internet revealed to me that there are now 20 years old who don’t get it.
385
3,026
78
99,656
4,645,418
Kiran Jonnalagadda retweeted
PSA for macOS users: 1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys. 2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git. 3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately. 4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again. 4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below. 5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt: “Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.” Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple. I’ll share the script I used in a follow-up post if you’d prefer to use that directly.
PSA for Codex CLI users: 1. Codex 0.163.0’s release lockfile pins rustls-webpki 0.103.15 and root bundles that can still trust compromised eMudhra certificates. 2. An attacker intercepting your connection could impersonate a server, steal sensitive data, or alter responses, potentially tricking Codex into running malicious commands. 3. Codex 0.164.0, released October 23 at 12:48 a.m. ET, updates those dependencies to fixed versions. 4. To check your codex version run "codex --version". It should be at least 0.164.0. 5. To patch the vulnerability, run "codex update". 6. Apps that bundle their own Codex copy must also be checked.
59
147
23
1,504
323,320
Kiran Jonnalagadda retweeted
Dictators will always insist that you follow the proper channels to remove them from power because they know they have captured those very channels. They are confident the system will protect them, not the people.
35
4,529
79
11,697
96,972
Kiran Jonnalagadda retweeted
Election Commission’s software has made a massive blunder. It’s translating Hindi/Urdu names by treating them as if they were English. For example, the name was Muhammad Iqbal Beg, but the software turned it into “Mohammad Iqbal Bheek Mangte Hain”. Another example: A woman’s name was Phool Kali Devi, and the software changed it to “Murkh Kali Devi” . Absolute chaos, what’s going on?
71
323
89
1,135
108,085
Kiran Jonnalagadda retweeted
The closest we have come to getting an independent audit of the EVMs.
🇮🇳 🚨 INDIA: EVIL MARKHORS CLAIMS BREACH OF BHARAT ELECTRONICS (BEL), DEFENSE FIRM'S PERSONNEL AND SHAREHOLDER KYC DATA ALLEGEDLY LEAKED The hacktivist group Evil Markhors claims it breached Bharat Electronics Limited (BEL), India's state-owned defense electronics manufacturer, and leaked about 1 GB of internal data (around 1,069 files). The actor claims: * A roster of roughly 18,000 to 19,500 retirees and spouses * 23,553 shareholder KYC records, including PAN, Aadhaar and dates of birth * More than 50,000 rows of recruitment candidate data * Around 6,000 health-benefit portal accounts, working login credentials and organizational digital-signature private keys ⚠️ Analyst Note: If real, the Aadhaar and PAN data puts shareholders and staff at high risk of identity fraud and targeted phishing, and stolen credentials or signing keys could be used against BEL systems and its defense supply chain. Hacktivist groups in this space have a history of exaggerated claims. BEL has not confirmed an incident. Unverified threat-actor claim, NOT confirmation of a breach. #DDW #DarkWeb #India #Defense #DataBreach #ThreatIntelligence
23
108
1,637