Hector

Freelancer | Front End Programmer | React Node CSS | Gamer | Coffee is Love Biryani is BAE

[Mufaddal Vohra @mufaddal_vohra]

ON THIS DAY 7 YEARS AGO - AN ALL TIMER MEME DROPPED. 😂

[Gabbar @GabbbarSingh]

Indian chowmein tastes the best, when you are actually present, near the hawker, watching it get made.

Of course you are hungry. You see a chinese stall, with decent looking people wearing full sleeved shirts, with IT company lanyards around their necks, polishing off their plates. Enough positive signals for you to partake in.

You tell the wiry looking guy, you need one half plate, he barely registers your request, as he is busy murdering the noodles with hellfire. His forehead glistening with sweat, in the light of a petromax.

You patiently wait, as fumes of various spices enter your nostrils. Suddenly the guy throws a handful of veggies in his cauldron, they scream as they touch the red hot surface. Then he slaps the base of a bottle to emit questionable chilli sauce, while the stove hisses fire. Then all of it’s tossed with violence. Endlessly. You get hungrier.

Each time you think, maybe it’s done. He tosses it again. It’s less of cooking and more of a performance, a ticketed show, in which you get a complimentary plate of veg chowmein with a spelling mistake. Nothing elevates the taste of Indian street food more than a typo.

Everyone around the stall is just watches it get made, nobody is checking their phone. After JCB digging, this is the 2nd most watchable thing on the streets.

Then finally it’s done. Half plates come out from a tub, being manned by a teenage helper from the same village, then magically, the chowmein walah, distributes the Kadhaai-ful of noodles equally in all half-plates. Someone throws in some freshly cut onion on top. And then it’s served to you with a fork planted in it. Onions taste like apples, sweet, when had with this half plate spice bomb. Don’t miss.

[Abhijit Joshi @AbhijitJoshi87]

#DisclosureDay releasing on 12th June. My recommendation for #Pune would be the below formats.

Watch in any of the below formats to get the best experience

#DolbyCinema @CityPrideGroup in #kharadi
#Epiq @ #esquare VJ Happiness in #Hinjewadi
#IMAX @Westend_Mall in #Aundh or @MillenniumPune in #Wakad

@DolbyIn
@UniversalIND
@epiqcinema
@IMAX
@disclosureday

[Mr Sharma @sharma_views]

THIS 18-YEAR-OLD DID NOT BLINK 🔥

RAJDEEP: CBSE says TCS quoted around ₹951 crore, Coempt Edutech around ₹384 crore. Lowest bidder wins, so rules were followed.

SARTHAK 🎯: My question is not whether CBSE followed the rules. My question is why CBSE changed the rules.

RAJDEEP: People say you are batting for the opposition.

SARTHAK 🔥: In a democracy, opposition parties are pressure groups. If someone supports me, I am thankful. If someone ignores me, I do not care.

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[nisarga @ni5arga]

CBSE people didn't configure their AWS bucket properly and now we can paginate & enumerate all their media which has 2026 answersheets & question papers. ListObjectsV2 works without any auth and the bucket root is listable too — anyone on the internet can download any scanned booklet — across institutions. Multiple institutions are using the same bucket, insanely insecure.

[Sinister in the Presidency @AmandaBRinquest]

salary increases

[recluse; @cosine_distance]

I once got job security advice from an old timer who worked at IBM: "you have to inject subtle time bombs in the code that only you can disable. If they ever fire you they have to hire you back at 2x as a consultant"

[Codie Sanchez @Codie_Sanchez]

Life without HR at your company.

[BuBBliK @k1rallik]

> be Andrej Karpathy
> born in Slovakia, move to Canada at 15
> start coding at 15. instantly obsessed
> become YouTube famous... for Rubik's cube tutorials
> get PhD at Stanford under Fei-Fei Li
> co-found this tiny startup called OpenAI
> Elon calls you "arguably #2 in computer vision in the world"
> go build Tesla Autopilot for 5 years
> leave. come back to OpenAI. leave again
> coin the term "vibe coding" casually in a tweet
> it ends up in the New York Times
> build an AI education company
> 9.3M people watch your next move

Today he joined Anthropic to lead pretraining research. The man never stops.

[Andrej Karpathy @karpathy]

Personal update: I've joined Anthropic. I think the next few years at the frontier of LLMs will be especially formative. I am very excited to join the team here and get back to R&D. I remain deeply passionate about education and plan to resume my work on it in time.

[Smita Barooah @smitabarooah]

The quiet grief of adult friendship: One of the most beautiful articles I've read in a while. Hits hard
https://t.co/qXi6UBaTs3

[Abhishek AB @ABsay_ek]

Just a small anecdote of Sachin Tendulkar’s Irani Trophy debut on his birthday:

November 1989, Wankhede Stadium.
5 selectors sat in the stands with notebooks & doubts, watching a 16 year old boy try to force his way onto a plane to Pakistan. Sachin Tendulkar had already shone through the Ranji season, 583 runs showing he was ready. But the men in charge preferred patience. They wanted one more look.

Irani Trophy gave it to them. Rest of India against Delhi. Tendulkar made 39 in first innings. Promising, but not the hundred that would have made selection automatic. So the 2nd innings became an audition he could not afford to fail.

What happened next was less a cricket match & more a rescue mission. Tendulkar walked in at number 4. Scorecard around him read like a horror story. Not a single teammate managed to reach double figures after he arrived (in fact, no one crossed 6 runs). Wickets fell like dominoes. By the time 9th wicket went down, he was stranded in the 80s, the hundred slipping away with every departing batter.

Enter Gursharan Singh. Rest of India vice captain had fractured his finger in first innings, his right hand wrapped in plaster, his match effectively over. Then Raj Singh Dungarpur walked over & told him to pad up. Not to save the game, but to save the boy’s hundred.

Gursharan walked out one handed. Tendulkar, already heading back to the pavilion assuming the injured man would not bat, stopped in his tracks. Gursharan looked at him & said, “Tera hundred kar ke jayenge.”

Tendulkar smiled, took strike & told Gursharan he would handle Maninder Singh himself. They added 36 runs for last wicket & Sachin scored 103*.

A week later, he was on a flight to Karachi. Selectors had seen enough. Sometimes greatness needs a century. Sometimes it needs a teammate with a broken finger willing to stand in the firing line so the story can continue.

[Amani @Amani_Chowdhry]

https://t.co/YLEoi89q8Z

[Hector @HectorBarbosssa]

@sardamit Night 2 was a lot better

[Hector @HectorBarbosssa]

@sardamit totally !! and this year the build up was so messed up

[pdawg @prathamgrv]

this is by far my favourite tweet of all time