Sourya

Si tacuisses, philosophus mansisses.

Views are personal.

Advocate | Policy Wonk.

Not Left. Not Right. Just Free. :)

[Sourya @JoeBanerjee]

Law students all over the country should understand that the point of Law School is not to memorize the Constitution and pass the exam. It doesn't matter if you can't recollect an Article. The point is to understand what the Constitution stands for, so the same can be defended.

[Sourya @JoeBanerjee]

Maybe they are not wrong about the press freedom rankings in India..

[Rahul Shivshankar @RShivshankar]

BIG ACTION BY MODI GOVERNMENT
CBSE Chairman and Secretary transferred over the CBSE evaluation failure.
Inquiry committee constituted to probe the procurement of On-Screen Marking (OSM) services by CBSE.

[Nikhil Pahwa @nixxin]

Someone @ CERT-IN woke up & decided to come to work finally.

CERT-IN was always useless. Moment this govt took a decision to take CERT-IN out of the ambit of accountability via RTI, the pressure to improve vanished.

Destruction of RTI by this govt has real world consequences.

[Dharmendra Pradhan @dpradhanbjp]

Learn to take responsibility,you are VP of GOP.Cowards never take responsibility .Hippocracy of Sahazade!!!

[Sakshi Narula @mssakshinarula]

My god ...please watch this. I swear this country is being held together by a chewing gum.@ni5arga well done on exposing these vulnerabilities and even answering the media so confidently. I know this is not easy for you and took a lot of courage 🙌

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[Makarand (मकरंद) (مکرند) @Makarand_S]

@prempanicker He's at 3

1. nothing is going to happen.
2. something may be about to happen, but we should do nothing about it.
3. that maybe we should do something about it, but there's nothing we *can* do
4. maybe there was something we could have done, but it's too late now.

[Prem Panicker @prempanicker]

Steps are not taken by whom, FFS?

The passive voice isn't accidental or careless. It is calculated evasion. "If steps are not taken" conjures up urgency while discounting accountability. The crisis hovers in the realm of the abstract, responsibility for the remedy is unattributed, and Modi gets to sound alarmed without being answerable for whether HE takes those steps, HIS government, HIS energy ministry.

The consequence is vivid and concrete — erase development, set us back 10-20 years — but the condition for avoiding it is mist. The passive says: something must be done, by someone, somehow. Which is another way of saying: don't look at me, I am enjoying Indian culture in the Netherlands.

[Sourya @JoeBanerjee]

Thread got nationalist Indians supporting Robert Clive and positively drawing parallels between EEC and BJP.

[Sunanda Vashisht @sunandavashisht]

In 1756, Siraj-ud-Daulah attacked and captured Calcutta after the British refused to comply with his orders. Many British soldiers fled to Falta to regroup. In Falta, British regrouped under Robert Clive and received naval support from the Royal Navy. They also formed an alliance with Mir Jafar after their retreat to Falta. Finally this led to decisive Battle of Plassey in 1757 and rest is history.

[Neil Borate @ActusDei]

Welcome to the Hunger Games - Indian Income Tax Version

Every year the Indian State plays a version of hunger games with its taxpayers. Those who have made the mistake of earning RSUs (ESOPs) abroad by working in multinationals or those who have dared to invest abroad through entirely legal channels, trying to take some shelter from an ever-falling rupee, have to run the gauntlet of something called Schedule FA. This Schedule (along with other related parts like Schedule FSI) is an exam that only the most skilled CAs can pass - or they think they can, until the robot singing the song stops and a single foot has inadvertently moved ahead. You then get hit by the horrors of the Black Money Act. The funny thing is the real black money sits in crypto and that is way more relaxed in terms of reporting norms in Schedule VDA.

So let's go back to the hunger games. You have to know first of all that even if you have disclosed your foreign assets or income elsewhere, it must also be present in Schedule FA. Not just present, but in the right way with things like date of investment, peak balance and other minute details correctly recorded. It must be in calendar year although everything else in the ITR is financial year. You have to ensure that the asset is disclosed in rupees using the SBI TT rate (which SBI itself doesn't actually put out). Your CA has to be smart enough to fetch the TT rate from some website the unofficially records it from SBI. If by some miracle you've been a class topper and filled every single detail correctly, you could still end up with a notice. Because 'the system' has flagged it.

Most Indian citizens who invest overseas in listed equity have every intention of paying tax. There is a paper trail at every point - from the remittance to the actual investment with annual information sharing between countries. Sometimes, they make the mistake of thinking tax is payable when there is actually income (schedule FA applies even if you don't actually have any income from abroad that year) and fail to disclose it. If they don't 'do the needful' they are hit with a 10 lakh penalty if they're lucky and prosecution if they are not. In recent years, the State has waived penalty for small mistakes (up to Rs 20 lakh) but for many, the annual hunger games are a brutal as ever. As more and more people flunk the exam, the government has tried SMSes and 'nudge' to get them to pass.

But here's a simpler idea. Just prefill Schedule FA and FSI using the info you get from foreign countries and let citizens 'agree' with the tax. Just as happens with the AIS for all other types of income. Alternatively give a relaxation from hunger games for those investing in listed equity - these are not the black money people. They're just trying to make a quick buck by scoring the next Nvidia or they actually work in Nvidia.

Unless the State has every intention of playing these games so that scapegoats can be found, while politicians continue to sink black money into real estate and crypto without check. In that case, lose your best and brightest to Dubai, faster than ever.

[Sourya @JoeBanerjee]

People who don't understand the difference between en dash and em dash shouldn't really be calling other people's posts AI generated, simply cause it has one.

[Sourya @JoeBanerjee]

@malikgarv Maybe even 1% of subscribers renewing is fine for them. But ChatGPT is free for 12 months. Gemini for 18 (I think), and Perplexity again for 12. By the 12th month the entire AI Asst setup may change. Making non renewal of this redundant for the company. All assumptions here.

[Sourya @JoeBanerjee]

Grew up in WB. There were constant strikes almost every two weeks. Nothing really worked or got done. Kolkata seemed happier with nostalgia than progress. Havnt been there for the last few years, but we are massively better than where we were. Still a LOT to be done

[ranjona banerji 🇮🇳 @ranjona]

No arguments here. Moved to Calcutta in 1977. Traffic, road conditions, poverty, garbage, powercuts, bad health facilities, constant upheavals, it was traumatic.
The improvements are staggering since then.

[ranjona banerji 🇮🇳 @ranjona]

😂😂😂😂😂

[Sourya @JoeBanerjee]

Think tanks are not for profit and run on donations and grants.
Consultancy and advocacy firms are private companies which do research for their clients.

Nothing wrong with the second, but it is important that the media makes the distinction to understand interest groups.

[Nikhil Pahwa @nixxin]

Note for journos reporting on tech policy in India: a "Think Tank" refers typically to an NGO or non profit org.

Most orgs you're referring to as think thanks in reporting are private co's mostly representing client interests without disclosing. Many are masquerading as civil society.

Don't enable this. Ask for disclosures.

[Indian Libertarians @IndLibertarians]

Today, A.B. Venkateswara Rao and other members of the Centre for Liberty met with Siva Shankar (IAS), the newly appointed Chairman of APSPDCL.

During the meeting, we submitted substantial evidence detailing corruption and irregularities amounting to thousands of crores of rupees within APSPDCL. We have formally requested a comprehensive investigation into these issues.

To address this matter publicly, we are organizing a round table meeting with representatives from various political parties and civil society organizations at the Tirupati Press Club, tomorrow at 11:00 AM.

[Sourya @JoeBanerjee]

@J0K3Roffl Wish I was that jobless. Unfortunately no.

[R @hornysoprano]

My grandpa was a former commie who quit the CPIM coz of disagreements in the 1970s. He was beaten up with bicycle chains while he was returning from the school he taught at by his former comrades. When he ran against the CPIM as congress candidate in local elections (1/n)

[Anup Malani @anup_malani]

The failure is that we don’t teach economics in high school and/or make it a required course in college. (Even UChicago does not make it part of the core.) If Econ 101 started earlier or reached more people, people would understand supply and demand. It is in those classes that you provide simple graphs *and* empirical evidence.

[Sourya @JoeBanerjee]

@mvallamp @Aditi_muses This is what we call isomorphic mimicry in policy. It's when tech folks looks at something which is working in another country and tries to copy past it in their country without checking for the institutional systems first.I understand this concept would be confusing to you.

[Sourya @JoeBanerjee]

@paakarkai @IndLibertarians @libertypartyind More autowalls offering locker service = cheaper locker service. Why is there a complaint on that.