Building AI-powered products 💻
Having fun building things! 🚧🛠️🔭
AI-Native Full-Stack Engineer 💭
🏃 Runner
Chennai → California 🌉
NIT Trichy → SUNY Buffalo
Boomers and older generation blindly believe whatever said in WhatsApp, fb & AI.
GenZ and later generations believe similarly whatever crap sold from insta & TikTok & AI.
Only 80/90s kids are doing some research before believing it. Sad days ahead.
The fun fact about the eMudhra certificate leak is that the numbers were so low that only an AI or a flawed/test script would have found them. No sane human would have thought that a fellow human could have done something that stupid.
We just released uv 0.13.4, which updates our bundled certs in response to the eMudra incident.
This is a huge deal, and not unique to uv! It affects much of open source due to bundled CAs in certifi, webpki-root-certs, etc. Please upgrade anything that bundles CA certs.
What a terribly poor situation. And it happens because of lack of actual meritocracy in India.
What is eMudhra business model? Regulatory capture. What is their competency? Being in cahoots with the govt.
All govt organisations and PSU banks use them and they are one of the “recognised” authorities to digitally sign documents and all that - why? Because they had “contacts” in government to get into this position
No private company actually use them of course because the experience of using them is dogshit and no one competent enough trusts them.
But after getting such large PSU banks and orgs in India on board they went to other South Asian and Middle Eastern countries and got them onboard as well. And as of last week before the certificates were breached many popular financial institutions were using them.
Like if someone brute forced their certificates; within first 256 attempts all 8 intermediate certificates would be gotten.
Till now only reason they were not; was because no one thought it would be useful to brute force 2^384 combinations. Basically they never locked the door and no one actually tried to push it open all these years.
private keys from 8 intermediate CA certs have been compromised (eMudhra)
Happy "Update everything" day to all my pager-carrying friends
https://t.co/7ASSy72Rxg
How on earth did this happen:
The Indian certificate authority (CA) eMudhra had one job (well, two):
1. Create secure, 384-bit private keys
2. Store these securely and do not leak them
Well, eMudhra chose private keys between 1 and 256 (the numbers!!) and called it a day. WTF
நமது அன்பிற்குரிய ‘தேனிசைத் தென்றல்’ தேவா ஐயாவின் மறைவு மிகுந்த துயரத்தை அளிக்கிறது. தமிழ் இசையின் ஆன்மாவோடு பிணைந்த அவரது மெல்லிசைகள், பல தலைமுறையினரின் இதயங்களைத் தொட்டுள்ளன. அவை வரும் காலங்களிலும் தொடர்ந்து ஒலித்துக்கொண்டே இருக்கும்.
அவரது குடும்பத்தினர், நண்பர்கள் மற்றும் ரசிகர்களுக்கு எனது ஆழ்ந்த இரங்கலைத் தெரிவித்துக்கொள்கிறேன். அவரது ஆன்மா அமைதியில் நிலைபெறட்டும். 🤲