Derin Davis

💥🔥

[Derin Davis @derin_here_]

#withnothing #nothingphone2a @nothing

[Derin Davis @derin_here_]

@DelhiPolice @CPDelhi Shame on you!

[The Cockroach India 🇮🇳 @TheCockroachIND]

THE DICTATOR'S POSITION IS NOW IN DANGER.

IF YOU CAN'T WRITE, JUST RETWEET.

LONG LIVE THE REVOLUTION.

[Derin Davis @derin_here_]

@volklub 😂

[Derin Davis @derin_here_]

@RShivshankar Dude whatever. Nothing can defends the forced implementation of E20 Petrol on non-compatible. Why are we not given choices for E0, E5,E10 to use accordingly for the vehicles that was rolled out before this shit.

[Sunderdeep - Volklub @volklub]

As per NITI Ayog’s report in 2020, using e20 on e10 vehicles was a safety issue and they were urging to provide e10

Today everything is fixed! Wow!

[Derin Davis @derin_here_]

@nothingindia 📉

[BBC News (World) @BBCWorld]

Loved and loathed: The making of India's viral liver doctor https://t.co/75wad7yyOv

[Derin Davis @derin_here_]

@Phonenurd Dude I really believe they were planning to release this as the CMF phone, later backed out and rebranded this as nothing phone so that they can sell it in a higher price range.

[Derin Davis @derin_here_]

@nothing Seems like this one was supposed to be a CMF phone, but later thought of realising in the nothing series die to the ram crisis and the inflation.😂

[Malay Krishna @Malay4Product]

This is an unbelievable piece of work by Sarthak and something that requires amplification.

Let me explain what he found, in simple terms.

Sarthak is a Class 12 student from the 2025-26 batch, one of the 17 lakh students whose answer sheets went through CBSE's new On-Screen Marking system.

He spent days reading through CBSE's evaluation tenders, scraped all 576 tenders CBSE has issued, and tracked how the rules changed across three versions of the same tender.

The core finding is that the company that won the contract to scan and grade 17 lakh students' answer sheets is Coempt Eduteck.

Coempt used to be called Globarena Technologies. Globarena was the company behind the 2019 Telangana intermediate exam disaster, where software failures led to 3.8 lakh students getting wrong or missing marks, and 23 students died by suicide.

A government committee found systemic failure and negligence. Six months later, Globarena rebranded to Coempt Eduteck.

So a company with that track record won a contract to handle 17 lakh CBSE students. Sarthak's investigation is about how the rules were rewritten to let that happen.

The tender was issued three times.

> First tender, February 2025. It existed, then disappeared from the public GeM portal. Sarthak scraped all 576 CBSE tenders and this one was missing from the archive entirely.

> Second tender, May 2025. Four companies applied including TCS and Coempt. All four failed the technical evaluation. Cancelled.

> Third tender, August 2025. Coempt won. Between the second and third tender, a series of rule changes happened, and every single one made it easier for Coempt to qualify.

Here is what changed, one by one.

01. The old rules disqualified any company with a history of abandoning work, failing to complete contracts, or financial weakness. The new rules deleted this clause entirely. Coempt's Telangana history stopped being a barrier.

02. The old rules disqualified any company that was "blacklisted earlier." The new rules changed this to "currently blacklisted." Because Globarena rebranded after Telangana, removing the word "earlier" effectively erased their past.

03. The rules required Rs 50 crore average turnover over three years. Coempt's exact average came to Rs 50.86 crore. They cleared the bar by less than 1%. Earlier, a smaller company had asked CBSE to lower the bar to Rs 30 crore for fairer competition. CBSE refused. So the bar was kept high enough to block small players, but sat exactly low enough for Coempt to scrape through.

04. Software maturity is measured on the CMMI scale, 1 to 5. The old rules required Level 5. The new rules dropped it to Level 3. Coempt is a Level 3 company.

05. The cooling-off period for engaging retired CBSE officials was cut from two years to one. This makes it easier to use recently retired insiders to influence the process.

06. The old rules required experience with large projects of at least 5 lakh students each. The new rules removed the student count and counted cumulative answer-book volume across small projects instead. Coempt has many small fragmented university contracts. This helped Coempt and hurt TCS.

07. The old rules required bidders to own their own data centre and disaster recovery centre on Indian soil. The new rules allowed third-party MeitY-empanelled cloud hosting. Coempt runs on AWS and Azure. This helped Coempt and hurt TCS, which owns its own data centres. It also means student data is no longer on sovereign, Indian infrastructure.

08. The old rules required the bidder to own or control the complete source code of its software. The new rules deleted this. Coempt's platform runs on Microsoft's proprietary IIS, which they don't own.

09. A last-minute corrigendum, issued right before bid submission, removed CBSE's own power to blacklist the firm if its software failed catastrophically. So even a Telangana-scale failure couldn't get Coempt banned from future government tenders.

10. The penalty structure shifted from punishing mistakes to punishing delays. The old rules fined the vendor for wrong scanning, merged pages, and unscanned books. The new rules dropped those and instead levied Rs 50,000 per day for delays. This incentivises rushed scanning over accurate scanning.

11. The old rules had a hard accuracy threshold, error rate not to exceed 0.5%. The new rules removed this number entirely.

12. The old rules specified proper book and robotics scanners. The new rules just say "sufficient scanners." The definition was vague enough that, as Sarthak notes, the scanning could be done with a phone on a stand.

13. On the security side, the contract required a VAPT (vulnerability and penetration test) certified by CERT-In before go-live, and a restricted beta phase before launch. The system clearly wasn't restricted, because the other researcher, Nisarga, was able to access it and find vulnerabilities four days before go-live. So the mandatory security audit appears to have been bypassed.

These are more than a dozen rule changes, all between the failed tender and the winning tender, all pushing in the same direction, all benefiting the one company with the worst track record in the field.

The security holes Nisarga found last week now have an explanation. The system was built by a vendor that was specifically allowed to skip the security certification, the source code ownership, the data sovereignty, and the quality thresholds the original rules demanded.

Following things need to happen immediately;

1. An immediate CAG audit of the tender process.
2. A parliamentary debate on the topic.
3. An independent investigation into
> Why the first tender vanished?
> Why the disqualification clauses were deleted?
> Why the turnover bar was held exactly where it was?
> Why the security level was dropped?
> Why the blacklisting power was removed at the last moment?

Sarthak, this is genuinely exceptional investigative work. Far better than most journalists with full resources ever manage. Take a bow. :)

[Deedy @deedydas]

A 19-year old broke into India's largest high school examination system of 2M+ students a year, the CBSE, and was able to view and CHANGE any students' marks.

He responsibly wrote to the team 3 months ago, and it took them 3 days to fix only one of the issues. Today, they took the entire website down.

This is a absolute embarrassment. The futures and lives of millions rests in the hands of the utterly incompetent. There is also no mass media reporting on the matter.

This topic is close to me because not only is this the education system I went through, but 12 years ago and silently for 5yrs since, I'd written about and reported a much less severe vulnerability allowing me to scrape these results too. More than a decade later, not much has changed.

This 19yo, Nisarga Adhikary, wrote a great piece outlining each vulnerability he reverse engineered:
- the master password leak
- the client-side 2fac / OTP validation workaround
- tokenless access to the entire internal app (dashboard, evaluator details, etc) setting dummy browser values
- changing any password without knowing the old one
- an IDOR vuln allowing you to act as any user and edit exam marks

For those interested in a beautiful study in security breaches, this is a must read (link below).

If there's any light at the end of the tunnel, it's that a 19yo who never went to college can do things 99% of top engineers couldn't figure out.

[Derin Davis @derin_here_]

@GoogleMyBiz So frustrating to see this.Don't you care about the Google businesses? False and repetitive reviews still on the page. You could only manage to remove one. This is so annoying to keep on adding the business phone number again and again.Why do you keep on removing it from profile?

[Derin Davis @derin_here_]

@GoogleMyBiz @googlemapsit's 106 days since reporting the fake reviews on my business profile. I am thankful you took off one of them. But still 2 is remaining which are not genuine. These 2 false reviews affects the overall rating of the business profile. Please do take actions.

[Derin Davis @derin_here_]

@krishg1990 😂

[Derin Davis @derin_here_]

@MrPerfectTech @geekyranjit @beebomco

[Derin Davis @derin_here_]

@MrPerfectTech @beebomco @geekyranjit Did @nothing start app recommendations along with software updates? First it came just after the updating the phone, which I skipped succe. Later a notification came named software optimization or so. And on clicking it, came this shit again.

[Derin Davis @derin_here_]

@MrPerfectTech @geekyranjit @beebomco

[Derin Davis @derin_here_]

@GoogleMyBiz You mailed that you found all those reviews violating the rules and will be removed, but only one among them is removed.

[Derin Davis @derin_here_]

@GoogleMyBiz This is the status of the reporting. How come you take this much days with all the evidences I have given and not yet be done with the email escalation.

[FootballWalla @FootballWalla]

Dear @ckvineeth,
You are one of my favourite Malayali footballers, and my most favourite Malayali player to have played for KBFC. The kind of performance you delivered in the third season of the ISL are the stuff of legend for millions of club supporters. That said, with all due respect, the comments you made against the protesting fans didn’t sit right with me and thousands of others. This protest is not about one or two losses this season, but about the lack of ambition, intent, and effort shown by the management over the last three years. They have hidden behind hollow claims and big talk, while also threatening and mocking those who criticise them. Not once have they acknowledged mistakes in their planning for the league or any tournament over the past 3-4 seasons. This protest didn’t erupt because of a couple of defeats,it has grown out of frustration, anger, sadness, and helplessness at seeing this club decline. As someone who believes in philosophy of standing up and protesting for one’s rights, I hope you will understand the fans’ position on this.
#YennumYellow #KBFC #MagnumOut