Kiran Jonnalagadda

My superpower is wondering “what happens if I do this” and then somehow causing epic drama.

[RedBoxxLocal India Parody @REDBOXINDIIA]

The X account of betting platform @Polymarket account is now withheld in India.

This development has no relation to the fact that they ran below poll during the CJP protests in Delhi

[Nikhil Pahwa @nixxin]

The first step towards dealing with a colossal fuckup is to acknowledge that it is a colossal fuckup, instead of trying to weasel out of it with ad hominem against ppl explaining the seriousness of this colossal fuckup.

Our bureaucrats treat Yes Minister as guidance not parody.

[Charlie Warzel @cwarzel]

you're just going about your day and you now get to read stuff like "Trump says Sundar Pichai talked him out of renaming the Atlantic Ocean" and you just have to nod and move on with your day.

“Oceans are different, sir.” lmao

https://t.co/Dfly8jfZz1

[Michael Weiss @michaeldweiss]

The GRU hacked into Jared Kushner's iPhone. Dutch military intelligence (MIVD) then recruited a GRU spy who gave them access to the hacked phone. What MIVD discovered was that Kushner had access to two bank accounts --one Azerbaijani, the other Israeli --where Saudi Crown Prince Mohammed bin Salman and Emirati ruler Mohammed bin Zayed deposited money. It sounds like a slightly far-fetched episode of "Slow Horses," but it's real. And it proves just how eye-poppingly corrupt this administration was and continues to be as its "special envoy" decides the fate of tens of millions in Europe in the Middle East. Simply incredible reporting by Matthew Cole, drawn from his new book on Kushner. https://t.co/8AyV60gg1X

[Kun Chen @kunchenguid]

see - if eMudhra was chinese, they would never have picked number 4 as their private key

[Gergely Orosz @GergelyOrosz]

I suspect the real reason eMudhra is exiting the SSL business is Google indicated it is most likely going to drop eMudhra from being trusted by Chrome AT ALL, after observing inexplicable incompetence in how they mis-generated their private key for the CA certificate.

[Young child/golden retriever @EggMasonValue]

BREAKING: eMudhra exits SSL/TLS certificate business, blames social media instead of incompetence for the same

[Sandeep Srinivasa @sandeepssrin]

So this is an interesting story. How eMudhra became the foundation of global internet. Im surprised that no news channels are digging up the root CA history. Maybe people dont know that this is public information.

https://t.co/0WIu1XaKoD

So this is the discussion list for mozilla security policy back in 2018. When emudhra first applied for inclusion as a root ca.

One of the maintainers questions eMudhra's credentials as an "Indian co".

The filing in response is very interesting.

"eMudhra has been a licensed CA under
Controller of Certifying Authorities which operates the Indian
Government Root for more than 10 years and is also a licensed CA in
Mauritius under Ministry of IT, Mauritius. eMudhra has issued over 35
million digital certificates (3% of India’s population).
eMudhra is a critical partner to Digital India and supports the usage of
digital signatures on a variety of eGovernance platforms for
Government of India including Company Law Board, Income Tax, Goods
and Service Tax (GST / VAT), eProcurement, Travel Portals, Customs,
Banking etc. eMudhra’s solutions power digital signature and other
multifactor authentication for over 35 Banks which include domestic
and global Banks. eMudhra also has a proprietary CA solution which is
today used by the Indian Army and other defense establishments."

Eventually mozilla HAD to accept, because emudhra claimed publicly - "But this was not a complete Webtrust audited setup. Rather, it is under Government of India."

[Troy Hunt @troyhunt]

The important thing with incidents like @eMudhra is to proceed openly and by engaging with the communit… ah crap

[Nikhil Pahwa @nixxin]

Indian govt can't secure shit: emudhra, aadhaar, the list is endless. CERT-IN issues advisories, protects nothing.

But Home Min & DOT will shove stupid ideas down our throats be of their god complex.

They have no idea how much will break, & can't be bothered to figure out

[flow in 🏴‍☠️ @flowirin]

the certificates were issued a long time ago, and are embedded in many IoT devices. in that time, the ability to intercept encrypted emails and SMS meant that many challenge/response logins were wide open.
so there could be backdoors in place across the ENTIRE internet.

Think like a state backed red team.

Every single system exposed to the 'net needs to be examined for breaches. including ISP hardware.

[Kiran Jonnalagadda @jackerhack]

@GergelyOrosz Nobody in India is surprised. Just look at eMudhra's official statements. We call this "Digital Public Infrastructure".

[Nilesh Trivedi @nileshtrivedi]

> The revoked intermediates themselves have no customer impact. They never issued a certificate, so no certificate in use anywhere relied on them.

This is a listed company whose business is digital signatures, completely missing the point. 🤦‍♂️

Everyone who either had emudhra's certs in their trust store or communicates with such entities who had that, is impacted - not just emudhra "customers". Because many web browsers, operating systems, and cloud provides included these, almost everyone in the world is impacted.

Cloudflare explains the seriousness of the problem:

[Kiran Jonnalagadda @jackerhack]

@kognise7 Class A is too large. ISPs and large networks tend to use it, so their netmask becomes my LAN bridging problem. Class C preferred. I find myself setting up small LANs often (<10 devices).

[Kiran Jonnalagadda @jackerhack]

I want to move my home LAN off the common 192.168.0.x and 192.268.1.x ranges. Something other than 0 and 1.

Options: 4, 66, 115, 155, 156, 230, 237

[Kiran Jonnalagadda @jackerhack]

@thedivtagguy Mine's already 42. Need more numbers.

[Kiran Jonnalagadda @jackerhack]

@vinayaravind That reminds me of someone who made great comics before making world-changing software. 🫡 @rough__sea

[Kiran Jonnalagadda @jackerhack]

@kingslyj Fat finger syndrome. My network so big…

[Kiran Jonnalagadda @jackerhack]

@gautamnpradhan Good obscure choice. Must have a story? I find myself setting up LANs a lot and bridging needs unique subnets, so that needs a generator. No 0, 1, 2 or 100. Maybe based on door number? Today's new series is great! eMudhra private key numbers are all uncommon for LANs.

[Samuel Colvin @samuelcolvin]

I read this and I'm terrified, the situation seems intractable.

In the python ecosystem alone every cpython install, venv, UV is at risk.

Don't get my started on npm, pnpm, yarn, go, rust.

My current 2026 security posture: stay home and only connect to the internet from a trusted ISP.

The winter is coming.

https://t.co/ZYkRKcRvs8

[Kiran Jonnalagadda @jackerhack]

@gauravsabnis Please frame them. I wish I had the sense to do that when I had any.