Kapil Varshney

Computer Vision | Deep Learning
Data Scientist @ Esri R&D New Delhi
BS Aerospace Engineering @ UIUC

[Malay Krishna @Malay4Product]

Every Indian needs to know about this because it is a massive deal for how we trust anything on the internet.

Let me explain.

When you open your bank's website, there's a small padlock next to the web address. That padlock means two things.

First, that you're talking to your real bank.

And second that nobody can read what you type, like your password.

So how does your browser know the website is real?

It checks the website's certificate. Think of it like an ID card for a website.

Your Aadhaar is trusted because the government issued it. A website's ID card is trusted because a certificate authority issued it.

A certificate authority, or CA, is a company that browsers like Chrome, Firefox and Safari already trust. If a CA says "yes, this really is this bank's website," your browser believes it and shows the padlock.

eMudhra is an Indian CA. It's a big one, with more than 60 million certificates issued over the years.

So how does a CA sign these ID cards?

Every CA has a secret number called a private key. It uses that number to put a stamp on each certificate.

Your browser checks the stamp to confirm it really came from that CA.

The whole system only works if that number is impossible to guess.

For the type of key in this story, it's supposed to be around 116 digits long.

Every computer on Earth working together for billions of years wouldn't be able to guess a number like that, just because of the sheer combinations that exist.

But here's what happened.

On October 17, Mozilla got a report that the private keys behind eight eMudhra certificates had been compromised.

The report came through a person called Wayne on Google's Chrome team.

The keys weren't 116 digits long.

All eight keys were smaller than 256. Security researcher Scott Helme found that one of them was just the number 4. Others were 66, 155, 156, 230 and 237.

So anyone could break them by trying 256 numbers. A basic laptop does that in less than a second.

Mozilla didn't need to know how Wayne did it. Its own team recovered the keys within two hours. Since then, several other people have found them on their own too.

To understand the gravity of the problem, a bad actor could make fake ID cards for any website they want.

Your bank, your email, a government portal.

Browsers that trusted eMudhra would have checked the fake stamp and shown the padlock like everything was fine.

If someone could get between you and the internet, say on public Wi-Fi, they could show you a fake site with a real-looking padlock and read or change what you send.

eMudhra says a script used during its key creation process back in April 2025 had a flaw. It made a second, much weaker set of keys, and those were used by mistake to create the certificates.

That means these weak keys were there for about a year and a half before anyone caught it. eMudhra says the person who found it may have used AI-assisted techniques.

The good news is that the response was fast.

Mozilla received the report at 8:06 pm UTC on October 17 and had pushed a block to Firefox users by 10:59 pm.

Google, Apple and Microsoft have also blocked these certificates for their users.

eMudhra revoked all eight the next morning and stopped issuing new certificates from the affected root.

Mozilla is now removing that root certificate from Firefox's trusted list altogether.

But there's still a lot of clean-up to do.

Browsers are mostly covered. But plenty of apps, servers and backend systems don't check these block lists. They need software updates to stop trusting the bad certificates, and some of those updates are still pending.

Real websites that used eMudhra are also affected. Yash Kadakia, founder of Security Brigade, estimates around 30,000 legitimate certificates will need to be moved over. A lot of those are likely Indian businesses and services.

See, we're moving our whole lives online, UPI, banking, tax filing, DigiLocker, government services.

All of it rests on this invisible layer of trust.

So, when an Indian company that's trusted by every major browser makes a mistake this basic, it hurts how the world sees Indian digital infrastructure.

This has happened before, and it went very badly.

In 2011, a Dutch CA called DigiNotar was hacked, and fake Google certificates were used to spy on people in Iran.

Browsers stopped trusting it completely, and the company shut down soon after.

For now, here's what you can do. Keep your browser and apps updated on your phone and laptop.

Be careful on public Wi-Fi. Type your bank's website address yourself instead of clicking links.

eMudhra still owes India a clear, public explanation of how a key that protects millions of people ended up being the number 4.

[International Cyber Digest @IntCyberDigest]

‼️ BREAKING: The private keys of 8 certificates from Indian certificate authority eMudhra were compromised, Mozilla says. Firefox blocked them within 3 hours.

Each key should be a 116-digit number, but one was just 4.

Anyone can guess them and forge HTTPS certs for any website.

[Andrew Ng @AndrewYNg]

One of the new, buzzy jobs in Silicon Valley is the AI Forward Deployed Engineer (FDE), an engineer who is embedded within a client organization to help customize solutions, such as building and tuning agentic workflows that suit the client’s particular needs. I’ve heard from people who are wondering anew about the FDE career path since OpenAI and Anthropic started building new teams to place FDEs within client organizations.

The rise of FDEs for AI workloads is one way AI is creating new jobs (and why the jobpolcalypse narrative of upcoming job market collapse is false -- there will be many AI and non-AI jobs). However, I believe there will be far more AI Engineer jobs than FDEs, as I explain below.

The FDE role was pioneered about two decades ago by Palantir, which sent engineers to government locations to work on secure, air-gapped networks. In addition to having good technical skills, FDEs need communication skills and sometimes business skills. For example, they may need to speak with clients to understand their needs, formulate a strategy to prioritize projects, explain complex technology, and respectfully push back if a client asks for something unrealistic. They’re enjoying a resurgence because of the amount of work involved in taking an off-the-shelf LLM and building it into a custom agentic workflow that fits particular business needs.

However, I believe the number of AI Engineer jobs will be far larger. A company might accept a few FDEs to be embedded within its organization. But most companies will want far more of their own employees working on their projects. While my organizations do hire FDEs, we hire far more AI Engineers! Also, a common client concern is that it is hard to find vendor-neutral FDEs — they are, after all, there to deeply integrate a particular vendor’s product into a company. In this moment when it’s hard to predict which AI service will be the best one in a year’s time, optionality (the ability to pick whatever vendor turns out to fit best in the future) is very valuable. In contrast, letting FDEs tightly bind a company’s processes significantly reduces optionality.

Right now, I see surging demand for AI Engineers who can build software applications using AI software components (like LLM prompting, agentic frameworks, evals, etc.) and effectively use AI coding agents (like Claude Code, Codex, Antigravity CLI, and OpenCode). As the AI Engineer role matures, I expect it to fragment into more specialized roles, like the generic Software Engineer role from decades ago fragmented into frontend, backend, mobile, data engineering, devops, and so on.

What will be the future, specialized AI engineering roles? I don’t know. Perhaps there will be AI FDEs, LLMOps Engineers, Evals Engineers, AI Data Engineers, Harness Engineers, and other roles we don’t have names for yet. But for now, I see a lot of AI engineers who are generalists create a lot of value. Skilled AI Engineers are in very high demand! As our field continues to mature over the coming decade, I look forward to new specializations within AI Engineering that create even more job opportunities.

[Original text: The Batch newsletter]

[Kapil Varshney @kapilv14]

@_groww @IDFCFIRSTBank @MiraeAsset_IN @utimutualfund @abslmf @SEBI_India Kiran Singh from @_groww called me up and clarified that @IDFCFIRSTBank takes 1 day to settle the Net Banking transactions and hence the fund house allots the NAV of the next day. @IDFCFIRSTBank why is the settlement delayed by 1 day, other banks do it on the same day?

[Kapil Varshney @kapilv14]

Since 1/1/24, when I place a lumpsum MF order on @_groww, the money from @IDFCFIRSTBank is debited & the order is confirmed by @MiraeAsset_IN @utimutualfund @abslmf instantly, but the payment is confirmed after 1 day (and NAV of 1 day later). Can anyone explain why? @SEBI_India

[Kapil Varshney @kapilv14]

@_groww @IDFCFIRSTBank @MiraeAsset_IN @utimutualfund @abslmf @SEBI_India I don't understand this!
How is it that the fund realization happens a day later if it gets debited from my account at the moment of placing the order? Where is that money for that 1-day duration?

[Kapil Varshney @kapilv14]

@_groww @IDFCFIRSTBank @MiraeAsset_IN @utimutualfund @abslmf @SEBI_India Part 2:
...as per SEBI guidelines pool account will not be available for placing orders so we can't place the order on your behalf the order gets placed directly at BSE and as per that NAV will be applied and units allocation is done.

[Kapil Varshney @kapilv14]

@_groww @IDFCFIRSTBank @MiraeAsset_IN @utimutualfund @abslmf @SEBI_India This is the reply I received from @_groww earlier:

Part1:
We would like to inform you that NAV applicability is now totally dependent on fund realization at the fund house end. Once the funds are received at the fund house that NAV will be applied for the orders because now...

[Kapil Varshney @kapilv14]

I am expecting the NAV of the same day if the money is debited from my account on that day.

[Kapil Varshney @kapilv14]

@airtelindia @Axisbank why are you sending me WhatsApp msgs to apply for the Airtel Axis CC when you think I am not eligible? Please, either give the CC or don't put it on my face.

PS: I already have another Axis CC. But, whatever...

[Kapil Varshney @kapilv14]

@Flipkart @AxisBank Credit Card wants me to pay up for a fraudulent charge which I reported right away, in January. @AxisBankSupport isn't really supportive, their whole narrative is around blaming me for sharing the OTP with the scammers.

[Kapil Varshney @kapilv14]

@UberINSupport @prabhjeet_s Thanks, I see the refund has been initiated.

[Kapil Varshney @kapilv14]

@Uber @Uber_India doing organized scam with Reservations-they assign you a cab that will b 30mins away at the time of pickup, forcing you to cancel & pay cancellation fees to book another ride. @UberINSupport defends the driver. @nch1915 @prabhjeet_s @MORTHIndia @AshwiniKChoubey

[Kapil Varshney @kapilv14]

At #LucknowJunction, to reach Platform 6, you need to pay toll 3 times-20, 60, 20; the last two are just 50m apart, causing wait times and jams at the station. Any explanation @RailMinIndia @AshwiniVaishnaw sir, for wasting the public's time and money? @GM_NRly @gmner_gkp

[Google DeepMind @GoogleDeepMind]

A new algorithm that generates paintings using a neural visual grammar system evaluated using a text conditioned dual encoder. This allows for the creation of images that look very different from those made by GANs: https://t.co/fEDghIzDRv

[elvis @omarsar0]

🔥 The NLP Cookbook: Modern Recipes for
Transformer based Deep Learning Architectures

This is one of the best overviews of Transformer based models for NLP I've seen. A good read for ML engineers/researchers wanting to learn about modern NLP techniques.

https://t.co/mYO5htK8Fp

[Kapil Varshney @kapilv14]

So no more googling Linux commands!!

[elvis @omarsar0]

🔥 Machine learning powered Linux shell 🔥

A cool project showing how to use @OpenAI's API to build a basic program that turns task descriptions into commands.

full video: https://t.co/8zzAk1qrn4
blog: https://t.co/TTGuG6TZf8

[Yann LeCun @ylecun]

Solving integrals and differential equations symbolically with deep learning.
Now open source.

[MIT CSAIL @MIT_CSAIL]

ML model saves 90% on bandwidth during video-calls by using just an image of your face & some basic motion data.

Paper: https://t.co/AK5zxCRl9L (v/@nvidia)

Video: https://t.co/kuTiC4QoNQ (v/@twominutepapers)

#CVPR2021 #Compression #DeepFakes #KindOf

[MIT CSAIL @MIT_CSAIL]

A map for your machine learning needs: https://t.co/GHVt6hosaE

#mondaymotivation