Pratick

Generalist

[Pratick @pratickk_]

Andaman and Nicobar could be the new "Maldives of India", reasons why it is not yet:
#ExploreIndianIslands
1/ Neglected by Mainlanders: Andaman & Nicobar Islands is often overlooked by mainstream tourists. Despite having beaches that are consistently ranked among the world's best

[Al Pacino भारद्वाज @Undoubtfulnerd]

On this World Environment Day, Iet's revisit Rahul Gandhi's another battle for ecological preservation.

The Niyamgiri hills protest against Vedanta's Bauxite Mining project in Odisha(2013)

He was always like this!

[billi @cudikudiiii7]

bsdk sidewalks to bana nahi sakta
nala saaf hota nahi
ek bi shehr ki municipality dhang se chalti nahi, kya shiksha doge vishwa ko
nalayak disgusting boomers i hope you all r0t

[Rahul Gandhi @RahulGandhi]

मैं अंडमान और निकोबार के विनाश के खिलाफ़ पूरी शक्ति के साथ खड़ा हूँ।

अंडमान और निकोबार भारत की सबसे अनमोल प्राकृतिक धरोहर हैं। वर्तमान और आने वाली पीढ़ियों के लिए उनकी रक्षा करना मेरा कर्तव्य है।

मेरे साथ जुड़िए - याचिका पर हस्ताक्षर कीजिए और इस अमूल्य संपत्ति को बचाने की लड़ाई का हिस्सा बनिए।

#GreenOverGreed

[Rahul Gandhi @RahulGandhi]

This #WorldEnvironmentDay, I want to ask every young Indian one question:

What kind of India do you want to inherit?

One where rainforests have been bulldozed for casinos, coral reefs erased from maps, tribal communities pushed off their land, and the air we breathe turned into poison?

Or one where India’s natural heritage is protected, our tribal communities are safe, and progress works with nature - not against it.

Right now, the Modi government is destroying Great Nicobar Island. More than 1.5 crore trees, ancient coral reefs, irreplaceable rainforests are being destroyed - to profit one businessman.

This is your inheritance they are bulldozing. And only you can stop them.

Sign the petition. Tell the Modi government we choose #GreenOverGreed 🇮🇳

#NicobarMatters

https://t.co/bJOIt0tzgs

[Rahul Gandhi @RahulGandhi]

I visited the southernmost tip of India.

I stood at Indira Point. I walked under trees that have stood for centuries. I dove into coral reefs among the most vibrant on earth.

And I sat with the people who live there. Tribal communities, whose land is being taken away by violating the Forest Rights Act. Settlers, many of them former soldiers, placed on these islands by the Indian government, who aren’t getting fair compensation.

The Modi government and BJP tells you Great Nicobar Project is about defence. It is not.

Expand INS Baaz - we will back the government fully. The Navy has been asking for expansion for five years - it has been ignored.

They tell you it is about a transhipment port. It is not. India is already building one in Kerala, which is on the mainland.

What it actually is: 1.5 crore trees felled. Coral reefs erased from official maps. Soldiers and tribals displaced - so one businessman can build hotels and casinos on India’s most irreplaceable ecological land.

Every young Indian I have spoken to understands this. You know that no amount of profit is worth destroying what can never be recovered.

I stand for ecologically balanced development. These islands can be the most extraordinary sustainable destination the world has ever seen. That is the India worth fighting for.

#GreenOverGreed
#NicobarMatters
#WorldEnvironmentDay

[Rahul Gandhi @RahulGandhi]

आकांक्षा डॉक्टर बनकर देश और समाज की सेवा करना चाहती थी। आकांक्षा के पिता किसान हैं। बेटी के डॉक्टर बनने के सपने के लिए किसान क्रेडिट कार्ड पर ₹3 लाख का कर्ज़ लिया। और नागपुर में खुद कुक की नौकरी कर ली, ताकि बेटी वहाँ coaching कर सके।

एक पिता ने जो कर सकता था, सब किया।
फिर NEET पेपर लीक हुआ। परीक्षा रद्द हुई। उस अनिश्चितता में आकांक्षा हमें छोड़ कर चली गई।

आकांक्षा की मौत आत्महत्या नहीं - मोदी जी की एक भ्रष्ट, टूटी हुई व्यवस्था की देन है।

और धर्मेंद्र प्रधान जी? आज भी कुर्सी पर हैं।
फिर वही कमेटी। वही ट्रांसफर। वही जाँच। न सुधार, न न्याय।

मोदी जी, कुर्सी स्थायी नहीं होती - आती-जाती रहती है। लेकिन आपने 12 वर्षों में शिक्षा व्यवस्था को जिस हद तक बर्बाद किया है, उसकी कीमत भारत की एक पूरी युवा पीढ़ी चुका रही है।

[Roshan Rai @RoshanKrRaii]

Anushka Sharma left India to live in 4 AQI of London, eats the most unadulterated food items in the world, jogs in clean lanes, lives around the most advanced healthcare system.

Then comes home occasionally and preaches unscientific cures using Homeopathy to Indians who breathe in 400+ AQI Air, eat adulterated food and walk in garbage and dirt.

[Abhijeet Dipke @abhijeet_dipke]

Sack the Education Minister!

[Abhijeet Dipke @abhijeet_dipke]

Will be returning to India to demand the resignation of the Education Minister.

I request the youth of India to join this peaceful protest at Jantar Mantar and exercise our constitutional right to seek accountability from the government.

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[The Hindu @the_hindu]

Sensitive data, including students' personal information, was processed by Google's Gemini through automation scripts prepared by quality assurance engineers at COEMPT Eduteck, CBSE's tech vendor. Ethical hacker Nisarga Adhikary (@ni5arga), who exposed #CBSE, calls it "scary" and "sad" that a third-party company allegedly sent such data to the U.S. for processing.

"Data Privacy Laws are not respected, and they should get sued for doing this without student consent," Adhikary says in conversation with Maitri Porecha (@dawalelo) and John Xavier (@johnXavier777).

[datavorous @datavorous_]

"duplex scanners" they said.

i wonder which scanner allows you to scan accessories nearby..
amazing ain't it?

not a black swan incident, sampled 2944 pages randomly, and all had similar features.

phone cameras? you say?
the tender(s) said something different.

[nisarga @ni5arga]

CBSE people didn't configure their AWS bucket properly and now we can paginate & enumerate all their media which has 2026 answersheets & question papers. ListObjectsV2 works without any auth and the bucket root is listable too — anyone on the internet can download any scanned booklet — across institutions. Multiple institutions are using the same bucket, insanely insecure.

[Jawhar Sircar @jawharsircar]

Dharmendra Pradhan's son
is studying in America, so did Nirmala's and Jyotiraditya.

Piyush Goyal's son is studying in Singapore, Anurag Thakur's son is studying in Canada.

S. Jaishankar's son is studying in the UK & even Smriti Irani (who hardly studied) sent son to study there.

Nishikant Dubey's son studied in Scotland

So why would these people bother about NEET paper leak
or CBSE scam or communal distortion of history by NCERT?

Or care about your children getting pushed around in trains and buses or even committing suicide?

Government of Hypocrites from Top to Bottom!!

[V Vinay @ainvvy]

Brazen. But nothing deters them because there are no consequences, and they have no conscience.

It is all about managing the narrative. Suffereing students be damned.

[ZayK | @Bombaycircuitt]

Indian Air Force for transporting NEET question papers ? 😭

[Rahul Gandhi @RahulGandhi]

Read this story. Carefully.

CBSE called for OSM tenders thrice. Zero bids the first time. No qualified bidder the second time. And finally, the technical bar was lowered until COEMPT could clear it.

Scanning resolution cut. Robotic scanner requirement dropped. CMMI certification lowered from Level 5 to Level 3. Penalties for errors in answer sheets removed.

TCS, India’s biggest IT services company, qualified in the third round too. TCS lost. COEMPT - a company with a spectacular track record of failure - won.

And what are CBSE students complaining about today? Badly scanned answer sheets. Missing pages. A broken evaluation portal.

Teachers had warned CBSE that the OSM system needed at least a year or two for further preparation before nationwide implementation, yet it was rushed through.

So I ask again - who wanted COEMPT to win? Who lowered the bar, step by step, until this company could clear it?

Pradhan ji and CBSE say “due process was followed.” That is not an answer, that is not accountability. The question is whether the contract was honestly awarded to the best company which could do the job correctly.

The futures of 18.5 lakh children were handed to a company that could only qualify after the rules were bent for it.

To the BJP Ministers attacking me for asking questions - I have, from day one, demanded an independent judicial probe. Expand it from CBSE to every contract awarded to COEMPT. Our youth deserve the truth.

And Modi ji, your silence on the CBSE debacle and inaction against the Education Minister tells the country what you actually care about - not the futures of lakhs of students, only the survival of your own government.

[nisarga @ni5arga]

Some updates: HT found some shocking stuff about the CBSE OSM process from digging into the publicly obtainable tenders.

Also, most of the dashboards for other institutions hosted under the onmark domain don't seem to have proper security – they are also running on an old version of PHP.