Raison D'souza

Engineering leader | 0 to product-market fit to repeatable execution at scale at Harness and Synup
Cycled through the Himalayas

[Raison D'souza @rdsoze]

20 minutes left in the final games and 4 teams still have a chance at winning the title. East Bengal, Mohun Bagan, Punjab and Mumbai. #ISL

[Rushil @RushilM_]

🚨 FASTag has a MASSIVE security loophole & nobody is talking about it.

Today, literally anyone with access to your car & RC can get a NEW FASTag issued on your vehicle in THEIR name & mobile number.

No OTP.
No owner authorization.
No consent from the actual vehicle owner.

The moment that happens?
Your existing FASTag gets blacklisted/deactivated instantly under the “One Vehicle One FASTag” policy.

That’s exactly what happened to me.

I’m currently transporting my car from Mumbai to Delhi & handed over the vehicle to the transporter’s driver on Saturday.

He casually asked me if there was balance in the FASTag.

Next morning, I received a message from ICICI saying a new FASTag had been activated on my vehicle & my existing FASTag would be deactivated.

Within minutes, it was blacklisted/deactivated.

Honestly, God knows what the plan even was.

Maybe he thought the balance would transfer.
Maybe he wanted to misuse it during transit.
Maybe something worse.

The scary part?
The system ALLOWED this without a single authorization from the actual vehicle owner.

The NETC FASTag portal was down the entire day.

After 4+ hours of calls, ICICI finally told me the new FASTag was issued via Airtel Payments Bank.

Later, I checked the Airtel Thanks app & guess what?
The FASTag had been registered by the SAME driver who took the car.

This is where things become ridiculous.

Airtel Payments Bank support told me THEY cannot close the FASTag unless the person who activated it calls them personally.

Read that again.

The actual vehicle owner has ZERO control over the FASTag -
but the person who fraudulently activated it does.

The NHAI helpline at 1033 was equally useless.

No emergency block.
No fraud handling.
No owner protection mechanism.

So if someone activates a FASTag on your car, you’re basically stranded.

How is this acceptable infrastructure for something linked to a vehicle owner’s identity & movement?

This is no longer just a scam.
It’s a massive security vulnerability in the FASTag ecosystem.

NPCI/NETC urgently needs mandatory owner authorization.

At the very least, mandate OTP verification from the registered vehicle owner before ANY FASTag change is approved.

This needs immediate attention, @NPCI_NPCI @FASTag_NETC.

Pathetic support, zero accountability, and absolutely no protection for the actual vehicle owner while someone else fraudulently took control of the FASTag.
That should never be possible, @ICICIBank @airtelbank.

[Raison D'souza @rdsoze]

@FinRight I had signed up for a paid EPF guidance session through @thefynprint .
I do not want to provide the login credentials for the EPFO site. After a lengthy call with you support team yesterday, they informed that I can provide screenshots. What do you need?

[Deepak Shenoy @deepakshenoy]

The last three years of low crude prices didn't help Indian consumers (we kept the petrol price the same)

Who made money? The govt, and the oil cos. The largest oil retail co, has more than 82,000 cr. in collective profits since FY24 to now.

They should take the hit now.

[Kenneth Dsouza @Kenneth]

Hey so I’m doing a workshop at @VizChitra. Tickets are on sale now 👇🏼

[Raison D'souza @rdsoze]

@meltwith @BMTC_BENGALURU Third party insurance in India is too cumbersome. Apart from FIRs, it involves impounding both vehicles, and it can take months for a court ruling.

https://t.co/hM6a9pG2Ok

[Swanand @_swanand]

Something that is obvious in hindsight but wasn't at first (to me): CTOs operate in a high-trust universe, CEOs operate in a low-trust universe.

A reductive framing:
CTO = epistemic environment
CEO = narrative environment

[Kenneth Dsouza @Kenneth]

Next ‘Design Demo Nights’ is on May 8th.

‘Design Demo Nights’ is a small, curated evening for designers (in blr) to get together, share what they’ve been building, and see what others are doing with code and AI.

Join the waitlist at (limited seats): https://t.co/yUPnpx37KM

[svs 🇮🇳 @_svs_]

why aren't we building this? 8-10 months to green canopy over streets. needs maintenance but totally worth it.

[Raison D'souza @rdsoze]

@phanichand It’s from https://t.co/eq5lrzPnSt

[Raison D'souza @rdsoze]

The guy telling you that you need ₹40 crore hasn't outperformed most of his peers.

So I checked how Dezerv's own equity PMS ranks against 446 peer strategies. Data is from PMSBazaar and Dezerv's public factsheet.

Mid-table across every timeframe.

[Sonia Shenoy @_soniashenoy]

In my opinion, If you spend 1-2 lakh/month today in a metro city for a family of 4 including education and rent/ emi, You would need roughly 8-10 crore by age 60 as a retirement corpus to live comfortably.

But Sandeep Jethwani of Dezerv tells me that inflation, lifestyle creep and unexpected health costs can inflate your retirement expenses much more than you think and 8-10cr is not enough. he says a family of 4 spending 1-2 lakhs per month today need a 40cr retirement corpus in 20 years to maintain a certain lifestyle.

That got me thinking about how the numbers keep getting more and more unattainable and the frustration among the youth is palpable due to lack of jobs and opportunities to grow income.

Whats the solution then ? reduce your expenses, cut lifestyle creep, stop comparison and decide what your definition of enough is.

Thoughts ?

[Raison D'souza @rdsoze]

@NagpalManoj @_soniashenoy Fear mongering from someone who does a very average job at managing other people's money.

https://t.co/HO3PomEkzG

[Raison D'souza @rdsoze]

The guy telling you that you need ₹40 crore hasn't outperformed most of his peers.

So I checked how Dezerv's own equity PMS ranks against 446 peer strategies. Data is from PMSBazaar and Dezerv's public factsheet.

Mid-table across every timeframe.

[Snehil Saluja @mrsnhl]

A 1 crore earning techie's life has no value in Bengaluru.

And if you're not earning that much? Your life has even less.

My sister and her friend were driving home in my car. They stopped at a red light - the logical thing anyone does. A drunk driver in a mini-truck didn't feel the need to stop. He slammed into them instead.

I know he was drunk. She knows it. The highway police knows it. The truck owner knows it.

No arrest was made.

The truck driver never showed up at the station. The owner never showed up. Nobody cared. My sister and her friend - both injured, both terrified - kept going back to the station, back to the accident site, explaining what happened over and over, just trying to get a report filed.

I was in the US. All I could do was talk to them on calls, helpless.

Here's what the police told them:
"If nobody died, an FIR doesn't make sense."
"Just claim first party insurance."
"Third party insurance doesn't pay much anyway."

And then, quietly, one officer pulled them aside and told the truth: "These truck mafia bribe us. Nothing will happen."

Nothing happened.

The truck was KA04 AE6550. The police themselves said if they'd been on a two-wheeler, both would be dead.

We had 100% insurance from Reliance. Claim rejected. Reason? "Misrepresentation of facts." These two, even while injured, kept showing up to represent the facts. Reliance still found a way to deny them.

The law says if someone hits you from behind, the person behind is at fault. It was a red light. How does a truck driver not see that?

Trust me, this isn't about money. I'll manage the repairs and the medical bills. I have savings. And I have a decent credit score; I'll take a personal loan if I have to. That's not the point.

The point is this: my sister is afraid now. Afraid that anything can happen to her at any moment and there's no one - no system, no law, no institution - that will protect her.

But how do I tell her the world is supposed to be fair? How do I tell her to trust the system? How do I explain that the drunk driver walks free, the truck owner was never questioned, and the police pocketed their bribe and closed the file?

I can't say to any official, "What if this was your daughter? Your sister?" Because their daughters travel in cars with security escorts. They will never know what it feels like to be ordinary and unprotected.

So I'm saying it to you, an ordinary reader.

You're on the road. You stop at a red light. A drunk driver in a truck rear-ends your car. Your loved one is inside, terrified.

And then you learn: there is no recourse. None.

The truck owner pays off the cops. The insurance company rejects your claim. The system shrugs.

This is Bengaluru in 2025. This is India in 2025. This is what your life is worth here.

One more thing. The friend in the car? He's one of the smartest people I know. close to top 100 rank in IIT-JEE. AI engineer and one of the biggest data companies. At 23, he is valuable to be paid more annually than the cost of five such trucks, that too, in India. He's patriotic. He pays his taxes. He stays in India even though he constantly gets offers to move to the US.

This is the confidence our system gives to someone who is clearly an asset to this country. All this unfairness - for a drunk truck driver.

@blrcitytraffic @BlrCityPolice - tell me. I've always avoided raising fingers publicly. But what else can I do?

[Prukalpa ✨ @prukalpa]

The 3 roles —> Engineering, Product and Design are definitely merging into one “you build the product” role.

[Raison D'souza @rdsoze]

Hey @ani @bsindia , is this legit?
https://t.co/ge8fQGxYkp

Website domain for puchasing tickets was registered a month back, Insta and FB pages two months back. Seems suspect

[Nikhil sharma @gajodharwa]

Hey @BrunoMars
Can you please confirm that this is a scam?

Bruno Mars India Tour

https://t.co/w3zJBnAtG1

[Ramanuj Mukherjee @law_ninja]

Turns out Goa Tourism decided the best course of action when tens of thousands of people are complaining about how badly they were treated in the state is this:

[Neil Borate @ActusDei]

Govt made PMJAY 5 lakh health cover open for ALL Indians> 70 yrs. But
1) Just 3k active hospitals
2) Hospitals refusing PMJAY patients
3) Quality hospitals not empaneled
If you have private insurance, keep it. Even if expensive.
Story by @apri_sharma https://t.co/uVngXEqsvs

[jss @jsensarma]

There's a cab company in India. It's founder says we just need to think big and we will become a world leader in AI.

Let's compare this cab company with its cross continent rival Uber.

[Shreyas Doshi @shreyas]

Since time immemorial, when a CEO asks a PM at Product Review, “what do you need to 10X users/revenue?”, “what will make you go faster?”, etc

The PM steadfastly responds “We need [N] more engineers”. The Eng Mgr nods approvingly

A story thread, with some hard truths to swallow:

[Akash Manohar @HashNuke]

While that post about GraphQL is trending, here are my notes.

I've worked on and helped with GraphQL implementations in Node, Ruby & Python, across micro-services. It's almost 2am. And I have a fckton of solutions, notes, opinions, whatever and in no particular order, all from memory. So I'll just type them here.

Use "summary" types to limit query nesting.
* For certain types with a lot of nested fields, some of these fields would return "shadow types" of the original type. These were basically types with some fields from the original type, without the fields that allowed further nesting.
* There's also query length that can be used to limit queries.

Lookup the queried fields to optimize data-fetching
In one case, we used the parsed query structure in the python graphl lib to check the fields being queried and then fetch appropriate data to return. I very clearly remember working on @kann87's laptop one afternoon for this 😀

Errors
You have to plan how you want your errors to be returned since multiple queries are possible. Very likely that the easy way is going to be responses & errors with status:200, because your errors could be only in parts if your query spans different actions. (we did more; notes in next section).

Schema stitching
* The v1(?) of Apollo server allowed piecing together multiple GraphQL endpoints into one endpoint. We wrote our own schema-stitching endpoint on top of Apollo server with some bells and whistles (below).
* This included checking responses from different micro-services for errors and returning an appropriate status code.
* The graphql introspection queries would have to be supported without authentication for end-users to be able to explore APIs with their graphql clients. Now when you add schema-stitching, it gets complicated. You now have to parse the query at the schema stitching endpoint to check if the query is an introspection query to be passed on as is, or if it has to be authenticated before passing it downstream to a micros-service.
* We had a small implementation in here that translated certain REST calls to GraphQL. This was for some large customer that demanded a REST API because their only integration engineer knew "REST".
* Authentication would ideally be here at the endpoint. That's what we did. But then I one fine day, someone up-top mandated that auth be it's own micro-service and so we had the n+1 with auth queries being made on each micro-service that was serving part of the query (This one - like many other things - is on me. I should have stood my ground to not let non-coding managers decide what happens in the codebase).
* What about file uploads? We built support for that too with this schema-stitcher endpoint.

Testing
You can say bye bye to your "I'll call this endpoint with these params and get this response" tests. It now is combination of inputs/queries/mutations that need to be tested. I read somewhere that someone wanted to do property-based testing for graphql APIs.

Versioning
I remember seeing some popular company API using suffixes like "CreatePandaV2", and another using headers to version their APIs. How do you plan to version your APIs? And you also have to decide what types/queries are exposed in different versions.

GraphQL is no guarantee that your frontends are going to make few queries.
We can all dream 🤣
Frontends can have serious tech debt too and when they have it, you'll be disappointed to find your frontends making multiple API calls to populate different sections of the UI despite the graphql endpoint being able to serve them all at once.

Requires re-thinking tooling
* Integrations with observability tools won't be out of the box. Your request metrics for the endpoint are useless now. You have to switch to publishing measurements at the level/functions that respond to the GraphQL types/fields/queries.
* Not just integration, reviewing these metrics becomes a hard task (and therefore makes it useless to have them).
* If you have schema-stitching, depending on your setup, the endpoint has to be restarted every time there's an update to a micro-service deployed with a new/updated schema.

Impact on API end-users outside the company
* While it is possible to use apps to explore GraphQL schema, nothing beats documentation that users can Google. Without this, your team will have to write additional cookbook-style documentation, with the assumption that readers do not know GraphQL.
* Exposing this API to customers impacts caching because unlike your frontend, these users can hit your API with any combination of fields.
* Ok, also explain cursor-based pagination, graphql file uploads, etc, to customers 🤣
* Or try explaining to customers that are using the existing API that there's this new GraphQL API and... 🏃

What's one good thing that came of it?
Better collaboration. When planning work, the frontend and backend engineers would decide the schema (queries, types, mutations, etc) and part ways until it was time to integrate and test. The graphql schema could be used to generate an endpoint with fake data (this setup is EASY with graphql). So the frontend folks could work in parallel. The folks would just switch the endpoint on the frontend from the fake data endpoint to a real one. I'm sure this is possible with non-graphql stuff too, but I haven't explored (maybe throw an OpenAPI spec and get fake data?).

Would I do GraphQL again?
Fuck no. I like my peace. I would rather go with purpose-built REST APIs than free-form query-what-you-want APIs like graphql. Your frontend requires a special API endpoint? Write one. This helps keep surface area smaller for bugs.

For most of us, GraphQL is one of those things that reads impressive on a tech blog of a large company, but horrible if brought home.

It may seem like GraphQL types/fields can just be thrown together as you grow your APIs, but designing GraphQL APIs requires thorough planning (much more than a usual HTTP API endpoint). Especially so, if you have end-users/customers using the APIs.

Not all Engineering teams can afford the time. And some of us (especially me as I get older), don't want the headache of onboarding every new person with an additional paradigm/layer.

While it may be old adage for some, this experience etched "keep it simple" on my mind permanently.