Santosh Kumar

Solving problems with Science. Fixing things one at a time. Old time Software dev, manager now freelancer, tinkerer, crypto enthusiast

[Swamidass @jsdass1978]

South India’s toxic center JIPMER had seen 30 PG students took psychiatric counseling in the year 2025 ( Refer point 6) which shows the level of cruel inhumane duty hours and residency ragging by JR2 & JR3 with blessing of insensitive sleeping HoDs

Dear parents of PG students & Fellow Indians please don’t get deceived by the brand value and useless NIRF ranking of JIPMER.

PG ragging in JIPMER is very harsh almost in all clinical departments especially in Ortho. In Ortho no JR can get a week off for the first 180 days of ragging period and juniors are never allowed to eat brush and bathe. Also Ortho JRs have twice 36 hours cruel inhumane duty against residency scheme guidelines. HoD does nothing to alleviate the suffering. All done by senior PGs.

Dear ortho JRs & other JRs of JIPMER if your HoD / consultant or any faculty or senior humiliates / yells at you in front of nurses please file a complaint in CPGRAM as well with the national human rights commission. Please update your parents about illegal duty hours & human rights violations.
Please share live location to parents every 6 hours which would be an evidence for 24 to 36 duty hours
You can file FIR on HoD & Dean under BNS 146.

Please keep parents updated about no week off and 2 hours sleep , one meal toxic culture

Or else file a FIR in nearby police station under BNS 352 for intentional insult which will land the abuser 2 years in Jail

Please try to record the abuse.

Let's eliminate toxicity from medical education by sending law breakers and abusers to Jail

[Akshay 🚀 @akshay_pachaar]

Google just dropped a new LLM!

You can run it locally on just 8GB RAM.

Let's fine-tune this on our own data (100% locally):

[Vir Das @thevirdas]

Sir. I think maybe I speak for a small but valid percentage of India when I say couldn’t care less what the congress did anymore. Let it go. India moved on. They are not in power for their deeds. We did jokes about them for years, we booed them at the commonwealth games, they were a punch line on this platform for years, they got voted out. That’s life. These kids giving exams don’t even remember a congress govt. Questions can only be asked of those in power. That’s not being selective, it’s just called living in the present. No one dealing with a paper leak cares about BJP/Congress or Hindu/Muslim or any partisan bullshit. They’re worried about the future.

[Ayaan 🐧 @twtayaan]

The creator of Linux just publicly called out the AI hype. Word for word.

Linus Torvalds took the stage at Open Source Summit 2026 and said this:

"When I see people saying 99% of our code is written by AI, I literally get angry. Because those same people — I can pretty much guarantee — 100% of their code is written by compilers. But they never say that."

He is not anti AI. The Linux kernel saw a 20% jump in submissions this release because of AI tools. He uses it. He gets it.

His point is something most people are too afraid to say.

AI is a productivity tool exactly like compilers were. Compilers boosted programming by 1000x. AI adds another 10x on top. Enormous. But nobody says "the compiler wrote my code." So why are we saying AI wrote it?

He also flagged something nobody is talking about.

AI is flooding small open source projects with drive-by bug reports. Someone runs a prompt, files a report and disappears when asked for a patch. Maintainers with one or two people are drowning trying to keep up.

"Sometimes AI reports a bug and when you ask for more information the person has done that drive-by and does not even answer your question. That is the real burnout issue."

And his final warning was the sharpest of all.

"People who do not understand the complexity of systems will prompt systems and write processes that will fail."

The AI hype crowd is very loud right now.

Linus has been building real systems for 35 years. When he talks, engineers listen.

Full interview here:
https://t.co/LmXJtvKc4O

[Santosh Kumar @santrox444]

@Cheekytogeeky @asadowaisi @ni5arga I am very sad. Had lot of respect for cbse. Very brave boys.

[Manish Sharma @Cheekytogeeky]

be @ni5arga

→ 19 years old, from West Bengal, studied in Delhi for a few years
→ just finished his own Class 12 exams in 2026
→ calls himself a hobbyist cybersecurity researcher
→ says he is an engineer, not a hacker
→ built an OSINT engine, a stock-tracking TUI, a pastebin in Rust
→ once found bugs in FOSS United and disclosed them quietly
→ just another CBSE student watching his own board roll out a new digital marking system

then he opened the portal

→ CBSE moves Class 12 evaluation to On-Screen Marking, 1.8 million students affected
→ Nisarga sees the portal link is fully public, gets curious
→ opens DevTools, downloads the Angular JavaScript bundle
→ first vulnerability found in 30 minutes
→ a literal master password sitting in plain text inside the frontend code
→ enter it, the OTP field auto-fills, the entire login flow gets bypassed
→ OTP validation happens in the user's browser, not on the server
→ no route guards, every internal page reachable by editing browser storage
→ password reset API never checks the old password
→ systemic IDOR across the entire API, change one value in sessionStorage, become any examiner
→ outcome: take over any teacher account, view answer sheets, edit marks

25 February 2026. He reports everything to CERT-In the same day.

→ CERT-In asks for a screen recording, he sends a full walkthrough
→ acknowledgement comes back as a boilerplate reply
→ reference number assigned: CERTIn-16590126
→ he follows up multiple times. no response.
→ three months pass. portal still live. Class 12 results released. vulnerabilities still there.
→ 22 May: publishes the blog post and a thread on X
→ Deedy Das, Satish Acharya, Internet Freedom Foundation amplify it
→ the post goes viral
→ CBSE issues a clarification: that was just a test portal, no breach
→ the URL CBSE cited in their own tweet was not even a registered domain
→ a friend buys the domain and points it at Nisarga's blog
→ CBSE quietly deletes the tweet

then it gets worse

→ 25 May: finds an SQL injection vulnerability on the live production portal
→ reports to CERT-In, gets a one-line thank you
→ gains admin access to the live https://t.co/1WpmNGsczK server
→ portal stays up for four more hours
→ he uploads anime videos and memes, links them publicly from CBSE servers
→ plays a viral Japanese song on a CBSE page, makes the news for it
→ CBSE finally takes the whole portal down

then he reads the database

→ master table accessed: 10 GB, 9.3 million records
→ examiner names, addresses, school names, bank account details
→ passwords stored in plain text
→ login tokens anyone can paste into a browser to log in as that user
→ 31 May: finds a second live CBSE production portal, 45,074 records of failed payments
→ emails, phone numbers, payment IDs, order IDs, all readable
→ 31 May, the bigger one: an AWS S3 bucket is misconfigured
→ ListObjectsV2 works without authentication, the bucket root is listable
→ samples pulled from 18 lakh scanned 2026 answer sheets, every subject
→ multiple institutions sharing the same bucket
→ also notices something strange in the scans: bedsheets visible in the background of answer sheets CBSE paid for proper scanners to handle

CBSE responds

→ posts an AI-generated image saying the system is robust and secure
→ three days later admits some vulnerabilities existed and have been contained
→ refuses to name the cybersecurity firm doing the audit
→ claims they tried contacting him. he says they have not.

→ Internet Freedom Foundation writes to the Ministry of Education and CERT-In
→ asks for an investigation into CBSE, a review of the contract with vendor Coempt EduTeck, a full audit

→ he points out he could have sold this data and made a lot of money
→ he did not. he is a CBSE student too.
→ his own analogy: the door wasn't just unlocked. the key was lying on the ground in front of everyone.

a 19-year-old with a anima pff broke a national exam evaluation system in 30 minutes with browser developer tools and the government is still pretending it was a test environment

[Tom Dörr @tom_doerr]

100+ challenging Python programming exercises

https://t.co/rp3B6MdnH4

[Turing Post @TheTuringPost]

A must-read survey to refresh math and gen AI basics → The Little Book of Generative AI Foundations: An Intuitive Mathematical Primer

It shows a clear walkthrough of how gen AI learns to understand, model, and create complex data, covering:

- Latent algebra foundations: PCA, SVD, autoencoders
- Latent models: PPCA and VAEs
- VAEs: ELBO, inference, reparameterization
- Diffusion: the way from noise → denoising
- Score-based and continuous-time generative modelling
- Density models: flows, autoregression
- GANs and energy-based models beyond likelihoods

[Malay Krishna @Malay4Product]

This is an unbelievable piece of work by Sarthak and something that requires amplification.

Let me explain what he found, in simple terms.

Sarthak is a Class 12 student from the 2025-26 batch, one of the 17 lakh students whose answer sheets went through CBSE's new On-Screen Marking system.

He spent days reading through CBSE's evaluation tenders, scraped all 576 tenders CBSE has issued, and tracked how the rules changed across three versions of the same tender.

The core finding is that the company that won the contract to scan and grade 17 lakh students' answer sheets is Coempt Eduteck.

Coempt used to be called Globarena Technologies. Globarena was the company behind the 2019 Telangana intermediate exam disaster, where software failures led to 3.8 lakh students getting wrong or missing marks, and 23 students died by suicide.

A government committee found systemic failure and negligence. Six months later, Globarena rebranded to Coempt Eduteck.

So a company with that track record won a contract to handle 17 lakh CBSE students. Sarthak's investigation is about how the rules were rewritten to let that happen.

The tender was issued three times.

> First tender, February 2025. It existed, then disappeared from the public GeM portal. Sarthak scraped all 576 CBSE tenders and this one was missing from the archive entirely.

> Second tender, May 2025. Four companies applied including TCS and Coempt. All four failed the technical evaluation. Cancelled.

> Third tender, August 2025. Coempt won. Between the second and third tender, a series of rule changes happened, and every single one made it easier for Coempt to qualify.

Here is what changed, one by one.

01. The old rules disqualified any company with a history of abandoning work, failing to complete contracts, or financial weakness. The new rules deleted this clause entirely. Coempt's Telangana history stopped being a barrier.

02. The old rules disqualified any company that was "blacklisted earlier." The new rules changed this to "currently blacklisted." Because Globarena rebranded after Telangana, removing the word "earlier" effectively erased their past.

03. The rules required Rs 50 crore average turnover over three years. Coempt's exact average came to Rs 50.86 crore. They cleared the bar by less than 1%. Earlier, a smaller company had asked CBSE to lower the bar to Rs 30 crore for fairer competition. CBSE refused. So the bar was kept high enough to block small players, but sat exactly low enough for Coempt to scrape through.

04. Software maturity is measured on the CMMI scale, 1 to 5. The old rules required Level 5. The new rules dropped it to Level 3. Coempt is a Level 3 company.

05. The cooling-off period for engaging retired CBSE officials was cut from two years to one. This makes it easier to use recently retired insiders to influence the process.

06. The old rules required experience with large projects of at least 5 lakh students each. The new rules removed the student count and counted cumulative answer-book volume across small projects instead. Coempt has many small fragmented university contracts. This helped Coempt and hurt TCS.

07. The old rules required bidders to own their own data centre and disaster recovery centre on Indian soil. The new rules allowed third-party MeitY-empanelled cloud hosting. Coempt runs on AWS and Azure. This helped Coempt and hurt TCS, which owns its own data centres. It also means student data is no longer on sovereign, Indian infrastructure.

08. The old rules required the bidder to own or control the complete source code of its software. The new rules deleted this. Coempt's platform runs on Microsoft's proprietary IIS, which they don't own.

09. A last-minute corrigendum, issued right before bid submission, removed CBSE's own power to blacklist the firm if its software failed catastrophically. So even a Telangana-scale failure couldn't get Coempt banned from future government tenders.

10. The penalty structure shifted from punishing mistakes to punishing delays. The old rules fined the vendor for wrong scanning, merged pages, and unscanned books. The new rules dropped those and instead levied Rs 50,000 per day for delays. This incentivises rushed scanning over accurate scanning.

11. The old rules had a hard accuracy threshold, error rate not to exceed 0.5%. The new rules removed this number entirely.

12. The old rules specified proper book and robotics scanners. The new rules just say "sufficient scanners." The definition was vague enough that, as Sarthak notes, the scanning could be done with a phone on a stand.

13. On the security side, the contract required a VAPT (vulnerability and penetration test) certified by CERT-In before go-live, and a restricted beta phase before launch. The system clearly wasn't restricted, because the other researcher, Nisarga, was able to access it and find vulnerabilities four days before go-live. So the mandatory security audit appears to have been bypassed.

These are more than a dozen rule changes, all between the failed tender and the winning tender, all pushing in the same direction, all benefiting the one company with the worst track record in the field.

The security holes Nisarga found last week now have an explanation. The system was built by a vendor that was specifically allowed to skip the security certification, the source code ownership, the data sovereignty, and the quality thresholds the original rules demanded.

Following things need to happen immediately;

1. An immediate CAG audit of the tender process.
2. A parliamentary debate on the topic.
3. An independent investigation into
> Why the first tender vanished?
> Why the disqualification clauses were deleted?
> Why the turnover bar was held exactly where it was?
> Why the security level was dropped?
> Why the blacklisting power was removed at the last moment?

Sarthak, this is genuinely exceptional investigative work. Far better than most journalists with full resources ever manage. Take a bow. :)

[ANI @ANI]

#WATCH | Ranchi, Jharkhand | A class 12th student, Sarthak Sidhant, says, “…I have written a blog that compares the tender documents of CBSE. I have uploaded and published it… There were at least 15 discrepancies, as per my blog. I would like to highlight three or four of them. Let me give a background about Coempt. It was known as Globarena, and they have a very shady background. 23 students killed themselves because of coempt… Now, I would like to tell you about RFP (Request for Proposal). What happens is the government issues a tender and asks the bidder to bid for it. CBSE issued this tender three times… I have compared the old RFP and the new RFP, and I found some discrepancies… The first discrepancy is that there were three clauses of poor performances which was completely wiped out from the new RFP. In the earlier RFP, there was a clause called blacklisted earlier, whereas in the new RFP, it was changed to blacklisted currently. Why would the board want a service provider which was blacklisted earlier? The third thing I found out is the 50 crore limit, which you needed to qualify, and coempt qualified that by 1.7% … The time frame of corrupt practices was halved, and there were project criteria changes… It shows a pattern that the industry giant TCS was not preferred, but coempt was preferred, which works as a very fragmented group of institutions…”

[Tom Dörr @tom_doerr]

Recursive self-improving harness for AI agents

https://t.co/wXZNvEjxEQ

[Antonio Lupetti @antoniolupetti]

"Algorithms for Decision Making" is a free book about the mathematical foundations of artificial intelligence, autonomous decision systems and modern machine learning.

Published by MIT Press, the book connects probability, optimisation, planning, search, reinforcement learning, Markov decision processes, utility theory, and sequential decision-making in a rigorous yet modern way.

With more than 700 pages, it provides a remarkably broad view of how intelligent systems reason, evaluate uncertainty, and make decisions under constraints.

One of the most interesting aspects of the web is the enormous amount of high-quality free knowledge available today. Complex subjects that once required access to expensive institutions or specialised libraries are now accessible to anyone willing to study!

https://t.co/I9cHSCvvlm

[سيف الدرعي| Saif alderei @saif_aldareei]

Dubai is building the world’s largest solar-powered desalination plant in Hassyan.
Once completed in 2027, it will produce 818,000 cubic meters of fresh water per day — enough for 2 million people — using 100% solar energy.
A remarkable step in sustainable water security and clean technology.

[Hamdan bin Mohammed @HamdanMohammed]

I approved an additional package of economic incentives worth AED 1.5 billion, bringing the total support introduced over the past two months to AED 2.5 billion. The new package includes 33 initiatives offering facilitation measures ranging from three to 12 months across key sectors including tourism, trade, education, and customs services, further strengthening Dubai’s economic resilience and global competitiveness. Guided by the vision of His Highness Sheikh Mohammed bin Rashid Al Maktoum, Dubai has built a model that transforms challenges into opportunities for growth. We remain committed to strong public-private partnerships and maintaining close engagement with the community and business sector, taking every decision needed to support society, strengthen economic resilience, and reinforce Dubai’s position as a global economic hub.

[Ihtesham Ali @ihtesham2005]

A guy named nbatman on Reddit accidentally built the most useful website on the internet.

It's called FMHY (Free Media Heck Yeah).

This is the website Google delisted from search for DMCA violations, Reddit shadow-banned for promoting piracy, the Motion Picture Association flagged as a top piracy threat, and the RIAA pressured hosting providers to drop. It is still online. It is still updated every month.

Here's how it works.

FMHY is the index. The wiki itself hosts nothing. It just tells you where every free thing on the internet actually lives, organized into 14 categories with safety ratings on every single link.

→ Movies and shows in 4K from 50+ streaming sites
→ Music at Spotify and Apple Music quality
→ Adobe Creative Cloud, Microsoft Office, AutoCAD, JetBrains
→ Every paid course on every major learning platform
→ 100 million books and papers through Anna's Archive
→ Free alternatives to every paid AI tool
→ A SafeGuard browser extension that flags unsafe sites in real time

It started as a single Google Doc maintained by one Reddit moderator in 2018. Google killed it with a DMCA takedown in 2023.

The community rebuilt the wiki on its own domain, mirrored it to GitHub and IPFS, and now runs it across 12 backup domains simultaneously.

There is no company. No CEO. No central server. Six anonymous volunteers maintain the entire thing in their spare time. Donations through Ko-fi pay for the hosting. Nobody profits.

Hollywood can't shut this down. Spotify can't shut this down. Adobe can't shut this down.

The entire subscription economy is held together by you not knowing this wiki exists.

https://t.co/AAr2rLlqgy

[Data For Science @data4sci]

[2605.06394] Lecture Notes on Statistical Physics and Neural Networks — Clear lecture-style notes connecting statistical physics tools to neural network theory—useful as a structured refresher if you want the big ideas and standard derivations… https://t.co/7OQ9k6yi7g

[Ivan Velichko @iximiuz]

Networking Fundamentals for Developers, DevOps, and Platform Engineers (free course) 🔽

It doesn't matter if you work with real servers, virtual machines, Docker containers, Kubernetes pods, microVM-powered agent sandboxes, or full-blown cloud VPCs - all this tech relies on the same L2/L3 "magic" under the hood.

Gaining at least a basic understanding of how traffic flows on the Ethernet and IP layers will allow you to troubleshoot connectivity issues and design your own networking solutions. And this highly-illustrated course is a good start: https://t.co/Cm4NTgcjK9

[Simon Scheidegger @comp_simon]

Thrilled to share a project I've been refining: a complete, open-source repository on "Deep Learning for Solving and Estimating Dynamic Models in Economics and Finance."
I've cleaned up the materials from my PhD classes and summer schools into one coherent resource. 🧵 1/6

[INDIA STATISTICS @indi_statistics]

🇮🇳 Top 25 Powerful Physics Professors of India:-

1. Ashoke Sen — TIFR, string theory
2. Rohini Godbole — IISc, particle physics
3. Sandip Trivedi — TIFR
4. Rajesh Gopakumar — ICTS Bengaluru
5. Aninda Sinha — IISc Bangalore
6. Deepak Dhar — IISER Pune
7. Biman Bagchi — IISc Bangalore
8. Spenta Wadia — TIFR
9. T. V. Ramakrishnan — IIT Kanpur / IISc
10. Harish Chandra Verma — IIT Kanpur
11. Ajoy Ghatak — IIT Delhi
12. Umesh V. Waghmare — JNCASR
13. Pinaki Majumdar — Harish-Chandra Research Institute
14. Supurna Sinha — Raman Research Institute
15. Nandini Trivedi — ICTS Bengaluru
16. Arindam Ghosh — IISc Bangalore
17. Amitava Raychaudhuri — University of Calcutta
18. Gautam Bhattacharyya — SINP Kolkata
19. Bhal Chandra Joshi — NCRA Pune
20. Somak Raychaudhury — IUCAA Pune
21. Tarun Souradeep — IUCAA Pune
22. C. N. R. Rao — JNCASR
23. Thanu Padmanabhan — IUCAA Pune
24. Sriram Ramaswamy — IISc Bangalore
25. V. Balakrishnan — IIT Madras

[灰狐 @huihoo]

Open Textbook Initiative

The American Institute of Mathematics (AIM) seeks to encourage the adoption of open source and open access mathematics textbooks. The AIM Editorial Board has developed evaluation criteria to identify the books that are suitable for use in traditional university courses. The Editorial Board maintains a list of Approved Textbooks which have been judged to meet these criteria.

https://t.co/ek7Aj8jhhj