Vishnu S

Programmer @zerodhaonline, volunteer @FOSSUnited and @RainmatterOrg

[Vishnu S @vishnus]

We (@zerodha) are excited to announce the launch of a dedicated fund aimed at providing financial assistance to Free/Libre and Open Source Software (FOSS/FLOSS) projects globally, with an annual commitment of $1 million. Read more here: https://t.co/o7dF6ZipEI

[Yashar Ali 🐘 @yashar]

London Underground station flooding has reportedly been reduced by around 90% thanks to a group of engineers: beavers.

After conservationists reintroduced a family of beavers into a nearby city park, the animals built dams and restored wetlands that now absorb and slow floodwater naturally.

Authorities had planned major man-made flood infrastructure, but the beavers effectively created their own system — while also boosting biodiversity and restoring the ecosystem around them.

[Vishnu S @vishnus]

@airtelnews Hi, got this message few days back, now during a call the call got disconnected and keeps getting the error "Not registered on network" both calls and internet died :/ unable to call 121 obviously for raising complaint

[Sanitary Panels @sanitarypanels]

In this week’s “I have a comic on that”

Page 120 from my book Touching Grass https://t.co/OFnsJEz077

[Sanitary Panels @sanitarypanels]

Why do Indian government officials turn into white hippies visiting Goa when asked a hard question by international press? “The culture, the colours, the yoga, the food, the people namasté 😍😩🙏🏼”

[GrapheneOS @GrapheneOS]

Apple and Google are gradually expanding their use of hardware-based attestation. They're convincing a growing number of services to adopt it. Google's Play Integrity API and Apple's App Attest API are very similar. Apple brought it to the web via Privacy Pass, which Google intends on doing too.

Google's Play Integrity API requires hardware attestation for the strong integrity level and is gradually phasing in requiring it for the more commonly used device integrity level. Apple already has it as a requirement. Over the long term, this will increasingly lock out hardware and OS competition.

The purpose of these systems is disallowing people from using hardware and software not approved by Apple or Google. This is wrongly presented as being a security feature. Banks and government services are the main ones adopting it but Apple and Google are encouraging every service to use it.

Apple's Privacy Pass brought hardware attestation to the web to help with passing captchas on their own hardware. Many people saw that as harmless since few sites would be willing to lock out non-Apple-hardware users. Apple and Google are both likely to bring broader hardware attestation to the web.

Google's reCAPTCHA is planning an approach where they use Privacy Pass on Apple hardware, their own approach on Google Mobile Services Android devices and a QR code scanning system to require an iOS or Google certified Android device for Windows and other systems:

https://t.co/7rQnioRa8A

Banking and government services increasingly require using a mobile app where they can use attestation to force using an Apple or Google approved device and OS. Apple's privacy pass, Google's 'cancelled' Web Environment Integrity and now reCAPTCHA Mobile Verification are bringing this to the web.

Current media coverage for reCAPTCHA Mobile Verification misunderstands it and the impact of it. They're bringing a hardware attestation requirement to Windows, desktop Linux, OpenBSD, etc. by requiring a QR scan from a certified smartphone to pass reCAPTCHA in some cases. They could expand it more.

Control over reCAPTCHA puts Google in a position where they can require having either iOS or a certified Android device to use an enormous amount of the web. Google defines certification requirements for Android which includes forcing bundling Google Chrome, etc. It's enormously anti-competitive.

Google's Play Integrity API bans using GrapheneOS despite it being far more secure than anything they permit. It also bans using any other alternative. This isn't somehow specific to an AOSP-based OS. You can't avoid this by using a mobile OS based on FreeBSD instead. You'll just be more locked out.

Google's Play Integrity API permits devices with no security patches for 10 years. The device integrity level can be bypassed via spoofing but they can detect it quite well and block it once it starts being done at scale. The strong integrity level requires leaked keys from TEEs/SEs to bypass it.

It doesn't provide a useful security feature, but it does lock out competition very well. Services requiring Apple App Attest or Google Play Integrity are primarily helping to lock in Apple and Google having a duopoly for mobile devices. Play Integrity is more relevant due to AOSP being open source.

Governments are increasingly mandating using Apple's App Attest and Google's Play Integrity for not only their own services but also commercial services. The EU is leading the charge of making these requirements for digital payments, ID, age verification, etc. Many EU government apps require them.

Instead of governments stopping Apple and Google from engaging in egregiously anti-competitive behavior, they're directly participating in locking out competition via their own services. Requiring people to have an Apple device or Google-certified Android device is anti-competition, not security.

reCAPTCHA Mobile Verification will currently work with sandboxed Google Play on GrapheneOS but it clearly exists to provide a way for them to start using hardware attestation on systems without it. People without an iOS or Android device will be locked out when this is required even without that.

This isn't about security or any missing functionality. GrapheneOS can be verified via hardware attestation. Google bans using GrapheneOS for Play Integrity because we don't license Google Mobile Services and conform to anti-competitive rules already found to be illegal in South Korea and elsewhere.

Services shouldn't ban people from using arbitrary hardware and operating systems in the first place. Google's security excuse is clearly bogus when they permit devices with no patches for 10 years but not a much more secure OS. It's for enforcing their monopolies via GMS licensing, that's all.

[Raizer @RaizerSays]

Adani

[Nithin Kamath @Nithin0dha]

The heat has been brutal this past week. Temperatures hit 45° in Nagpur, 44° in Ahmedabad, 43° in Prayagraj, 42° in Delhi. Even Bengaluru hit 37°. And we're still in April 😬

A big contributing factor behind rising temperatures is the loss of forest cover, and India has lost a lot of it. Back in 2020, we met the team behind Farmers for Forests (F4F). Their idea was to do agroforestry at scale. The challenge is that farmers can't afford to wait years for trees to pay off, and most tree-planting projects don't survive the first monsoon. The idea was ambitious, and we at @RainmatterOrg backed them early.

Most tree-planting in India is monoculture, just rows of one species. But a plantation isn't a forest. F4F plants multi-layer agroforests with fruit, timber, shrubs, intercrops, and native species, trying to mimic what an actual forest does.

Six years later, they've gone from 50 acres to 5,000 acres and have just secured funding to reach 40,000 over the next three years. Compared to traditional crop farming, per acre, they're seeing ~4x carbon sequestration, ~3x farmer income, and meaningful improvement in biodiversity and soil health. Still early days, but promising.

Those numbers needed to be verifiable. So F4F built TreeLens, an open-source tree-tracking system that uses drone imagery to measure carbon sequestration, tree height, and biodiversity across thousands of small farms. 15 other organisations now use it.

The hardest problem in agroforestry is time. Fruit trees take 5 to 7 years to pay off, and most small farmers simply can't wait that long. So F4F is now working with the government and the larger ecosystem to design financial instruments like carbon bonds and first-loss guarantees that protect farmers while the trees grow.

Really glad we backed Arti, Aditya, and Krutika early.

[Karthik Rangappa 🇮🇳 @karthikrangappa]

Since we published the 1st module on @ZerodhaVarsity (2014), there has been one constant request - to release the module in book format. I think many still prefer holding a book in hand, flipping through pages, highlighting, and taking notes. For all of them, here is the book 😊

This book is for those who want to get started with the stock markets, but dont know where and how to start.

Thanks to Trisha Bora and @HarperCollinsIN for nudging me constantly to work on this book :)

It feels odd to say this - but the link to preorder the book is in the comments below 😬

[Nithin Kamath @Nithin0dha]

Rainmatter started in 2016, with a few of us doubling up on our day jobs and trying to help startups that were trying to expand India’s capital markets ecosystem. Nine years later, it has grown into something far bigger than we ever imagined.

So far, we’ve invested over ₹1,500 crore across 160+ startups spanning fintech, climate, health, media, and deep tech. We’ve also earmarked 10% of everything Zerodha earns to invest in startups, and another 10% for the social sector through the @RainmatterOrg.

The thesis has evolved from just expanding the capital markets, but the thread running through it is simple. As a country, we need to own more of what we consume. Sovereignty, in the truest sense.

We’re not a typical VC. We don’t take board seats, and we’re not in this for quick exits. We’re not interested in forcing founders into short-term decisions just so we can make money in five or six years.

The simple reality is that building a good business is hard. Building one that is genuinely useful, scalable, and profitable is even harder when investors are pushing you to speedrun success and sustainability.

That kind of pressure usually leads to shortcuts. And shortcuts, more often than not, come at the consumer’s expense.

So our approach has been simple: be patient, back founders for the long term, and help them build the business the right way.

That, more than anything else, is the heart of @Rainmatterin.

[Nithin Kamath @Nithin0dha]

Kite Terminal Mode is now live on beta!

We are quite excited about this. 😬Beta platform and feedback links in reply.

[Nithin Kamath @Nithin0dha]

The number of full-fledged Free and open-source software (FOSS) products and initiatives coming out of the 4th Phase, JP Nagar (Zerodha Tech), must be unprecedented for a team of its size globally.

All of these projects started as a way to solve problems we faced internally and were then open sourced. We use them at scale in our stack, and several large organisations and even government departments globally use many of these tools today.

Read more, check the website in the comments.

[Nithin Kamath @Nithin0dha]

In 2020, we did something very odd. Well, K (Kailash, CTO) did. He helped open-source Alar, a Kannada–English dictionary. It's a little absurd, considering we're a stockbroking company, but the project itself is one of monumental importance.

The story of how Alar came to be is even more inspiring. It was essentially the life's work of one man: V. Krishna.
Alar is the online version of what he had built over 40 years—researching, writing, and cataloguing more than 150,000 Kannada words and 240,000 English definitions, complete with all their attendant details. Just thinking about someone spending four decades relentlessly pursuing one single project is beyond inspiring. Oh, and he is still working on adding to the corpus. That @zerodha had even a small role to play in this is deeply gratifying.

It has now been five years since Alar launched, and over two lakh people visit it every month. It also just received a major update, faster than ever. And K has been working on improving dictpress, the underlying open-source technology that powers the creation of online dictionaries includng Alar.

So if, by any chance, you're obsessed with languages and dictionaries and have been wondering how to build one online, you should definitely check it out. (link in comments)

[Karthik Rangappa 🇮🇳 @karthikrangappa]

Office perks 😬

[Nithin Kamath @Nithin0dha]

The amount of love this has gotten is quite crazy. I was just asking K, 'How does it make sense that there are tech companies worth billions and trillions of dollars who use these pieces of open source software without which they could not exist, and yet are unwilling to fund them?'

We’ve been funding open source projects from ~2018 on and off before setting up FLOSS/fund in 2024. We run on open source, so supporting is a no-brainer.

Our support for ffmpeg received a lot of unexpected goodwill among the open source community internationally, which, as a business, are not even our target customers. As such, I don’t understand why tech businesses don’t do this. Barring everything, they could at least do it out of their marketing budgets for the sake of publicity? It would be a win-win.

[Nithin Kamath @Nithin0dha]

If there’s one thing I wish I had done differently when I was hit by a stroke last January, it would be to go to the hospital immediately, within the Golden Hour (<4.5 hours), instead of thinking I could just sleep it off.

This “nothing will happen to me” attitude is common, especially among those under 50. But the truth is, strokes are rising sharply, up to nearly 30% of all strokes in the last few years, among 30 to 50-year-olds.

When it comes to strokes, time is brain; every minute counts.

Thanks to @timesofindia for featuring this on World Stroke Day today.

[Nithin Kamath @Nithin0dha]

Tech sovereignty and self-sufficiency are national conversations now, the world over. Free and open-source software (FOSS) enables just that—tech sovereignty and, at the same time, mutually assured global collaboration and innovation. IndiaAI Mission's recent push for sovereign open-source LLMs is a great example for this. Without FOSS, there would be no Zerodha or the global digital ecosystem as we know it today.

Here's an article by K (Kailash) on the topic from 2021 that's still relevant now (link in the replies).

[Venkatesh Alla @venkat_fin9]

Where are you @Gurudev?

[Vir Das @thevirdas]

Anyone else still on an iphone 13 mini not wanting to change because it's THE perfect size?

[Defence Brat @DefenceBrat]

Hello Guys, finally the link to report civic issue is live: https://t.co/4UgYBaoAZT

All thanks to active developers on X. Especially @MeHonestPerson who made it smooth and intuitive

Pls report all your civic issue with the pic of your local DM/MLA/MP/CM/PM

[Nithin Kamath @Nithin0dha]

We met with several partners/ leaders  from the social sector that we work with at @RainmatterOrg yesterday.

It was my first time interacting with so many at once, and the quality and depth of the conversations struck me, far beyond the usual closed-room discussions with founders that revolve around PMF, CAC, DAU/MAU, etc.

Honestly, I felt stressed. 😬I didn’t know what to say to people who aren’t chasing the standard benchmarks in life that most of us are. Many have given up lucrative careers to work for the greater good of society.

This “doing good” deserves far more encouragement. If we could even celebrate 1% of what we do as compared to startup founders based on valuations, user growth, etc that would be a good start.

Oh, and someone asked me to add, just because they work at a non-profit doesn’t mean they don’t earn a salary. 🙂 They do, but their incentives are very different from what drives most of us.