Vamsi Krishna B

Interested in Startups, Data, DevOps and Programming

[Vamsi Krishna B @vkbdev]

@ayushagarwal DeepSeek flash 4.1 .

[Nilesh Trivedi @nileshtrivedi]

This info should be coming from the "Emergency Response" team, i.e. @IndianCERT 🫤

[Vamsi Krishna B @vkbdev]

@Yaarige_helona Mostly caste feeling alla but TG state feeling.

[Vamsi Krishna B @vkbdev]

@caretak8r @doodlestein Crazy model, it wa able to derive the said PK and also mint certs

[Nemo @captn3m0]

156 Indian government websites are currently inaccessible because of a cert revocation by @eMudhra, including 4 that come under @GoI_MeitY. One of them is @ccaindiapki - which regulates eMudhra.

cc @internetfreedom

I made a list: https://t.co/eembYeXfn6

[Nemo @captn3m0]

It took exactly one day before my brand new one-time email used on @policybazaar with @heydigit got spam.

[Vamsi Krishna B @vkbdev]

@Mudit__Gupta Who was even using emudra to get SSL certs for domains ?

[Patrick Brauckmann 🕉️ @vonbrauckmann]

My Great Grandfather x 5 came from Germany and landed in Pennsylvania in 1735. Hindus have done nothing but make great contributions. Low crime, high income and low key. Colour and dance is exactly what this world needs right now.

[Vamsi Krishna B @vkbdev]

@AjeyGore even if they didn't what's a CA going to do if no browsers trusts them any more ? question is : what about their other "core" products !

[Ambuj Kumar @ambuj0]

Fiasco with eMudhra cert signing

The first question to ask is how the heck did their private key was generated outside the HSM? Everyone is making fun of them using 4 as the private key, but even if they had used a better 'looking' key like 3d0a6371ea2d8a7e.. it just happens to be sha2 of 10/20/2026 (the day they would blow up their PKI). So, looks are not enough.

We need to move to a fully transparent open sourced CA to avoid these kind of problems. Oh wait, that already exists. Let's encrypt, everyone!

[Robin Linus ⛊ @robin_linus]

The eMudhra incident is a striking illustration of the fundamental flaw in how SSL certificates work: every Certificate Authority is effectively empowered to vouch for every website on the planet.

That’s insane.

Hopefully the world eventually adopts a Bitcoin name system.

[Eztainutlacatl @cbkwgl]

At least in the case of eMudhra, the numbers 4 and 155 were system generated. Do you know what happened with Crowdstrike? They sent a 20 digit input to a 21 digit array and when they did a non-wildcard search, it led to total collapse. If I remember correctly, no one said, a company which doesn't know the difference between 20 and 21 and doesn't know how to count numbers till 20 has no reason to exist.
You see, that is the impossible standards I was talking about. A bug is a bug. Even silly mistakes happen. No one needs to be drawn and quartered for a bug. It's a lesson to learn, not a stereotype on a company or a race. Mistakes happen and if there is a damage, there will be accountability and demands for compensation. You don't need to run a witch hunt to burn down a company for a production bug.
When people don't get similar treatment even for lethargy or for using trivial passwords which led to major issues, why are we applying absurd yardsticks in this case?

[AWACS Sky Keeper @HQuarterma43504]

Number of Certificate Authorities on Mozilla CA list by country:

Europe: 70
US: 50
UK: 14
China: 6
Japan: 8
Taiwan: 4
India: 1 (now 0)
Russia: 0

https://t.co/nrvv2aX2Ud

Establishing a company capable enough to be a CA and re-establishing trust with Mozilla will now take a long time.

[Sandeep Srinivasa @sandeepssrin]

So this is an interesting story. How eMudhra became the foundation of global internet. Im surprised that no news channels are digging up the root CA history. Maybe people dont know that this is public information.

https://t.co/0WIu1XaKoD

So this is the discussion list for mozilla security policy back in 2018. When emudhra first applied for inclusion as a root ca.

One of the maintainers questions eMudhra's credentials as an "Indian co".

The filing in response is very interesting.

"eMudhra has been a licensed CA under
Controller of Certifying Authorities which operates the Indian
Government Root for more than 10 years and is also a licensed CA in
Mauritius under Ministry of IT, Mauritius. eMudhra has issued over 35
million digital certificates (3% of India’s population).
eMudhra is a critical partner to Digital India and supports the usage of
digital signatures on a variety of eGovernance platforms for
Government of India including Company Law Board, Income Tax, Goods
and Service Tax (GST / VAT), eProcurement, Travel Portals, Customs,
Banking etc. eMudhra’s solutions power digital signature and other
multifactor authentication for over 35 Banks which include domestic
and global Banks. eMudhra also has a proprietary CA solution which is
today used by the Indian Army and other defense establishments."

Eventually mozilla HAD to accept, because emudhra claimed publicly - "But this was not a complete Webtrust audited setup. Rather, it is under Government of India."

[Vamsi Krishna B @vkbdev]

@AjeyGore @eMudhra It was hard for Let's Encrypt ( when they started ) to get accepted in all browsers !!

[Nemo @captn3m0]

If you'd like to start an #emudhra competitor in India, a CCA license requires 50 crores for companies and 5 crores for Individuals/firms.

The rest of the guidelines are at https://t.co/AgJC5Sa3vX

[AWACS Sky Keeper @HQuarterma43504]

These guys just don't realise how much damage they've done.

In 2014, the government's CA (NIC) got blacklisted by Google, Microsoft and Apple for spying/backdoor concerns.

Now in 2026, eMudhra is blacklisted. That was the only Indian CA uniquely available by default.

All Indian companies and websites would've to now secure a foreign CA. I hope this was some Gigachad attempt at spying because otherwise losing your sole internationally recognised certificate authority because some intern ran the 8-bit test suite into production and nobody bothered to check.

[Vamsi Krishna B @vkbdev]

I also hope that our government orders a high-level, independent security audit of eMudhra’s Digital Signature Certificate (DSC) and eSign services.

Trust must be demonstrated through independent audits, not merely claimed.

[naren.io @nareni0]

Good riddance, your utter incompetency has tainted our software industry already and you stay ashamed forever.

[Vamsi Krishna B @vkbdev]

Don't know how, but since the past year or so cloudflare has improved their product and made it 100x better and sticky.

[Matthew Prince 🌥 @eastdakota]

Amused that AWS just unilaterally cancelled Cloudflare's Reinvent booth. There are always signs when someone finally realizes they're losing. Guess we'll just attend and throw the most fun side events without paying Amazon! Reply if you want an invite.

[Vamsi Krishna B @vkbdev]

@wangbin579 How about rust that LLMs write ?