Reading Law & Writing Code. Interested in Information and Society, Data, Cybersecurity, Archives, RTI, Maps, Cities, తెలుగు Poetry 😍
Null Island
Joined March 2012
- Tweets101K
- Following5.1K
- Followers31.7K
- Likes5.3K
Pinned Tweet
Free speech is between you and the state, its not between you and me, you and me don't even have a social contract. Feel free to unfollow, mute me if you don't like my views
Srinivas Kodali retweeted
EC refusing to name the software used to flag “errors” in voter rolls during SIR, citing “trade secrets n IPR… “
Yet it also claims “no new software has been developed or procured.” So what exactly is the secret tool that flagged crores of voters?
In a democracy, tools deciding who stays on the electoral roll cannot be commercial secrets.
Other counties like Estonia or Switzerland do disclose the same. And Brazil opens its systems to scrutiny.
Our EC hides behind proprietary n confidential pretexts while crores are deleted or flagged. Opacity is not confidence building but it’s evasion or subversion!
#SIR #ElectionCommission
Srinivas Kodali retweeted
Serbian students took to the streets, staging rallies, turning up in rural areas, long been Vučić strongholds, went door-to-door, to rally voters behind their slogan of “Serbia or Mafia?” theguardian.com/world/2026/o…
Srinivas Kodali retweeted
MHA declares information on High-Level Committee on Demographic Changes “Confidential”!
In response to an RTI application, the Ministry of Home Affairs (MHA) has refused to disclose copies of the proposal, file notings, approvals and other documents relating to the constitution and appointment of the High-Level Committee on Demographic Changes, stating that the information has been classified as CONFIDENTIAL and is exempt from disclosure under Section 8(1)(a) of the RTI Act, 2005.
The section 8(1)(a) of the RTI Act, 2005, exempts information that would harm India’s sovereignty, security, strategic or economic interests, or foreign relations, or incite the commission of an offence.
The RTI application was filed by social activist @SQMasood.
The the MHA’s response can be accessed through the link below.
rtilibrary.in/share/028e7e9a…
🤖 Made with AI
Srinivas Kodali retweeted
Three things would settle it. The evidence exists:
1. CBI: release SFMS access logs, Oct 15–17.
2. IFTAS: did the hub see the 187 messages, and from which gateway?
3. RBI: is MFA on SFMS console access mandatory now?
The logs name the door. Publishing settles it.
Srinivas Kodali retweeted
What we did not find: any public statement from RBI or CERT-In. No recovery figure. No account-freeze count. The 187 transfers are per the bank's complaint as reported. IFTAS disputes the breach vector. We grade these separately for a reason.
Srinivas Kodali retweeted
Passwords still open the doors on the bank side. We read the RTGS System Regulations (Oct 2024), the IDRBT-CA certificate practice statement, and RBI's access circulars. We found no published circular that mandates multi-factor authentication for SFMS console logins.
Srinivas Kodali retweeted
SFMS is the hub through which RTGS and NEFT messages travel between 300+ banks. Bank side, each member runs a gateway on its own servers. Access rides on INFINET, the closed financial network, and IDRBT-CA digital certificates.
Srinivas Kodali retweeted
What IFTAS, the RBI subsidiary that runs SFMS, said (22 Oct, reported 25 Oct): no unauthorised access to the SFMS hub, and no security breach. Both statements cannot be equally complete. That is the finding that stands.
Srinivas Kodali retweeted
What the bank told Mumbai police (complaint, 22 Oct; FIR for cheating by personation; reported 24–25 Oct): unknown persons used the national SFMS messaging system to push 187 unauthorised RTGS credits. Sender records in those messages do not belong to the bank, per its complaint.
Srinivas Kodali retweeted
₹13.97 crore. 187 transfers. Three days.
Central Bank of India says the money left its settlement account at the RBI between October 15 and 17, and its own books show no matching entries. Full verification: cyber.cashlessconsumer.in/pa…
Look who is talking about cyber security. An organisation that is in deep slumber and doesn’t care about citizens rights. Meet the Ministry of Electricity & IT. Your neighbour censor, digital strongman aka the cop who stops your freedoms.
Strong cyber hygiene starts with the basics.
Keep secure backups, protect them with strong credentials, and always use genuine operating systems and trusted software.
#CyberSecurityAwarenessMonth #CyberSecurity #DigitalIndia
Srinivas Kodali retweeted
BBMP decentralised into 5 corporations. Blore Police Comissionerate also likely to split into 5.
Why then should protests remain centralised and locked in freedom park ?
Join the Round Table organised by by @horaata_protest on Mon 26 Oct.
@bengawalk @clifroz @aishwaryar23
Srinivas Kodali retweeted
⚠️ UPDATE: ORACLE PULLS eMUDHRA AND COMODO AAA ROOTS FROM JAVA IN NEW SECURITY ALERT (CVE-2026-114820)
Oracle issued a second eMudhra-related Security Alert on Oct 24, 2026. Its Oct 21 alert (CVE-2026-91403) distrusted the compromised intermediate CA certificates. The new update removes the root certificates themselves from the JDK cacerts keystore.
* Removed: emSign ECC Root CA - G3, emSign Root CA - G1, emSign Root CA - G2 and Comodo's AAA Certificate Services (owned by Sectigo)
* CVE-2026-114820, CVSS 3.1 9.1 (JSSE, network, no authentication)
* Affected: Oracle Java SE 8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; GraalVM for JDK 17/21; GraalVM EE 21.3.20.0.2
* Fixed: JDK 27.0.1.0.3, with matching .0.3 baselines for 25, 21, 17 and 11, and 8u511-b33
This is a cleanup step for the eMudhra incident DDW has covered since Oct 20, not a new breach, and no exploitation has been reported. Removing the Comodo root does not mean its key was compromised. If you only patched for the Oct 21 alert, update again, then test anything that still chains to these roots. Check other Java vendors' builds separately.
oracle.com/security-alerts/a…
#CyberSecurity #Java #PKI
Srinivas Kodali retweeted
⚠️ UPDATE: eMUDHRA CLEANUP GAP: DATADOG'S WINDOWS AGENT STILL TRUSTED CHAINS BUILT ON THE COMPROMISED KEYS
Datadog confirmed that its signed 7.84.5 Windows Agent still accepted cross-signed TLS chains using the compromised eMudhra intermediate CA keys. Its embedded Python loads the Windows CA and ROOT stores but never reads the Disallowed store, so the OS-level distrust did not reach it.
* Fixed in Datadog Agent 7.84.6 (release notes dated Oct 23, 2026).
* The fix backports CPython's key denylist for CVE-2026-115557: any chain containing one of the 8 compromised eMudhra keys is now rejected, whatever trust store it anchors in.
* CPython merged that fix upstream on Oct 24. Python runtimes that have not picked it up may still trust these chains.
* Sectigo chains and private CAs in the Windows store are not affected.
No exploitation or intercepted traffic has been reported, and this is not a Datadog breach. Upgrade Windows agents, and check the trust your Python runtimes actually enforce, not just the OS or CA bundle.
github.com/DataDog/datadog-a…
#CyberSecurity #SupplyChainSecurity #PKI
Srinivas Kodali retweeted
Bhakts keep calling me all sorts of names here: 'urban naxal' 'dirty/ugly leftist scum' 'Commie Bong whore'. So I thought I would lean into all this name calling and share a wonderful visual someone shared on Insta about all the things we have because of protests. Protests are indeed the lifeblood of a diminishing democracy.
Srinivas Kodali retweeted
Online security depends not only on the precautions users take, but also on whether the organisations entrusted with protecting them maintain reliable safeguards.
For code to be considered law, it has to be open. But codification of law with software is resulting in black box governance, where one won't know what is the code? We are ending up with Kafka's trial where you are punished because they won't tell you what the law is.
Srinivas Kodali retweeted
SCOOP: The Censor Board has had a data breach exposing hundreds of documents from the e-Cinepramaan portal. Application dockets were uploaded in bulk on the Internet Archive by a user with a display ID that of Prasoon Joshi's name in Russian.thehindu.com/sci-tech/techno…
