3 ms·

> There are three people across three different parts of the world who corroborate the report - CTO of a global technology group, a security based analyst and a

> There are three people across three different parts of the world who corroborate the report - CTO of a global technology group, a security based analyst and a professor of Computer Science. I wonder how this is "sensationalist". Put out the patch in public domain or at least provide some technical information on the vulnerability itself (by making the said report public). Every time a story of this sort comes out it inevitably ends in a lot of hand waving and sensationalism: how a reporter got access to a secret WhatsApp group that sells a patch in exchange for 2500 rupees and it allows access to the UIDAI system. What makes it worse is that we are supposed to just accept whatever this CTO and his two other researcher friends have to say without any way to validate it ourselves. I don't see this happening with any other vulnerability disclosure: be it Spectre, Meltdown or plethora of other exploits which have detailed explanation of the exploit itself. Considering that it affects a billion plus people and as claimed by the article that Aadhaar is "compromised" and "cannot be fixed without requiring a fundamental change in the system" there is no reason now to hold back on technical details. "This is pretty feasible, and looks like something that would be possible to engineer" On the one hand you say the patch which can be bought for 2500 rupees already does this and at the same time you use words like "possible to engineer" and "feel pretty comfortable". Since when have feelings and possibilities gotten more prominence than technical explanations? I'm not saying that the system is foolproof. On the other hand I am waiting for that one article that goes into technical details of the exploit than just sensationalism.

iamshs 8y ago
There's a professor in there too who verified it. Putting the patch out is going to see reporters being jailed and the story being buried. Especially when with the patch we will see 4chan like flaming and the database being filled up with bogus entries from all around the world.
- shripadk 8y ago
  Professor means nothing. I know a lot of professors who have plagiarised to obtain PhDs. So I would never accept a professor's word to technical details. > Putting the patch out is going to see reporters being jailed and the story being buried That's a ridiculous assertion. Wasn't a reporter from Tribune already booked for spreading the same nonsense a while back? Why so? Because she was unable to provide any evidence for the said software that could gain access to UIDAI database. If you are going to be worried about being arrested then don't get into journalism. Journalism is all about taking risks. By putting out the patch in public domain the reporters are actually going to get immunity from arrests as everyone will know the facts and any arrest by the government would be seen in a negative light. Right now, the reporters have a higher probability of being arrested for indulging in spreading false information, to their own detriment. > Especially when with the patch we will see 4chan like flaming and the database being filled up with bogus entries from all around the world. What better proof of breach than having the entire database filled with bogus entries? That should make it amply clear to everyone involved including the public that the system is not secure. What is surprising is that reporters use the garb of national security when it pleases them. You can't have it both ways. If you truly believe in national security and that the entire database is compromised and that there is no way to fix the problem without fundamental change to the system then release the patch. Withholding the patch is detrimental to national security as you are deliberately allowing nefarious activities to take place unchecked and unhindered.

iamshs 8y ago

There's a professor in there too who verified it. Putting the patch out is going to see reporters being jailed and the story being buried. Especially when with the patch we will see 4chan like flaming and the database being filled up with bogus entries from all around the world.

shripadk 8y ago
Professor means nothing. I know a lot of professors who have plagiarised to obtain PhDs. So I would never accept a professor's word to technical details. > Putting the patch out is going to see reporters being jailed and the story being buried That's a ridiculous assertion. Wasn't a reporter from Tribune already booked for spreading the same nonsense a while back? Why so? Because she was unable to provide any evidence for the said software that could gain access to UIDAI database. If you are going to be worried about being arrested then don't get into journalism. Journalism is all about taking risks. By putting out the patch in public domain the reporters are actually going to get immunity from arrests as everyone will know the facts and any arrest by the government would be seen in a negative light. Right now, the reporters have a higher probability of being arrested for indulging in spreading false information, to their own detriment. > Especially when with the patch we will see 4chan like flaming and the database being filled up with bogus entries from all around the world. What better proof of breach than having the entire database filled with bogus entries? That should make it amply clear to everyone involved including the public that the system is not secure. What is surprising is that reporters use the garb of national security when it pleases them. You can't have it both ways. If you truly believe in national security and that the entire database is compromised and that there is no way to fix the problem without fundamental change to the system then release the patch. Withholding the patch is detrimental to national security as you are deliberately allowing nefarious activities to take place unchecked and unhindered.