@bagder.mastodon.social.ap.brid.gy
I write curl. I don't know anything.
🌉 bridged from ⁂ https://mastodon.social/@bagder, follow @ap.brid.gy to interact
@bagder.mastodon.social.ap.brid.gymy week: https://lists.haxx.se/pipermail/daniel/2026-October/000170.html
vacation, security, blab, rc3
@bagder.mastodon.social.ap.brid.gyI still get no comments or questions about CRA in regards to #curl
@bagder.mastodon.social.ap.brid.gymy download folder is full of "evil-server([number]).py" scripts
@bagder.mastodon.social.ap.brid.gyand whatdoyouknow: we're now at 24 pending CVEs
@bagder.mastodon.social.ap.brid.gyWelcome İlyas Serdar Dursun as #curl commit author 1544: https://github.com/curl/curl/pull/23319
@bagder.mastodon.social.ap.brid.gyThat's the very harness which found the pending HIGH severity issue in #curl.
@bagder.mastodon.social.ap.brid.gy"Launching an opt-in vulnerability-finding service for open-source software"
/ Anthropic
https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source
@bagder.mastodon.social.ap.brid.gy@virtuous_sloth yeps, that's exactly my thinking of how to detect when "the wave" starts going down
@bagder.mastodon.social.ap.brid.gybeen so preoccupied by vuln reports I totally missed writing a nonsense blog post about #curl surpassing 40,000 git commits
@bagder.mastodon.social.ap.brid.gyand in case you thought having twenty-two pending CVEs in the pipeline for publishing would in any way cause the inflow of reports to slow down, think again... 😰
@bagder.mastodon.social.ap.brid.gyWe've had 154 commit authors in #curl so far in 2026. Exactly as many as we had during the entire year 2025...
@bagder.mastodon.social.ap.brid.gyNext week we'll publish a 54 page "audit report" detailing every #curl vulnerability finding the good people at Aisle found in curl (so far) - all 35 of them.
@bagder.mastodon.social.ap.brid.gy"The people holding up the internet"
A good-looking but somewhat depressing exposé about the people holding up current digital infrastructure as a hobby.
@bagder.mastodon.social.ap.brid.gy"Here you can find a full list of all New gTLD Program: 2026 Round applications"
Yeps, exactly as crazy as you can imagine.
@bagder.mastodon.social.ap.brid.gy@RxBrad I think it might be still be true, but you now need to also use the same harness or direct the model in the same way, which in reality is not common
@bagder.mastodon.social.ap.brid.gy@RxBrad if that was true, we'd see this same flaw get reported multiple times. Which we don't.
@bagder.mastodon.social.ap.brid.gyI'm a little miffed someone read something else into a previous post of mine so let me clear that up: gcc is an outstanding project and compiler set. We owe so much to them.
@bagder.mastodon.social.ap.brid.gyTwenty-two pending #curl vulnerabilities
https://daniel.haxx.se/blog/2026/10/07/twenty-two-pending-curl-vulnerabilities/
@bagder.mastodon.social.ap.brid.gyBuckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years.
Yes, found with AI.
@bagder.mastodon.social.ap.brid.gy7 days to the next #curl release.
22 pending CVE announcements. 230+ bugfixes. 37 authors. SMB support is dropped.
