Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Curl will not accept vulnerability reports during July 2026

daniel.haxx.se

Post reply on HN
Print view View original

121–130 of 326 posts

Re: Curl will not accept vulnerability reports during July 2026

#121

Post by GoblinSlayer »

sevenzero wrote: post #61
donw wrote: post #16

Earlier quoted context omitted.

As a manager, I will quite literally ding people for working when they are supposed to be off. Work during work time, don't work during not-work time. Good practices mean that everyone is important, but nobody is irreplaceable, the team and the work will move along a little slower, but that's fine.

Being the only dev in a startup since 2 years without a single day off where I wasn't messaged by my employer I want this. At least I'll have a 3 week out of country trip where I do not bring my laptop later this year...

That's exploitation, no? You're just scammed into it, because you let it slide.

Re: Curl will not accept vulnerability reports during July 2026

#122

Post by prmoustache »

utopiah wrote: post #78
throw93033 wrote: post #27

Earlier quoted context omitted.

> Log out of all accounts, remove 2FA keys after backing them up on paper Seems like a lot of extra work, just to go on vacation :) I would suggest another approach. Automate your work, that you can work from your phone. I go on multi day hiking trips, or a week long family beach holidays, without taking PTO... Edit: I do not get negative reactions. Big part of my work is to monitor system, and answer questions. I sp…

>> Log out of all accounts, remove 2FA keys after backing them up on paper [...] >> Signed: Former workaholic. > Seems like a lot of extra work, just to go on vacation :) That's the point, this person and plenty others, are NOT able to "just" go and disconnect. If you can do that, wonderful for you, but please don't assume others are like you precisely when they are humble enough to clarify that they do have a proble…

Just not bringing the devices should be enough.

Re: Curl will not accept vulnerability reports during July 2026

#123

Post by teruakohatu »

nicbou wrote: post #87
fender256 wrote: post #73

Earlier quoted context omitted.

Thanks for the reminder that this shouldn't be taken for granted. I am a German and sometimes this privilege feels so normal that it's unthinkable that it could be different elsewhere in the world.

I help immigrants integrate for a living. Germany can be a frustrating country, but this is one of its best redeeming qualities. I'd also add that the culture allows and encourages sick days. The average is 15 sick days per year IIRC.

The average number of sick days used is 15 or the number of days offered?

In New Zealand we get a minimum of 10 sick working days per year but some companies offer more and allow unused sick leave to accumulate.

Re: Curl will not accept vulnerability reports during July 2026

#124

Post by rzmmm »

eviks wrote: post #107

> Contracts excluded They aren't. If you ignore vulnerability report from an entity without a support contract, the vulnerability doesn't disappear just because the entities with support contracts are not aware of it

Curl has a ton of features, I can imagine this means fixing small fraction of the vulns affecting only the supporters.

Re: Curl will not accept vulnerability reports during July 2026

#125

Post by 0x1ceb00da »

ozim wrote: post #33
dist-epoch wrote: post #8

[flagged]

https://curl.se/libcurl/ Let me Google that for you. supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, MQTTS, POP3, POP3S, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET, TFTP, WS and WSS. libcurl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, HTTP/2, HTTP/3, cookies, user+password authentication (Basic, Digest, NTLM, Nego…

I'm 90% sure that even the monkey's paw curls.

Re: Curl will not accept vulnerability reports during July 2026

#126

Post by askonomm »

robin_reala wrote: post #25
low_tech_love wrote: post #17

I read one sentence into this and knew directly that the developer must’ve been Swedish!

For people who aren’t familiar, Sweden takes summer holidays seriously. 25-30 days + public holidays is a normal amount of annual vacation time, and if an employee requests it and has the time available, it’s basically legally required to allow them to take a four-week contiguous summer break. (See https://www.riksdagen.se/sv/dokument-och-lagar/dokument/sven... )

I thought it's basically the same in all of EU?

Re: Curl will not accept vulnerability reports during July 2026

#127

Post by eviks »

rzmmm wrote: post #124
eviks wrote: post #107

> Contracts excluded They aren't. If you ignore vulnerability report from an entity without a support contract, the vulnerability doesn't disappear just because the entities with support contracts are not aware of it

Curl has a ton of features, I can imagine this means fixing small fraction of the vulns affecting only the supporters.

Why would you imagine they have any clue about the area of effect if they ignore the report?

Re: Curl will not accept vulnerability reports during July 2026

#129

Post by blauditore »

nicbou wrote: post #58
patates wrote: post #11

For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…

One of the reasons I left North America for Europe is that such things are normalised. The cultural difference is staggering. In Germany, if you are on vacation, you are simply not available. You are dead to the world until you return. Emails do not get read, and devices get left at the office. Another neat thing is that if you get sick on vacation, you get your vacation days back, because vacation days are for resti…

> if you are on vacation, you are simply not available. You are dead to the world until you return. Emails do not get read, and devices get left at the office.

It's funny because that's kind of the definition of a vacation in my book. I find it weird that some places in the world handle it differently.

Note that it's also much better for the company in the long run: It's a test of resilience and redundany, the famous bus factor. It simulates what happens if someone is not available, and forces the organization around to have a backup plan. Having those is important for cases where employees leave the company or team (switching jobs/teams, accidents, sickness, parental leave, death, burnout, layoffs etc.). It's mind-boggling how many leads at various levels just don't understand that.

Re: Curl will not accept vulnerability reports during July 2026

#130

Post by davidgerard »

patates wrote: post #11

For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…

Kai Lentit just dropped a video on precisely this

https://www.youtube.com/watch?v=5E7kBOH9owI

Post reply on HN