What this shows me (again) is that the whole system where vulnerabilities need to be constantly discovered, reported, analyzed, then patched, then the new version distributed to every singe user - again and again - is quite obviously unsustainable. The industry must come up with some alternative system for dealing with bugs and security issues. Currently the industry prefers to play dumb and turn its own failures into a profit (rent seeking) opportunity.
Curl will not accept vulnerability reports during July 2026
231–240 of 326 posts
Re: Curl will not accept vulnerability reports during July 2026
#232For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…
One of the reasons I left North America for Europe is that such things are normalised. The cultural difference is staggering. In Germany, if you are on vacation, you are simply not available. You are dead to the world until you return. Emails do not get read, and devices get left at the office. Another neat thing is that if you get sick on vacation, you get your vacation days back, because vacation days are for resti…
I've lived and worked in America my entire life, and in my approximately 40 years of working I've never had a job where I was expected or had to arrange to be available during a vacation. For the odd unplanned personal day maybe I'd try to check email and have my phone with me. But vacation, never.
Re: Curl will not accept vulnerability reports during July 2026
#233Earlier quoted context omitted.
> Especially since it appears there is a solution if you truly need a fix. If you ever really need anything fixed in the open source world, there is always the option of doing it yourself
Doing the fix yourself is almost always the easy part. Disclosing it and getting a patch shipped across the entire Internet is the hard part.
Why would you personally need the entire internet to receive a fix?
Re: Curl will not accept vulnerability reports during July 2026
#234Earlier quoted context omitted.
curl is the sandbox. It exchanges packets with the internet and then outputs a safely sanitized byte stream.
curl is only the sandbox if you don't then do anything with the byte stream. Pipe it to bash? game over Pipe it to less/more? Better hope your distro keeps those patched Open the file in a browser or PDF reader? Hey, look at all this shiny new attack surface!
How do you set up the sandbox without having downloaded anything from the internet? I guess there’s still places where you can buy Linux CDs.
Re: Curl will not accept vulnerability reports during July 2026
#235Today is Jun 15. So, I wonder if somebody + AI can rewrite curl in Rust in 1.5 months. I think it's possible if that person knows all curl features. However, does that person even exist?
If that were possible it would already have been done.
Re: Curl will not accept vulnerability reports during July 2026
#236For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…
This is one of the reasons I work in an office every single day. I leave my work laptop there. I don't have any work software on any of my personal devices, including my phone. If I had the ability to check in on work things while out of the office, I probably would, so I make it impossible.
Re: Curl will not accept vulnerability reports during July 2026
#237Earlier quoted context omitted.
The average number of sick days used is 15 or the number of days offered? In New Zealand we get a minimum of 10 sick working days per year but some companies offer more and allow unused sick leave to accumulate.
Even the concept that you need permission from your employer to take a sick day is crazy to me. After all, if you're sick, you're sick, not like a hard deadline of 15 days (or whatever) is going to make the sickness go away?
The point of the deadline is not that you can't be off work, but that you stop getting paid for not working.
For example, the way it works in Australia is that after you have used up your sick days, you have to take any further absences from work out of your annual leave balance, and once that is exhausted, you switch to leave without pay.
I had a downline team member who once needed to extend their time away from work for over 5 months due to illness. They had been with the company for several years at that point, so they had a reasonable sick leave balance, probably 10 weeks. When it became clear that they needed longer, they used their remaining 4 weeks of annual leave, then took a month of leave without pay, then another. They were still employed, I approved their leave requests each time they needed to extend, and we just used the most appropriate tool that was available at the time.
The thing you're getting permission for is not to be sick, it is to be considered still employed while not doing work, rather than being fired/disciplined for being AWOL.
Re: Curl will not accept vulnerability reports during July 2026
#238For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…
This is one of the reasons I work in an office every single day. I leave my work laptop there. I don't have any work software on any of my personal devices, including my phone. If I had the ability to check in on work things while out of the office, I probably would, so I make it impossible.
This is exactly the move. Work and life should be separate. No work stuff on your personal devices; no personal stuff on your work devices. This way, you can be your best self in both worlds.
Re: Curl will not accept vulnerability reports during July 2026
#239Earlier quoted context omitted.
Until someone races to the bottom to do 12 months of availability.
Races to the bottom to … do work exclusively for free and not make any money out of the hopes that they become the most popular OSS toolkit, with an end goal of … what?
Validation, often. Stars and installs make self-worth integer go up, etc.
Greed, sometimes. Gotta get those usercounts high to get acquihired / to sell out / to flip on the paid subs for formerly free features.
I can’t remember the word for “prosocial through lowering cost to zero” is but sometimes that too.
Re: Curl will not accept vulnerability reports during July 2026
#240Earlier quoted context omitted.
One of the reasons I left North America for Europe is that such things are normalised. The cultural difference is staggering. In Germany, if you are on vacation, you are simply not available. You are dead to the world until you return. Emails do not get read, and devices get left at the office. Another neat thing is that if you get sick on vacation, you get your vacation days back, because vacation days are for resti…
I'm a senior at a big tech company. You can do this in America too. Just communicate with your manager and set the boundary. "By the way, when I'm on vacation I'm away from devices, so let's coordinate beforehand if there's anything critical path."
100%, and it extends beyond vacations, too. Unless you have a formal on-call arrangement, then any time you spend doing work stuff outside of your work hours is time you are choosing to donate to your company. It's fine if you want to do that, but you don't have to. I work 8-4 every day. I am not contactable outside that window and definitely not contactable on my days off. I haven't worked at a ton of different places, but at the places & teams I have worked with, I've never had anyone object to this policy.