Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

github.com

Post reply on HN
Print view View original

11–20 of 106 posts

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#12

Post by Gigachad »

KronisLV wrote: post #10
Gigachad wrote: post #8

C software really needs to be used in a sandbox because this stuff is inevitable.

I wonder whether we'll ever get to a point where the kernel, the drivers and the userland software are all written in memory safe languages, possibly with other safe mechanisms and abstractions thrown in; yet to have it become mainstream and as popular as Linux is now. Might take decades of work though and probably nobody cares enough for something like that.

Android has been replacing a lot of core components with Rust and other memory safe languages. The Asahi team built a GPU driver in Rust recently. Seems like things are moving in the right direction.

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#16

Post by fer »

ZiiS wrote: post #2

Ouch! Percentage of internet of things devices who don't ship libcurl is a rounding error. Percentage of internet of things devices that patch libcurl is also a rounding error.

I have the feeling that this is gonna be way bigger than the log4j mess.

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#17

Post by jddj »

> Updating the shared libcurl library should be enough to fix this issue on all operating systems.

> Then again there will also be countless docker (and similar) images that feature their own copies, so there will still be quite a large number of rebuilds necessary I bet.

Quite a large number, yeah.

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#19

Post by binary132 »

KronisLV wrote: post #10
Gigachad wrote: post #8

C software really needs to be used in a sandbox because this stuff is inevitable.

I wonder whether we'll ever get to a point where the kernel, the drivers and the userland software are all written in memory safe languages, possibly with other safe mechanisms and abstractions thrown in; yet to have it become mainstream and as popular as Linux is now. Might take decades of work though and probably nobody cares enough for something like that.

I feel that a sort of universal sandboxing is more likely

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#20

Post by Ekaros »

I kinda hate doing things this way...

Could it be better not to just come out with somewhat alarmist take that hey we are going to release high risk vulnerability in week... And fixes to that...

But instead just release new version and CVE at same time? Now is everyone trying to get ready to exploit this on 11th, or already getting most out of it if they know? And does this information really make anyone to hover their finger on button to push new versions and so on on 11th?

Post reply on HN