Good for them & haxx!
Curl will not accept vulnerability reports during July 2026
221–230 of 326 posts
Re: Curl will not accept vulnerability reports during July 2026
#222Earlier quoted context omitted.
Until someone races to the bottom to do 12 months of availability.
Races to the bottom to … do work exclusively for free and not make any money out of the hopes that they become the most popular OSS toolkit, with an end goal of … what?
End goal of complaining that no one pays for their efforts.
Re: Curl will not accept vulnerability reports during July 2026
#223Today is Jun 15. So, I wonder if somebody + AI can rewrite curl in Rust in 1.5 months. I think it's possible if that person knows all curl features. However, does that person even exist?
https://curl.se/docs/security.html - C bugs are marked.
Re: Curl will not accept vulnerability reports during July 2026
#224Earlier quoted context omitted.
then it is up to community to fork the project if they find it valuable and can convince people migrating to their fork. many engineers actually work that way, right? We are employed for 12 months and give our availability fully to the company and we get salary for it, why isn't it allowed to others?
A fork of a project that does security patches only is an interesting idea... Since then a diff of the two projects will be a perfect list of security issues and will make designing an attack rather easy...
Only until the next feature lands in upstream, likely accompanied by some refactoring.
Re: Curl will not accept vulnerability reports during July 2026
#225Earlier quoted context omitted.
> curl is mature enough that the chance of an impactful bug is basically zero Curl is also something that should be thoroughly sandboxed to begin with, because even if there are no vulnerabilities in curl itself, its a tool for downloading arbitrary data over the internet, and you may well accidentally trigger vulnerabilities in every other part of your environment just by downloading arbitrary data to your shell...
curl is the sandbox. It exchanges packets with the internet and then outputs a safely sanitized byte stream.
curl is only the sandbox if you don't then do anything with the byte stream.
Pipe it to bash? game over
Pipe it to less/more? Better hope your distro keeps those patched
Open the file in a browser or PDF reader? Hey, look at all this shiny new attack surface!
Re: Curl will not accept vulnerability reports during July 2026
#226A curious approach, but I like it! Wonder if this means just publishing vulnerablities without contact with curl team would be responsible (you have no other path to tell vulnerable users)
It would certainly be irresponsible. The responsible thing would have been to simply wait another month, considering you've been warned about the delay.
the vulnerability is there whether disclosed or not. if you find it, someone else has too. sitting on it is the irresponsible thing.
Re: Curl will not accept vulnerability reports during July 2026
#227Earlier quoted context omitted.
> tell you outright That is not ignoring but announcing a delay. Bigger companies may have only limited number of people checking the mailboxes in july and august, that doesn't excuse not sending a small reply announcing delays but I guess they take it so much for granted they don't realize other continents aren't used to those kinds of delays. However in May and June every company is totally operational ( that doesn…
> That is not ignoring but announcing a delay. I think maybe with the American PoV of "the customer is always right", that might basically feel like a slap and the face and being ignored. Of course, we should understand that every human needs to rest during the year, but if you don't have that opportunity yourself by law, maybe you're less knowing about that being a thing in other more modern countries?
In America we generally ensure there are multiple people who can do the job. Somebody can go on vacation no nobody will know because the backup is just as good.
Every once in a while there is an exception. Then that guy says "If your sending me to Australia I'm going to use my vacation to scuba drive the Great Barrier Reef" - and his body is never found. True story, it took months for someone else to figure out everything that guy knew.
Re: Curl will not accept vulnerability reports during July 2026
#228Earlier quoted context omitted.
It's an extremely un-European approach. European companies normally ignore their paid customers too from May to August.
Incorrect. In europe, either july or august, is the informally agreed upon "vacation month" which means that both customers and vendors scale down and go on vacation, and work slows down to very low levels. That means you need a lot less employees than usual in order to provide for the customers that do not go on vacation.
Vacation months*, plural. All project timelines were aligned to wrap up important things by the end of May. June is still operational but mostly focused on reporting, shaping and generally preparing for September when (mostly) everyone will be back, refreshed and ready for new adventures.
Re: Curl will not accept vulnerability reports during July 2026
#229For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…
One of the reasons I left North America for Europe is that such things are normalised. The cultural difference is staggering. In Germany, if you are on vacation, you are simply not available. You are dead to the world until you return. Emails do not get read, and devices get left at the office. Another neat thing is that if you get sick on vacation, you get your vacation days back, because vacation days are for resti…
I'm a senior at a big tech company. You can do this in America too. Just communicate with your manager and set the boundary. "By the way, when I'm on vacation I'm away from devices, so let's coordinate beforehand if there's anything critical path."
Re: Curl will not accept vulnerability reports during July 2026
#230Earlier quoted context omitted.
Especially since it appears there is a solution if you truly need a fix. > Or you get a support contract and we get to read about it earlier.
> Especially since it appears there is a solution if you truly need a fix. If you ever really need anything fixed in the open source world, there is always the option of doing it yourself
Doing the fix yourself is almost always the easy part. Disclosing it and getting a patch shipped across the entire Internet is the hard part.