Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Curl will not accept vulnerability reports during July 2026

daniel.haxx.se

Post reply on HN
Print view View original

241–250 of 326 posts

Re: Curl will not accept vulnerability reports during July 2026

#241

Post by msh »

jorvi wrote: post #166
Autious wrote: post #138

Earlier quoted context omitted.

Sweden has 14 sick days no questions asked before you need a doctors note. The German way of having to call your doctor for a flu note is a little odd to me. You do loose the first day's pay (the meme is that too many people were off sick when there was a world cup finals or something), and then 80% pay.

> You do loose the first day's pay Many countries have this system and the usual effect is that the duration people are sick for is magically never less than 2 days. It's dumb policy.

yeah, when denmark switched from loosing first days pay to the first day also being paid sick rates dropped more than enough to pay for it.

Re: Curl will not accept vulnerability reports during July 2026

#242

Post by rurcliped »

With more advance notice, someone could have found resources to fork curl with different vulnerability management expectations, e.g., "will not accept or otherwise handle any vulnerability reports during the month beginning 21 December 2026. We call it The Winter of Our Discontent."

Re: Curl will not accept vulnerability reports during July 2026

#243

Post by simonask »

altairprime wrote: post #239
t-writescode wrote: post #140

Earlier quoted context omitted.

Races to the bottom to … do work exclusively for free and not make any money out of the hopes that they become the most popular OSS toolkit, with an end goal of … what?

Validation, often. Stars and installs make self-worth integer go up, etc. Greed, sometimes. Gotta get those usercounts high to get acquihired / to sell out / to flip on the paid subs for formerly free features. I can’t remember the word for “prosocial through lowering cost to zero” is but sometimes that too.

This works for a while. Then you - the programmer - grow up.

Wise customers know this.

Re: Curl will not accept vulnerability reports during July 2026

#244

Post by cmxch »

patates wrote: post #11

For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…

Or maybe don’t have devices doing double duty such that 2FA and work devices can be partitioned out from any incidental personal use. That way, even if you have one half of it, you still don’t have enough to attempt work.

Re: Curl will not accept vulnerability reports during July 2026

#245

Post by account42 »

sensanaty wrote: post #143
teruakohatu wrote: post #123

Earlier quoted context omitted.

The average number of sick days used is 15 or the number of days offered? In New Zealand we get a minimum of 10 sick working days per year but some companies offer more and allow unused sick leave to accumulate.

Even the concept that you need permission from your employer to take a sick day is crazy to me. After all, if you're sick, you're sick, not like a hard deadline of 15 days (or whatever) is going to make the sickness go away?

And you'd think that it would be in the interest of the employer too to not have people come in with a flu and infect everyone in the office.

Re: Curl will not accept vulnerability reports during July 2026

#246

Post by unethical_ban »

isodev wrote: post #228
abc123abc123 wrote: post #155

Earlier quoted context omitted.

Incorrect. In europe, either july or august, is the informally agreed upon "vacation month" which means that both customers and vendors scale down and go on vacation, and work slows down to very low levels. That means you need a lot less employees than usual in order to provide for the customers that do not go on vacation.

Vacation months*, plural. All project timelines were aligned to wrap up important things by the end of May. June is still operational but mostly focused on reporting, shaping and generally preparing for September when (mostly) everyone will be back, refreshed and ready for new adventures.

Time to start looking for a work visa.

Re: Curl will not accept vulnerability reports during July 2026

#247

Post by arwineap »

layer8 wrote: post #233
matthewdgreen wrote: post #230

Earlier quoted context omitted.

Doing the fix yourself is almost always the easy part. Disclosing it and getting a patch shipped across the entire Internet is the hard part.

Why would you personally need the entire internet to receive a fix?

Running a fork is a lot of work. You need your fixes upstreamed so that you don't need to backport other people's fixes

Re: Curl will not accept vulnerability reports during July 2026

#248

Post by colinsane »

dxxvi wrote: post #174

Today is Jun 15. So, I wonder if somebody + AI can rewrite curl in Rust in 1.5 months. I think it's possible if that person knows all curl features. However, does that person even exist?

curl used to have rust in it, dropped it 1.5 yrs ago. AI doesn't help with the hard parts here i don't think. https://daniel.haxx.se/blog/2024/12/21/dropping-hyper/

Re: Curl will not accept vulnerability reports during July 2026

#249

Post by jayd16 »

nicbou wrote: post #58
patates wrote: post #11

For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…

One of the reasons I left North America for Europe is that such things are normalised. The cultural difference is staggering. In Germany, if you are on vacation, you are simply not available. You are dead to the world until you return. Emails do not get read, and devices get left at the office. Another neat thing is that if you get sick on vacation, you get your vacation days back, because vacation days are for resti…

> if you get sick on vacation, you get your vacation days back,

This slightly blew my American mind but it makes sense. What about getting sick on calendar holidays?

Re: Curl will not accept vulnerability reports during July 2026

#250

Post by jayd16 »

SoftTalker wrote: post #232
nicbou wrote: post #58

Earlier quoted context omitted.

One of the reasons I left North America for Europe is that such things are normalised. The cultural difference is staggering. In Germany, if you are on vacation, you are simply not available. You are dead to the world until you return. Emails do not get read, and devices get left at the office. Another neat thing is that if you get sick on vacation, you get your vacation days back, because vacation days are for resti…

I've lived and worked in America my entire life, and in my approximately 40 years of working I've never had a job where I was expected or had to arrange to be available during a vacation. For the odd unplanned personal day maybe I'd try to check email and have my phone with me. But vacation, never.

It doesn't need to be arranged. Like you said, we would check email ourselves of our own volition.
Post reply on HN