[deleted]
Curl will not accept vulnerability reports during July 2026
271–280 of 326 posts
Re: Curl will not accept vulnerability reports during July 2026
#272Earlier quoted context omitted.
Validation, often. Stars and installs make self-worth integer go up, etc. Greed, sometimes. Gotta get those usercounts high to get acquihired / to sell out / to flip on the paid subs for formerly free features. I can’t remember the word for “prosocial through lowering cost to zero” is but sometimes that too.
This works for a while. Then you - the programmer - grow up. Wise customers know this.
But a programmer is born every minute.
Re: Curl will not accept vulnerability reports during July 2026
#273Earlier quoted context omitted.
I liked the idea as well, maybe OSS should adopt 6 months availability and 6 months for enterprise support schedule. This way both could benefit, OSS gets more funding, enterprise gets support (cheaper than hiring full-time employee for specific OSS)
Until someone races to the bottom to do 12 months of availability.
Isn't that what we have already?
Re: Curl will not accept vulnerability reports during July 2026
#274Earlier quoted context omitted.
100%, and it extends beyond vacations, too. Unless you have a formal on-call arrangement, then any time you spend doing work stuff outside of your work hours is time you are choosing to donate to your company. It's fine if you want to do that, but you don't have to. I work 8-4 every day. I am not contactable outside that window and definitely not contactable on my days off. I haven't worked at a ton of different plac…
In the USA at least, I've found that this kind of "not working means not available" arrangement is easier or harder based on your seniority and the kind of company you work for. I am able to hold the line on this now, 25 years into my career, but it took a long time to get to this point, and I never would have been able to swing it when I was a junior programmer, and when I was working in a hyper-work-obsessed startu…
This was mostly my experience. Once I was very Sr and reporting to the VP my solution was people could get in touch via the VP, his admin or my admin. Worked well (there were some things I really did need to be called for).
But not a general solution. But with a good manager can work more broadly. And I did see a couple managers do something similar for their teams, making it clear that if you need emergency attention contact the oncall, if for some reason that won’t do call the manager. This friction alone deals with most issues.
Re: Curl will not accept vulnerability reports during July 2026
#275Earlier quoted context omitted.
curl is the sandbox. It exchanges packets with the internet and then outputs a safely sanitized byte stream.
curl is only the sandbox if you don't then do anything with the byte stream. Pipe it to bash? game over Pipe it to less/more? Better hope your distro keeps those patched Open the file in a browser or PDF reader? Hey, look at all this shiny new attack surface!
Well yeah, that's true for any sandbox. If you pipe stuff outside of the sandbox, outside of any sandbox, and run it there, then you're not running it in a sandbox.
Re: Curl will not accept vulnerability reports during July 2026
#276Both libexpat ("Expat") and uriparser are following the curl security vacation and will not accept new vulnerability reports before 2026-08-01, starting today.
Re: Curl will not accept vulnerability reports during July 2026
#277Earlier quoted context omitted.
100%, and it extends beyond vacations, too. Unless you have a formal on-call arrangement, then any time you spend doing work stuff outside of your work hours is time you are choosing to donate to your company. It's fine if you want to do that, but you don't have to. I work 8-4 every day. I am not contactable outside that window and definitely not contactable on my days off. I haven't worked at a ton of different plac…
In the USA at least, I've found that this kind of "not working means not available" arrangement is easier or harder based on your seniority and the kind of company you work for. I am able to hold the line on this now, 25 years into my career, but it took a long time to get to this point, and I never would have been able to swing it when I was a junior programmer, and when I was working in a hyper-work-obsessed startu…
It's a small number of data points, but neither of my two early-career jobs had any expectations like that. I've never explicitly said "I'm not reachable," I just have never worked or responded to work communications outside of work hours, and no one has ever questioned me on it.
Re: Curl will not accept vulnerability reports during July 2026
#278[flagged]
What do you work on? My guess is you have an inexhaustible list of work to be done, right? We all do, curl included.
Re: Curl will not accept vulnerability reports during July 2026
#279Earlier quoted context omitted.
100%, and it extends beyond vacations, too. Unless you have a formal on-call arrangement, then any time you spend doing work stuff outside of your work hours is time you are choosing to donate to your company. It's fine if you want to do that, but you don't have to. I work 8-4 every day. I am not contactable outside that window and definitely not contactable on my days off. I haven't worked at a ton of different plac…
In the USA at least, I've found that this kind of "not working means not available" arrangement is easier or harder based on your seniority and the kind of company you work for. I am able to hold the line on this now, 25 years into my career, but it took a long time to get to this point, and I never would have been able to swing it when I was a junior programmer, and when I was working in a hyper-work-obsessed startu…
> Back in the early 2000s when I was Junior Engineer ...
I tried something like this over July 4th weekend last time I was full-time anywhere (startup; 2010) and it very quickly devolved into an i-quit-you-cant-quit-i-fired-you situation and the company withholding my final paycheck. (New York State employment law does not mess around and I was eventually paid after dragging the deadbeat through Small Claims.)
It traumatized me and is in large part why I've been a freelancer / running my own consultancy ever since. My self-employed situation is better in some way and worse in others but I can't even imagine what it's like to not have my back against the wall 24/7/365. :(
Re: Curl will not accept vulnerability reports during July 2026
#280For the people here who want to do the same when they are vacation (be completely detached from work): Make it impossible for you to work! Leave your work devices behind! Log out of all accounts, remove 2FA keys after backing them up on paper and tell your partner to not give them back to you for the duration of your vacation, etc. I actually went to a country from which I wasn't allowed to work remotely. Crazy but i…
I think my POV on this is a bit different than what others are expressing… I don’t mind answering the occasional email while on vacation, but I view it as a fair trade - as long as the company doesn’t mind me handling the occasional personal obligation during work hours I don’t mind handling the occasional work obligation during personal hours. If the company wants to be strict about clock in/out hours or taking PTO…
I'm the same.
If I can answer a question with a 30-second response to a Slack message, I will, and I won't mind it as long as it's not frequent. I won't join a call, and I'm only logged into Slack and Outlook on my phone, so if answering requires checking something on Confluence or Jira, I can't help.
Maybe I feel this way because actually being asked something is exceptionally rare. I'll be gone for a week and MAYBE I'll get one message.