An evil way to extort money via support contracts.
...so open source developers should know their place and just dedicate themselves to endless, unpaid toil forever and ever, amen?
Curl will not accept vulnerability reports during July 2026
291–300 of 326 posts
Re: Curl will not accept vulnerability reports during July 2026
#292Earlier quoted context omitted.
Doing the fix yourself is almost always the easy part. Disclosing it and getting a patch shipped across the entire Internet is the hard part.
Why would you personally need the entire internet to receive a fix?
It's handy if you run a service and the internet runs clients you didn't write to access said service. (or vice versa)
Also handy if the internet is running a DDoS reflector and you're being targetted.
Otherwise, usually no sense of urgency for fixes I did for me/my employer and want the rest of the world to benefit. My problem is solved now, everyone else can get it when it ships.
Re: Curl will not accept vulnerability reports during July 2026
#293Earlier quoted context omitted.
We don’t need to speculate do we, there are tons of real non company run OSS projects Now I personally wish lawyers and plumbers also got into the free work thing but here we are
Lawyers have a term for it, pro bono, and they do it for good causes. Turns out they're as human as software engineers.
> Turns out they're as human as software engineers.
Lawyers start out as humans but something about going into law school and then private practice, and feeding them after midnight turns them into... something else entirely.
Re: Curl will not accept vulnerability reports during July 2026
#294Earlier quoted context omitted.
My company have accidentally forced this on me, and it is great. I used to have a desktop that I could VPN+RDC into from my personal laptop or desktop to work away from the office¹. I've now got a laptop, that refuses to let me authenticate remotely and they have no interest in fixing that as there are other priorities, so I simply can't work if I don't have that laptop with me and I'm not carting it around when I'm…
> Not a workaholic, I don't think, but a 24/7 stress monkey when I think that I could be helping I er... think you might be a workaholic. But I'm glad for you that your current setup is helping :)
Does it count as being a workaholic when work is just one place it manifests? I class it more “being-useful-aholic”!
Re: Curl will not accept vulnerability reports during July 2026
#295Re: Curl will not accept vulnerability reports during July 2026
#296Earlier quoted context omitted.
Why would you personally need the entire internet to receive a fix?
Running a fork is a lot of work. You need your fixes upstreamed so that you don't need to backport other people's fixes
Nobody said doing it yourself was neccesarily easy. Its just an option that is there.
Re: Curl will not accept vulnerability reports during July 2026
#297Earlier quoted context omitted.
Why would you personally need the entire internet to receive a fix?
Running a fork is a lot of work. You need your fixes upstreamed so that you don't need to backport other people's fixes
You don’t need to backport other people’s fixes. You only need to re-merge your patches into updated versions of the upstream (aka vendor branch), which usually is straightforward.
Maybe you mean that if there are many people like you, they’d want to integrate each other’s fixes. But then you’d probably have the combined manpower to start maintaining a true fork.
Re: Curl will not accept vulnerability reports during July 2026
#298Re: Curl will not accept vulnerability reports during July 2026
#299Re: Curl will not accept vulnerability reports during July 2026
#300Earlier quoted context omitted.
curl is only the sandbox if you don't then do anything with the byte stream. Pipe it to bash? game over Pipe it to less/more? Better hope your distro keeps those patched Open the file in a browser or PDF reader? Hey, look at all this shiny new attack surface!
Well yeah, that's true for any sandbox. If you pipe stuff outside of the sandbox, outside of any sandbox, and run it there, then you're not running it in a sandbox.
Right, but nobody actually uses curl as the end destination, right? You use it to download something so that you can run another tool on it.
And as such, you need to already be sandboxing the tool (since it processes untrusted data you received over the internet).