Elektrine lite

← Feed

daniel:// stenberg://

bagder@mastodon.social

<p>I write curl. I don&#39;t know anything.</p>

Posts

  • View post

    don&#39;t forget to order yourself a cake for Wednesday to properly partake in the #curl 30 years celebrations

  • View post

    The trillion dollar monsters are all focusing on *finding* issues at high speed in large volumes. Hardly any of them care about *fixing* these problems with any sense of quality.

  • View post

    Assuming we spend an average of 4 hours per vuln report, we just yesterday got ourselves **four weeks** of full-time work.

  • View post

    yesterday the #curl project got an email from a person announcing their grand new project to security audit a range of Open Source projects. Got a fancy project name and all. Asked for permission. Two hours later the same person emailed us again, announcing that he shuts down this effort blaming &quot;widespread failure affecting Codex&quot;. We never got to respond. Moving on.

  • View post

    @utzer (image given to me by someone a long time ago, sorry for losing credit)

  • View post

    https://youtu.be/06Qjai8RQKw?is=D1d7R-vLuBq9iPwr

  • View post

    state of #curl dev in three graphs

  • View post

    Guess which project that just had *24* sweet hours of not a single vuln report coming in? This is like holiday. Wohoo. ⛱️ 🍹 😎

  • View post

    Thanks team for the massively successful redirect actions this week. Hardly anyone looks at the curl code right now. 😎

  • View post

    gosh, a vulnerability report just arrived that was... *gasp* seemingly written by a human!

  • View post

    Coffee cup for the current Open Source workload and situation.

  • View post

    “ignore the slop” https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/

  • View post

    A key four everyone

  • View post

    you know its a special day when the curl signal group is busier than the mastodon feed

  • View post

    Original AI word salad describing a flaw: 241 words and 1322 characters. My human summary of the same problem: 27 words,. 142 characters.

  • View post

    &quot;Ignoring the slop&quot; cannot be done and it doesn&#39;t help. These reports created with the help of AIs point out actual problems, and sometimes vulnerabilities. Ignoring real vulnerabilities because they were found by AI does not make users safe and secure. It makes them vulnerable. We don&#39;t want that. (I don&#39;t call this &quot;slop&quot; because it&#39;s typically accurate and correct, even if too wordy)

  • View post

    Imagine having been cleaning your apartment for days until it is all shiny and you&#39;ve polished every surface and detail you can think of. Spotless. Perfect. Then your friends arrive. One by one they all leave you a list each of about 7 different things you missed, forgot or did a bad job with. This is what we have now with the AI vulnerability reports. A really long line of friends queuing to point out more flaws to you. Clean better dammit.

  • View post

    A Saturday email that makes my chores easier. I want to extend this to my fellow maintainers in these testing times; I&#39;m not doing curl by myself. Hi Daniel, With all the nonsense going on related to AI slop bug reporting and PRs, just looking in from the outside is exhausting, I imagine it must be even worse for you and the other contributors. I wanted to say thank you for all the time and energy you put into cURL, the tool really is a joy to use and never lets me down.

  • View post

    #curl&#39;s law: Everything eventually runs curl A trend in society over the last decade and I don&#39;t see it changing anytime soon.

  • View post

    Thirteen years ago since this golden email arrived in my inbox: https://daniel.haxx.se/email/2013-10-16.html

  • View post

    PSA &quot;The existing maintainers will cease their involvement in their development and maintenance of Mbed TLS from April 2027.&quot; https://lists.trustedfirmware.org/archives/list/mbed-tls@lists.trustedfirmware.org/thread/YPIGCB7WN6GCHOGEGKOJXUYAP7OK527W/#BSRM3JY6JFNWWEHKMY4JQQON5QB3LP5U

  • View post

    A UAF turned RCE In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free. https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/

  • View post

    We&#39;re all &quot;happy&quot; for the pending curl release... #cats #catsofMastodon

  • View post

    I just want to express my gratitude and thanks to Daniel Gustafsson for all the time and efforts spent on #curl over the years. Daniel has decided to step down from the curl security team and has asked to get his &quot;commit bit&quot; revoked. Thanks Daniel, you are always welcome back when you feel like it!

  • View post

    I am awarded a gold medal by the Royal Swedish Academy of Sciences for my work on #curl https://daniel.haxx.se/blog/2025/10/21/a-royal-gold-medal/

  • View post

    &quot;The people holding up the internet&quot; A good-looking but somewhat depressing exposé about the people holding up current digital infrastructure as a hobby. https://sheets.works/data-viz/holding-up-the-internet

  • View post

    Buckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years. Yes, found with AI.

  • View post

    &quot;Google freezes open-source bug bounty program amid flood of invalid AI slop submissions&quot; https://www.tomshardware.com/tech-industry/artificial-intelligence/google-suspends-part-of-the-oss-vrp-bug-bounty-program-due-to-an-influx-of-invalid-ai-submissions-product-vulnerability-submissions-ended-october-1

  • View post

    my week: https://lists.haxx.se/pipermail/daniel/2026-September/000169.html 25 years, security, performance, Rock-solid, Development, rc2, stickers

  • View post

    Organisation curl Job title internet janitor Attending Social: No Filling in the registration form for a conference talk I&#39;ll do in a few weeks.