Skip to main content

in reply to daniel:// stenberg://

At 09:00 UTC I will do live-streamed release presentation about curl 8.7.0 on twitch: twitch.tv/curlhacker
in reply to daniel:// stenberg://

We announce four new CVEs, none of them a "C mistake".

They are the top four ones in the table we provide here: curl.se/docs/security.html

in reply to daniel:// stenberg://

depends what you mean by "C mistake".

When you use the type system to make it impossible to generate invalid combinations of arguments, you also remove a lot of issues.

Unfortunately the focus currently is to talk about memory safety when arguing against C. I find type safety much more important and would claim that would fix more CVEs than memory safety.

Of course, no language enforces this, so it does require the designer of an API to enforce it. But C doesn't even allow it.

in reply to daniel:// stenberg://

the fastest ever .1 curl patch release happened and now we call the release 8.7.1 instead... 😵
in reply to Pyte

@pyte I managed to produce the release tarball with one of the files "broken". Just me messing up locally. I immediately realized why and how so I could just fix and rerun the scripts to make a second release of the day...
@Pyte
in reply to daniel:// stenberg://

@pyte thank you for pushing a .1 release instead of silently re-upload a fixed 8.7.0
@Pyte
in reply to daniel:// stenberg://

Never believe an X.X.0 release 😂 !

Great job and good luck on everything to come. You're a model to many, even in failure

in reply to daniel:// stenberg://

and curl 8.7.1 container released ... try it yourself > podman run -it quay.io/curl/curl:8.7.1 -V

daniel:// stenberg:// reshared this.