Thank you for your dedication to the curl cause and others. You inspire me to be more stable, less chaotic, and confident in my journeys. I appreciate your sharing and your candor. Cheers!
Following the recent advisory for **CVE-2025-14524**, I conducted an investigation into how libcurl manages OAuth2 credentials during complex redirect chains. I have confirmed that while the...
Anyway, BIND 9 now also has Bug Bounty program via #YesWeHack (fosstodon.org/@iscdotorg/11576…) and we got exactly one genuine issue out of 15 (and that's issue that has been previously independently reported). The rest was: ⁃ Cryptographic Weakness in BIND 9.20.15 PRNG Enabling DNS Cache Poisoning (Bullshit AI Slop; it just proved lack of randomness in provided PoC :) ⁃ Multiple EC/TLS Private Keys Committed to Public Bind9 Repository (yeah, in system tests) (1/2)
When the European Commission approached us about funding a bug bounty for BIND 9, we were impressed with the proposal. We have a policy against bug bounties (because we were frustrated with people wasting our time), but under this proposal, the YesWeHack team would do initial triage, and use their expertise to minimize the 'slop' reports. This is a game-changer for a small development team.
The bounty program is active, and we are looking for our first valid report.
thejikz
in reply to daniel:// stenberg:// • • •Cheers!
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •curl disclosed on HackerOne: libcurl: Improper Authentication State...
HackerOneLangerJan
in reply to daniel:// stenberg:// • • •This could be a theatre play:
“Drop the AI”
“I sincerely apologize, you are absolutely right”
youtube.com/shorts/6eA_o9qZBuU…
“Say Potato!” Stream on Apple and Spotify!! #funnysong #tinder #dating #music
YouTubeφ
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to φ • • •The Psychotic Network Ferret
in reply to daniel:// stenberg:// • • •Sensitive content
jarizleifr
in reply to daniel:// stenberg:// • • •Ondřej Surý
in reply to daniel:// stenberg:// • • •But Wait!
Anyway, BIND 9 now also has Bug Bounty program via #YesWeHack (fosstodon.org/@iscdotorg/11576…) and we got exactly one genuine issue out of 15 (and that's issue that has been previously independently reported). The rest was:
:)
⁃ Cryptographic Weakness in BIND 9.20.15 PRNG Enabling DNS Cache Poisoning (Bullshit AI Slop; it just proved lack of randomness in provided PoC
⁃ Multiple EC/TLS Private Keys Committed to Public Bind9 Repository (yeah, in system tests) (1/2)
ISC.org
2025-12-22 14:42:16
daniel:// stenberg://
in reply to Ondřej Surý • • •Ondřej Surý
in reply to daniel:// stenberg:// • • •Michael
in reply to daniel:// stenberg:// • • •lol. Don’t need any AI detection software here 🤪😂
Andreas Scherbaum
in reply to daniel:// stenberg:// • • •Tóth Gábor Baltazár
in reply to daniel:// stenberg:// • • •