Search

Items tagged with: curl

#curl

This thing works by generating fake vulnerability reports. Here are some of the qualities of the HackerOne report 3125832 sent to #curl:
- It looks convincing at a glance, especially if you're not a subject matter expert.
- It's vague about actual repro steps. It makes it impossible for the victim project to reproduce the issue. For example, it makes up fake patches against non-existent, imaginary code.
- It refers to functions and methods that do not exist (in case someone tries to look for them). When confronted, the attacker refer to some old or new versions of components, using non-existent commit hashes.
- The report makes up some convincing functionality or names that are novel, but don't really exist.

An expert’s look at the report shows the number of discrepancies, but finding them takes time and effort. It requires attention from a subject matter expert, with limited resources.

The real exploit here is that the attacker (evilginx) exploits the fact that the victims (the orgs who paid the attacker money) don't have the capacity to perform thorough analysis and rather just pay up. TL;DR: It's cheaper to pay the bug bounty than hire an expert to perform true analysis.

Why didn't it work against the curl project? The attacker miscalculated badly. Curl project is not a company and has far greater capability in security response than your average org. Also they can smell #aislop miles away.

#curl #aislop

#AI #llm #curl #golem @daniel:// stenberg://

#curl

#curl #stockholm

Live the bleeding edge life and take curl-8.14.0-rc1 for a test spin for us!

Thanks to users testing our rc builds, we can reduce the regression risk once we ship the actual *real* release on May 28. Today I shipped the rc1. There will be two more rc builds before the release.

curl.se/rc/

Thanks for flying #curl

curl release candidates

curl.se
#curl

#curl

#curl

#curl

This ordinary Tuesday? Two. Two AI slop security reports arrived to #curl. So far.
A STOP sign that says SLOP
#curl

#curl

#curl

Slide 108 in my "state of curl" WIP slideset for #curl up 2025
we are not done yet
#curl

#curl

#curl

#curl

Updated #curl bug bounty stats, six years in:

520 reports
78 confirmed security vulnerabilities
104 "informative" reports, bugs that weren't vulnerabilities
11 marked as "AI slop"

The rest were just different kinds of not applicable. Some more crazy than others.

The latest confirmed curl vulnerability (CVE-2025-0725) was reported 90 days ago.

There is currently zero issues in our queue.

curl.se/docs/bugbounty.html

curl - Bug Bounty

curl.se
#curl

#curl

@kiyo I don't know and I don't care that much. If people want it added there it will be added. For users such as #curl, we add things like DoH ourselves anyway and it would be hard to use any such provided by c-ares because of the "different layer" it works on.
#curl @kiyo

#curl

I compared #curl today vs curl 8 years ago on malloc count + memory use to download a single 512MB file over cleartext HTTP:

129 mallocs, which is exactly the same.

Maximum allocated now: 135566. 17,681 bytes *less* than eight years ago.

Not everything has to go bloat over time I suppose.

And here's the old blog post: daniel.haxx.se/blog/2017/04/22…


Fewer mallocs in curl

Today I landed yet another small change to libcurl internals that further reduces the number of small mallocs we do.
daniel.haxx.se
#curl

#curl

#curl

Four years ago we introduced this #curl graph
Number of planets running curl. A plot with a straight line for one planet over many years until 2021 when it bumps up to two.
#curl

#curl

Look, @icing now has his name on more than 1/4 of the lines of #curl production source code:
top-40 authors with production code remaining in master (for curl)
#curl @Stefan Eissing

Every topic I usually blab about here in a single weekend in Prague? That's basically #curl up 2025. Consider yourself invited. Only two weeks away now.

github.com/curl/curl-up/wiki/2…


2025

All things related to the curl up conference series - curl/curl-up
GitHub
#curl

#curl

#curl

#curl #fossnorth @daniel:// stenberg:// @FOSS North conference 🇸🇪

I'll run over to #fossnorth tomorrow, where I primarily will hand out #curl stickers and socialize with people.

Oh and do a little keynote at 9am Monday morning titled "What comes after world domination?"

What comes after world domination? (with a photo of a running dog)
#curl #fossnorth

curl HTTP/3 with OpenSSL 3.5 may be coming you way soon. Tatsuhiro, the maintainer of ngtcp2, did the (unnecessarly) heavy lifting to adapt and I did the comparatively few changes for it in curl.

Once ngtcp2 releases, we can merge that hopefully for the next curl release. If you want to test, see:

github.com/curl/curl/pull/1702…
#curl #http3


ngtcp2+openssl support by icing · Pull Request #17027 · curl/curl

With the new addition of QUIC support and the support in ngtcp2 main branch, make the necessary adjustments in curl to support this combination. add support in configure.ac to detect the feature O...
GitHub
#http3 #curl

#curl

The annual #curl distro meeting happened. Thanks everyone who participated. Good discussions. Excellent feedback. I have some action items.

curl might just get yet a little better as a result of this!

a red heart symbol with the curl symbol inside, also in red
#curl

#OpenSSL #curl #ngtcp2

#curl

#curl

#curl

Remember, if you just take this day as a weekend, your #curl rewrite could be finished

(from the collection at daniel.haxx.se/blog/2021/05/20…)

I used curl to test my handwritten HTTP 2.0 server. That includes sending chunked, compression support, SSL with the 3 basic auth methods, all the various verbs, etc. I could write curl in a 3 day weekend comfortably.

“I could rewrite curl”

Collected quotes and snippets from people publicly sneezing off or belittling what curl is, explaining how easy it would be to make a replacement in no time with no effort or generally not being very helpful. These are statements made seriously.
daniel.haxx.se
#curl

⇧