Search

Items tagged with: curl

Summing up #curl's 2024 in a single image could possibly look like this.

28 years into this never-ending journey, development activity is higher than ever before.

#curl

#curl

I'm a little amused that there are so may people trying to find faults or poke "a hole" in this graph. You're taking this too seriously. It's not the end of the world if some commits are assigned the wrong time zone.

The fact is that many top contributors to #curl, myself included, are based in Europe. That's the simple explanation for why the graph looks like this.

#curl

#curl is written in European time zones (still polishing the graph script for this)
#curl

Top #CWE reasons used in #curl #CVE reports. In the 161 CVEs we have published over 25+ years so far, we have used 59 different CWEs.

The graph shows all CWEs that have been used more than once.

#curl #cve #cwe

#curl

#rust #hyper #curl

#curl

#curl

#curl

#curl

#curl

Come May 2025, #curl will drop support for Secure Transport.

If you develop something for apple devices and use libcurl, you might want to think about what this means. And maybe do something too.

github.com/curl/curl/discussio…


Apple iOS Secure-Transport deprecated, is there plan to port to use Network.framework · curl curl · Discussion #15759

Apple has deprecated Secure-Transport capabilities since iOS 13.0 (which is several years by now) with a recommendation of porting to. use Network.framework instead. Therefore building libCURL with...
GitHub
#curl

do you have #curl tatooed on either bicep?
cheers! 💪
#curl

If you have run #curl on an OS not listed here already, let me know. 102 operating systems.
#curl

#curl

Twenty-five years of commit history says >17% of all #curl commits have been done on the weekend.
#curl

#curl

Apparently #CISA has rated #curl #vulnerability #CVE_2024_11053 as #CVSS v3 Base Score 9.1 "critical". This is wrong, and will lead to automation triggering unnecessary warnings and blocking use of perfectly fine systems until an update is installed (which can take months). nvd.nist.gov/vuln/detail/CVE-2…

Edit: In case you wonder my credentials for judging this: I found this vulnerability.

Edit2: This appears to be originating from CISA: cve.org/Media/News/item/blog/2…

Edit3: The score has now been fixed. Commit: github.com/cisagov/vulnrichmen…


data updated · cisagov/vulnrichment@91fadb2

A repo to conduct vulnerability enrichment. Contribute to cisagov/vulnrichment development by creating an account on GitHub.
GitHub
#vulnerability #curl #cvss #cisa #cve_2024_11053

#curl

25 years later, #curl is now at 0 sscanf calls - and we do not allow new ones to get added
#curl

Given that #curl is such a prominent project and you are very present in the media arguing against the quality of LLM generated issue reports, I fear the cohort of misguided "AI" evangelists will make it a sport to "prove you wrong".
#curl

#curl

#curl

About 40% of #curl's vulnerabilities could have been avoided had we not used C.
#curl

As for every #curl release, I will do a live-streamed video presentation about it at 10:00 CET (09:00 UTC) At

twitch.tv/curlhacker


curlhacker - Twitch

I'm Daniel Stenberg, maintainer and lead developer in the curl project. I stream curl related stuff. Release presentations, curl development and related topics.
Twitch
#curl

#curl

#curl

#curl 8.11.1 has been released. It includes a fix to #CVE_2024_11053 - a #vulnerability I discovered.

It is a logic flaw in the way curl parses .netrc file. In certain situations, the configured password can be sent to a incorrect host. Luckily the affected configurations should be quite rare and thus the situation is unlikely to occur often.

The issue has existed in the curl source code for almost twenty-five years.

• curl.se/docs/CVE-2024-11053.ht…
• hackerone.com/reports/2829063

No AI tools were used in discovering or reporting the vulnerability.

#noai #handcrafted #infosec #cybersecurity

curl - netrc and redirect credential leak - CVE-2024-11053

curl.se
#infosec #cybersecurity #vulnerability #curl #noAI #cve_2024_11053 #handcrafted

#curl 8.11.1 is released. About 79 bugfixes, including one CVE addressed.

daniel.haxx.se/blog/2024/12/11…


curl 8.11.1

Welcome to another curl release. This time we do a bugfix only release, five weeks since the previous version shipped. Release Presentation Today at 09:00 UTC I will do a live-streamed video presentation of curl 8.11.1 on Twitch.
daniel.haxx.se
#curl

#curl

#Slop is low-quality media - including writing and images - made using generative artificial intelligence technology.


Quelle: Wikipedia.

Open source projects have to deal with a growing number of low-quality vulnerability reports based on AI. See for example this comment from Daniel Stenberg, maintainer of #Curl:

I'm sorry you feel that way, but you need to realize your own role here. We receive AI slop like this regularly and at volume. You contribute to unnecessary load of curl maintainers and I refuse to take that lightly and I am determined to act swiftly against it. Now and going forward.

You submitted what seems to be an obvious AI slop "report" where you say there is a security problem, probably because an AI tricked you into believing this. You then waste our time by not telling us that an AI did this for you and you then continue the discussion with even more crap responses - seemingly also generated by AI.

Weiterlesen bei HackerOne: Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4.

#opensource #AI #LLM #Spam


curl disclosed on HackerOne: Buffer Overflow Risk in Curl_inet_ntop...

*Curl is a software that I love and is an important tool for the world. * *If my report doesn't align, I apologize for that.* The `Curl_inet_ntop` function is designed to convert IP addresses from...
HackerOne
#opensource #AI #llm #spam #curl #Slop

#curl #hackerone

As a service to security researchers, I added this section to #curl's hackerone page:

AI

If you have used AI in the creation of the vulnerability report, you must disclose this fact in the report and you should do so clearly. We will of course doubt all "facts" and claims in reports where an AI has been involved. You should check and double-check all facts and claims any AI told you before you pass on such reports to us. You are normally much better off avoiding AI.

hackerone.com/curl


curl - Bug Bounty Program | HackerOne

The curl Bug Bounty Program enlists the help of the hacker community at HackerOne to make curl more secure.
HackerOne
#curl

Certainly a more thorough and thoughtful reply than was deserved.

Keep up the excellent work Daniel. Enthusiastic kudos to all the #curl maintainers.

#curl

Marking them as spam now. #curl #hackerone (AI slop as "security vulnerability reports")
#curl #hackerone

#curl

#curl

⇧