Email or username:

Password:

Forgot your password?
48 posts total
daniel:// stenberg://

Today we got what must be the most alarming first line in a newly file sec issue to #curl:

"To replicate the issue, I have searched in the Bard about this vulnerability"

... followed by a complete AI hallucination where Bard has dreamed up a new issue by combining snippets from several past flaws. Creative, but hardly productive.

Closed as bogus.

Show previous comments
pixx

@bagder ...we're going to need to start compiling a global blocklist of AI users, so that not every project has to rediscover the same geniuses, aren't we. :(

daniel:// stenberg://

Yes, #curl will have support for IPFS (via HTTP gateway) starting in 8.4.0

See curl.se/docs/ipfs.html

daniel:// stenberg://

"CVE-2020-19909 is everything that is wrong with CVEs"

A claimed "9.8 CRITICAL" flaw in #curl that does not exist.

daniel.haxx.se/blog/2023/08/26

Show previous comments
monpop

@bagder wait…. So it’s just a bug? If it overflows it just executes, that’s all? Could an attacker do anything with that?

Rafael Kassner

@bagder sounds like Chatbots are now reporting CVEs -.-

DarkCyberMan

@bagder As a way of saying how old I am without saying how old I am. Mitre used to have a mechanism that potential issues were assigned a CAN-number. Then the elite would vote if it was indeed a vulnerability. If so, a CAN would become a CVE. Of course this soon became a mess as the CANs piled up and checking if a CAN ended up as CVE just for reference became a dreadful chore. I guess you’re on the accepted risk end of the choice made to end the CAN/CVE naming and stick with CVE.

daniel:// stenberg://

Today in 2000, 23 years ago, we introduced #libcurl into the world. #curl 7.1 was the first release featuring a separate library for Internet transfers, that curl was then made to use.

PHP adopted it almost instantly to become their default built-in transfer engine, which greatly helped the library "take off".

libcurl was not an instant success but has gradually grown more popular over time. Over 23 years.

Today we estimate 20 BILLION installations worldwide.

Show previous comments
F4GRX Sébastien

@bagder i have even somewhat ported a part of the easy API to NuttX.

Karsten Schmidt

@bagder Happy b'day! 🎉 The modern internet/devops would not be the same without your tools...

Kevin Karhan :verified:

@bagder also #curl is way more versatile and useful than #wget and is available as a #standalone #binary:

No need to fiddle with shit: #ItJustWorks!

Kainoa

@bagder@mastodon.social for the uninitiated, what is the NSS TLS library and why was it removed?

Elaine 💜🏳️‍⚧️🏳️‍🌈
Can you explain what this means to curl users? What is NSS?
Kornel

@bagder The github issue doesn't give any background for this decision. I'm curious whether there's something terrible about it, or is it just some spring cleaning.

nytpu

@bagder
> Its quite similar to going back to GOPHER.
It should be noted that Gemini was literally intended as “Gopher but with TLS and more palatable markup” rather than anything related to modern HTTP.

However your other points not related to the markup/visual style are perfectly accurate IMHO

tomasino

@bagder glad to see your thoughts on the subject

Slatian

@bagder Considering that gemini started out as a though experiment on a phlog that someone else implemented …

Thanks for having a look at the protocol! (I invested quite a bit of time to develop one of the first graphical gemini browsers)

That being said: There is a gemini specification that was being worked on over at https://gitlab.com/gemini-specification but it looks pretty dead now.

There also is one giant flaw in gemtext: While easy to write and parse isn’t great for expressing semantics and encourages abusing unicode and ACII-Art for conveying Information, making it … not very useful beyond the content it was intended for.

Some content feels a bit like marking something as a red font color in an Office document and expecting everyone to be able to see and interpret that part as important, just in the complete opposite direction when it comes to the technology being used.

It is fun though! But it will never scale (having read the original phlogpost when it was new: Mission kind of accomplished, I guess).

@bagder Considering that gemini started out as a though experiment on a phlog that someone else implemented …

Thanks for having a look at the protocol! (I invested quite a bit of time to develop one of the first graphical gemini browsers)

That being said: There is a gemini specification that was being worked on over at https://gitlab.com/gemini-specification but it looks pretty dead now.

daniel:// stenberg://

Hi [name],

I certainly am a lead developer of libcurl, but I have no contractual agreement with either XXXX or YYYY so I do not think I can be qualified as a provider or a vendor to you. In this context, I'm but an individual.

We could arrange for a curl support contract to make me/us a provider.

#outgoing #email

Elias Mårtenson

@bagder What kind of requests do you get? I have a feeling a large number of them has to do with certifying various aspects of the security of the software? How about questions about whether your developers are trained?

daniel:// stenberg://

Twenty-five years of curl: daniel.haxx.se/blog/2023/03/20 - 3600 words on the biggest events in #curl history, year by year.

Show previous comments
Apprentice Bodega Cat 🐈‍⬛

@bagder

Thank you for curl! It's served me quite well over the years, and also served as proof to my engineer colleagues that this Technical Project Manager is no slouch, technically. 😸

daniel:// stenberg://

I argue we (#curl) should NOT pay docker. Not give in to extortion. This might mean that someone else soon suddenly will register our name and can serve whatever image they want there. 5 *billion* pulls indicate there's a user or two that might fall victim for this.

That's on docker, not us.

Show previous comments
farcaller

@bagder wait, why would curl ever pay docker? It's on docker for having a successful ecosystem.

Paolo Redaelli

@bagder
Have you evaluated #podman? I'm quite ignorant on the issue but AFAIK it should be a drop in replacement for #docker
@valhalla

MrClon

@bagder docker images of curl? For what?

daniel:// stenberg://

This slide is from the #FOSDEM keynote by Dr. Steve Crawford of NASA from a few hours ago.

Show previous comments
rubenwardy

@bagder

Anyone know where I can watch the NASA #fosdem keynote online? Will it be on the fosdem website at some point?

Marcin Cieślak

@bagder

I frankly turned my head around and thought you'll be out there in the room

btw Steve is at @crawfordsm here

daniel:// stenberg://

#GitHub now allows us to add more "social links" to our profiles... including #mastodon.

Show previous comments
tallship

@bagder yes and eventually they'll support #Fediverse addresses instead of mastopub

Tom Sherman :unverified:

@bagder A shame that they haven't added support for rel="me" in markdown yet though.

Julian Reschke

@bagder Couldn't get that to work with my Mastodon account; is this restricted to specific instances?

daniel:// stenberg://

I think naming projects prefixed with your programming language of choice is silly. I would never name my project... oh wait.

daniel:// stenberg://

When shown the huge list of operating systems curl runs on, people often ask me which is the strangest, or hardest, operating system to keep curl support for. The answer is always, and will probably always remain: Windows.

No other operating system has so many custom, special, weird and quirky ways that require special-case solutions in the code.

Show previous comments
Christian Hujer

@bagder This has also been my experience. Linux and BSD, and anything POSIX-y is usually super-easy to support. Amiga OS is so-and-so. But Windows is terrible. And it says something that Windows is worse than Amiga OS.

daniel:// stenberg://

Sonic Frontiers is the brand new addition to my collection of screenshotted curl credits: daniel.haxx.se/blog/2016/10/03

daniel:// stenberg://

The curl project is exactly 9,000 days old today.

daniel:// stenberg://

A bug that was 23 years old or not daniel.haxx.se/blog/2022/09/05 - This is a tale of cookies, Internet code and a CVE. It goes back a long time so please take a seat, lean back and follow along.

Terence Eden

@bagder thank you for that very clearly written blog post.

Go Up