daniel:// stenberg://
We got another "critical vulnerability" on #curl reported. I figured you might enjoy it.
"The authentication mechanism in cURL does not properly restrict the number of failed authentication attempts, allowing an attacker to brute-force credentials"
Yawn. Away, away you go.
Xilokar
@bagder
Well,
What the hell if you can't rely on the client side to implement security checks?
abeltramo
@bagder you should obviously `rm -rf /` after five "403 Forbidden" returned.
thepwnicorn
@bagder curl is client-side software ffs.
young man yells at the cloud
@bagder my coffee maker just lets me keep pouring, even when my mug is full!
DJGummikuh
@bagder these sound like the same breed of people that complain that they can try passwords on multiple Pages AT THE SAME TIME without those pages magically restricting them. These guys really are just good for one thing in life and that is being ridiculed 😅
craignicol
@bagder clearly you need to record all attempts on the Blockchain so that curl can verify it's not being used for a distributed password attack 🤦
rtn
@bagder Wait. What? Curl doesn't log all usage in a centralized database so this can be tracked? Omg. O.o 😁
Daniel Spilker
@bagder That should be reported upstream to the keyboard manufacturers.
GreenSkyOverMe (Monika)
LiquidParasyte
@bagder ...brute force cURL? isn't it explicitly a user-side tool?
Joel Takvorian 🦬
@bagder and when you implement the fix, please also obfuscate it so bad actors can't just fork curl to remove it. Thanks 😘
Nordern
@bagder I bet you don't even add two-factor authentication to servers that don't support it natively 😡
hisold
@bagder It would be funny if he added "... Which allows curl to be used for hacking purposes making it illegal und German law § 202c StGB"
Bonkers
@bagder Linux command line is extremely dangerous and used by hackers !!!
Marek
@bagder "curl can act as a server?"
Michelle Hughes
Curl does not properly detect whether the user has evil in their heart.
AndyK1970
@bagder haha!
A bit like saying "I found a dangerous flaw in my car, the traffic light down the street is not working so this car could enter the intersection in a dangerous way."
GNU social JP is a social network, courtesy of GNU social JP管理人. It runs on GNU social, version 2.0.2-dev, available under the GNU Affero General Public License.
All GNU social JP content and data are available under the Creative Commons Attribution 3.0 license.