Conversation

Notices

1. Embed this notice
   Stefan Eissing (icing@chaos.social)'s status on Monday, 18-May-2026 01:29:02 JST Stefan Eissing

   First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening.

   They are edge cases under highly constructed preconditions. Yes, not impossible, but unlikely to be ever encountered.

   Before LLMs, no researcher would have invested the time to explore those scenarios. my guess.

   Yes, we fix them. But, they could also have been a bug report.💁🏻♂️

   • Embed this notice
     Soatok Dreamseeker (soatok@furry.engineer)'s status on Monday, 18-May-2026 01:31:22 JST Soatok Dreamseeker

     in reply to

     • Joe Cooper 🇺🇦 🍉

     @swelljoe @icing Judging how most FOSS utilized cryptography until the mid 2010s? I would bet on a few really bad Shellshock-esque exploits. But not many.

   • Embed this notice
     Joe Cooper 🇺🇦 🍉 (swelljoe@mas.to)'s status on Monday, 18-May-2026 01:31:23 JST Joe Cooper 🇺🇦 🍉

     in reply to

     @icing after twenty or thirty years, the really scary stuff has probably already been found in anything popular. (Probably.)