Notices by daniel:// stenberg:// (bagder@mastodon.social), page 2

the latest vuln we got reported was detected by... a Chinese AI thing. They're on it as well.

Now I'm happy I wasted time making those silly sinus-moving things for the alternative #curl progress meter. (seen in the log output for a failed GitHub CI job)

A slide from my talk this Thursday. How we view our role in the curl project.

https://www.meetup.com/openinfra-user-group-sweden/events/313615139/

"Trailing dots in hostnames is a menace and a plague that keeps haunting us and the world at large."

I felt I had to put this into this CVE advisory I'm drafting...

18 security reports in a single day. Let's not beat this record.

Day off. National holiday. Fourteen security reports have arrived in the last fourteen hours... 😱

"Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch."

https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/

ENHANCE_YOUR_CALM

I like the Register's headline: "Anthropic’s bug-hunting Mythos was greatest marketing stunt ever, says cURL creator"

... even though I did not say that. 😂

https://www.theregister.com/security/2026/05/11/anthropics-bug-hunting-mythos-was-greatest-marketing-stunt-ever-says-curl-creator/5238111

Bandwidth spend per hour on my blog the last week. Can you spot when I posted?

My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.

#Mythos finds a #curl vulnerability

yes, as in singular one.

https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

I'm on it. There is a Mythos scanning #curl blog post pending.

"Science runs on Open Source. Let’s fund it."

https://os4science.org/

I had to save the book quote as a blog post: https://daniel.haxx.se/blog/2026/04/30/inspired/

Reading this brings me close to medal-receiving levels of joy.

RE: https://toot.yosh.is/@yosh/116487778402803336

Excuses. They forgot to run their site as they should and instead got lost working on AI features we never asked for. That's why.

"Pre-built GitHub profiles with five-year commit histories and Arctic Code Vault Contributor badges sell for approximately $5,000 on Telegram."

https://awesomeagents.ai/news/github-fake-stars-investigation/

Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload.

Ask yourself what you do to make the situation better.

Make sure your employer does as well.

After just having responded to the third #curl security report for the evening I noticed a post that cheered me up...

Have a good Friday everyone!

https://www.linkedin.com/posts/moekatib_millions-of-people-look-up-to-steve-jobs-activity-7450947453085749248-K1w-