Notices by Stefan Eissing (icing@chaos.social)

Frank Denis on zeroing secrets and why it may not work as desired or even be counter-productive.

https://00f.net/2026/10/06/zeroization-1/

NTLM/Negotiate authentication with HTTP in #curl needs to die. In a fire. And everyone is invited to join us in the dance!

Broken designs are not worth the price we pay for this shit.

@ilyabirman
Interesting twist in the last sentence from turning your personal situation into an overall truth.

Me, I am not good at making a Hamburger and I do not think a real cook would be interested in making one for me.

The only way one can get a good meal therefore is to order at McDonalds or Burger King.

Congrats to Spain! A country legalizing immigrantion, pro Ghaza and denying US air base use…how could that happen?

Booing Trump and Infantino however who worked hard to make this all what it was…such a sad thing to read.

I believe, aside from the money, these two really look for recognition of their greatness.

And who are we to deny them that?💁🏻♂️

Oh no! „Squidbleed“ found by Mythos! When using http:// urls via a squid proxy, an attacker might see the data!😱

Maybe we should all be using https: on the internet or expect our traffic to be public. Wait…we already do that since Lets Encrypt started a decade ago!

This vulnerability could have been a bug report.💁🏻♂️

https://www.theregister.com/security/2026/06/23/mythos-discovers-squidbleed-a-memory-leak-thats-gone-undetected-since-clinton-era/5260367

@catsalad Someone shares my vision for

ubool64_t

😌

This is @samueloph being asked to revert to the pre-vibe rsync in Debiam.

@ariadne plans to switch to openrsync in Alpine.

Important decisions to be made here.

It‘s about trust, not technology. rsync has earned trust over the years. Now it has increased changes using Claude with no second person reviewing.

That people feel uneasy about this, for a tool that copies exabytes of important data every day, is very understandable.

The LLM is the minor player here.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138239

First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening.

They are edge cases under highly constructed preconditions. Yes, not impossible, but unlikely to be ever encountered.

Before LLMs, no researcher would have invested the time to explore those scenarios. my guess.

Yes, we fix them. But, they could also have been a bug report.💁🏻♂️

When you see 'i' as variable name, it means the code is complex.

Follow me for more bad math jokes.😌

In math 'i^2 == -1'. But computers can only approximate that. Good values for 'i' are then:

int32_t 479772853 squared is -7
int32_t 1667710795 squared is -7
int16_t 16203 squared is -7
int16_t 16565 squared is -7
int8_t 53 squared is -7
int8_t 75 squared is -7

😌

We now require proof of work before you can submit a #curl security report.

Like mowing @bagder 's lawn or washing his car.😌

A security audit of Rust Coreutils found 70 CVEs. 44 of these could be fixed for release 0.8. The rest remain unfixed and undisclosed for now.

Ubuntu 26.04 LTS has added Rust Coreutils EXCEPT the cp, mv, and rm commands.

I assume most of the remaining 26 CVEs are therefore in cp, mv and rm.

How is your „let‘s rewrite it in Rust“ project going?

https://www.phoronix.com/news/Ubuntu-Rust-Coreutils-Audit

Do not travel to the USofA, part XXXIV:

- doing everything right is not enough
- white skin does not protect you
- detention may mean a cell shared with 70 people, fighting over food, without medical supplies
- your signature will get forged if you refuse
- judge orders for release on bail are ignored

https://www.theguardian.com/us-news/2026/feb/09/irish-man-seamus-culleton-ice-detention

Working on new thread pools for #curl to rework the async DNS resolving. This will be useful for performance and resource control, as well as improved happy eyeballing.

This all because simply calling ‚getaddrinfo‘ is not good enough and replacements like c-ares are never 100% compatible to all the quirks that exist „below“ getaddrinfo.

So, here we go.💃

(Writing threaded code always makes me feel real good about myself until it all blows up in my face. So, fun!😌)

There are good things in the world:

Security training on the topic of "do not click links or open attachments" is obsolete now.

The AI in your inbox will open all attachments and click on all links. Problem solved.💁🏻♂️

@catsalad @vieuxnez @sophieschmieg @saraislet When your partner is into role playing electrical engineering, going along can result in a power coupling.

Still my favorite meme.😌

@hailey @whitequark
It‘s an area where few can make it better, but everyone can make it worse (add a dependency or an unreliable test case).

An organisational challenge, not a technical one.

1 open #curl issue for some Kerberos header file on IBM OS400 platforms…

I expected more from you…🦧

RIP pthread_cancel() in curl. It was an interesting adventure.
#curl

https://eissing.org/icing/posts/rip_pthread_cancel/