@heisec

Wonder how big the "actual existing security vulnerability to fabricated noise" ratio is for the #OpenSSL project.

Based upon what the #curl project reported so far I'd assume that this is just a lucky coincidence.

Aka even a blind hen sometimes finds a grain of corn...

#itsecurity #infosec #itsec

Spent today at #fosdem in the declarative & minimalist computing and the decentralized internet & privacy devrooms. Also saw a great talk on the #meshiverse. A funny talk on esolangs and the talk by #curl maintainer Daniel to top things off.
Today was a good day :-)

Last talk at #FOSDEM26 is by @bagder about #OpenSource #Security in spite of #AI will start soon and the room is overflooding. Let's look at the slopmetre and #curl

Thanks to friends' sacrifices, the #curl sticker supply is shrinking fast

Not sure what reach this'll get, but anyway: #cpp #developers, how do you use #curl?

I dislike my unit tests talking over the network, so what mocking/faking options do I have? Are there C++ curl wrappers you could recommend? 🤔

#cplusplus

Please help @bagder with his sticker problem #curl #fosdem #fosdem2026 #fosdem26
(location: chez theo cafeteria)
(Notice: in Janson speaking)

Fosdem people: @bagder is at the cafeteria around 11, handing out curl stickers.

Remember: if your laptop has #curl installed, you need a sticker or it will stop working after the grace period!😌

GUIs are very nice yes, but nothing makes you feel quite as powerful as a successfully chained command line pipeline.

For example, taking a massive log file and filtering it through cat | grep | awk | sort | uniq -c to find the exact problem in seconds is a form of wizardry that modern UI simply cannot replicate.

Sometimes I believe the pipe | might be the single greatest invention in computing history lol 😋

#bash #shell #linux #terminal #cli #grep #tui #sysadmin #curl #debian #arch #nixos #ubuntu #linuxmint #fedora

Secured my sticker.

#fosdem #fosdem26 #fosdem2026 #curl

Number of #curl stickers left at #FOSDEM: 2714

#curl stickers at the wolfSSL booth at #FOSDEM

@bagder is there a curl-accessible API which will give us running count of the number of #curl stickers left at #FOSDEM?

Number of #curl stickers left at #FOSDEM: 2996

Not at #fosdem myself. Me and @vsz are the #curl project Designated Survivors.💁🏻‍♂️

Current weather for Marienburg SR / SA with the power of wttr.in curl {ba{c{k{z{sh}}}}} and lolcat

Photograph shot with DSLR Nikon using FL Circular Polarizer 81A warming and love

#weather #curl #wttr #bash #csh #ksh #zsh #lolcat #technology #OpenSource #SR #SA #Marienburg #Commewijne

Das neue Jahr beginnt mit glibc- und MongoDB-CVEs. #curl stellt aufgrund von massenhaftem AI-Slop das Bug-Bounty-Programm ein, während #Firefox ein KI-Browser werden soll. @zendis und Docker stellen gehärtete Container-Images vor. #CachyOS arbeitet an einer Server-Version. #Fedora hat das FESCo neu gewählt und Debian unterstützt ab Forky loong64. Auch gibt es Lebenszeichen von den Asahi- und oVirt-Projekten.

#ZendisNusspli #GarbageCollectorSocialClub

🎙️ https://user.space/e014-newsupdate-01-2026-curl-bug-bounty-firefox-als-ki-browser-gehaertete-container-images-mongodb-glibc-cves-ovirt-lebenszeichen/

RE: https://chaos.social/@christopherkunz/115967169847516672

I also heard this week from @mcollina that the #fastify project had - in January alone - seen 50% of the total number of vulnerability reports submitted than in the whole of 2025. When you hear things like that it's not surprising that @bagder 's #curl project has taken the decision to stop using this service. A shame that it's come to this 😥 #security
https://fosdem.org/2026/schedule/event/B7YKQ7-oss-in-spite-of-ai/ would be an interestign talk if I was heading to #FOSDEM this year (I'll catch the recording of course)

Share cURL Handle across PHP Requests (New in PHP 8.5)

https://phpc.tv/w/9aA3xJgh5g5ZokUnw7tgLX

@JessieHealdUK @BenjaminHCCarr
I want to preface this long message by saying that I am not a developer. By training I am a security analyst, however I do like to develop stuff, and am currently studying to become one.

I do use LLMs, especially when it comes to libraries that I am not familiar with (have been using NotebookLM pretty extensively to learn the basics of the #EclipsePaho lib to some success), but I will never trade real documentation for a LLM response.

And I wil never, ever just paste #AI code into my repos. At least not without being 100% sure that I understand the code fully.

All that to say that I dont think that AI is the problem. It is a tool. It definitely is not what Sam Altman & Co have been trying to sell to us, but it is a tool nontheless.

And people have been misusing it. People have been foregoeing actually developing the tech in favor of just shipping stuff as fast as non-humanly possible.

That results in unsecure, unstable, crappy code. Which is fine. All of us have written bad code, especially when we were starting out. What is harmful is people trying to sell it as good, putting it directly in prod, or worse, not actually learning the tech along the way, getting stuck with it ad eternum. But learning requires work, time and humility. It is hard, and when presented with an easy way and a hard way it's human nature to choose the easy, instant gratification way, especially when we are misinformed. That is very harmful, but it is basically the product working as intended.

I am sure there are thousands of examples in desing, but one example that is very emblematic of this effect is the creator of #cURL Daniel Stenberg closing the bug bounty program because it was being flooded with crappy AI generated garbage.

My conscience knows that the people responsible for that were mainly people trying to get a quick buck, but my heart knows there were people that were genuinely interested in security, but either got in the bandwagon or were fed a lie that AI bug/vulnerability reports are the future. They didn't learn, but they "shipped" what they thought was a good bug report. And that makes me sad.