EmilStenstrom
Joined 16 years ago
Joined 16 years ago
Paraphrasing: "The world's top security researches and AI labs are pouring all their VC money into finding as many security issues in curl as possible". At the same time, we know that curl is run by volunteers that needs to handle all of this. I'm not saying that we shouldn't do security review of open source libraries, just saying that this situation puts a lot of pressure on the maintainers.
The second unnerving thing is that many of the listed vulnerabilites target embedded libcurl; a library with a much slower update cycle. I'm guessing that many of the listed bugs are still in active use, inside the thousands of applications that use curl internally. Another tricky situation.
Both of these stand in contrast to the posts "braggy" style of "we found the most vulnerabilities of all!!!".
Numbers are from 2024, but smoking was at 5.4%, and snus at 15.7%.
And how would you even use this model, given that there are no explanations that help you trust where the prediction comes from…
- Bleach-like sanitization feature built in and enabled by default
- Transforms API for simple HTML mutations
- Rewamped docs
- Playground powered by PyOdide (thanks for the idea simomw!)
Some tags do require ending tags, others do not. Personally I find it hard to remember which ones, so I just close things out of caution. That way you’re always spec-correct.