Nowadays, I am happy to find a spam mail between all the CVE announcements. Makes for a nice break.😌

„Scheinriese“: a sky-piercing giant from afar, getting smaller as you approach, turning out to be a rather tiny fella face to face.

„Scheinreicher“: a super billionaire, until you come close enough to see all the things they lack, making you feel *almost* sorry for them.

Anything else we Germans can help with today?

Even if we rewrote #curl in rust, the just reported UAF RCE could still happen when integrating third party libraries like OpenSSL, nghttp2 and others.

Look at the linked source of ‚upki‘ the new lib for certificate validation. Most of the code is ‚unsafe‘ and memory pointers are stored in OpenSSL via „*_set_ex_data()“ beyond any guard of the rust compiler.

#curl used such an „ex_data“ pointer beyond its lifetime in the CVE. C or rust unsafe, makes no difference.

https://github.com/rustls/upki/blob/main/upki-openssl/src/lib.rs

Lets Encrypt goes to 64 days of certificate validity in February 2027. And to 45 days in 2028.

This change to 64 will go live on their test servers (staging) next week.

https://letsencrypt.org/2026/10/07/64-day-certs.html

Really good blog by Joshua Rogers from Aisle about how to do vulnerability hunting using AI. The gist:

- if you set a goal, the AI will try *anything* it learned to reach it, including cheating. It has no morals, it just applies options.
- you need a non-AI gatekeeper to verify findings in various ways to confirm a vulnerability.

„…in some cases, the agents really will happily edit the source code of programs […] adding the vulnerability itself.“

https://joshua.hu/lessons-using-sanitizers-oracle-llm-vulnerability-triage

Frank Denis on zeroing secrets and why it may not work as desired or even be counter-productive.

https://00f.net/2026/10/06/zeroization-1/

RE: https://hachyderm.io/@epage/117395511667671376

Someone is looking for rust projects with more than 1800 dependency crates.

It‘s for testing cargo, a valid cause as I understand it.

But the binary of such a project would contain them all inside. Given the current security findings, one rebuilds it fresh every hour? Or do the >1800 crates coordinate their disclosures?

Excuse an old man for wondering at such miracles!😌

Someone is a bit fed up that #curl limits individual cookies parsed from a file to 8200 bytes.

"the pedantic opinion of someone" has a nice touch, I'd say.

https://github.com/curl/curl/issues/23284

Talk at the gym. People believe in the danger of rogue models „because it‘s in the news“.

Explanations are met with doubts at best.

💁🏻‍♂️

It‘s easy going today in the #curl project. @bagder took his wife on a cruise with one of the yachts we always have on standby (the one with the two helipads, of course) and we all have some time to slack off a little. Nice!😍

Starting the day with my new @heyheymomo mug and tshirt.

Mordor releasing the Muse Orc which can be customized with different armor and wigs. And people are like:

„Wow, I never thought I‘d ever want something from Mordor again after them orcs killed Isildur and auntie Hilda…
…but these Muse Orcs are SO CUTE!😍“

🤦🏻‍♂️

*Cut to scene of more elves leaving for Valinor*

@bagder 's cat is a huge fan of the new #curl purrformance tests. She thinks they are pawfect!

https://curl.se/perf/

@hugovk With all the rogue Python loops happening, can‘t you guys do something to prevent Python from killing us all?

A ROGUE AI ALMOST STARVED ME!

(I was reading about rogue AIs and almost forgot to eat my breakfast. It was close!😌)

Don't think a positive AI review means anything. They have a very "tunnel view" perception on things. Without an extra signal, it does not mean much.💁🏻‍♂️

PR on new data type.
Copilot: "There is a spelling mistake. Otherwise looks fine."

commit
Codex: "Well, this increment may wrap."

PR with fix
Copilot: "Actually, there is also a problem on 32bit architecture here."

Saudi Arabia is looking for new allies. The US relationship has failed. Everything that Trump and his goons touches dies, sucked dry and spit out.
https://www.theguardian.com/world/2026/sep/16/us-officials-decide-against-backing-saudi-arabia-yemen-meeting-houthi-leaders

Do you need to Slow Down, too?

I feel like slowing down.

Let‘s all slow down.😌

Idea: a Space Invader game that can restart failing Github infrastructure on clearing a level.
#github

Years back, we had a temp secretary for a few days. The sales guy went by, stopped and asked:

„Why is the fax turned off?“
„Oh, I don‘t have anything to send right now!“

Which was very funny then.

But then you notice that such people work in all sorts of places, including head of companies and nations. Which isn‘t so funny anymore as they switch off more vital things.💁🏻‍♂️