Do excellent vulnerability reports
It is time for me to try to help future reporters by providing a short guide on how to submit a truly excellent vulnerability report to an Open Source project.
https://daniel.haxx.se/blog/2026/06/29/do-excellent-vulnerability-reports/
After the last months vulnerability onslaught and the recent heat:
performance reliability at 39%
stasis initiated for emergency repair sequence
Today is „I don‘t know“ day.
This #genai #llm #tokenCost is getting silly. Can't wait for the bubble to burst.
In the 90s, with Internet companies gaining ground, McKinsey sold large corporations the idea of the „Small Company Approach“ where development centers act in the spirit of garage startups.
Presenting this to us, I asked if that meant we could develop competing solutions.
Pause. No, management said, that was not what they meant. They would „coordinate“ any ideas.
That was all I needed to know about corporate management and business consulting.😅
A new opportunity to become a gatekeeper for open source: selling vulnerability analysis, deduplication, coordination and patching to commercial users.
That‘s what Chainguard and the Linux Foundation are trying to be. And they plan to use AI, of course. That will include patching and assigning CVEs.
My guess: upstream gets these AI patches „for free“ and is flagged if it does not take them.
A global LTS source distro, sitting between traditional distros and projects.
A view into the future of packet management by @andrewnez
https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html
My week: https://lists.haxx.se/pipermail/daniel/2026-June/000160.html
release, security, PSL, inet_ntop, OpenSSL, wolfSSL, QUERY
@dev #Goose valued
Art by @anubiarts
RE: https://mastodon.social/@appassionato/116815718475863119
wow. beautiful.
What we do ship this Friday, is a published policy on LLM use in the open source projects we maintain. We hope it’ll help potential contributors assess how to spend their time and ours in the most productive way. https://nlnetlabs.nl/llm-policy/
If you really want to value a #goose, you first have to learn to love yourself!🪿
A #curl mountain movie
https://daniel.haxx.se/blog/2026/06/26/a-curl-mountain-movie/
The #curl vulnerability mountain development timeline
A first public version.
To make a #goose you need to break some eggs!
Or at least one...🐣
HackerOne reporter: "But you assigned a CVE to something similar in 2013!"
Really now?
#curl
I reported a possible security problem against OpenSSL 4.0.1 found with no AI at all. Like a cave man.
Following #goose has doubled Mastodon's value.😌
"Vibe coding has taught me to think more like an engineer" is one of the more chilling sentences I've brushed against today.
"Meta glasses are Cybertrucks for your face"
hehehe