Even if we rewrote #curl in rust, the just reported UAF RCE could still happen when integrating third party libraries like OpenSSL, nghttp2 and others.

Look at the linked source of ‚upki‘ the new lib for certificate validation. Most of the code is ‚unsafe‘ and memory pointers are stored in OpenSSL via „*_set_ex_data()“ beyond any guard of the rust compiler.

#curl used such an „ex_data“ pointer beyond its lifetime in the CVE. C or rust unsafe, makes no difference.

https://github.com/rustls/upki/blob/main/upki-openssl/src/lib.rs

Really good blog by Joshua Rogers from Aisle about how to do vulnerability hunting using AI. The gist:

- if you set a goal, the AI will try *anything* it learned to reach it, including cheating. It has no morals, it just applies options.
- you need a non-AI gatekeeper to verify findings in various ways to confirm a vulnerability.

„…in some cases, the agents really will happily edit the source code of programs […] adding the vulnerability itself.“

https://joshua.hu/lessons-using-sanitizers-oracle-llm-vulnerability-triage

Frank Denis on zeroing secrets and why it may not work as desired or even be counter-productive.

https://00f.net/2026/10/06/zeroization-1/

RE: https://hachyderm.io/@epage/117395511667671376

Someone is looking for rust projects with more than 1800 dependency crates.

It‘s for testing cargo, a valid cause as I understand it.

But the binary of such a project would contain them all inside. Given the current security findings, one rebuilds it fresh every hour? Or do the >1800 crates coordinate their disclosures?

Excuse an old man for wondering at such miracles!😌

‚Torvalds added, in the case of AI-discovered bugs, you need to keep in mind that just "because you found it with AI, 100 other people also found it with AI."‘

There is nothing secret about a bug found by a model. If the software is a target, you can be sure that the bad guys are running continously prompts against it. Without token restrictions.

As a maintainer, this is all hard to manage. But this is happening everywhere. It‘s not your job to save the world from stupidity, vanity and greed.

In math 'i^2 == -1'. But computers can only approximate that. Good values for 'i' are then:

int32_t 479772853 squared is -7
int32_t 1667710795 squared is -7
int16_t 16203 squared is -7
int16_t 16565 squared is -7
int8_t 53 squared is -7
int8_t 75 squared is -7

😌

When you see 'i' as variable name, it means the code is complex.

Follow me for more bad math jokes.😌

There are many nice people here on the fediverse. Some are smart, some are kind, some are funny, some are just there for the ride.

Many thanks to the admins and mods, for enabling this.🤗

/cc @ordnung @leah @rixx

RIP pthread_cancel() in curl. It was an interesting adventure.
#curl

https://eissing.org/icing/posts/rip_pthread_cancel/

Honored to be part of the first Sovereign Tech Fellowship program. This will support a good chunk of my work on curl and Apache during this year.

It's great to see a government realising the need to support the infrastructure so many rely on, business as well as individuals.

https://www.sovereign.tech/news/meet-the-sovereign-tech-fellows

@bagder ...using a single connection to a local, plain vanilla Apache httpd.

But who cares for raw power?💁🏻‍♂️😌

Many PRs were merged today. A successful curl Friday.

On @bagder 's god-like machine, curl master now shows nice numbers on our scorecard.

50x1OOMB https: GETs in parallel with HTTP/2: 2477 MB/s

Mood: happy

I got a new social network for Xmas! Thanks to you all!
😀🍾🎄❤️