<![CDATA[First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening.]]>First of all, *most* of FOSS security reports nowadays (that I see in and httpd) are non-threatening.

They are edge cases under highly constructed preconditions. Yes, not impossible, but unlikely to be ever encountered.

Before LLMs, no researcher would have invested the time to explore those scenarios. my guess.

Yes, we fix them. But, they could also have been a bug report.πŸ’πŸ»β€β™‚οΈ

]]>https://forum.other.li/topic/6cf1a83e-1037-48ec-aa67-2113eb052828/first-of-all-most-of-foss-security-reports-nowadays-that-i-see-in-curl-and-apache-httpd-are-non-threatening.RSS for NodeFri, 05 Jun 2026 04:24:59 GMTFri, 15 May 2026 06:10:10 GMT60<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 11:39:37 GMT]]>@icing I like to think we're closing the back doors and zero days nation state actors had found and not reported.

]]>https://forum.other.li/post/https://mastodon.social/ap/users/116266959024807499/statuses/116578397568845160https://forum.other.li/post/https://mastodon.social/ap/users/116266959024807499/statuses/116578397568845160Fri, 15 May 2026 11:39:37 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 10:25:31 GMT]]>@icing And then people observe the changes required to fix the problem and can use them to create their exploit right away, even before the fix is released.

]]>https://forum.other.li/post/https://genealysis.social/users/Flominator/statuses/116578106198284494https://forum.other.li/post/https://genealysis.social/users/Flominator/statuses/116578106198284494Fri, 15 May 2026 10:25:31 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 09:46:49 GMT]]>@stevel @icing There's more than RCE, e.g. heartbleed had a 8.6 cvss w/o RCE, but had aggravating factors that aren't evaluated by the CVSS scale, like how widespread the vulnerable configuration is.

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

In comparison, we have a 4-bytes uninitialized stack value leak in application logs bug to be reported soon. CVSS 3.1 Low
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

]]>https://forum.other.li/post/https://infosec.exchange/users/aris/statuses/116577954033613881https://forum.other.li/post/https://infosec.exchange/users/aris/statuses/116577954033613881Fri, 15 May 2026 09:46:49 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 09:37:37 GMT]]>@aris @icing if its not RCE in a normal deployment - it's just a normal bug. Makes sense,

]]>https://forum.other.li/post/https://hachyderm.io/users/stevel/statuses/116577917809779949https://forum.other.li/post/https://hachyderm.io/users/stevel/statuses/116577917809779949Fri, 15 May 2026 09:37:37 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 08:52:09 GMT]]>@icing at libssh we're considering the policy of filing all bugs under a certain CVSS threshold (5 or 6) as regular bug reports in bug tracking and fix them without any embargo to avoid clogging up the security pipeline

]]>https://forum.other.li/post/https://infosec.exchange/users/aris/statuses/116577739056100692https://forum.other.li/post/https://infosec.exchange/users/aris/statuses/116577739056100692Fri, 15 May 2026 08:52:09 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 08:49:34 GMT]]>@holsta Ah yes. Sorry. I saw two separate posts drifting onto my timeline (which isn't normally about curl or security stuff). They seemed related in an interesting way which I thought I would comment on it. But maybe I should've noticed they're both from people who are well aware of eachother.

]]>https://forum.other.li/post/https://en.osm.town/users/harry_wood/statuses/116577728856914667https://forum.other.li/post/https://en.osm.town/users/harry_wood/statuses/116577728856914667Fri, 15 May 2026 08:49:34 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 08:43:07 GMT]]>@icing I suspect the Linux kernel is an exception.

]]>https://forum.other.li/post/https://infosec.exchange/users/alwayscurious/statuses/116577703501762967https://forum.other.li/post/https://infosec.exchange/users/alwayscurious/statuses/116577703501762967Fri, 15 May 2026 08:43:07 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 08:41:18 GMT]]>@harry_wood What? Stefan is literally on the curl team.

Why are you like this?

]]>https://forum.other.li/post/https://mastodon.art/users/holsta/statuses/116577696398036494https://forum.other.li/post/https://mastodon.art/users/holsta/statuses/116577696398036494Fri, 15 May 2026 08:41:18 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 08:11:33 GMT]]>@swelljoe @icing eh… either way, it used to be every time a new developer looked at a corner of a code base that hasn't been touched in 10, 20, 30 years we get, at the very least a bug fix a refactoring

and at least one new person who's now familiar with that code… ⬅️ and the loss of this is perhaps the most frustrating part

]]>https://forum.other.li/post/https://cathode.church/users/meena/statuses/116577579403244642https://forum.other.li/post/https://cathode.church/users/meena/statuses/116577579403244642Fri, 15 May 2026 08:11:33 GMT<![CDATA[Reply to First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening. on Fri, 15 May 2026 06:38:01 GMT]]>@icing after twenty or thirty years, the really scary stuff has probably already been found in anything popular. (Probably.)

]]>https://forum.other.li/post/https://mas.to/users/swelljoe/statuses/116577211635745828https://forum.other.li/post/https://mas.to/users/swelljoe/statuses/116577211635745828Fri, 15 May 2026 06:38:01 GMT