3 ms·
It may well be that the hype was primarily marketing. The other alternative is that Curl is simply secure enough that there was far less to find than in other
by vidarh 6mo ago
It may well be that the hype was primarily marketing.
The other alternative is that Curl is simply secure enough that there was far less to find than in other projects.
- teiferer 6mo agoGiven how much money is on the line, it would be gross negligence if anything came publicly out of the CEO's mouth or is otherwise published by the company that's not marketing.
- red75prime 6mo agoThe question is whether they need to massage the results for them to be marketable.
- zeroCalories 6mo agoSometimes you gotta let people know how awesome you are. The real question is if you're misrepresenting yourself(all marketing, no substance).
- shakna 6mo agoDaniel found 30 CVEs in Curl, this year. I would not say that there is nothing to find, here. Just that it takes an actual expert.
- bcjdjsndon 6mo ago[flagged]
- vidarh 6mo agoI did not suggest there was nothing to find. But is also very different to count all CVE's found and reported (there are less than 30 total for 2025 and 2026 per [1]) by anyone and everyone vs. what was found in a short time by someone prompting a model. [1] https://curl.se/docs/security.html https://curl.se/docs/security.html
- shakna 6mo agoIs not the selling of the model, that it is as capable as anyone and everyone? > Claude Mythos is Anthropic's most specialized model, trained exclusively on security research, vulnerability disclosures, and attack pattern literature. Its reasoning reflects how the world's best security researchers think. [0] [0] https://mythosvulnerabilityscanner.com/what-is-claude-mythos https://mythosvulnerabilityscanner.com/what-is-claude-mythos
- vidarh 6mo agoEven if I was selling the model, which I am not, it still does not follow that you can judge that on a single run, given that no security researchers have found all of these bugs on their own in a short amount of time either.
- shakna 6mo agoOkay, to respin this - Daniel doesn't say that curl is secure-enough. Half the point of the talks this year, is there has been an uptick in detecting security bugs, not a downturn. And here's some graphs. [0] > Given the look of these graphs I don’t think we are close to zero bugs yet. These two curves do not seem to even start to fall yet. If the author thinks there is more to find, then the soil probably isn't dry. But, from the author's mouth: > My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing. [1] [0] https://daniel.haxx.se/blog/2026/04/30/approaching-zero-bugs/ https://daniel.haxx.se/blog/2026/04/30/approaching-zero-bugs... [1] https://mastodon.social/@bagder/116554460442650929 https://mastodon.social/@bagder/116554460442650929
- Joel_Mckay 6mo agoNot really, curl has slow anonymous memory leaks because of how the connection session caching was implemented. If you don't periodically restart a program, than people encounter strange hard to diagnose issues sooner or later. Also, looking at something that trips valgrind warnings already, may obfuscate a lot of problems in both your own code and the curl library itself. One could report the issue as functioning as described in the API, but the developers do not accept direct community input into the project. People use it out of convenience, but it is just as janky as most bloated projects. =3