3 ms·

> > The bad guys won’t rest > Probably not. But we will. A pleasant dose of humanity in decidedly inhuman times.

donw 4mo ago
That was just a beautiful, period.
Timshel 4mo ago
Especially since it appears there is a solution if you truly need a fix. > Or you get a support contract and we get to read about it earlier.
- bawolff 4mo ago
  > Especially since it appears there is a solution if you truly need a fix. If you ever really need anything fixed in the open source world, there is always the option of doing it yourself
  - alibarber 4mo ago
    Yes - and realistically, if you're $BIGCO who's shipped a billion devices with some obscure curl vulnerability you just discovered, then the hard part is going to be rolling out a patch to all of them anyway, which is still a 'you' problem.
  - matthewdgreen 4mo ago
    Doing the fix yourself is almost always the easy part. Disclosing it and getting a patch shipped across the entire Internet is the hard part.
    - layer8 4mo ago
      Why would you personally need the entire internet to receive a fix?
      - arwineap 4mo ago
        Running a fork is a lot of work. You need your fixes upstreamed so that you don't need to backport other people's fixes
        lokar 4mo ago
        For a couple months? Not a big deal
        bawolff 4mo ago
        Nobody said doing it yourself was neccesarily easy. Its just an option that is there.
        layer8 4mo ago
        You don’t need to backport other people’s fixes. You only need to re-merge your patches into updated versions of the upstream (aka vendor branch), which usually is straightforward. Maybe you mean that if there are many people like you, they’d want to integrate each other’s fixes. But then you’d probably have the combined manpower to start maintaining a true fork.
      - toast0 4mo ago
        It's handy if you run a service and the internet runs clients you didn't write to access said service. (or vice versa) Also handy if the internet is running a DDoS reflector and you're being targetted. Otherwise, usually no sense of urgency for fixes I did for me/my employer and want the rest of the world to benefit. My problem is solved now, everyone else can get it when it ships.
      - matthewdgreen 4mo ago
        I'm thinking of something on the order of Heartbleed. Sure, you fix it in your own servers. Are you sure you're ok with the entire Internet being vulnerable for two months? You don't have any data stored on servers that are outside of your control?
- cat_plus_plus 4mo ago
  In 2026 there is a considerably cheaper/quicker solution, but that in no way invalidates OSS maintainers' right to enjoy a summer vacation without interruption.
Natsu 4mo ago
I worry that this will make the bad guys focus on finding zero days during the month they have free to exploit anything they find, but I don't doubt that they need a break.
- Cider9986 4mo ago
  Mythos found only one. Would have to be pretty serious bad guys. https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/ https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-v...
  - bluGill 4mo ago
    Remember though that many other AIs had already run and found issues that were fixed. If you had a time machine and took Mythos back a year it probably would have found a lot more. (if anyone has access to mythos it wouldn't be hard to test - download a release from last year and check)
    - timeinput 4mo ago
      Imagine the bugs you'd find in curl from five years ago! I bet there are tons!
    - etn_se 4mo ago
      > if anyone has access to mythos it wouldn't be hard to test - download a release from last year and check Mythos might have seen last years bug reports so that might be cheating, kind-of. Bug reports ought to be great study material for LLM training.
- bvcp 4mo ago
  if a company has a problem with this pay for support if its not worth the money …
- victorbjorklund 4mo ago
  Pretty sure if you find a zero day in a software like that you don’t wait until a certain month.
Scroll_Swe 4mo ago
>A pleasant dose of humanity in decidedly inhuman times. As opposed to when? Do tell. I see this crap so much online. You just want an excuse to give up and be a victim. I hear it online and irl. You young people are broken, broken yet you have everything. How old are you, and where do you live? Life is better now than ever. I in Sweden can buy everything, access everything, and I own my apartment. Problem? As opposed to what? WW1? WW2? Vietnam war and corrupt nixon? The cold war when Russians accidentally invaded Sweden? Nuclear bomb fear? the 90s debt crisis? 90s balkan war? And refugee crisis? 9/11 and all that? 2015 refugee crisis? When? What do you compare to? The truth is, life is getting better. All the time. We had 10% unemployment in 2016 and even worse in 2008 when I graduated. Grow up.

donw 4mo ago

That was just a beautiful, period.

Especially since it appears there is a solution if you truly need a fix. > Or you get a support contract and we get to read about it earlier.

bawolff 4mo ago
> Especially since it appears there is a solution if you truly need a fix. If you ever really need anything fixed in the open source world, there is always the option of doing it yourself
- alibarber 4mo ago
  Yes - and realistically, if you're $BIGCO who's shipped a billion devices with some obscure curl vulnerability you just discovered, then the hard part is going to be rolling out a patch to all of them anyway, which is still a 'you' problem.
- matthewdgreen 4mo ago
  Doing the fix yourself is almost always the easy part. Disclosing it and getting a patch shipped across the entire Internet is the hard part.
  - layer8 4mo ago
    Why would you personally need the entire internet to receive a fix?
    - arwineap 4mo ago
      Running a fork is a lot of work. You need your fixes upstreamed so that you don't need to backport other people's fixes
      - lokar 4mo ago
        For a couple months? Not a big deal
      - bawolff 4mo ago
        Nobody said doing it yourself was neccesarily easy. Its just an option that is there.
      - layer8 4mo ago
        You don’t need to backport other people’s fixes. You only need to re-merge your patches into updated versions of the upstream (aka vendor branch), which usually is straightforward. Maybe you mean that if there are many people like you, they’d want to integrate each other’s fixes. But then you’d probably have the combined manpower to start maintaining a true fork.
    - toast0 4mo ago
      It's handy if you run a service and the internet runs clients you didn't write to access said service. (or vice versa) Also handy if the internet is running a DDoS reflector and you're being targetted. Otherwise, usually no sense of urgency for fixes I did for me/my employer and want the rest of the world to benefit. My problem is solved now, everyone else can get it when it ships.
    - matthewdgreen 4mo ago
      I'm thinking of something on the order of Heartbleed. Sure, you fix it in your own servers. Are you sure you're ok with the entire Internet being vulnerable for two months? You don't have any data stored on servers that are outside of your control?
cat_plus_plus 4mo ago
In 2026 there is a considerably cheaper/quicker solution, but that in no way invalidates OSS maintainers' right to enjoy a summer vacation without interruption.

Natsu 4mo ago

I worry that this will make the bad guys focus on finding zero days during the month they have free to exploit anything they find, but I don't doubt that they need a break.

Cider9986 4mo ago
Mythos found only one. Would have to be pretty serious bad guys. https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/ https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-v...
- bluGill 4mo ago
  Remember though that many other AIs had already run and found issues that were fixed. If you had a time machine and took Mythos back a year it probably would have found a lot more. (if anyone has access to mythos it wouldn't be hard to test - download a release from last year and check)
  - timeinput 4mo ago
    Imagine the bugs you'd find in curl from five years ago! I bet there are tons!
  - etn_se 4mo ago
    > if anyone has access to mythos it wouldn't be hard to test - download a release from last year and check Mythos might have seen last years bug reports so that might be cheating, kind-of. Bug reports ought to be great study material for LLM training.
bvcp 4mo ago
if a company has a problem with this pay for support if its not worth the money …
victorbjorklund 4mo ago
Pretty sure if you find a zero day in a software like that you don’t wait until a certain month.

Scroll_Swe 4mo ago

>A pleasant dose of humanity in decidedly inhuman times. As opposed to when? Do tell. I see this crap so much online. You just want an excuse to give up and be a victim. I hear it online and irl. You young people are broken, broken yet you have everything. How old are you, and where do you live? Life is better now than ever. I in Sweden can buy everything, access everything, and I own my apartment. Problem? As opposed to what? WW1? WW2? Vietnam war and corrupt nixon? The cold war when Russians accidentally invaded Sweden? Nuclear bomb fear? the 90s debt crisis? 90s balkan war? And refugee crisis? 9/11 and all that? 2015 refugee crisis? When? What do you compare to? The truth is, life is getting better. All the time. We had 10% unemployment in 2016 and even worse in 2008 when I graduated. Grow up.