"my experience from working with them on and off for many months now is nothing but good. Skilled, professional engineers without any bureaucracy. They know their stuff, and they've been very good at listening in and adjusting for our needs and wants."
Not to mention, it seems HN started to block login from user agents which are not based on a 'whatwg cartel' web engines... or their security provider loves gogol a bit too much...
(How do I post this messase then, well, my browser is faking a real user agent from some browser using a 'whatwg cartel' web engine)
Blocking the curl useragent can obviously be worked around, but is probably a net good. This isn’t a conspiracy, HN would be getting spammed by crawlers but they won’t care about legitimate users.
I'm thinking it's rapidly not becoming "can you find a security issue in XYZ?" and "what is the cost of finding a security issue in XYZ?". I want to know what the spend was.
What stood out the most to me here was their pitch that harness currently matters most, over and above a specific model capacity. That’s one of my conclusions reading cloudflare’s Mythos debrief as well — the work right now that’s most valuable is in getting the models to loop effectively on tasks - so it’s super interesting to read the same perspective from a clearly effective org.
Paraphrasing: "The world's top security researches and AI labs are pouring all their VC money into finding as many security issues in curl as possible". At the same time, we know that curl is run by volunteers that needs to handle all of this. I'm not saying that we shouldn't do security review of open source libraries, just saying that this situation puts a lot of pressure on the maintainers.
The second unnerving thing is that many of the listed vulnerabilites target embedded libcurl; a library with a much slower update cycle. I'm guessing that many of the listed bugs are still in active use, inside the thousands of applications that use curl internally. Another tricky situation.
Both of these stand in contrast to the posts "braggy" style of "we found the most vulnerabilities of all!!!".
Would be great if people would brag with quotes and feedback from the maintainers. I'd be more interested to see that. Instead our model found x, I want something that really helps the maintainers.
Another way to read it is that the public now have access to resources on a scale that was formerly the domain of three letter government agencies throwing millions of dollars to hire humans to do this work. While in the short-term it's painful for maintainers, in the long-term we all end up safer.
> I'm not saying that we shouldn't do security review of open source libraries, just saying that this situation puts a lot of pressure on the maintainers.
This is true, and worth saying, but it is also a problem of the OSS philosophy. All software is used at your own risk, so if maintainers want their software used they need to keep up, and the (true) promise of "more eyeballs means more secure software" has this downside built in.
Thanks for making open source a bit more secure, even though your website is super laggy with all these ridiculous animations.
Based on the eye candy I imagine the team consists of a bunch of VC bros on their macbooks drinking chai lattes. Not sure if that is the impression you want to portray to a technical audience. The eye candy might work with nontechnical crowds though, so you do you.
Edit: To elaborate on the nontechnical macbook user angle: If the tagline is "outsmart your adversaries" I wonder how you plan to outsmart anyone if your security company is set up on backdoor-infested MacOS or Windows systems? You can't assume that the backdoors put in by USUK are not known to other foreign adversaries. Maybe I'm wrong and they are a Linux/BSD shop. In that case a report about running a security startup in a secure manner based on an open-source operating system would be a more interesting contribution than yet another CVE.
"my experience from working with them on and off for many months now is nothing but good. Skilled, professional engineers without any bureaucracy. They know their stuff, and they've been very good at listening in and adjusting for our needs and wants."
Who am I? I'm Daniel, curl lead developer.
https://mastodon.social/@bagder/116807425534711479
(How do I post this messase then, well, my browser is faking a real user agent from some browser using a 'whatwg cartel' web engine)
What stood out the most to me here was their pitch that harness currently matters most, over and above a specific model capacity. That’s one of my conclusions reading cloudflare’s Mythos debrief as well — the work right now that’s most valuable is in getting the models to loop effectively on tasks - so it’s super interesting to read the same perspective from a clearly effective org.
[0] https://youtu.be/t4wqREXVEAc
Paraphrasing: "The world's top security researches and AI labs are pouring all their VC money into finding as many security issues in curl as possible". At the same time, we know that curl is run by volunteers that needs to handle all of this. I'm not saying that we shouldn't do security review of open source libraries, just saying that this situation puts a lot of pressure on the maintainers.
The second unnerving thing is that many of the listed vulnerabilites target embedded libcurl; a library with a much slower update cycle. I'm guessing that many of the listed bugs are still in active use, inside the thousands of applications that use curl internally. Another tricky situation.
Both of these stand in contrast to the posts "braggy" style of "we found the most vulnerabilities of all!!!".
I am guessing the slower update cycle is an issue where it is statically linked?
This is true, and worth saying, but it is also a problem of the OSS philosophy. All software is used at your own risk, so if maintainers want their software used they need to keep up, and the (true) promise of "more eyeballs means more secure software" has this downside built in.
Based on the eye candy I imagine the team consists of a bunch of VC bros on their macbooks drinking chai lattes. Not sure if that is the impression you want to portray to a technical audience. The eye candy might work with nontechnical crowds though, so you do you.
Edit: To elaborate on the nontechnical macbook user angle: If the tagline is "outsmart your adversaries" I wonder how you plan to outsmart anyone if your security company is set up on backdoor-infested MacOS or Windows systems? You can't assume that the backdoors put in by USUK are not known to other foreign adversaries. Maybe I'm wrong and they are a Linux/BSD shop. In that case a report about running a security startup in a secure manner based on an open-source operating system would be a more interesting contribution than yet another CVE.