Five years ago I started getting these emails about #curl from NASA. Months later we learned this probably was related to them using curl in the Mars Helicopter mission.

daniel.haxx.se

curl supports NASA

Not everyone understands how open source is made. I received the following email from NASA a while ago. Subject: Curl Country of Origin and NDAA Co...

I decide to view the continued onslaught of slop security reports as research material for my coming FOSDEM talk.

If you need to get your mood down a few notches, there are some new slop entries to torment yourself with here:

Gist

AI slop security reports submitted to curl

AI slop security reports submitted to curl. GitHub Gist: instantly share code, notes, and snippets.

new day, new slop

slip slop slap

HackerOne

curl disclosed on HackerOne: Path Traversal Bypass in file:// URLs...

## Summary: The `dedotdotify()` function in `lib/urlapi.c` is responsible for removing path traversal sequences (`../` and `./`) from URLs accordi...

Please stop using AI when responding. It is enough if you answer with no more than 20 lines. The rest is just word sallad. *shakes fist in the air*

Microsoft will pay bug bounties even for 3rd party components:

Microsoft now buys bugs, with or without a bounty program

: Critical vulnerabilities found in third-party applications eligible for award under 'in scope by default' move

My week:

[Daniel's week] December 13, 2025

Security, AI, FOSDEM, 40K stars, rc1, URLs, AIxCC, mallocs

I am probably getting old, but the idea to cram in lots of events in Brussels the entire week before FOSDEM is not getting my thumbs up. Or well, you can have them but I won't be there. A regular FOSDEM already wears me out on its own. Being at the European Open Source Awards on the Thursday before FOSDEM is stretching it but I will do it. Adding *more* events to my agenda that week would probably kill me. Did I mention I'm old? Leave me alone.