Swamped curl maintainers take low-level flaws public to survive vulnerability 'avalanche'

Heise

Factuality

Ownership

The curl project wants to limit itself to high-risk and critical security gaps on the HackerOne bugtracker.

DiarioBitcoin

Factuality

Ownership

The pressure of the security reports led the curl maintainers to change their disclosure rules: since October 26, cases of low and medium severity will pass to GitHub public, while those of high and critical level will remain under private management. Daniel Stenberg argues that the bill seeks to share the work. Although reports generated with the help of AI contributed to the pressure in the past, the maintainer recently said that those shipmen…