Curl is closing its security inbox for July. 'The bad guys won't rest. But we will'
For one month, curl stops accepting vulnerability reports through HackerOne and email. The trackers stay open, paid support stays full. After four months of pressure, the maintainers are taking the summer off — on purpose.
The HackerOne form and security email go dark July 1 to August 3, and the 8.22.0 release slips two weeks to September 2. Daniel Stenberg's reasoning is plain: the team is burnt out and needs rest.
The thread half-celebrates, half-worries about one loophole: paid support clients can still pressure for a fix if someone discloses publicly during the freeze — and curl, for all its ubiquity, has no second on-call human.
A month of deliberate quiet
Daniel Stenberg announced curl's "summer of bliss": from July 1 to August 3, 2026, curl will not accept vulnerability reports through its HackerOne form or its security email. The GitHub issue and pull-request trackers stay open, paid support contracts get "full and appropriate service" throughout, and the 8.22.0 release shifts two weeks to September 2. The stated reason is human, not technical — Stenberg writes of being "under a huge pressure for the last four months or so" and the team needing "some rest." The line everyone quoted:
"The bad guys won't rest. But we will."
For a piece of software that ships in basically everything, "we are turning off the security inbox" is a genuinely radical sentence.
The applause — and the business model nobody named
Most of the thread cheered, but the most-upvoted insight reframed the move as quietly commercial.
"The headline buried the lede -- this is a way to get some summer vacation AND encourage enterprise support contracts, which will still have availability." — an investor and longtime open-source watcher
A startup co-founder and ex-React-team engineer put it in three words: "what a fantastic advertisement." The freeze advertises the value of a paid relationship by withdrawing the free one.
The loophole and the bus factor
The worriers found the seam. One reader flagged the contract-work loophole: if researchers disclose publicly during the freeze, paying clients "may pressure them to ship a fix anyway," so the rest isn't guaranteed to hold. A harder structural point cut deeper:
"this sort of (again) puts the spotlight on our collective dependence on a handful of individuals basically working for free with no backup. Most normal organizations stagger vacations… it saddens me that not even friggin curl has the financial muscles to have somebody on-call for one month." — a commenter on the bus-factor problem
The reassurance came from the pragmatists: curl is mature enough that an impactful, novel bug is near-zero odds over a single month, and if one appears, "someone will figure out how to get in touch with Daniel" — what matters most is patches landing in package managers, which don't need the upstream release.
Rest as infrastructure
The deeper story isn't a vacation; it's a maintainer with the standing to say no, doing it out loud. Curl can afford this precisely because it's curl — battle-tested, slow-moving, with paying clients as a safety net. The uncomfortable corollary is the one the thread couldn't shake: the most depended-upon plumbing of the internet rests on people whose only backup, when they finally need a break, is to close the door and hope.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
'Improvement in Alzheimer's after psilocybin' is one patient, one journal, and a lot of red flags
The headline says a woman with advanced Alzheimer's improved after a 5-gram mushroom dose. The paper says, in its own words, the finding 'does not imply disease reversal.' The thread fills in everything the headline left out.