Curl is closing its security inbox for July. 'The bad guys won't rest. But we will' (daniel.haxx.se)
The HackerOne form and security email go dark July 1 to August 3, and the 8.22.0 release slips two weeks to September 2. Daniel Stenberg's reasoning is plain: the team is burnt out and needs rest.
The thread half-celebrates, half-worries about one loophole: paid support clients can still pressure for a fix if someone discloses publicly during the freeze — and curl, for all its ubiquity, has no second on-call human.
Sign in to save