daniel:// stenberg://
bagder@mastodon.social
#curl has been a CNA for a year now https://daniel.haxx.se/blog/2024/01/16/curl-is-a-cna/
2
2
0
daniel:// stenberg://
bagder@mastodon.socialThe short summary of if it has been worth the hassle: yeah I think so. It is now easy and fast to get new CVE IDs. We have a seat at a table where I can complain loudly on the system and what I say actually might have a (small) impact.
We have yet to deny someone else's crazy CVE attempts against curl.
2
3
0
daniel:// stenberg://
bagder@mastodon.social@oneiros Twelve. Eleven of them are public, there is one still pending publication. See https://curl.se/docs/security.html
0
0
0
daniel:// stenberg://
bagder@mastodon.socialIt is an added bonus that the Linux kernel with @gregkh at the wheel also became a CNA around the same time, as they are pushing for good things in the ecosystem and do it at such a much bigger volume and scale than we do. And it's fun to sit next to this and learn.
0
0
1
@bagder are there any good resources for learning what actually qualifies as a CVE for the curl project? And the best way to write up a report about it
1
0
0
daniel:// stenberg://
bagder@mastodon.social@Man2Dev this is probably the best: https://curl.se/dev/vuln-disclosure.html
0
0
0