Post

I don't think people really understand how important this is—or how bad it is for curl.

curl is a commonly used library in almost every major industry, including banks, car manufacturers, phones, and computers. This means that if someone wants to hack a large organization and they are aware of an exploit in a library like curl, I wouldn't be surprised at all if they tried to use it.

With the recent changes, curl will eventually miss important exploits because: 1. AI "slop" reports are taking up most of the maintainers' time. 2. The removal of monetary rewards takes away one of the main reasons talented exploit researchers look for vulnerabilities in curl in the first place.