Reading through some of the examples at the end of the article it’s infuriating when these slop reports have opened and when the patient curl developers try to give them benefit of the doubt the reporter replies with “you have a vulnerability and I cannot explain further since I’m not an expert”. Oh but for sure it’s broken and you are expert enough to know? One of the examples the reporter kept replying with how a strcpy() could be unsafe and the curl devs were kindly explaining that yes in general that function has potential for issues but their usage was not such a case. Reporter just repeats without paying attention. Insanity.
I love working in systems writing C and assembly but I’ve grown many gray hairs over the years being yelled at that “C is the worst” or “lol memory bug” or the classic “this thing isn’t working perfectly for me so it must have been written in C and we need to rewrite it entirely in (alpha) language which is for sure better than the collective centuries of expertise in C existing now”. These LLMs sure do amplify these obnoxious voices because now the fancy chatbot says so.
It’s unfortunate that the bug bounty payout removal is probably the best immediate remedy for some filtering but with curl being everywhere resume padders are still going to rush to generate slop reports or patches. I hope they are more fast and direct with communication as well. Their current patience and politeness is admirable.