How to tell your OSS is ridiculously popular: people aren't 100% sure they _didn't_ embed it, and tack on the software equivalent of "packaged in a facility where peanuts were also present" to the license list.
This watch contains software, so statistically probably contains at least traces of curl.
@IzzyOnDroid @danderson I guess I need to be more clear:
I think it's unfortunate that our tools don't automatically record what they put inside. I'm hopeful that the addition of SBOM requirements for federal contracting will help drive improvements in the tooling so that we can get the contents of our software automatically.
Right now, I'm hearing that we know everything that goes into the factory, so we assume that all of that goes into the Twinkies that come out. Including the bolts...
@evana Oopsie… No offense meant! Wasn't aware you were involved. Still, my "rant" holds its truth unfortunately in far too many places. But I should add that with the current tools it's not always easy to be aware what went it or what dragged in other things (well, one can check the dependency tree in most cases, but does not always remember too). One reason more than one FOSS dev expressed their thanks to the additional checks at the #IzzyOnDroid repo, for example…
So: apologies 4 my phrasing!
@evana That's a driving force for me as well. If I might exaggerate a bit, I guess you'll have a hard time looking at just 10 Github repos without finding some issue, issue comment, PR or review by me 🙈 Especially if it's the repo of some Android app.
And it's usually a clear win-win. Not being an Android dev, I've learned a lot about that during the discussions – while my reports usually uncovered something the devs were not aware of. Respect from both sides, precious outcome for all 
For the past few years, we have seen a lot of discussions around the concept of the Software Supply Chain. These discussions started around the time of LeftPad and escalated with multiple incidents in the past few years. The problem of all the work in this domain is that it forgets a fundamental point.
i am allergic to curl and that's why we need these warnings
if i have just a little gzipped curl or if i exchange files with someone who just ran curl i can go into a kernel panic shock
@danderson
So they could write..
"This product may contains licenses of any open-source project in the world (or may not, who knows !)"
...and get away with it.
Important information for people with OSS allergies!
@danderson
And if curl is in fact not included, can I get a refund?
It's misleading advertisment!
I paid for a curl flavored product, I demand some curl in it.
@danderson well, curl sounds a lot like curly.
Sooooooo…
Funny thing, curl is also embed in action cameras… It's literally an anything that has network
@danderson ah, another garmin watch!
no, I can't tell by the looks of the device. And "it includes cURL" doesn't help of course.
But it lists these things in the exact same order as mine does… so that's a hint
@danderson
With a few hundred lawyers, tapping away at a few hundred keyboards, for a few hundred years, you MAY end up with disclaimers that contaIn cURL...
* apologies to the Infinite Monkeys (tm).
Well. That explains the rash.
Dave Anderson
evana
Clemens
Ankit Pati
Stephan Schulz
Izzy
PheebeUK
Geoff Matthews
Jacket
Jason Parker (he/they)
ᴮᵉⁿ ᴿᵒʸᶜᵉVOTE IN THE PRIMARIES
avrona
Riley S. Faelan
Haelwenn /элвэн/ 
AzureArmageddon
Charlotte 
/Cinny 
o ifrit 🌱
Nick Selby 
Newk
MicroBlog Castellano
Gwenn
Tanguy ⧓ Herrmann
enthraxxx
C-27733
Seb-Solon
Joonas Kuorilehto
Richard Fontana
Claudius Link
Apostolis
Rob Vincent (OLD ACCOUNT)
🐧DaveNull🐧 ☣️pResident Evil☣
Xer Shadow Tail ☄️🌺🏳️⚧️
Alesandro Ortiz 🇵🇷🏳️🌈
stevenray
abadidea
Elric
Sam 
Thomas Guyot-Sionnest
faxmodem
Ozzelot 
Cegorach
J. Brian Coyle
Pilsnerd
Karpour
nLupo 
Personne