daniel:// stenberg://Jun 30
It has gone zero days since the latest slop
Show threaddaniel:// stenberg://
Now disclosed: https://hackerone.com/reports/3230082
curl disclosed on HackerOne: Stack-based Buffer Overflow in TELNET...

**Title:** Stack-based Buffer Overflow in TELNET NEW_ENV Option Handling **Vulnerability Description:** **Summary:** A stack-based buffer overflow vulnerability exists in the `libcurl` TELNET handler. When `libcurl` connects to a malicious TELNET server, the server can trigger an overflow by sending a `NEW_ENVIRON SEND` request. This causes the client to construct a response that overwrites...

HackerOne
Jun 30 at 6:36pmWeb
Show threaddaniel:// stenberg://Jun 30
... and added to the list: https://gist.github.com/bagder/07f7581f6e3d78ef37dfbfc81fd1d1cd
AI slop security reports submitted to curl

AI slop security reports submitted to curl. GitHub Gist: instantly share code, notes, and snippets.

Gist
Show threadExa Jul 1
@bagder Wow, I just read the first two links and it's amazing, it feels like the submitters think they're going to be paid for submitting nothing of value. Will continue reading.
Show threaddaniel:// stenberg://Jul 1
@Exagone313 it is educational. And frustrating...
Show threadExa Jul 1
@bagder I have found that one of the submitters listed there got awarded more than $1000 from a company on Hacker One. I guess sometimes it pays off.
Show threadNatasha Nox 🇺🇦🇵🇸Jul 1

@Exagone313 @bagder The second one is funny in hindsight given today you can immediately tell from the wording it's just copied directly off of ChatGPT.

"Hello <user>,
Certainly! Let me elaborate on the concerns raised by the triager:

[...]

I hope this clarifies the concerns. If you have any further questions or need additional details, feel free to ask."

ChatGPT LOVES its "Certainly!" starter.
They didn't even bother writing a comprehensive LLM command not to use the default slop wording.

Show threadalphareeJun 30
@bagder "hey chat, give this in a nice way so I reply on hackerone with this comment" 😂
Show threadtheoretical lesbianismJun 30

@bagder

hey chat, give this in a nice way so I reply on hackerone with this commentim dying 😭

Show threadBrodie RobertsonJul 1
@bagder Chat is Curl cooked
Show threadNatasha Nox 🇺🇦🇵🇸Jul 1
@BrodieOnLinux @bagder F in chat.
Show threadarcayrJul 1

@bagder

AI slop. Reported as abuse. Banned from the project.

unfathomably based. even that is more effort than they deserve.

Show threadAriadne Conill 🐰Jul 1
@bagder i don’t think that’s how snprintf works…
Show threadCory CarsonJul 1
@bagder thank you for sharing these