<![CDATA[Average number of hours between #curl security reports]]>Average number of hours between security reports

Material for a pending presentation

Link Preview Image
]]>https://board.circlewithadot.net/topic/56849820-3806-4a8a-aaad-e3590375e6bf/average-number-of-hours-between-curl-security-reportsRSS for NodeFri, 15 May 2026 00:33:13 GMTThu, 16 Apr 2026 07:10:18 GMT60<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 08:21:39 GMT]]>@lukstru since this trend is seen across many projects, we can be fairly sure that nothing we did specifically drives this change

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413412134749849https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413412134749849Thu, 16 Apr 2026 08:21:39 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 08:19:30 GMT]]>@bagder do you think it’s because you removed the bug bounty program or because the tools are getting better?

]]>https://board.circlewithadot.net/post/https://toot.kif.rocks/users/lukstru/statuses/116413403631983655https://board.circlewithadot.net/post/https://toot.kif.rocks/users/lukstru/statuses/116413403631983655Thu, 16 Apr 2026 08:19:30 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 08:08:14 GMT]]>@eliskunk in curl

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413359366147250https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413359366147250Thu, 16 Apr 2026 08:08:14 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 08:02:03 GMT]]>@bagder Vulnerability of what/where/who exactly?

]]>https://board.circlewithadot.net/post/https://queer.group/users/eliskunk/statuses/116413335055602706https://board.circlewithadot.net/post/https://queer.group/users/eliskunk/statuses/116413335055602706Thu, 16 Apr 2026 08:02:03 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:48:02 GMT]]>@bagder yaaaaaaay nature is healing

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/by_caballero/statuses/116413279906847149https://board.circlewithadot.net/post/https://mastodon.social/users/by_caballero/statuses/116413279906847149Thu, 16 Apr 2026 07:48:02 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:43:33 GMT]]>Oh, and... AI slop rate in submissions has gone back to 2024 levels

Link Preview Image
]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413262309640424https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413262309640424Thu, 16 Apr 2026 07:43:33 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:36:59 GMT]]>@bagder@mastodon.social oh wait, just one fifth of that

]]>https://board.circlewithadot.net/post/https://hai.z0ne.social/notes/al4qd6j0p7ka00ighttps://board.circlewithadot.net/post/https://hai.z0ne.social/notes/al4qd6j0p7ka00igThu, 16 Apr 2026 07:36:59 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:34:23 GMT]]>@bagder@mastodon.social at least 365?

]]>https://board.circlewithadot.net/post/https://hai.z0ne.social/notes/al4q9tsjp7ka00iehttps://board.circlewithadot.net/post/https://hai.z0ne.social/notes/al4q9tsjp7ka00ieThu, 16 Apr 2026 07:34:23 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:30:09 GMT]]>also of course: the forecast for 2026 says that we will report a lot of CVEs this year...

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413209596411068https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413209596411068Thu, 16 Apr 2026 07:30:09 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:26:18 GMT]]>@icing Yes, close enough. Awesome! ❀️ @bagder

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/stitzl/statuses/116413194487819905https://board.circlewithadot.net/post/https://mastodon.social/users/stitzl/statuses/116413194487819905Thu, 16 Apr 2026 07:26:18 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:26:04 GMT]]>To sum up:

Much higher submission rate. Much higher quality reports. More bugs and more vulnerabilities identified.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413193544371367https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413193544371367Thu, 16 Apr 2026 07:26:04 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:25:13 GMT]]>@felix_eckhardt improved tooling. AI.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413190217730269https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413190217730269Thu, 16 Apr 2026 07:25:13 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:24:58 GMT]]>Confirmed vulnerability rate in reports, year to year so far.

Link Preview Image
]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413189215294287https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413189215294287Thu, 16 Apr 2026 07:24:58 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:23:57 GMT]]>@bagder interesting. Any idea what causes the increased share of reports that identified bugs?

]]>https://board.circlewithadot.net/post/https://det.social/users/felix_eckhardt/statuses/116413185241347586https://board.circlewithadot.net/post/https://det.social/users/felix_eckhardt/statuses/116413185241347586Thu, 16 Apr 2026 07:23:57 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:21:11 GMT]]>@stitzl With this: https://curl.se/dashboard1.html#vulnerabilities-in-releases ?

/cc @bagder

]]>https://board.circlewithadot.net/post/https://chaos.social/users/icing/statuses/116413174333941247https://board.circlewithadot.net/post/https://chaos.social/users/icing/statuses/116413174333941247Thu, 16 Apr 2026 07:21:11 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:21:01 GMT]]>Share of reports that identified bugs (not vulns)

Link Preview Image
]]>https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413173688707644https://board.circlewithadot.net/post/https://mastodon.social/users/bagder/statuses/116413173688707644Thu, 16 Apr 2026 07:21:01 GMT<![CDATA[Reply to Average number of hours between #curl security reports on Thu, 16 Apr 2026 07:17:40 GMT]]>@bagder Please correlate with number of security related bugs introduced into codebase per time slice. πŸ˜…

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/stitzl/statuses/116413160518701542https://board.circlewithadot.net/post/https://mastodon.social/users/stitzl/statuses/116413160518701542Thu, 16 Apr 2026 07:17:40 GMT