Three years ago I blogged about #nuget serving outdated #curl packages.
Uncategorized
28
Posts
21
Posters
0
Views
-
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
-
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
@bagder That's quite the nugget you found there.
-
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
Microsoft, and Windows.
Ah well. -
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
"Microsoft is no longer accepting new submissions through secure@microsoft.com. Please use the Microsoft Researcher Portal "...
😠
-
"Microsoft is no longer accepting new submissions through secure@microsoft.com. Please use the Microsoft Researcher Portal "...
😠
but I took it to the big generic security portal and submitted a report there. Let's see what happens.
-
"Microsoft is no longer accepting new submissions through secure@microsoft.com. Please use the Microsoft Researcher Portal "...
😠
@bagder Maybe they got too many slop reports via email.
-
@bagder Maybe they got too many slop reports via email.
-
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
@bagder Have you considered if there's a demand for vintage curl releases that you aren't serving? Give the people what they want!
-
@bagder Have you considered if there's a demand for vintage curl releases that you aren't serving? Give the people what they want!
@Tenzer I linked the security people to this relevant page: https://curl.se/docs/vuln-7.51.0.html
-
"Microsoft is no longer accepting new submissions through secure@microsoft.com. Please use the Microsoft Researcher Portal "...
😠
@bagder AI Slop, this is why we can't have nice things.
-
-
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
@bagder I've using dotnet for a few years and wanted to try using Curl but didn't find anything that wasn't poorly maintained or totally outdated.
-
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
@bagder @shanselman responded to the bluesky mirror of this post.
-
@bagder @shanselman responded to the bluesky mirror of this post.
@ssg @shanselman thanks, I tend to miss the replies to the mirror-me over there...
-
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
@bagder
Have you considered reserving "Curl" prefix on NuGet?
https://learn.microsoft.com/en-us/nuget/nuget-org/id-prefix-reservation
It is not much but it would prevent random people from uploading "officially looking" packages. -
but I took it to the big generic security portal and submitted a report there. Let's see what happens.
My not at all surprised face: "After careful investigation, this case has been assessed as not a vulnerability and does not meet Microsoft's bar for immediate servicing."
-
My not at all surprised face: "After careful investigation, this case has been assessed as not a vulnerability and does not meet Microsoft's bar for immediate servicing."
@bagder our own IT team are running Office 2016 in a sensitive environment.
Why would MS be any better. 🙁 -
My not at all surprised face: "After careful investigation, this case has been assessed as not a vulnerability and does not meet Microsoft's bar for immediate servicing."
@bagder Subscription first, Quality second. Works as expected I suppose.
-
My not at all surprised face: "After careful investigation, this case has been assessed as not a vulnerability and does not meet Microsoft's bar for immediate servicing."
@bagder Microslop
-
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
@bagder nuget? more like oldget amirite
Gli ultimi otto messaggi ricevuti dalla Federazione
-
@Nonya_Bidniss
AFAIK recharging is a 1.5 MegaWatt, 1000 Volts affair. Per single charging point/plug. Such powers and tensions are not only quite dangerous to handle but they will require extensive rebuilding of existing electrical networks
-
Leggo che al #cinema 40 anni fa non ebbe successo. Non ne dubito, anche se io la ricordo diversamente. Sarà pure che le canzoni dei #Queen comprese nella colonna sonora allora erano ovunque. Sicuramente "ne rimarrà uno solo" sarebbe stato un consiglio da seguire quando vennero realizzati X sequel. Usciva il 7 marzo 1986 (negli USA) Highlander - L'ultimo immortale https://streamingcommunityz.computer/it/watch/5268
-
Onda anomala: ultima generazione a processo. cosa cambia con il nuovo pacchetto sicurezza. intervista all’avvocata paola bevere
@anarchia
“Onda Anomala”- Notizie eventi movimenti dal clima che cambia, la trasmissione quindicinale di Radio Onda d’Urto all’interno della casetta degli attrezzi del martedi pomeriggio alle
-
@pressenza_italia Con Leonardo (Min. dell’Economia e delle Finanze italiano detiene il 30%) l’Italia è complice attivo dei crimini di Israele.
Leonardo fornisce:- i cannoni navali da 76 mm delle Sa’ar israeliane, testati su Gaza dal 16/11/2023
- elicotteri da addestramento AW119, aerei M-346 “Lavi”
- rimorchi cisterna per l’esercito Idf, contratti firmati mentre i bombardamenti su Gaza erano già in corso
- radar congiunti con RADA, in una joint venture italo-israeliana quotata anche a Tel Aviv
-
@rsiinfo pastori evangelici che non hanno mai letto il vangelo
-
Trump: «L’Iran non è più il bullo del Medioriente»
In effetti, ora c'è rimasto solo LUI
-
@gian_d_gian niente scottature = niente imprecazioni.
Il pubblico è deluso.
Sappilo.
-
@gian_d_gian non è una rottamazione ma un meritato riposo.
