oss-security - Re: Vulnerability management and Open Source: FOSDEM BoF

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20260125035320.GA503@openwall.com>
Date: Sun, 25 Jan 2026 04:53:20 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Vulnerability management and Open Source: FOSDEM BoF

Hi,

On Fri, Jan 23, 2026 at 01:51:29PM +0000, Peter Gutmann wrote:
> In the meantime I think the cURL folks approach is worth a mention:
> 
> https://curl.se/.well-known/security.txt
> 
> (Third sentence).

Let's please be posting actual content in here, not only links (but
links as well).  Peter is referring to:

# We will ban you and ridicule you in public if you waste our time on crap
# reports.

The full content from the URL above:

---
#***************************************************************************
#                                  _   _ ____  _
#  Project                     ___| | | |  _ \| |
#                             / __| | | | |_) | |
#                            | (__| |_| |  _ <| |___
#                             \___|\___/|_| \_\_____|
#
# The curl open source project accepts security reports for problems found in
# products made by the curl project.
#
# We offer NO (zero) rewards or other kinds of compensation for reported
# problems, but we offer gratitude and acknowledgments clearly stated in
# documentation around confirmed issues.
#
# We will ban you and ridicule you in public if you waste our time on crap
# reports.

Contact: mailto:security@...l.se
Contact: https://github.com/curl/curl/security/advisories

Policy: https://curl.se/dev/vuln-disclosure.html

Preferred-Languages: en

Acknowledgments: https://curl.se/docs/security.html

Expires: 2026-10-25T00:00:00Z

Canonical: https://curl.se/.well-known/security.txt
---

Alexander

P.S. While our list content guidelines ask not to post conference CFPs,
I felt this thread was more focused on this community and sufficiently
different from a CFP to let it through.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.