Daniel Stenberg Named the Cost Before Asking for Help

Policy announcements tend to lead with benefits and leave the costs for someone else to find. On October 20, Daniel Stenberg put the cost in the announcement. Curl would now discuss minor security flaws in public before formally disclosing them, and this, he wrote, gives attackers "a slightly longer window of opportunity to exploit weaknesses." The people exposed during that window are curl's users.

Stenberg has led curl since its first release under that name in 1998. It is a small program that fetches data from web addresses and runs inside phones, cars, servers and the scripts that build other software. The project guesses thirty billion installations and admits nobody knows the real number. He works on it full time, paid through wolfSSL support contracts, with volunteers and other contributors alongside.

His public record since 2024 reads like someone adjusting the intake of a queue. The first trouble was AI-written false reports that sounded plausible, which made them slower to disprove than the sloppy kind. In January 2026 he ended the bug bounty, which had paid cash for confirmed flaws. By spring the fabrications had largely stopped. What replaced them was harder to turn away: better reports, more often describing real flaws, nearly all AI-assisted, arriving at about twice the 2025 rate. By May that meant more than one a day, and that summer he closed the inbox for a month to rest.

The tools made finding and writing up a flaw much cheaper, and did nothing comparable for checking one. Someone still has to establish whether the flaw is real, how serious it is, which versions carry it and whether the proposed fix is correct. That work, Stenberg says, "does not shrink." Our essay on PHP's memory bug located the scarcity in repair. At curl it appears one step earlier, at verification.

So the October policy is an attempt to recruit more checkers. Since October 26, reports rated low or medium go on curl's public GitHub issue list, while high and critical ones stay private. His hope is that "we might share the burden among more people easier," an expectation no one has measured yet. The bounty had paid outsiders to find flaws; this asks them to check flaws for free.

The cost he named is smaller than it first sounds. Fixes for minor flaws already went public as ordinary, unlabeled code changes, with the formal advisory following at the next release, every eight weeks. What becomes public now is the report itself and the argument about how severe it is. That tier is most of curl's history: of 239 published flaws, 196 were rated low or medium.

A second exposure, one the announcement doesn't price, follows from the order of events. A report now becomes public first, and its severity gets settled afterward, in threads where anyone may comment, attackers included. Reporters who are unsure can still go private first. But the policy doesn't say what happens when a flaw filed publicly as "low" turns out to be high, what success would look like, or when anyone will look again.

Two observations would start to tell us something: whether outsiders do real verification work in those threads, and whether any public case gets upgraded. Ten days in, the public pages examined so far are two draft advisories, kept in a separate repository from the severity threads and possibly covering flaws reported before the change. They show work from Stenberg and an automated review tool, and little else, which is too small a sample to read either way.

Stenberg put the cost in writing before anyone paid it, and that gives curl's users a standard to hold him to. Whether the benefit appears will be visible in those same public threads, to anyone willing to count.