--- title: "Daniel Stenberg Named the Cost Before Asking for Help" canonical: "https://current.tinyfish.ai/issue/54/practitioners-corner/article/61484/daniel-stenberg-named-the-cost-before-asking-for" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" format: "Builder Profile" author: "Sevda Polat" author_url: "https://current.tinyfish.ai/team/200" issue: 54 section: "practitioners-corner" section_name: "Practitioner's Corner" published: 2026-11-05 description: "Curl's maintainer, swamped by AI-assisted reports, opens minor flaws to public verification, weighing a longer window for attackers against the unmeasured hope of shared checking." word_count: 786 source_links: 8 --- # Daniel Stenberg Named the Cost Before Asking for Help *By [Sevda Polat]()* *November 5, 2026* [Read on the website]() Policy announcements tend to lead with benefits and leave the costs for someone else to find. On October 20, Daniel Stenberg put the cost in the announcement. Curl would now discuss minor security flaws in public before formally disclosing them, and this, he wrote, gives attackers "[a slightly longer window of opportunity](https://daniel.haxx.se/blog/2026/10/20/do-minor-curl-vulnerabilities-in-the-open/) to exploit weaknesses." The people exposed during that window are curl's users. Stenberg has led curl since its first release under that name in 1998. It is a small program that fetches data from web addresses and runs inside phones, cars, servers and the scripts that build other software. The project guesses thirty billion installations and admits nobody knows the real number. He works on it full time, paid through [wolfSSL support contracts](https://daniel.haxx.se/job.html), with volunteers and other contributors alongside. His public record since 2024 reads like someone adjusting the intake of a queue. The first trouble was AI-written false reports that sounded plausible, which made them slower to disprove than the sloppy kind. In January 2026 he [ended the bug bounty](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/), which had paid cash for confirmed flaws. By spring the fabrications had largely stopped. What replaced them was harder to turn away: better reports, more often describing real flaws, nearly all AI-assisted, arriving at about twice the 2025 rate. By May that meant [more than one a day](https://daniel.haxx.se/blog/2026/05/26/the-pressure/), and that summer he closed the inbox for a month to rest. The tools made finding and writing up a flaw much cheaper, and did nothing comparable for checking one. Someone still has to establish whether the flaw is real, how serious it is, which versions carry it and whether the proposed fix is correct. That work, Stenberg says, "does not shrink." Our [essay on PHP's memory bug](https://current.tinyfish.ai/issue/53/practitioners-corner/article/57552) located the scarcity in repair. At curl it appears one step earlier, at verification. So the October policy is an attempt to recruit more checkers. Since October 26, reports rated low or medium go on curl's public GitHub issue list, while high and critical ones stay private. His hope is that "we might share the burden among more people easier," an expectation no one has measured yet. The bounty had paid outsiders to find flaws; this asks them to check flaws for free. The cost he named is smaller than it first sounds. Fixes for minor flaws already went public as ordinary, unlabeled code changes, with the formal advisory following at the next release, every eight weeks. What becomes public now is the report itself and the argument about how severe it is. That tier is most of curl's history: of 239 published flaws, 196 were rated low or medium. A second exposure, one the announcement doesn't price, follows from the order of events. A report now becomes public first, and its severity gets settled afterward, in threads where [anyone may comment](https://daniel.haxx.se/blog/2026/11/03/scrutinize-our-assessments/), attackers included. Reporters who are unsure can still go private first. But the policy doesn't say what happens when a flaw filed publicly as "low" turns out to be high, what success would look like, or when anyone will look again. Two observations would start to tell us something: whether outsiders do real verification work in those threads, and whether any public case gets upgraded. Ten days in, the public pages examined so far are two draft advisories, kept in a separate repository from the severity threads and possibly covering flaws reported before the change. They show work from Stenberg and an automated review tool, and little else, which is too small a sample to read either way. Stenberg put the cost in writing before anyone paid it, and that gives curl's users a standard to hold him to. Whether the benefit appears will be visible in those same public threads, to anyone willing to count. ## Things to follow up on... - **Upgraded public cases:** curl's [Vulnerability Disclosure Policy](https://curl.se/dev/vuln-disclosure.html) still specifies no redaction or transfer procedure for a report filed publicly as low that later proves high or critical, so the first such case will show what the project actually does. - **Outsiders in assessment threads:** In his November 3 post [Scrutinize our assessments](https://daniel.haxx.se/blog/2026/11/03/scrutinize-our-assessments/), Stenberg explains the `vuln:ASSESS` label and invites anyone to challenge severity calls, and the tagged issues will show whether non-maintainers take him up on it. - **The December 9 release:** Eight advisory drafts opened October 26 are labeled for publication on December 9, and the [October 23 mailing-list thread](https://curl.se/mail/lib-2026-10/0014.html) explains why the team kept that date with at least thirteen CVE fixes waiting to ship. - **What January promised:** The [bounty-closure post](https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/) contains a "We never say never" passage promising further changes if those measures failed to help maintainers, a reconsideration clause the October policy does not include. ## More - [Practitioner's Corner — Issue 54]() - [Issue 54]() - [Publication guide]()