Comment by graemep
4 days ago
Curl seems to becoming one of the favourite things to demo AI finding vulns.
Curl is going to end up incredibly secure.
4 days ago
Curl seems to becoming one of the favourite things to demo AI finding vulns.
Curl is going to end up incredibly secure.
Curl has a well earned reputation for high quality code. If you find something there it means you are good. There is a lot of software where finding a vulnerability mostly means you bothered to look and are not completely stupid. Nobody is going to be impressed if you find an issue with something that everybody already knows is poorly coded.
Its vulnerability overview page[0] also helpfully lists which were caused by the use of C. The fact that even an extremely-high-quality codebase like Curl is still encountering things like use-after-free issues is pretty damning for the people clamoring that it is perfectly possible for skilled programmers to write safe C.
If even Daniel Stenberg can't consistently write safe C code, I think we can assume that nobody can. Either you switch to a memory-safe language like Rust, or you adopt a high-cost runtime checker like Fil-C, or you'll have to live with a never-ending series of memory safety vulnerabilities.
[0]: https://curl.se/docs/security.html
I don't know, that just seems like a category error that breaks apart when you get closer to any individual project. Use-after-free is still possible in Rust with unsafe. Assuming nobody _can_ write memory safe C is a good assumption for things like security modelling, regardless of how unlikely those issues actually come up.
Securing code you/your org did not write and programming for yourself/your org are just fundamentally different jobs.
2 replies →
Where is your extreme assessment coming from?
3 replies →
> Curl has a well earned reputation for high quality code.
SQLite also has a very good reputation. I vaguely recall hearing about one SQLite vulnerability discovered via AI, but I thought it turned out to be a nothingburger. A quick search turned up CVE-2025-6965[0,1], published on 2025-07-15, which affects SQLite < 3.50.2 (versions published before 2025-05-29[2]).
I'm not much of a security nerd, but my naive reading of this implies that it was already known and fixed as of the time of the CVE; in other words, the AI discovery didn't seem particularly helpful (though one could argue that it did successfully discover a CVE).
Has AI found many/any other vulnerabilities in SQLite?
[0] https://cybersecuritynews.com/sqlite-0-day-vulnerability/
[1] https://nvd.nist.gov/vuln/detail/cve-2025-6965
[2] https://sqlite.org/releaselog/3_50_2.html
Hard to say what AI has been used in SQLite unless someone is talking. My impression is the maintainer doesn't talk about this type of thing much, but maybe I'm wrong.
Tailscale worked with them on an issue they found, not a vulnerability:
https://tailscale.com/blog/sqlite-wal-reset-bug
Thank goodness because curl is a load bearing structure to the backend of the internet.
Anyone care to guesstimate how much effort there would be in creating an actually-secure curl and openssl? Using something like Common Lisp or Lean, instead of C.