Paraphrasing: "The world's top security researches and AI labs are pouring all their VC money into finding as many security issues in curl as possible". At the same time, we know that curl is run by volunteers that needs to handle all of this. I'm not saying that we shouldn't do security review of open source libraries, just saying that this situation puts a lot of pressure on the maintainers.

The second unnerving thing is that many of the listed vulnerabilites target embedded libcurl; a library with a much slower update cycle. I'm guessing that many of the listed bugs are still in active use, inside the thousands of applications that use curl internally. Another tricky situation.

Both of these stand in contrast to the posts "braggy" style of "we found the most vulnerabilities of all!!!".

Comments URL: https://news.ycombinator.com/item?id=48621930

Points: 1

# Comments: 0

Numbers are from 2024, but smoking was at 5.4%, and snus at 15.7%.

And how would you even use this model, given that there are no explanations that help you trust where the prediction comes from…

Comments URL: https://news.ycombinator.com/item?id=47386011

Points: 2

# Comments: 1

- Bleach-like sanitization feature built in and enabled by default

- Transforms API for simple HTML mutations

- Rewamped docs

- Playground powered by PyOdide (thanks for the idea simomw!)

Comments URL: https://news.ycombinator.com/item?id=46698911

Points: 1

# Comments: 1

Some tags do require ending tags, others do not. Personally I find it hard to remember which ones, so I just close things out of caution. That way you’re always spec-correct.

Comments URL: https://news.ycombinator.com/item?id=46439800

Points: 4

# Comments: 1

- The quoted test comes from justhtml-tests, a custom test suite added to make sure all parts of the algorithm are tested. It is not part of html5lib-tests.

- html5lib-tests does not support control characters in tests, which is why some of the tests in justhtml-tests exist in the first place. In my test suite I have added that ability to our test runner to make sure we handle control character correctly.

- In the INCOMING HTML block above, we are not printing control characters, they get filtered away in the terminal

- Both the treebuilder and the tokenizer are outputting errors for the found control character. None of them are in the right location (at flush instead of where found), and they are also duplicate.

- This being my own test suite, I haven't specified the correct errors. I should. expected-doctype-but-got-start-tag is reasonable in this case.

All of the above bugs are now fixed, and the test suite is in a better shape. Thanks again!

That said, the example you are pulling our out does not match that either. I'll make sure to fix this bug and other like it! https://github.com/EmilStenstrom/justhtml/issues/20