It's October 11 and was already October 11 for a lot of the world 13 hours ago (as of writing) when this patch was posted. Nothing was early, nothing was leaked.
EDIT: Why the downvotes? People don't like timezones or something?
https://github.com/curl/curl/discussions/12026 (2023-10-04T06:17:44Z)
Prior to this change the state machine attempted to change the remote resolve to a local resolve if the hostname was longer than 255 characters. Unfortunately that did not work as intended and caused a security issue."
Engineering is based on trade offs. In this specific case, the answer is no, unfortunately. This does of course not absolve new or smaller projects of this critique, but let's give curl a pass on this one.
> and there is no compiler support for some of the platforms libcurl supports
I feel like there are no serious platforms that don't have at least a C++ compiler for it. Or am I wrong there?
So you can only be attacked if you're using a socks5 proxy, and even then you can only be attacked by your own proxy? Which rules out things like torsocks where you're running the proxy too.
Does this really merit all of last week's antics?
