More The Secure Disclosure episodes
Published 16 Mar 2026
Duration: 00:33:36
The Curl project's evolution from a 1996 currency tool to a prominent open-source library highlights community-driven growth, open-source maintenance challenges, AI's impact on security reporting, sustainability issues, and tensions between innovation and unresolved technical risks.
Daniel Stenberg, creator of curl, explains how a small open source tool became core internet infrastructure. The conversation covers curls origin, mai...
The podcast explores the origins and evolution of the open-source tool Curl, which began as a personal project in 1996 by Daniel Stenberg to fetch currency rates for his IRC bot. Initially based on a minimal tool called HTTPGAT, it gradually expanded into a widely-used utility for handling URLs and HTTP requests. The development process was organic, driven by community contributions, user feedback, and iterative improvements over two decades. Despite its scalenow used in 30 billion applicationsthe project retained its core ethos of simplicity and collaborative refinement. However, the discussion also highlights challenges faced by open-source maintainers, including mental health strains from managing high-impact projects and navigating toxic interactions within the community.
A significant portion of the content revolves around modern challenges in open-source security, particularly the surge in AI-generated vulnerability reports. These reports, often detailed but invalid, overwhelm security teams, consuming time and resources while masking genuine issues. The decision to discontinue the Curl bug bounty program underscores tensions between external funding models and the need for quality control, as platforms like HackerOne struggle with low-validity submissions. Proposed solutionssuch as AI-based filtering, reputation systems, and credential requirementsface trade-offs between reducing spam and excluding new contributors. The dialogue also touches on the broader implications of AIs role in coding and security, noting both its productivity benefits and risks of deepening confusion or undermining foundational knowledge.
The narrative culminates in reflections on the evolving nature of open-source development and its sustainability. Maintainers grapple with balancing inclusivity and quality, ensuring newer contributors are not unfairly sidelined by rigid systems. Simultaneously, the rise of AI in technical fields raises philosophical questions about human adaptability, the erosion of deep technical understanding, and the resilience of the engineering community in confronting increasingly complex systems. The podcast ultimately portrays open source as a dynamic, human-driven endeavor shaped by both technical innovation and the persistent challenges of collaboration, ethics, and unforeseen consequences.
17 Sept 2026 Practical AI Security & Adversarial Machine Learning with Dr Harriot Farlow
"Examines unique AI security risks, industry misconceptions, governance gaps, ethical concerns, and the urgent need for tailored solutions and global cooperation."
3 Sept 2026 Email Security in the Age of AI | Josh Kamdjou, Sublime Security CEO
"Email security faces growing threats from AI-driven phishing, prompt injection, and malicious calendar invites, outpacing traditional defenses; Sublime Security's real-time, agentic approach offers a solution, while cyber warfare increasingly exploits human cognitive vulnerabilities."
27 Aug 2026 Can We Actually Fix Software Supply Chain Security? 6 AppSec Leaders Debate
"Software security faces critical challenges due to prioritizing developer speed over safety, rising supply chain attacks on open-source packages, industry silos, and AI-driven threats, requiring urgent collaboration, education, and stronger security measures."
19 Aug 2026 Tearing Down Vendor Fluff: The Real State of AI Security | James Berthoty
"AI's rapid adoption in cybersecurity, driven by executive pressure and fear of obsolescence, contrasts with slower cloud security uptake, as vendors overpromise solutions while breaches persist; AI both enables attacks (like supply chain malware) and enhances defenses, reshaping security roles and workflows, with governance and real-world gaps (e.g., Hugging Face breach) remaining critical."
12 Aug 2026 GitGuardian CEO: How Exposed API Keys & AI Agents Cause Security Breaches - Eric Fourrier
"Exposed NASA Slack API key highlights credential leaks, with GitGuardian using AI to detect and prevent secrets in repositories and developer machines, while addressing evolving threats, AI risks, and proactive security practices."