More The Secure Disclosure episodes
Published 16 Mar 2026
Duration: 00:33:36
The Curl project's evolution from a 1996 currency tool to a prominent open-source library highlights community-driven growth, open-source maintenance challenges, AI's impact on security reporting, sustainability issues, and tensions between innovation and unresolved technical risks.
Daniel Stenberg, creator of curl, explains how a small open source tool became core internet infrastructure. The conversation covers curls origin, mai...
The podcast explores the origins and evolution of the open-source tool Curl, which began as a personal project in 1996 by Daniel Stenberg to fetch currency rates for his IRC bot. Initially based on a minimal tool called HTTPGAT, it gradually expanded into a widely-used utility for handling URLs and HTTP requests. The development process was organic, driven by community contributions, user feedback, and iterative improvements over two decades. Despite its scalenow used in 30 billion applicationsthe project retained its core ethos of simplicity and collaborative refinement. However, the discussion also highlights challenges faced by open-source maintainers, including mental health strains from managing high-impact projects and navigating toxic interactions within the community.
A significant portion of the content revolves around modern challenges in open-source security, particularly the surge in AI-generated vulnerability reports. These reports, often detailed but invalid, overwhelm security teams, consuming time and resources while masking genuine issues. The decision to discontinue the Curl bug bounty program underscores tensions between external funding models and the need for quality control, as platforms like HackerOne struggle with low-validity submissions. Proposed solutionssuch as AI-based filtering, reputation systems, and credential requirementsface trade-offs between reducing spam and excluding new contributors. The dialogue also touches on the broader implications of AIs role in coding and security, noting both its productivity benefits and risks of deepening confusion or undermining foundational knowledge.
The narrative culminates in reflections on the evolving nature of open-source development and its sustainability. Maintainers grapple with balancing inclusivity and quality, ensuring newer contributors are not unfairly sidelined by rigid systems. Simultaneously, the rise of AI in technical fields raises philosophical questions about human adaptability, the erosion of deep technical understanding, and the resilience of the engineering community in confronting increasingly complex systems. The podcast ultimately portrays open source as a dynamic, human-driven endeavor shaped by both technical innovation and the persistent challenges of collaboration, ethics, and unforeseen consequences.
12 Aug 2026 GitGuardian CEO: How Exposed API Keys & AI Agents Cause Security Breaches - Eric Fourrier
"Exposed NASA Slack API key highlights credential leaks, with GitGuardian using AI to detect and prevent secrets in repositories and developer machines, while addressing evolving threats, AI risks, and proactive security practices."
14 Jul 2026 How to Stop Supply Chain Attacks Without Destroying Developer Productivity
"Cybersecurity threats, especially supply chain attacks on developers and open-source packages, demand balanced mitigation strategies, AI-driven security challenges, and early integration of security in development, with collaboration and adaptability key to addressing evolving risks."
1 Jul 2026 Solving the Supply Chain Security & Malware Crisis w/John Amaral
Escalating software supply chain threats target open-source ecosystems through credential exploitation, AI-fueled malware, and upstream compromises, with challenges in dependency management and outdated libraries driving AI-driven remediation strategies like automated patching and version pinning, though human oversight remains critical for validating fixes.
25 Jun 2026 AI is an Amplifier: Why Bad Infrastructure Gets Wronger Faster w/ Abdel SGHIOUAR
AI agents in cloud-native ecosystems like Kubernetes offer automation and monitoring benefits but face skepticism, security risks, trust issues from hallucinations, and require safeguards and human oversight to balance innovation with control and ensure reliability.
16 Jun 2026 Your Microphone Became a Keylogger w/ David vonThenen
Machine learning analyzes keystroke acoustic signatures to infer typed characters over remote platforms, highlighting high accuracy with known keyboards, privacy risks from surveillance, and challenges in noise and variability, while proposing defenses and noting AI's dual-use implications.