Samuel Henrique

debian developer, rust, python, security and stuff. he/him

[ksa 🏴‍☠️ @kosa12m]

You're not supposed to use 3-in-1 shower gel, it violates the Unix philosophy

[Samuel Henrique @samueloph_]

@FFmpeg @PhantomStnd Pro-tip: if you become a CNA, you get to decide what becomes a CVE. I know it does take some work, but you'll have control.

[Samuel Henrique @samueloph_]

"curl maintainers BoF - DebConf 25" https://t.co/hhpcW64eWg

curl maintainers meet-up to discuss HTTP3, GnuTLS, wcurl and other things.

[Samuel Henrique @samueloph_]

I've published the recordings of two of our #curl activities from Debian 's #debconf25

"wcurl - one year later - DebConf 25" https://t.co/PzokFx3F2F

Short presentation about what happened since wcurl’s creation in May 17 2024 and what will happen next.

[Samuel Henrique @samueloph_]

I've just published a blog post listing exciting new features in Debian 13, focusing on practical changes that can improve your workflow for better performance and productivity.

https://t.co/aMmudkBrGh

[Samuel Henrique @samueloph_]

@odyssjii @HSVSphere no, it goes to 0 because curl vulnerabilities are detected/fixed years after they got introduced, on average.

[Samuel Henrique @samueloph_]

@tsoding Lovely, thank you!

[Samuel Henrique @samueloph_]

Debian should publish a micronews article about this soon.

[Samuel Henrique @samueloph_]

-- CRITICAL CVE UPDATE FOR DEBIAN--

Fixes for a critical rsync vulnerability (CVE-2024-12084) have been released for Stable/Bookworm, Testing and Unstable. Oldstable/Bullseye is not affected.

[Samuel Henrique @samueloph_]

Fixes for other lower severity CVEs have also been released in the same update and can all be tracked at https://t.co/gSHFCxhpuU. The fixed Stable version is 3.2.7-1+deb12u1 and the fixed Testing/Unstable version is 3.3.0+ds1-3

[Samuel Henrique @samueloph_]

Just released a new version of wcurl: https://t.co/jjZpzjpYcZ

[Samuel Henrique @samueloph_]

The LWN article about one of my DebConf talks was published today:
Debian's "secret" sauce
https://t.co/LxajcXX73W

[Samuel Henrique @samueloph_]

@the_codedog Put this in your bashrc
# Automatically run "ls" after "cd"
[[ $- == *i* ]] && function cd {
builtin cd "$@" && ls -Ftr1
}

[Samuel Henrique @samueloph_]

@lauriewired @bagder nice idea for a curl graph

[Samuel Henrique @samueloph_]

@evilsocket @JeffreyShran Sorry, I didn't mean to sound like I doubt you, just pointing it out as this might be useful for you when discussing the vector

[Samuel Henrique @samueloph_]

@evilsocket @JeffreyShran That CVSS vector doesn't look right, I can't say it's wrong because I don't know the details but it looks like the person who scored it doesn't believe it's an RCE.

[Samuel Henrique @samueloph_]

@evilsocket @Halxor149 That's a lot of work indeed, thanks

[Samuel Henrique @samueloph_]

@evilsocket @Halxor149 Just wondering, have you tried to reach out to Debian's security team as well? They might be helpful too: [email protected]