Why is cURL specifically receiving so many slop contributions? Or is this a recent phenomenon for every open-source project, and cURL are the ones most spoken of? First time commenting on HN!
But from I hear it affects other projects too. It affected curl more because with the bug bounty they actually need to invest work and look at those.
[1] https://daniel.haxx.se/blog/2024/01/02/the-i-in-llm-stands-f...
[2] https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-s...
It is large, very popular (hence impact) and written in C. It supports many many many protocols with all of their real-world implementation quirks. Obscure or mainstream. And always handling user-controlled data.
If your motivation is a cool CVE for your CV, you'd pick such a project as the target of your efforts.
That’s a bad combination with LLMs which are almost perfect for letting the user think they’re being more productive than they actually are because the output sounds authoritative. You don’t have to be acting in bad faith to submit a slop report, just being inexperienced and over-confident will work if you don’t have enough experience in the area to reason about the security of the entire system.