> This would have been possible since the certificates were created in April 2025. ... CT-enforcing clients like Firefox, Chrome, Edge and Safari could not have been attacked.
Meanwhile, back in April 2025: "Is it possible to enable CT checks in curl?" "No." https://github.com/curl/curl/discussions/17078
> No. Nobody has added any such functionality (yet). Feel free to work on that.
If someone thinks a feature can be useful, especially in the era of agentic coding, instead of asking, do it.
No, the article listed some apps that were not vulnerable, and the first question to me is “so what is vulnerable?” And the answer is “every curl | sh installer on the internet since April 2025” (among assuredly many other less prolific apps).
No, it's entirely fair. There's absolutely no obligation to include the rest of it.
> If someone thinks a feature can be useful
Still unnecessary. Nobody is under any sort of obligation to contribute if they point out limitations of something.
> especially in the era of agentic coding
Agentic coding requires effort, unless you're advocating for slop.