Fedora considers curl-minimal [LWN.net]

Fedora considers curl-minimal

Posted Mar 10, 2022 9:01 UTC (Thu) by rwmj (subscriber, #5474)
In reply to: Fedora considers curl-minimal by SLi
Parent article: Fedora considers curl-minimal

If we are really serious about attack surface we should audit Fedora programs that use libcurl and make sure they are using CURLOPT_PROTOCOLS (https://curl.se/libcurl/c/CURLOPT_PROTOCOLS.html), because that is the only way to ensure that unwanted/exploitable curl modules are not invoked by redirects.

Fedora considers curl-minimal

Posted Mar 14, 2022 14:43 UTC (Mon) by Paf (subscriber, #91811) [Link] (1 responses)

We could do that if we’re “serious about security”, or, being equally serious about security, we could do this. And then if someone ever installs something that isn’t packaged by Fedora, they would *also* benefit from this change if it doesn’t use that option correctly.

Yes, if we handle our footguns *correctly*, there’s no issue. There’s ongoing overhead and risk from their existence, but obviously, handled correctly, they’re fine. If they’re completely unnecessary - like most, though not all, of these protocols clearly are - we could also *stop shipping them by default*.

Fedora considers curl-minimal

Posted Mar 14, 2022 14:55 UTC (Mon) by rwmj (subscriber, #5474) [Link]

More likely if someone installs something not in Fedora and they have curl-minimal they'll be wondering why the package they just installed doesn't work.