{"id":30829,"date":"2026-10-22T07:46:34","date_gmt":"2026-10-22T05:46:34","guid":{"rendered":"https:\/\/daniel.haxx.se\/blog\/?p=30829"},"modified":"2026-10-22T08:44:59","modified_gmt":"2026-10-22T06:44:59","slug":"ignore-the-slop","status":"publish","type":"post","link":"https:\/\/daniel.haxx.se\/blog\/2026\/10\/22\/ignore-the-slop\/","title":{"rendered":"“ignore the slop”"},"content":{"rendered":"\n

Lots of people who are against the use of AI for all its ethical and inherent issues tell me this. Just ignore it<\/em>. Don’t let big AI<\/em> control us.<\/p>\n\n\n\n

The “slop” they refer to is anything created that involved an AI, and in our case (the curl project<\/a>) it is in particular vulnerability reports.<\/p>\n\n\n\n

“Ignoring the slop” cannot be done<\/em> and it doesn’t help. Vulnerability reports created with the help of AIs point out actual problems, and sometimes vulnerabilities. Ignoring real vulnerabilities because they were found by AI does not make users safe and secure. It makes them vulnerable. We don’t want that<\/em>.<\/p>\n\n\n\n

I personally don’t refer to this as AI slop<\/em> because the reports are typically accurate and correct, even if much too wordy. I think “slop” implies that it is wrong, misleading or otherwise bad content.<\/p>\n\n\n\n

One can certainly object to the use of AI, but when we get real vulnerabilities reported and proven, we cannot in good faith pretend they don’t exist just because we think the tech involved in digging them up is questionable. That would be a disservice to, or even betrayal of, our users.<\/p>\n\n\n\n

We make curl secure for our users.<\/p>\n\n\n\n

Obligations<\/h2>\n\n\n\n

An Open Source project typically gives no guarantees at all, so there are no legal<\/em> requirements that force us to fix flaws.<\/p>\n\n\n\n

We are however a project with high goals of quality and stability and we would jeopardize our name and track record if we now would stop delivering on that. Also, a few of us involved in the project also sell curl related support and services, where at least part of that means providing secure<\/em> curl releases, so we still have this contractual obligation<\/em> to a set of customers. And they wouldn’t be customers in the fist place if the Open Source project didn’t already have the proven quality track record.<\/p>\n\n\n\n

So no, we really cannot ignore vulnerability reports.<\/p>\n\n\n\n

The slop is gone<\/h2>\n\n\n\n

A sizeable portion of users seem to still believe we still suffer from a lot of made up and hallucinated reports by these AIs. We really don’t.<\/p>\n\n\n\n

Almost all the stupidity and lies we saw in the vulnerability reports made by AIs in the past have ceased. Since spring 2026 the slop reports are practically gone. Our current challenge is much harder: high volume, high quality<\/a>.<\/p>\n\n\n\n

AI talks too much<\/h2>\n\n\n\n

They always use too many words. Every report is now hundreds of lines and the explanations are convoluted and detailed (and often repeat themselves multiple times).<\/p>\n\n\n\n

In a good report, the human writes a first paragraph explaining the problem briefly<\/em> and then they submit the full report. It’s annoying when the reporter surrender everything to the AI, including the communication part.<\/p>\n\n\n\n

The AIs are also still bad at figuring out exactly where the line is between a bug and a vulnerability, and if it is a vulnerability, what severity it is. This is not a surprise though, as this is also the case for human reporters.<\/p>\n\n\n\n

A good trend is that they often produce good reproducers or proofs of concept helping to trigger and prove the problem\/vulnerability. That was a really complicated part of the reporters’ work back in the day, now it’s just a prompt or two.<\/p>\n\n\n\n

Everything is with AI now<\/h2>\n\n\n\n

These days, like within the last few months, we have received hundreds of vulnerability reports submitted to curl and every single one had AI involved to some extent<\/em>.<\/p>\n\n\n\n

It is generally easy to tell on the language and the length and details of the report.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

Lots of people who are against the use of AI for all its ethical and inherent issues tell me this. Just ignore it. Don’t let big AI control us. The “slop” they refer to is anything created that involved an AI, and in our case (the curl project) it is in particular vulnerability reports. “Ignoring … Continue reading “ignore the slop”<\/span> →<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":25504,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[494,33,428],"class_list":["post-30829","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-curl","tag-ai","tag-curl-and-libcurl","tag-security"],"_links":{"self":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/30829","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/comments?post=30829"}],"version-history":[{"count":28,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/30829\/revisions"}],"predecessor-version":[{"id":30885,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/posts\/30829\/revisions\/30885"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media\/25504"}],"wp:attachment":[{"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/media?parent=30829"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/categories?post=30829"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/daniel.haxx.se\/blog\/wp-json\/wp\/v2\/tags?post=30829"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}