--- title: What the bliss taught us | daily.dev description: Daniel Stenberg, curl's lead maintainer, reflects on the outcome of curl's 'summer of bliss' — a deliberate month-long pause from accepting vulnerability... canonical: https://daily.dev/posts/what-the-bliss-taught-us-0dnr2bqis twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What the bliss taught us | daily.dev og:description: Daniel Stenberg, curl's lead maintainer, reflects on the outcome of curl's 'summer of bliss' — a deliberate month-long pause from accepting vulnerability... og:url: https://daily.dev/posts/what-the-bliss-taught-us-0dnr2bqis og:image: https://api.daily.dev/og/posts/0DNr2BQis.png og:image:alt: What the bliss taught us og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What the bliss taught us **[daniel.haxx.se](https://daily.dev/sources/danielhaxxse)** · 6 min read · 6 upvotes · 0 comments ## Summary Daniel Stenberg, curl's lead maintainer, reflects on the outcome of curl's 'summer of bliss' — a deliberate month-long pause from accepting vulnerability reports in July 2026. The experiment was a resounding success: maintainers felt immediate relief and renewed motivation, were able to tackle long-neglected features and pull requests, and no security emergencies arose. Commercial users were unaffected, the broader open source community was supportive, and several other projects followed suit. The main remaining concern is a potential flood of queued vulnerability reports now that the pause has ended. Stenberg plans to repeat the initiative and will post a follow-up in a month or two. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What happens if a CVE Numbering Authority like curl stops responding to vulnerability reports for a month? CNA rules require critical vulnerabilities to receive a response within 72 hours, but curl's maintainers decided the risk was minimal enough to pause reporting for all of July anyway, with a fallback plan to make emergency CVE assignments if truly needed. In practice, zero CVE assignments were required during the pause, and only one vulnerability report reached a maintainer's private email, which was simply ignored. _daily.dev surfaces how other maintainers balance CNA obligations against burnout when weighing a similar pause._ ### Did curl lose paying support customers by pausing vulnerability handling for a month? No, curl's maintainers kept supporting existing paying customers throughout the pause and reported no negative impact on them. They also saw no surge of new customers signing up out of worry, concluding that commercial curl users were not concerned by the temporary halt in public vulnerability report intake. _daily.dev helps engineering leads track how vendors like curl handle security support commitments._ ## Similar posts on daily.dev - [Stenberg: curl summer of bliss](https://daily.dev/posts/stenberg-curl-summer-of-bliss-lng7olbrg) · LWN.net · 0 upvotes · 0 comments - [High-Quality Chaos](https://daily.dev/posts/high-quality-chaos-gkbh5roqh) · daniel.haxx.se · 3 upvotes · 0 comments - [Stenberg: The pressure](https://daily.dev/posts/stenberg-the-pressure-k8p9szxyv) · LWN.net · 1 upvotes · 0 comments - [The pressure](https://daily.dev/posts/the-pressure-vvfgkr2pw) · daniel.haxx.se · 23 upvotes · 4 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#curl](https://daily.dev/tags/curl) [View this post on daily.dev](https://daily.dev/posts/what-the-bliss-taught-us-0dnr2bqis) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What the bliss taught us","url":"https://daily.dev/posts/what-the-bliss-taught-us-0dnr2bqis","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-the-bliss-taught-us-0dnr2bqis"},"datePublished":"2026-08-03T06:45:29.457Z","dateModified":"2026-09-14T07:15:50.127Z","description":"Daniel Stenberg, curl's lead maintainer, reflects on the outcome of curl's 'summer of bliss' — a deliberate month-long pause from accepting vulnerability...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a429270421096d2af39b811809b14b28?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a429270421096d2af39b811809b14b28?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"daniel.haxx.se","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"daniel.haxx.se","logo":"https://media.daily.dev/image/upload/s--us7Mqjk6--/f_auto/v1714798819/logos/danielhaxxse","url":"https://daily.dev/sources/danielhaxxse"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-the-bliss-taught-us-0dnr2bqis","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":6},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,curl","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"daniel.haxx.se","item":"https://daily.dev/sources/danielhaxxse"},{"@type":"ListItem","position":3,"name":"What the bliss taught us"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-the-bliss-taught-us-0dnr2bqis#faq","mainEntity":[{"@type":"Question","name":"What happens if a CVE Numbering Authority like curl stops responding to vulnerability reports for a month?","acceptedAnswer":{"@type":"Answer","text":"CNA rules require critical vulnerabilities to receive a response within 72 hours, but curl's maintainers decided the risk was minimal enough to pause reporting for all of July anyway, with a fallback plan to make emergency CVE assignments if truly needed. In practice, zero CVE assignments were required during the pause, and only one vulnerability report reached a maintainer's private email, which was simply ignored. daily.dev surfaces how other maintainers balance CNA obligations against burnout when weighing a similar pause."}},{"@type":"Question","name":"Did curl lose paying support customers by pausing vulnerability handling for a month?","acceptedAnswer":{"@type":"Answer","text":"No, curl's maintainers kept supporting existing paying customers throughout the pause and reported no negative impact on them. They also saw no surge of new customers signing up out of worry, concluding that commercial curl users were not concerned by the temporary halt in public vulnerability report intake. daily.dev helps engineering leads track how vendors like curl handle security support commitments."}}]} ```