If one person can spend 2 days fighting to prevent 1h of useless work for all of the people running curl, that person has saved the software industry millions of dollars worth of developer time. So it's very much worth it, and I, for one, am very grateful for it.

And make no mistake - havin every user of curl spend time to read this CVE and decide that it doesn't affect that would be 10000% wasted effort for each and every one of them.

> If one person can spend 2 days fighting to prevent 1h of useless work for all of the people running curl, that person has saved the software industry millions of dollars worth of developer time.

Working in a large company, that used to be one of the ways I'd measure my annual business impact. "Look, through my reviews I reduced the work of 70 tasks that were going to go out to most engineering teams for an average reduction from 2 hours to 30 minutes. With 300 teams in scope, that saved us approximately of 31,500 hours of headcount, the equivalent of 15 full time employees"

One thing that has proven remarkably effective is making SVPs sign off on tasks that impact more than a certain number of teams, and/or take more than a certain length of time. Yet to see a single one argue the point when they see the task being asked.