daniel:// stenberg://

Internet protocols geek at wolfSSL. I lead the curl project. I don't know anything.

Public Key

npub10ql4aps87kugc57xc63ng3z70ymkydgp8pqmcsxm03v7adaea99ss4j5x8

NIP-05 Address

bagder_at_mastodon.social@mostr.pub

Profile Code

nprofile1qqs8s067scrltwyv20rvdge5g308jdmzx5qnssdugrdhck0wk7u7jjcwvwp8u

Author Public Key

npub10ql4aps87kugc57xc63ng3z70ymkydgp8pqmcsxm03v7adaea99ss4j5x8

Show more details

Last Notes

2025-01-11 14:57:49

- reply

@nprofile…tslx never seen anyone use that with wget, see it all the time mentioning curl...

2025-01-11 14:56:08

'To #curl something': to use a non-browser tool to download a file or resource from the Internet

2024-12-23 08:46:55

Got a rewrite of the #curl CVE-2024-11053 security advisory submitted as a new issue on Hackerone this morning. Using parts of the same wording. That I wrote.
People.

2024-12-04 13:12:52

The current #curl source code (product code) is exactly 1.14 times War And Peace by word count.
https://files.mastodon.social/media_attachments/files/113/594/725/752/803/499/original/e12be50923185fff.png

2024-11-17 16:28:35

If there is *any* area that #curl is not best-in-class, we should put in more work and improve curl in that area. While at the same time keep up and polish it in all other aspects.

2024-11-06 08:41:50

strcpy can cause a buffer overflow
user finds strcpy in #curl code
user files a CRITICAL security report against #curl for using strcpy in source code. Proof? Well he did grep the code and shows that it does indeed use strcpy...
Never a dull moment.

2024-11-05 06:58:55

Waking up to a new day and running the video a few more times just for the giggles. It is just so amazing.
https://www.youtube.com/watch?v=atcqMWqB3hw

2024-10-30 23:49:34

#curl source code age, take 4
https://files.mastodon.social/media_attachments/files/113/399/047/871/022/211/original/ddbf7bf65e14b488.png

2024-10-25 06:29:01

Three years ago I blogged about #OpenSSL's decision to deliberately block #QUIC progress in the world: https://daniel.haxx.se/blog/2021/10/25/the-quic-api-openssl-will-not-provide/
Which is timely with the OpenSSL 3.4.0 release announced just days ago: that still does not offer a working (and performant) QUIC API. (yes, there is an attempt there but it's not production grade)
It's almost like the writing was on the wall already a long time ago.
https://files.mastodon.social/media_attachments/files/113/366/631/347/474/286/original/ff81cacc9597cd9f.jpg

2024-10-22 09:40:50

I work on #curl full-time
https://daniel.haxx.se/job.html
(probably even a little more than full-time but let's ignore that for now)

2024-10-16 06:43:25

It looks like 2024 might become a special year for #curl ...
https://files.mastodon.social/media_attachments/files/113/315/739/202/205/729/original/e15ea4f513f2c856.png

2024-10-03 09:12:24

Current #curl bug-bounty stats (since April 2019).
Reports: 475
Confirmed security issues: 73 (15%)
Identified bugs (but not security problems): 92 (19%)
Invalid: 310 (65%)

2024-09-26 09:14:47

#openssl 3 does not seem to perform very well against the competition, as Willy of #haproxy fame details here: https://github.com/haproxy/haproxy/issues/2454#issuecomment-2353243899

2024-09-24 21:35:33

1. Mozilla is removing their :// from the logo?
https://www.theverge.com/2024/9/24/24253028/mozilla-brand-update-tyrannosaurus-rex-logo
2. I learned that jetty (the open source webserver) has a :// in their logo these days. When did this happen?
https://files.mastodon.social/media_attachments/files/113/194/677/459/917/213/original/aacd4ba06a712e24.png

2024-09-20 21:02:08

Not replying when your whole body is itching with a strong desire to send something really sarcastic back. *that* is the restraint that builds character.
At least that's what I tell myself.

2024-09-18 06:27:54

- reply

321 authors have written at least 10 lines still present in production code
96 authors have written at least 100 lines
11 authors have written at least 1000 lines
3 authors have written at least 10,000 lines
(out of 173,172 current lines of code)

2024-09-18 06:12:46

#curl 8.10.1
https://daniel.haxx.se/blog/2024/09/18/curl-8-10-1/
https://files.mastodon.social/media_attachments/files/113/157/076/191/616/564/original/1cabe0c8ac84df42.jpg

2024-09-12 08:48:00

- reply

@npub1hjl…69rd it is indeed completely incomprehensible and you wonder what exactly the person expects me to do or reply

2024-09-12 07:58:50

"DDoS service using you"
My #inbox
https://bagder.github.io/emails/2024/2024-09-07.html

2024-09-11 05:45:16

#curl 8.10.0 is here. A larger update than in a while.
https://daniel.haxx.se/blog/2024/09/11/curl-8-10-0/
At 08:00 UTC the curl release presentation is live-streamed here: https://www.twitch.tv/curlhacker
https://files.mastodon.social/media_attachments/files/113/117/327/574/169/947/original/333b17b2943e3347.jpg

2024-09-08 21:42:43

- reply

@npub1cl5…nzfu 1. we are using hackerone. 2. closing one of these silly things takes like 3 seconds of my time. Not a bother.

2024-09-08 21:24:22

got another "security report" from someone who find a directory listing on the #curl site insisting it is an "information exposure" vulnerability
Even though the entire thing is also available in a public git repository.
Closed.

2024-09-07 14:54:55

I'm slowly working on a new #curl graph...
https://files.mastodon.social/media_attachments/files/113/096/843/022/067/349/original/102d966a04455275.png

2024-09-06 08:49:01

The first ever #curl version was called 4.0 and we shipped it 9667 days ago.
Time flies.

2024-09-04 21:31:31

I'm also good at "hot takes" on #linkedin 🤠
https://files.mastodon.social/media_attachments/files/113/081/415/017/386/398/original/e68c88347b96697c.png

2024-09-04 07:05:27

The current JPEG XL decoder in #Firefox apparently consists more than 100,000 lines of multi-threaded C++
For just decoding an image format.
Not sure what it says about the format, the implementation and the Internet at large.
https://github.com/mozilla/standards-positions/pull/1064

2024-09-03 14:27:24

We are now down to 4, I repeat FOUR, open issues for #curl.
https://github.com/curl/curl/issues

2024-09-03 09:01:49

- reply

followed up by this screenshot
https://files.mastodon.social/media_attachments/files/113/072/806/700/971/618/original/18700617f5a3d649.jpg

2024-09-03 09:00:13

- reply

AI slide for the talk (work in progress):
AI does not save us
AI fools researchers think they found problems
AI assisted reports takes longer to debunk
AI is an added burden for maintainers
https://files.mastodon.social/media_attachments/files/113/072/799/329/172/938/original/3c03cef9cfcaa2ea.jpg

2024-08-30 13:54:29

- reply

work in progress title slide
https://files.mastodon.social/media_attachments/files/113/051/308/342/761/655/original/e3f024b466e84b4e.jpg

2024-08-30 08:03:41

I'm particularly happy with the titles of my talk: "CVEMITRECVSSNVDCNAOSS WTF"
... which I will present on September 23 at https://nsss.se/
I figure with that title I can mostly just sit back and let it speak for itself.

2024-08-28 08:00:02

https://www.twitch.tv/curlhacker starts now

2024-08-28 07:11:40

Beware, there is an ongoing spambot attack in #GitHub issues in several projects were random people suggests "the fix" is to download a random file from mediafire.com. Like this:
https://files.mastodon.social/media_attachments/files/113/038/397/826/183/338/original/884255950cf279ee.png

2024-08-24 08:54:02

Received another security vulnerability report where someone found "sensitive information" in curl's test suite...

2024-08-17 09:30:02

A full clean rebuild of #curl on my machine takes about 3.5 seconds. If I make it a "unity" build, it can be done in 2.3 seconds.

2024-08-16 07:40:25

It is Friday after all
https://files.mastodon.social/media_attachments/files/112/970/564/858/553/770/original/27f1f3b8b626e4d0.png

2024-08-16 07:27:22

- reply

@npub1rml…xa6t caddy is a go program, go programs belong to the modern kind the kids do where everything is static. So caddy can be downloaded with just curl, no bash required... =)

2024-08-15 17:05:35

- reply

@npub16dw…kdp2 none of the ones prompting me like this has, no. It always seems to me like they're content with just asking...

2024-08-15 11:44:36

the most recent hackerone issue was filed because the user googled "[another project] bug bounty program", clicked the first link (to #curl's bug-bounty) and entered an issue about a completely different project...

2024-08-14 21:46:56

So the Department of Energy emailed me
https://daniel.haxx.se/blog/2024/08/14/so-the-department-of-energy-emailed-me/
https://files.mastodon.social/media_attachments/files/112/962/568/795/715/942/original/9b9b50adb94d900c.jpg

2024-08-14 08:49:26

slow TCP connect on Windows
Presumably you just have to be more patient on Windows.
https://daniel.haxx.se/blog/2024/08/14/slow-tcp-connect-on-windows/
https://files.mastodon.social/media_attachments/files/112/959/508/199/653/855/original/c21d2f9a7b9759dc.jpg

2024-08-14 06:18:40

- reply

@npub14x7…kj68 What is confusing about it?

2024-08-14 06:16:44

With the three new CNAs announced today, there are now 400 CNAs (CVE Numbering Authorities).

2024-08-12 16:36:52

Daniel Stenberg on #curl's Journey: From C64 Demos to Internet Transfers. (I was on Nerding out with Viktor the other day.)
https://youtu.be/bTb_Rf_qkq8?si=63AvIcr9dkyTlxK1

2024-08-12 07:50:30

In #curl 8.10.0, coming on September 11, 2024, we introduce support for -vv, -vvv and -vvvv
https://daniel.haxx.se/blog/2024/08/12/verbose-verboser-verbosest/
(thanks to @npub17qe…u62y)
https://files.mastodon.social/media_attachments/files/112/947/953/250/268/648/original/32bf07f75c853338.jpg

2024-08-11 21:03:18

- reply

@npub1f4u…6pwy I kinda feel it is not possible without frankensteining the language so much it is not really C anymore

2024-08-09 21:36:32

Apple just upgraded to libcurl to 8.7.1 on MacOS 13 and 14. This version has a nasty brotli regression we fixed back in March...
The bug: https://github.com/curl/curl/issues/13209

2024-08-08 22:00:07

Trying out what a #curl family tree could look like.
https://files.mastodon.social/media_attachments/files/112/928/645/215/660/795/original/3da2c2aadd85edd4.jpg

2024-08-08 15:45:55

Is there any modern software that actually appreciates or uses SIGPIPE ?

2024-08-08 14:33:18

"Question regarding you hacking my webserver?"
It is #inbox time again.
https://bagder.github.io/emails/2024/2024-08-07.html

2024-08-07 08:14:15

- reply

the curl project is slowly extending the family with more sibling command line tools

2024-08-07 08:01:27

$ mv org/Debian/wcurl org/curl/

2024-08-06 21:39:46

Here's one way to view the 28 transfer protocols #curl supports.
https://files.mastodon.social/media_attachments/files/112/917/235/519/772/850/original/6835823b96a60d2d.jpg

2024-08-06 07:33:36

#GitHub releases another something something AI
https://files.mastodon.social/media_attachments/files/112/913/911/875/601/703/original/ea683ac6ae8705c0.png

2024-08-05 07:02:43

in the five days since the previous #curl release, we have merged 47 bugfixes and 9 new features
Busy days.

2024-08-04 14:57:01

"The Open-Source AMD GPU Linux Kernel Graphics Driver Nears 5.8 Million Lines"
Insane is a word that comes to my mind.
That's about 33 times the size of curl - for a set of drivers.
https://www.phoronix.com/news/AMD-Kernel-GPU-5.8-Million

2024-08-03 18:56:28

I am inviting the #wcurl tool to get adopted by the #curl project.
https://curl.se/mail/archive-2024-08/0000.html

2024-08-02 09:07:31

Bugfix rate in the #curl project is currently racing to an all-time high.
(yes, presumably this also means we insert more bugs as well as there need to be something to fix...)
https://files.mastodon.social/media_attachments/files/112/891/630/282/606/334/original/079123ee0c549209.png

2024-08-02 08:57:04

I still have never used an AI tool to help me develop.I see fancy demos all the time. I see nothing I want to use.

2024-08-01 22:06:13

The original #hackerone report for #curl's CVE-2024-7264: ASN.1 date parser overread is now published:
https://hackerone.com/reports/2629968

2024-07-31 15:13:47

The fifth QUIC backend being worked on for #curl could make the topology map look like this soon
https://files.mastodon.social/media_attachments/files/112/881/749/708/683/652/original/7c2ba393eb5c31c1.jpg

2024-07-31 12:24:32

Starting now, #curl is also apparently the curl "enterprise" on #GitHub.The curl enterprise owns the curl organization which owns the curl repository. From which you can build the curl tool.
Clearly we need more curl.

2024-07-30 12:41:35

- reply

because adding a 5th way to do QUIC with curl is exactly what we need

2024-07-30 12:40:34

I just learned there is a #QUIC in the #Linux kernel effort: https://github.com/lxin/quic
... as a draft PR making curl use it was filed: https://github.com/curl/curl/pull/14313

2024-07-30 12:34:24

- reply

@npub1r7a…qyw5 ... and it is already listed!

2024-07-30 12:33:29

- reply

@npub1r7a…qyw5 ah yes it is...!

2024-07-30 12:31:34

I have this slide showing the 101(!) operating systems people have reported #curl to run on.
I now have a customer call scheduled about porting it to a 102nd...
https://files.mastodon.social/media_attachments/files/112/875/449/227/610/129/original/905e570818ed44d4.jpg

2024-07-30 09:12:13

When I tell mortals I know by heart what RFC 959, 3986, 6265, 7540 and 9112 cover, barely anyone appreciate it.

2024-07-30 08:54:19

- reply

@npub1h2n…k25t I wasted hours trying to move my mailman2 installation to mailman3, only to finally give up and now I have python2 + mailman2 built from source ... 😕

2024-07-29 12:43:42

I was nominated for the #Microsoft MVP program, but even though I am the main author of #curl that ships with #Windows since many years now, I barely know any "Microsoft technology" so I could not fill in the form without taking some... eh, "liberties".
I'm pretty confident they will just discard it and I will not be sorry.

2024-07-24 06:27:40

#curl 8.9.0 is out: https://daniel.haxx.se/blog/2024/07/24/curl-8-9-0/
2 CVEs fixed
11 changes
260 bugfixes
by 80 contributors, out of which 47 authored commits
in 63 days since the previous release
https://files.mastodon.social/media_attachments/files/112/840/043/059/348/010/original/eed103e9cb241fab.jpg

2024-07-20 16:22:21

an old libcurl answer of mine on stackoverflow being questioned because I did not provide links to back up my statement when answering questions about code I wrote...
https://stackoverflow.com/a/28714247/93747
😂
(but yeah, I have stopped answering questions over there)

2024-07-20 15:25:04

On this day twenty-six years ago I released #curl 4.7
It does not make be feel old at all. 😁
https://curl.se/changes.html#4_7

2024-07-19 08:39:20

Thank you Crowdstrike for helping to illustrate that Open Source is not the problem.

2024-07-14 21:39:21

Ads on the web don't actually *need* user tracking. Browsers don't *have to* cooperate with those who want to surveil us.

2024-07-10 14:15:03

Welcome CMD as #curl commit author 1283: https://github.com/curl/curl/pull/14147

2024-07-07 09:10:56

I don't understand it, but I approve of the attempt. #FoundOnFacebook #curl
https://files.mastodon.social/media_attachments/files/112/744/426/796/291/562/original/fbff7180ea7ec74a.jpg

2024-07-03 20:46:03

"Announcing wcurl: a #curl wrapper to download files"
https://samueloph.dev/blog/announcing-wcurl-a-curl-wrapper-to-download-files/

2024-06-30 21:01:19

- reply

@npub1cl5…nzfu in a recent HTTP/3 talk I did for example: https://www.youtube.com/live/d--aGkEPR3M?si=mYtdwsXToq7Z-SyX&t=656

2024-06-30 20:43:41

I've spoken about ossification many times and how that for example have prevented TFO (TCP Fast Open) to get deployed widely.
Today #wget2 joined the team disabled-TFO-by-default: https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00025.html

2024-06-26 06:23:34

Top-5 #curl version distribution among requests done on haxproxy.org in June 2024:
curl/7.81.0 79.64%
curl/7.61.1 5.88%
curl/7.68.0 5.47%
curl/7.29.0 2.00%
curl/8.5.0 1.31%
https://mailarchive.ietf.org/arch/msg/quic/81Wa98MtpGt-idJTWClxQXVury8/

2024-06-25 14:55:14

- reply

a bonus command line to try:
curl -L 16843009

2024-06-25 14:54:10

I'm sure you know how "127.0.1" actually can become a valid address, but if you missed that, here's an old blog post of mine explaining the fun and games with numerical IPv4 addresses:
https://daniel.haxx.se/blog/2021/04/19/curl-those-funny-ipv4-addresses/

2024-06-20 11:13:19

Inside 22,734 Steam games
https://daniel.haxx.se/blog/2024/06/20/inside-22734-steam-games/
#curl

2024-06-17 13:13:32

- reply

@npub1neh…rshd how hard can it be? 😉

2024-06-17 08:23:45

- reply

22.8% of users said they would like to see #curl support "recursive HTML download" (!)

2024-06-17 08:12:24

- reply

83.1% gave #curl a 5 out of 5 rating for "How good is the project and its members at handling security-related issues?"

2024-06-17 07:49:47

8.9% of #curl users also use lynx (!)

2024-06-15 20:51:26

- reply

one of them claimed the fact that you can run "curl http://¹²7.0.0.1" is a vulnerability.
I insist this is IDN working as designed. However crazy it may look like.You just cannot filter URLs like that assume it will work.

2024-06-15 20:41:30

closing hackerone reports as not applicable without mercy on a Saturday night

2024-06-14 21:16:01

Daniel's weekly report June 14, 2024
https://lists.haxx.se/pipermail/daniel/2024-June/000068.html
survey, roffit, trurl, webinar, cmdline options, closed PRs, hackerone, contracts, graphs
https://files.mastodon.social/media_attachments/files/112/617/046/468/754/801/original/36572a23505fb558.png

2024-06-14 11:14:34

There has to be something special in the air today. We have received no less than three different new security reports against curl within the last 5 hours.
None of them yet confirmed to be actual curl issues.

2024-06-13 09:05:14

- reply

if you have any Qs for me ahead of time, fire them away here!

2024-06-13 08:04:48

On this fine morning #curl has 263 command line options

2024-06-12 08:06:00

Damned if I do. Damned if I don't.
"It’s odd to me how someone so concerned with the WWW would participate in its destruction like this."
Apparently I'm now destroying "the www" by letting others decide how to host the c-ares website.
https://daniel.haxx.se/blog/2024/06/06/bye-bye-hosting-c-ares-web/comment-page-1/#comment-27020

2024-06-12 07:07:36

my "advanced #libcurl" webinar runs tomorrow. Free of charge. Take the opportunity and ask me anything about (using) libcurl.
https://us02web.zoom.us/webinar/register/9316747720453/WN_zudyMou_RviqdgL-3QQXeg#/registration
https://files.mastodon.social/media_attachments/files/112/602/379/565/271/830/original/00d7149ba6ab9ebe.jpg

2024-06-11 08:50:34

💚
https://files.mastodon.social/media_attachments/files/112/597/128/108/258/058/original/ebd588440fd31bff.png

2024-06-07 12:14:03

#curl now has 261 command line options, as --ip-tos and --mptcp were added for the pending 8.9.0 release:
https://curl.se/docs/manpage.html#--ip-tos
https://curl.se/docs/manpage.html#--mptcp

2024-06-07 07:10:02

On this day ten years ago, we lost our innocence as the former single page HTTP/1.1 specification (RFC2616) "exploded" into six separate new documents (RFC7230 and family). We could then no longer pretend HTTP was a simple protocol.
In June 2022, it was again updated:. "RFC 9110 and family". The spec is now split up into five main documents: semantics, caching and separate specs for each version: 1.1, 2, 3.
Those five documents hold 143,000 words combined. HTTP is not easy.

2024-06-05 11:38:36

#curl can soon set the Type Of Service / Traffic Class IP header fields: https://github.com/curl/curl/pull/13606