daniel:// stenberg://

Internet protocols geek at wolfSSL. I lead the curl project. I don't know anything.

website: https://daniel.haxx.se/
github: https://github.com/bagder

Public Key

npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe

NIP-05 Address

bagder_at_mastodon.social@momostr.pink

Profile Code

nprofile1qqsvdhkcz7r724plrvs0p8t5fvyfgs6jfk0xle9ft2htfsrmgtsp9jcnvdk9l

Author Public Key

npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe

Show more details

Last Notes

2024-08-22 09:31:20

Mr @npub1unc…cvec found a HTTP/2 bug in the #Google frontend webserver.
https://github.com/curl/curl/issues/14620

2024-08-22 08:36:25

The Linux kernel is 38 million LOC. #curl is 170K.
The Linux kernel ships 60 CVEs per week, 3100 per year.
curl ships on average 13 CVEs per year, 3100/223 = 14
== Roughly the same CVE/line of code ratio.

2024-08-22 07:15:39

and here I get into a discussion about why we don't show off the "OpenSSF scorecard" in #curl
(tldr: it's wrong)
https://github.com/curl/curl/discussions/12609

2024-08-20 11:06:16

I got #curl whiskey - gifted me by @npub14lz…2yld. Thanks!
https://files.mastodon.social/media_attachments/files/112/994/014/966/898/826/original/07ce41708d11afad.jpg

2024-08-19 12:56:42

If you develop on #Windows, I could use your quick assistance on this #curl issue: https://github.com/curl/curl/issues/14368

2024-08-19 08:21:56

Exactly eight years ago #Microsoft made powershell open source and I *immediately* filed a pull request to remove their #curl alias...
Did not really work.
https://daniel.haxx.se/blog/2016/08/19/removing-the-powershell-curl-alias/

2024-08-16 07:40:25

It is Friday after all
https://files.mastodon.social/media_attachments/files/112/970/564/858/553/770/original/27f1f3b8b626e4d0.png

2024-08-15 12:32:44

In the fresh report "Investing in #Rust" by Shane Miller yours truly is quoted several times.
https://www.lawfaremedia.org/article/investing-in-rust

2024-08-15 11:44:36

the most recent hackerone issue was filed because the user googled "[another project] bug bounty program", clicked the first link (to #curl's bug-bounty) and entered an issue about a completely different project...

2024-08-14 21:46:56

So the Department of Energy emailed me
https://daniel.haxx.se/blog/2024/08/14/so-the-department-of-energy-emailed-me/
https://files.mastodon.social/media_attachments/files/112/962/568/795/715/942/original/9b9b50adb94d900c.jpg

2024-08-12 17:18:19

- reply

that has been my take as well, but so many people keep bringing this up so I figured I would ask "the crowd" what the general opinion is!

2024-08-12 17:02:52

Do you think trurl, the URL parser and manipulation tool, should support input given as JSON? (it can already output JSON)

2024-08-12 07:50:30

In #curl 8.10.0, coming on September 11, 2024, we introduce support for -vv, -vvv and -vvvv
https://daniel.haxx.se/blog/2024/08/12/verbose-verboser-verbosest/
(thanks to @npub1unc…cvec)
https://files.mastodon.social/media_attachments/files/112/947/953/250/268/648/original/32bf07f75c853338.jpg

2024-08-08 14:33:18

"Question regarding you hacking my webserver?"
It is #inbox time again.
https://bagder.github.io/emails/2024/2024-08-07.html

2024-08-07 06:21:32

what people have been using for years already will start working in #curl 8.10.0: -vv, -vvv and -vvvv for more verbose logging.
Up until now, adding more vs did not do anything different.
https://github.com/curl/curl/pull/13977
PR by the awesome @npub1unc…cvec

2024-08-06 21:39:46

Here's one way to view the 28 transfer protocols #curl supports.
https://files.mastodon.social/media_attachments/files/112/917/235/519/772/850/original/6835823b96a60d2d.jpg

2024-08-06 07:33:36

#GitHub releases another something something AI
https://files.mastodon.social/media_attachments/files/112/913/911/875/601/703/original/ea683ac6ae8705c0.png

2024-08-02 15:31:00

- reply

that problem has nothing to do with HTTP/3...

2024-08-02 08:57:04

I still have never used an AI tool to help me develop.I see fancy demos all the time. I see nothing I want to use.

2024-06-20 11:13:19

Inside 22,734 Steam games
https://daniel.haxx.se/blog/2024/06/20/inside-22734-steam-games/
#curl

2024-06-16 09:41:40

- reply

This is the same fun Windows feature biting PHP: https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/

2024-06-16 08:06:20

- reply

closed a third. Turns out Windows sometimes do fun IDN-like unicide-to-ascii conversions for command lines that then allows users to insert unicode characters in cmdline argument when run on windows, and they are converted to their ASCII look-alike counterparts. Which can be abused to insert arguments and what not.
Not a curl security flaw. Just the weirdest Windows feature I've seen in a while. And probably a security problem in many places.

2024-06-15 20:51:26

- reply

one of them claimed the fact that you can run "curl http://¹²7.0.0.1" is a vulnerability.
I insist this is IDN working as designed. However crazy it may look like.You just cannot filter URLs like that and assume it will work.

2024-06-15 20:41:30

closing hackerone reports as not applicable without mercy on a Saturday night

2024-06-14 06:18:23

The #curl website has been hosted by #Fastly CDN for over seven years now. I cannot ask for a better service and a friendlier company to help us.
Starting now they offer a free tier. https://www.fastly.com/pricing/
Here's my blog post from seven years ago: https://daniel.haxx.se/blog/2017/05/02/a-curl-delivery-network/

2024-06-13 09:05:14

- reply

if you have any Qs for me ahead of time, fire them away here!

2024-06-12 14:05:56

- reply

we ran our own CVS pserver instances!

2024-06-12 07:07:36

my "advanced #libcurl" webinar runs tomorrow. Free of charge. Take the opportunity and ask me anything about (using) libcurl.
https://us02web.zoom.us/webinar/register/9316747720453/WN_zudyMou_RviqdgL-3QQXeg#/registration
https://files.mastodon.social/media_attachments/files/112/602/379/565/271/830/original/00d7149ba6ab9ebe.jpg

2024-06-11 10:01:21

Why #curl closes PRs on #GitHub
https://daniel.haxx.se/blog/2024/06/11/why-curl-closes-prs-on-github/
https://files.mastodon.social/media_attachments/files/112/597/406/532/447/211/original/aa67078fc2555598.jpg

2024-06-10 07:40:35

Experimental HTTP/3 support is soon coming to #curl on #debian. Brace for impact! https://curl.se/mail/distros-2024-06/0000.html

2024-06-07 07:10:02

On this day ten years ago, we lost our innocence as the former single page HTTP/1.1 specification (RFC2616) "exploded" into six separate new documents (RFC7230 and family). We could then no longer pretend HTTP was a simple protocol.
In June 2022, it was again updated:. "RFC 9110 and family". The spec is now split up into five main documents: semantics, caching and separate specs for each version: 1.1, 2, 3.
Those five documents hold 143,000 words combined. HTTP is not easy.

2024-06-06 20:29:21

bye bye hosting c-ares web
https://daniel.haxx.se/blog/2024/06/06/bye-bye-hosting-c-ares-web/
I passed on the duty after two decades.

2024-06-04 15:47:35

"maybe we need this in the future" is a bad idea for writing good code. If we need that flexibility in the future, other things will have changed as well. Better do it then, not complicating matters now.
Turning down needlessly flexible code like a boss.

2024-06-04 09:07:49

14.1% of #curl users say they have used it for 18 years or more

2024-06-03 21:10:31

Some of the emails I get are truly sad reflections of the complicated and rather sorry state of things we are in. Like this.
(also, apparently #curl is used in another popular game)
"Rainbow 6 Siege Activation issue"
https://bagder.github.io/emails/2024/2024-06-03.html

2024-05-31 13:04:11

"Hello Daniel, On behalf of the European Commission OSPO, I send you our gratitude for that fun, engaging and insightful presentation to our - internal - open source community."
Indoctrinating the world, one presentation at a time.

2024-05-30 07:13:14

#Windows users running stupid scanners now contact us for support regarding CVE-2023-46218 which the scanners say affects #curl 8.4.0 shipped by Microsoft.
It would, if their version was built to use #iibpsl, a prereq for this CVE, which #Microsoft does not.
Security scanners. A snake oil business.
https://curl.se/docs/CVE-2023-46218.html

2024-05-29 10:45:15

From the #Fastly dashboard showing the "Percentage of cache hits to all cacheable content over time" for the last 30 days for the #curl website:
A sustained 99.95% cache hit rate.
https://files.mastodon.social/media_attachments/files/112/523/967/008/434/940/original/005d1d6ede64cb7d.png

2024-05-23 21:40:04

"On behalf of Google Open Source, I would like to thank you for your contribution to #Curl."
https://files.mastodon.social/media_attachments/files/112/492/565/807/463/629/original/578094b07eeafbe7.png

2024-05-21 08:43:55

When #Mozilla created their new logo with :// in it, the team behind reached out to me and asked if I had any objections since #curl already was using :// in our logo.
I did not object - I approved of it. I think it validated our logo choice and I am jealous they have a name that can hold :// integrated the way they do.
(I was employed by Mozilla at the time)

2024-05-20 06:46:50

“I could rewrite #curl”
Here's my collection of some less cheerful quotes to keep me firmly grounded. Blogged three years ago today:
https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/
https://files.mastodon.social/media_attachments/files/112/472/068/305/454/249/original/9ef11f71f6248df1.png

2024-05-15 12:56:29

In the #curl project, being written in C, we always work on simplifying the code. One way is to use more internal helper functions and avoid direct use of some functions that are often involved in C mistakes/vulnerabilities.
To measure how this develops, we count number of these function calls used per every thousand lines of code. Over time.
In a graph.
https://files.mastodon.social/media_attachments/files/112/445/207/733/525/135/original/c88064dd9b1a8186.png

2024-05-14 08:24:12

What's (open source) maintaining?
https://files.mastodon.social/media_attachments/files/112/438/478/289/905/689/original/9cff85acf7ec8e75.jpg

2024-05-14 06:14:33

Please consider donating a few minutes of your time and answer the #curl user survey 2024:
https://daniel.haxx.se/blog/2024/05/14/curl-user-survey-2024/

2024-05-10 07:40:06

It has been a long time coming, but I've made it official:
"Daniel no longer answers questions on stackoverflow. Use a dedicated public curl forum for accurate and timely answers about anything #curl. "
(yes, speaking about myself in 3rd person)
https://stackoverflow.com/users/93747/daniel-stenberg

2024-05-08 05:40:07

"To me, the latest is the latest my OS provides me. If #curl maintainers dont care about pushing the latest into the OSes they support, it's not me to blame. I think curl maintainers should push Centos to provide the latest to all users. What's the purpose of you fixing multiple bugs and security holes if you dont spend time to make it available to the broader audience?"
We are obviously all just too lazy.
https://github.com/curl/curl/issues/13546

2024-05-07 08:52:46

- reply

"Is AI helpful for curl?"
- Did you mean cruel?
- 1923
- .. had a farm, AI-AI-O

2024-05-07 08:27:51

It is soon time for the annual #curl user survey. Anything in particular I need to remember to ask this time around? https://curl.se/mail/lib-2024-05/0008.html

2024-04-26 07:13:19

Over the last five years of #curl's bug-bounty we have received 489 submissions. For these 489 submissions the *median* first-response time has been, as calculated by Hackerone: 0 (zero) hours. If this does not ooze of awesomeness from a security team I don't know what does.
I presume they round or truncate to the nearest integer hour. Still means more than half of them got answered within an hour. Whenever or from wherever they were filed.
We take security seriously.

2024-04-25 06:45:12

#libcurl has proudly served as the HTTP(S) engine in #git for nineteen years now.

2024-04-24 05:54:25

Nine years ago today, a #curl command line was prominent on an even larger display...
https://daniel.haxx.se/blog/2015/04/24/curl-on-the-nasdaq-tower/
https://files.mastodon.social/media_attachments/files/112/324/641/126/499/908/original/256fc2ea173f88f6.jpg

2024-04-23 15:19:42

When in my car, I found myself in my car.
https://files.mastodon.social/media_attachments/files/112/321/198/276/987/614/original/aea7988204aef3a4.jpg

2024-04-22 08:00:38

#curl is just the hobby
https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/
https://files.mastodon.social/media_attachments/files/112/313/814/939/425/232/original/6932c2f073f909ae.jpg

2024-04-15 09:50:48

I was reminded of the great #Cisco security fix of 2019
#curl
https://files.mastodon.social/media_attachments/files/112/274/606/425/317/078/original/9c93f8e8cc3025b9.jpg

2024-04-02 08:55:58

There simply is no established or easy way to detect backdoors done the #xz way. We give powers and trust to maintainers because that is the development model.
Anyone suggesting there is an easy fix has not understood the issues at hand.
But we are Open Source which allows everyone to dig, check, read code and investigate.

2024-04-01 08:03:34

- reply

for sure. But we can all help our companies learn. Also, an excellent way to "sponsor" is to allow an employee to spend work hours to do upstream work.

2024-04-01 07:57:28

(Easy) ways to help struggling open source projects:
- step in and help review a few PRs
- help the project triage/reproduce bugs
- if code in the PR looks complicated or is hard to understand, ask for an explanation
- express your gratitude to the maintainers
- make your company sponsor projects they depend on

2024-03-31 21:10:24

I suppose his book should've given us a hint
https://files.mastodon.social/media_attachments/files/112/192/348/113/668/814/original/258624a3740240d0.png

2024-03-29 21:40:51

- reply

Maybe. I won't rule it out, but to me its a question of efforts and what we get in return. I'm sure lots of people will now ask (or tell) me to. But no one will help me or fund me do it.

2024-03-29 21:34:59

Can I just say that I have created #curl releases "the #xz way" since the 90s: I generate the release tarballs on my machine. It makes the tarball have (generated) files included that are not present in git. It's a feature. But it also makes it harder for observers to figure out if the additional files are fine or not.

2024-03-26 09:06:58

Dependency explosion is a problem and maybe the time is ripe to start thinking about how clever it is to rely on hundreds of tiny components you don't know, don't control and that keep changing.
https://tweedegolf.nl/en/blog/119/sudo-rs-depencencies-when-less-is-better

2024-03-25 12:38:59

For people with an interest in #curl in distros, there is a new mailing list being setup for this specific purpose. Sign up to curl-distros here: https://lists.haxx.se/listinfo/curl-distros
Patching, issues, collaboration etc.

2024-03-25 07:53:18

in case you too want to cross-stitch it
https://files.mastodon.social/media_attachments/files/112/155/241/936/438/692/original/3c6149c470464ff2.png