daniel:// stenberg://

I write curl. I don't know anything.

website: https://daniel.haxx.se/
github: https://github.com/bagder
GPG key : 27ED EAF2 2F3A BCEB 50DB 9A12 5CC9 08FD B71E 12C2: https://daniel.haxx.se/mykey.asc

Public Key

npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsvdhkcz7r724plrvs0p8t5fvyfgs6jfk0xle9ft2htfsrmgtsp9jcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dswe48fp

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe

Show more details

Last Notes

2026-05-13 22:16:38 GMT

- reply

*five* new reports landed just now, all within 40 minutes...

2026-05-13 21:24:00 GMT

Attention is fun and good. And sometimes painful. The #curl vulnerability counter keeps getting bumped... No rest for the security team.
(Yes: even after Mythos scanned the code people find issues...)

2026-02-11 07:06:02 GMT

- reply

no, we just didn't consider the flaw CVE material because of the circumstances - but they insists...

2026-02-10 11:36:30 GMT

- reply

no warranty and no money is where we start, where we are now. I can't see any open source project doing attestations unless given motivation and I can't figure out a motivation that would work better than the plain old money

2026-01-25 09:22:45 GMT

I just found this and I just wanted to say thanks #ffmpeg! (screenshot from the Nazi site)
https://files.mastodon.social/media_attachments/files/115/954/999/957/951/445/original/49515a17c9da860b.png

2026-01-23 07:43:34 GMT

#gnuplot turned 40 years old (!) back in December. Happy birthday!

2026-01-22 09:12:02 GMT

#curl is RFC 9116 compliant
https://curl.se/.well-known/security.txt
https :// curl.se / .well-known / security.txt

2026-01-21 23:26:20 GMT

"Subject: Offer to Purchase The cURL project"
😂

2026-01-20 08:19:47 GMT

Let me tease you with a real "thought leader slide" from my coming #FOSDEM talk 😎
https://files.mastodon.social/media_attachments/files/115/926/443/961/600/871/original/084e53fee28c4e23.jpg

2026-01-19 13:09:00 GMT

Thanks for Your Contribution to the #curl Project 💚
https://files.mastodon.social/media_attachments/files/115/921/918/350/194/865/original/38317c4eefb92c05.png

2026-01-19 10:44:52 GMT

Monday
https://files.mastodon.social/media_attachments/files/115/921/352/991/707/823/original/e1f48823afa0005d.jpg

2026-01-17 15:03:09 GMT

You are hereby banned from our program. We don't want your "help". Please never contact us again.
(just sent off to another "helpful" security researcher)

2026-01-14 10:52:29 GMT

We are at *twenty* hackerone submissions for #curl so far this year. Zero of them a confirmed vulnerability.

2026-01-14 10:41:16 GMT

https://github.com/curl/curl/pull/20312
There, now you know.

2026-01-14 07:55:58 GMT

When I find myself working in a big pile of metaphorical manure, I can always bring out this email I received on this day, nine years ago...
https://files.mastodon.social/media_attachments/files/115/892/374/419/605/570/original/8dc5315a37117d68.png

2026-01-13 14:36:38 GMT

You're absolutely right

2026-01-13 07:39:14 GMT

- reply

and of course some of the people I ridicule, ban and expose in these reports come back to me all up in arms about them being completely innocent and they did not know and now I have ruined their professional lives because their cool hacker aliases are now tainted.

2026-01-13 07:34:18 GMT

- reply

Ironically, we have also received complaints from people who get annoyed when we disclose so many rubbish reports on Hackerone...

2026-01-13 07:31:55 GMT

- reply

I suppose the upside is that lots of people are scrutinizing and try really hard to poke holes.

2026-01-13 07:30:51 GMT

On the morning of the 13th day of the year we have received *checks notes* 13 #curl vulnerability reports on Hackerone this year.
None a confirmed vulnerability.

2026-01-12 10:12:05 GMT

typo of the day "curl --limit-rage ..."

2026-01-10 12:05:22 GMT

I really want to love matrix.org but ...

2026-01-09 13:41:53 GMT

said in the IRC channel earlier
"curl is a sticker and image compression project that happens to release network software"

2026-01-07 09:58:33 GMT

#curl 8.18.0 with Daniel Stenberg
https://youtu.be/QVxFW6eqG_c

2026-01-06 10:10:15 GMT

buckle up and prepare for an unload of *six* CVEs against #curl getting published tomorrow, severity low and medium

2026-01-06 09:20:19 GMT

6,000 #curl stickers. 3 Kg.
Get yours at #FOSDEM
https://files.mastodon.social/media_attachments/files/115/847/408/574/894/970/original/8e65798281da784f.jpg

2026-01-04 20:37:22 GMT

Me and my beer.
https://files.mastodon.social/media_attachments/files/115/838/744/699/546/701/original/f8d33713419a2f22.jpg

2026-01-04 15:08:33 GMT

wcurl vs Wget
https://daniel.haxx.se/docs/wcurl-vs-wget.html

2026-01-04 14:52:33 GMT

wget2 2.2.1 is released (Wget2 is the successor of Wget)

2026-01-04 10:41:20 GMT

You can do it
(I commented this on LinkedIn)
https://files.mastodon.social/media_attachments/files/115/836/401/102/747/574/original/afd9c4c9e103263a.png

2026-01-02 21:56:20 GMT

I tried to read a post on hacker news just now.
https://files.mastodon.social/media_attachments/files/115/827/733/805/205/665/original/ccca0685a417dcc2.png

2026-01-02 10:19:30 GMT

the AI slop in security reports have developed slightly over time. Less mind-numbingly stupid reports now, but instead almost *everyone* writes their reports with AI so they still get overly long and complicated to plow through. And every follow-up question is another minor essay discussing pros and cons with bullet points and references to multiple specifications.
Exhausting nonetheless.

2025-12-30 12:52:57 GMT

26 years ago, on December 28 1999, we migrated the main #curl source code from self-hosted to Sourceforge.
It was the new hot thing. Imagine the idea of a dedicated service devoted to nothing but hosting code!
We then kept the code there for ten years (on CVS). A period when the distributed version control systems really exploded.

2025-12-29 21:37:09 GMT

No strcpy either.
https://daniel.haxx.se/blog/2025/12/29/no-strcpy-either/
#curl

2025-12-28 22:11:38 GMT

- reply

Closed this "critical" one. Only three to go...
https://hackerone.com/reports/3480641

2025-12-28 21:48:32 GMT

- reply

Deep breaths and go slow and gentle one by one asking questions. It's important to not waste time on the weirdos while not ignoring the good ones. And to not break in the process.

2025-12-28 21:31:48 GMT

*Seven* new hackerone reports the last 36 hours.

2025-12-27 22:30:15 GMT

strcpy density in #curl source code
https://files.mastodon.social/media_attachments/files/115/793/891/085/777/848/original/de0e979347202d14.png

2025-12-27 09:13:02 GMT

#curl has a new sponsor. Thanks #github!
https://files.mastodon.social/media_attachments/files/115/790/754/155/042/785/original/2970718cb5556d59.png

2025-12-22 22:31:12 GMT

I added a sentence to the #curl hackerone submission page:
"Please present your case briefly and to the point. Do not use an AI to help you blab hundreds of lines that will exhaust us to death instead of making us understand your claim."

2025-12-20 16:12:44 GMT

*Twelve* Hackerone submissions against #curl within the last seven days.
Zero of them turned out a confirmed vulnerability.
Several of them found, reported, phrased-in-far-too-many-words and mislead by stupid word completion machines.

2025-12-19 12:37:32 GMT

If your company needs #curl support for OpenSSL 1.1 in 2026, just say so and we can have you covered in no time.
OpenSSL 1 support is dropped from the regular #curl releases but is available as a commercial offer.

2025-12-19 09:40:00 GMT

make a photo realistic embroidered wall piece with the words "never expect two independent URL parsers to treat every URL identically"
okay, that failed
"again without repeating any words"
*ripping my eyes out*
https://files.mastodon.social/media_attachments/files/115/745/556/021/994/974/original/dabc5c445c13fc03.png
https://files.mastodon.social/media_attachments/files/115/745/557/554/879/363/original/fc39862cc63dcb04.png

2025-12-19 07:42:18 GMT

This is not working. The number of #hackerone report submissions for #curl in 2025 is going through the roof, while the quality is going through the floor.
And the year isn't over yet.
https://files.mastodon.social/media_attachments/files/115/745/095/462/639/644/original/bcd51c542038c21d.png

2025-12-18 22:08:08 GMT

If you've been wanting to speak securely to your garage door or whatever MQTTS capable devices you want to control with your #curl command lines, look no further:
(this is planned to merge in time for the March 2026 release)
https://github.com/curl/curl/pull/19418

2025-12-17 08:29:57 GMT

Today, twenty-nine awesome years ago, httpget 0.2 shipped. Unfortunately, both the source and the changelog for this release have been lost in time (like tears in rain).
httpget was the precursor to what later would become #curl
The internet, and the web, was different in 1996.

2025-12-17 08:17:58 GMT

Five years ago I started getting these emails about #curl from NASA. Months later we learned this probably was related to them using curl in the Mars Helicopter mission.
https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/

2025-12-16 10:09:15 GMT

https://files.mastodon.social/media_attachments/files/115/728/692/072/950/253/original/f7f235b07ab603cc.png

2025-12-16 09:50:42 GMT

I decide to view the continued onslaught of slop security reports as research material for my coming FOSDEM talk.

2025-12-16 09:45:53 GMT

If you need to get your mood down a few notches, there are some new slop entries to torment yourself with here:
https://gist.github.com/bagder/07f7581f6e3d78ef37dfbfc81fd1d1cd

2025-12-16 07:07:08 GMT

new day, new slop

2025-12-15 08:55:09 GMT

slip slop slap
https://hackerone.com/reports/3465094

2025-12-15 08:21:37 GMT

Please stop using AI when responding. It is enough if you answer with no more than 20 lines. The rest is just word sallad.
*shakes fist in the air*

2025-12-15 08:09:11 GMT

Microsoft will pay bug bounties even for 3rd party components:
https://www.theregister.com/2025/12/12/microsoft_more_bug_payouts

2025-12-12 23:09:18 GMT

My week: https://lists.haxx.se/pipermail/daniel/2025-December/000138.html
Security, AI, FOSDEM, 40K stars, rc1, URLs, AIxCC, mallocs
https://files.mastodon.social/media_attachments/files/115/709/112/433/787/414/original/0c3e9ea9a806da46.jpg

2025-12-12 10:38:07 GMT

I am probably getting old, but the idea to cram in lots of events in Brussels the entire week before FOSDEM is not getting my thumbs up. Or well, you can have them but I won't be there.
A regular FOSDEM already wears me out on its own. Being at the European Open Source Awards on the Thursday before FOSDEM is stretching it but I will do it.
Adding *more* events to my agenda that week would probably kill me.
Did I mention I'm old? Leave me alone.

2025-12-12 07:20:47 GMT

"Base Score: 9.8 (Critical)"
https://hackerone.com/reports/3462525

2025-12-11 09:39:15 GMT

Made with AI. Of course.
https://files.mastodon.social/media_attachments/files/115/700/259/210/858/717/original/c9696297a75fb014.jpg

2025-12-11 09:09:05 GMT

We currently have three pending CVEs to be announced in the next #curl release (severity low + medium x 2)
All three found with AI powered tooling.
So it is happening.

2025-12-10 09:06:38 GMT

On this day six years ago, we learned that mr Robot curls:
https://daniel.haxx.se/blog/2019/12/10/mr-robot-curls/
Exactly three years later, still this date, we found a #curl sighting in the movie Silk Road:
https://daniel.haxx.se/blog/2022/12/10/curl-sighting-silk-road/

2025-12-06 13:58:56 GMT

These are two of my favorite memes about companies putting AI into everything.
if you have any additional favorite ones you want to share, I wouldn't mind a few more to spice up one of my coming talks with....
https://files.mastodon.social/media_attachments/files/115/672/960/805/142/824/original/b28af433a33c9d6e.jpg

2025-12-06 13:43:17 GMT

Asking for a friend. What is the proper celebrations when reaching 20,000 personal commits in an open source project?

2025-12-05 22:57:59 GMT

Thanks to @npub1a6l…5kg0 this is quickly becoming the most thorough and detailed resource on the #OpenSSL fork situation. Which fork does what and how?
https://github.com/curl/curl/wiki/OpenSSL-forks

2025-12-04 11:16:33 GMT

Welcome Georg Schulz-Allgaier as #curl commit author 1424: https://github.com/curl/curl/pull/19828

2025-12-04 10:03:44 GMT

A new Hackerone issue was submitted for #curl and I had it closed as not applicable within four minutes. A new personal record I believe.
(It will be disclosed asap.)

2025-12-03 10:28:06 GMT

- reply

Apple products, all modern cars, all smart phones, many top selling games (Fortnite, Roblox, PubG, GTA, etc), e-readers, trains, Facebook, in Windows, YouTube, Google Photos, Music instruments, camera, motorbikes, Chrome OS, medical devices, modern TVs, smart light bulbs, Spotify, drones, tablets, most printers, Netflix, IP-cameras, Instagram, Roku, robot dogs, kitchen appliances, servers, refrigerators, game consoles, portable game consoles, smart watches, smart speakers, sound bars, busses, ..

2025-12-03 10:18:51 GMT

Reminder. #curl runs in all your devices. So I made a slide to show some of them.
(yeah, I've used and shown this slide numerous times before and I will probably do it again...)
https://files.mastodon.social/media_attachments/files/115/655/116/198/122/804/original/4da9836eb6ab854b.jpg

2025-11-30 18:37:39 GMT

"We are happy to tell you that we accept your proposal:
Open Source Security in spite of AI
in the track Main Track at #FOSDEM 2026."
See you there!

2025-11-23 12:27:42 GMT

On Linux, if I want a library that can produce a nice stack trace on demand with function name + line number in my C code, which is your recommended choice?

2025-11-19 07:10:33 GMT

- reply

but it was memory-safe! 😎

2025-11-18 15:08:19 GMT

Friends don't let friends disable TLS server verification. (#curl is used, but the check is explicitly disabled by the app)
https://www.ush.it/2025/11/14/multiple-vulnerabilities-gosign-desktop-remote-code-execution/

2025-11-18 12:01:05 GMT

Four years since Apple figured we give free support to their users. https://daniel.haxx.se/blog/2021/11/18/free-apple-support/
https://files.mastodon.social/media_attachments/files/115/570/586/378/681/351/original/d00bb0899fb144fc.png

2025-11-15 23:00:00 GMT

You can follow along here as we disclose all the reports as soon as they are closed: https://hackerone.com/curl/hacktivity?type=team

2025-11-14 08:18:30 GMT

'So let’s rewrite the new OWASP item. It’s not “Software Supply Chain Failures”. It’s more accurate to say “Collection of random software I found in the couch cushions that I don’t understand and we don’t know where most of it comes from”.'
nicely phrased by @npub16g6…s9jn
https://anchore.com/blog/supply-chain-security-made-the-owasp-top-ten-this-changes-nothing/

2025-11-13 08:27:47 GMT

RE: https://mastodon.social/@bagder/115535765105053532
A landslide win for 1024.
#note15vu…huys

2025-11-13 07:36:05 GMT

Parsing integers in C. Aka "bye bye atoi".
https://daniel.haxx.se/blog/2025/11/13/parsing-integers-in-c/
#curl #development

2025-11-12 08:24:28 GMT

Should the default #curl progress meter use 1000-based units instead of 1024-based ones ?

2025-11-11 16:15:38 GMT

From report to disclosed in 20 minutes
https://hackerone.com/reports/3419617

2025-11-11 06:49:30 GMT

Twenty-nine years ago on this day, #httpget 0.1 was released.
I found the tool a few days later and within a few months I became the maintainer. We later renamed it. Twice. The last name it got is #curl. It stuck.
httpget was my first insight and lesson into HTTP and since then I have kept learning it.
httpget 0.1 was written by Rafael Sagula, who unfortunately is not with us anymore.

2025-11-10 15:52:50 GMT

one of the most common security reports we get in #curl is claims of various CRLF injections where a user injects a CRLF into their own command lines and that's apparently "an attack".
We have documented this risk if you pass in junk in curl options but that doesn't stop the reporters from reporting this to us. Over and over.
Here's a recent one.
https://hackerone.com/reports/3418616

2025-11-10 14:46:05 GMT

Hello mr Slop, so we meet again...
https://hackerone.com/reports/3418528

2025-11-10 12:36:07 GMT

In the #curl security team, we get to exercise deep protocol knowledge into the bits for many protocols including version variations and exploring funny quirks we have for adapting to many 3rd party libraries as well as a thorough understanding of the C language, how ABIs work, OS/platform variations and the occasional CPU peculiarity. Did I mention build systems?
And that's only for the issues we received this weekend.

2025-11-10 09:08:33 GMT

Welcome Stanislav Fort as #curl commit author 1418: https://github.com/curl/curl/pull/19439

2025-11-09 23:08:52 GMT

Has the time come to pull the plug for #RTMP in #curl?
https://curl.se/mail/lib-2025-11/0008.html

2025-11-09 10:56:13 GMT

#curl speaks #MQTT but rather limited and in a slightly naive fashion. Feel free to help us improve.
https://curl.se/docs/todo.html#MQTT

2025-11-06 07:56:38 GMT

More than half of #curl's source code lines have been changed within the last four years. 1,101 lines from before year 2000 still remain "untouched".
https://files.mastodon.social/media_attachments/files/115/501/675/822/966/236/original/60bab84b1f584856.png

2025-11-04 09:45:31 GMT

"Secure Software Lifecycle for Open Source Software" according to the German Federal Office for Information Security (BSI)
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03185/BSI-TR-03185-2.pdf

2025-11-04 09:27:37 GMT

Yes really, #curl is still developed
https://daniel.haxx.se/blog/2025/11/04/yes-really-curl-is-still-developed/

2025-11-03 22:18:28 GMT

Educational moment on the #curl wikipedia page 😎
https://files.mastodon.social/media_attachments/files/115/488/079/274/082/429/original/19ddbcfb6a4f17c1.png

2025-11-03 08:19:56 GMT

A semi regular reminder. These are #curl's best friends. The top sponsor of November 2025.
https://files.mastodon.social/media_attachments/files/115/484/783/365/870/439/original/5eda00e69859a02b.jpg

2025-10-31 07:51:31 GMT

- reply

and the more you look, the sadder you get. It's really bad.

2025-10-30 19:31:01 GMT

I just learned TIOBE has a "quality indicator" and #curl is ranked D out of an A to F scale where A is best.
No further comments on that.
https://ticsdemo.tiobe.com/tiobeweb/DEMO/TqiDashboard.html#axes=Project(curl),Sub()&metric=tqi

2025-10-30 08:36:20 GMT

- reply

Probably the first time since we switched to GitHub back in 2010.
https://files.mastodon.social/media_attachments/files/115/462/200/023/256/603/original/6792e4dc510685ca.png

2025-10-30 08:35:08 GMT

- reply

and now, **zero**

2025-10-30 08:28:44 GMT

One. Open. Issue.
https://files.mastodon.social/media_attachments/files/115/462/170/576/632/110/original/98970935efc55ba7.png

2025-10-30 07:10:29 GMT

On this day last year, #libcurl celebrated its 18th anniversary of not breaking the ABI.
That makes it 19 years now.
https://daniel.haxx.se/blog/2024/10/30/eighteen-years-of-abi-stability/

2025-10-29 07:51:58 GMT

The other day we had our first ever chained AI tool success on the #curl factory floor:
- tool A found a possible flaw in code and reported it.
- using the plain English description from tool A, tool B could create a reproducible by itself that verified the finding
The sense of magic is strong in this.
Now us poor humans need to fix it. The AIs are still really lousy at writing patches.

2025-10-28 14:42:56 GMT

"This document specifies the experimental ai Uniform Resource Identifier (URI) scheme. The scheme provides a dedicated access point for Artificial Intelligence (AI) resources, enabling autonomous systems and robots to connect natively while allowing human-facing applications to interoperate via HTTPS gateways"
https://www.ietf.org/archive/id/draft-sogomonian-ai-uri-scheme-01.html

2025-10-28 10:12:36 GMT

Recognition - with Daniel Stenberg. A walk-through of awards, recognition and the medals Daniel has received during the years doing #curl and Open Source.
https://youtu.be/GwG0-eO4ZsQ?si=2av7KbFvKQnDiH2o

2025-10-27 16:03:53 GMT

The Python Software Foundation shows more spine than every single tech giant in just one single decision.
> Diversity, equity, and inclusion are core to the PSF’s values
https://pyfound.blogspot.com/2025/10/NSF-funding-statement.html