daniel:// stenberg://

I write curl. I don't know anything.

Public Key

npub10ql4aps87kugc57xc63ng3z70ymkydgp8pqmcsxm03v7adaea99ss4j5x8

NIP-05 Address

Profile Code

nprofile1qqs8s067scrltwyv20rvdge5g308jdmzx5qnssdugrdhck0wk7u7jjcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds3mlulz

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub10ql4aps87kugc57xc63ng3z70ymkydgp8pqmcsxm03v7adaea99ss4j5x8

Show more details

Last Notes

2026-08-19 06:00:23 GMT

It's now 10 whole years since I tried to do my duty for the community and remove the #curl alias from PowerShell.
It's still there.
https://daniel.haxx.se/blog/2016/08/19/removing-the-powershell-curl-alias/

2026-08-08 21:21:48 GMT

No one in the seven-person curl security team is on or runs Windows. People sending us Windows-only flaws makes us groan and roll eyes. And sometimes hyperventilate a little.
Why this is so? Because no one in the team wants to be on Windows, and no other curl contributor is active enough, Windows-knowledgeable and interested in joining the team. Let me know if you are someone like that who I've just not noticed.

2026-08-07 21:56:17 GMT

At times I'm thinking we should drop support for Windows. It's such a nightmare to support. #curl

2026-08-03 21:33:51 GMT

As an Open Source person I am apparently expected to keep doing things for free so I get invited to participate in EU policy events in Brussels, with not even an attempt to offer me compensation for travel, lodging or time.
So I decline.

2026-07-07 06:41:39 GMT

- reply

@nprofile…xnqz @nprofile…7eu0 modern clients supporting this are also the most likely to already do happy eyeballs and should already handle ipv6 only hosts just fine...

2026-06-22 21:14:29 GMT

- reply

@nprofile…lv9g POSIX does not mandate that format for 12 leading zero bytes, but several implementations do it as RFC 4291 suggests. @nprofile…g0lt makes no attempt to: https://git.musl-libc.org/cgit/musl/tree/src/network/inet_ntop.c?h=v1.2.3
As I want a stable behavior for curl, I need the same output independently of libc...

2026-06-22 14:57:11 GMT

Today I spotted that musl's inet_ntop() function does not output "::[ipv4]" when asked to output an IPv6 address RFC4291 style. Something both glibc and curl's internal replacements do...

2026-06-15 05:56:09 GMT

The #curl project will not accept or otherwise handle any vulnerability reports during the month of July 2026. We call it the curl summer of bliss.
https://daniel.haxx.se/blog/2026/06/15/curl-summer-of-bliss/

2026-05-21 06:53:50 GMT

last year at this time, #curl was git cloned 23,900 times per day
over the last two weeks, it has been git cloned 54,286 times per day

2026-05-11 06:02:17 GMT

#Mythos finds a #curl vulnerability
yes, as in singular one.
https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

2026-05-06 08:02:10 GMT

The 64-bit signed integer for time will overflow on Sunday, December 4, 292,277,026,596

2026-04-29 11:56:35 GMT

Excuses. They forgot to run their site as they should and instead got lost working on AI features we never asked for. That's why.
#nevent1q…yl5f

2026-04-29 06:35:04 GMT

in the curl 8.20.0 release there are still 903 lines of production code last modified before the year 2000

2026-04-29 06:27:32 GMT

I feel honored to present to you: #curl 8.20.0
https://daniel.haxx.se/blog/2026/04/29/curl-8-20-0/

2026-04-28 11:22:26 GMT

I spoke about the Open Source AI Reality at #fossnorth this morning. Awesome crowd. Excellent questions. (video pending)
Now going back home to do a #curl release tomorrow.
https://files.mastodon.social/media_attachments/files/116/482/057/572/100/483/original/1e934581d34900fc.jpg

2026-04-27 04:23:54 GMT

Argh. My train to #fossnorth this morning got cancelled. I had to book another and therefore I won't arrive until tonight. ☹️
Luckily my talk is first thing tomorrow, so should still work out.

2026-04-25 14:23:23 GMT

"Pre-built GitHub profiles with five-year commit histories and Arctic Code Vault Contributor badges sell for approximately $5,000 on Telegram."
https://awesomeagents.ai/news/github-fake-stars-investigation/

2026-04-22 11:45:38 GMT

High-Quality chaos. This is where we're at right now, security reporting wise.
https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/

2026-04-20 08:32:12 GMT

- reply

@nprofile…wuv3 yes we do

2026-04-20 07:31:21 GMT

Clearly the AIs sometimes can't quite figure out what an API is and how the internal functions differ so they happily generate POCs for our "security researchers" that use a mix (which then also requires them to build with a static lib so that it can find the hidden private functions).
Proving exactly nothing.

2026-04-07 06:38:40 GMT

If your Open Source project sees a steep increase in number of high quality security reports (mostly done with AI) right now (#curl, Linux kernel, glibc confirmed) please tell me the name of this project.
(I'd like to make a little list for my coming talk on this.)

2026-04-02 20:18:15 GMT

The challenge with AI in open source security has transitioned from an AI slop tsunami into more of a ... plain security report tsunami. Less slop but lots of reports. Many of them really good.
I'm spending hours per day on this now. It's intense.

2026-04-02 15:10:18 GMT

Look mum I'm in the paper (today's Svenska Dagbladet, Sweden's number two morning newspaper)
https://files.mastodon.social/media_attachments/files/116/335/743/170/839/955/original/85b8e60f048d2d84.png

2026-03-29 09:04:25 GMT

"Unfortunately in the bank where i work it is not easy to change the version, it requires lots of resources to retest." says reporter who uses a ten years old #curl version with a suspected bug... The problem is not open source.

2026-03-26 10:09:28 GMT

Don’t trust, verify
https://daniel.haxx.se/blog/2026/03/26/dont-trust-verify/
#curl

2026-03-23 21:52:34 GMT

A random guy telling the world how to install some new software. An illustration.
https://files.mastodon.social/media_attachments/files/116/280/701/251/044/654/original/05a23fb2fad9f277.png

2026-03-02 21:47:26 GMT

a detail you probably didn't know: nowhere in any #curl documentation do we use the word "very". It is a banned word enforced by a CI check. This rule encourages us to rewrite and instead use more appropriate words. Makes us write better English.

2026-03-02 15:05:14 GMT

Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/

2026-02-22 13:48:57 GMT

I'm doing another #curl sticker distribution run in Oslo in March at NDC Security.
As a small side-thing I will also do a talk there https://ndcsecurity.com/agenda/three-decades-of-curl-0ugm/0m55j1o34kp

2026-02-12 16:48:51 GMT

The future is here.
#nevent1q…jsl4

2026-02-10 07:21:19 GMT

curl -L sintonen.fi/curling

2026-02-03 07:58:49 GMT

I have this still unspecific idea in my head about somehow applying a coordinate system on the ULB campus and #FOSDEM maps (or something) to help us deal with "let's meet at..." problems once and for all.

2026-01-31 22:11:51 GMT

I received last year's medal retroactively because back then it did not yet exist.
ETOOMANYMEDALS
https://files.mastodon.social/media_attachments/files/115/991/998/002/664/226/original/a39e5bd8aa0d43bb.jpg
https://files.mastodon.social/media_attachments/files/115/991/998/547/151/372/original/c65b462758bfc6b3.jpg
https://files.mastodon.social/media_attachments/files/115/991/998/946/027/868/original/9dc68c59c7286319.jpg

2026-01-29 08:49:36 GMT

the Prize for Excellence in Open Source 2026 is handed out tonight in Brussels by the European Open Source Academy, and it is my honor as president to hand over this award to a truly worthy winner. I am sure you will agree with me once you learn who it is. Tonight.

2026-01-26 22:23:57 GMT

Another #FOSDEM advice: you won't find power outlets at the campus. Arrange so that your devices last through the day without getting plugged in.

2026-01-26 13:57:39 GMT

On this day, twenty-five years ago, we shipped curl 7.6. The first #curl release with IPv6 support!

2026-01-24 09:29:37 GMT

quote of the day
"Daniel Stenberg, the main developer of one of the most useful cURL tools"

2026-01-23 07:43:34 GMT

#gnuplot turned 40 years old (!) back in December. Happy birthday!

2026-01-15 16:05:45 GMT

- reply

@nprofile…3n63 it's a TRAP!

2026-01-14 10:41:16 GMT

https://github.com/curl/curl/pull/20312
There, now you know.

2026-01-14 09:30:55 GMT

It is our moral imperative to consider the "real world" and actual users when assessing the possible security impact of a reported #curl issue. If we deem that there is likely to be zero affected users, then we do more damage than good by insisting on doing the security dance for the issue.
Then we end up with a severity level that is below LOW, and then we treat it as a bug instead. For the good of mankind.

2026-01-14 07:55:58 GMT

When I find myself working in a big pile of metaphorical manure, I can always bring out this email I received on this day, nine years ago...
https://files.mastodon.social/media_attachments/files/115/892/374/419/605/570/original/8dc5315a37117d68.png

2026-01-13 10:24:16 GMT

$ git log --author="Daniel Stenberg" --oneline | wc -l
19988

2026-01-13 07:30:51 GMT

On the morning of the 13th day of the year we have received *checks notes* 13 #curl vulnerability reports on Hackerone this year.
None a confirmed vulnerability.

2026-01-12 10:12:05 GMT

typo of the day "curl --limit-rage ..."

2026-01-10 21:40:12 GMT

- reply

@nprofile…dyu0 or non-random shit! 😎

2026-01-10 12:05:22 GMT

I really want to love matrix.org but ...

2026-01-09 13:41:53 GMT

said in the IRC channel earlier
"curl is a sticker and image compression project that happens to release network software"

2026-01-09 07:40:21 GMT

- reply

@nprofile…3n63 "one user on the $250 max plan is costing the company approaching $15,000 per month"
😱

2026-01-08 22:05:55 GMT

Two years ago we dropped the years from all copyright mentions in the #curl project: https://daniel.haxx.se/blog/2023/01/08/copyright-without-years/

2026-01-08 10:12:44 GMT

- reply

@nprofile…3n63 sorry we didn't tell you earlier about this mandatory procedure for curl maintainers.😎

2026-01-08 07:56:45 GMT

- reply

@nprofile…3n63 @nprofile…t527 when people say Discord I smile and wave while slowly walking backwards.

2026-01-07 09:58:33 GMT

#curl 8.18.0 with Daniel Stenberg
https://youtu.be/QVxFW6eqG_c

2026-01-07 07:07:27 GMT

#curl 8.18.0 has been released
https://daniel.haxx.se/blog/2026/01/07/curl-8-18-0/

2026-01-06 09:44:02 GMT

The year's 6th day just started and we just clocked in our 8th hackerone report on #curl for the year.
This doesn't work.

2026-01-06 09:20:19 GMT

6,000 #curl stickers. 3 Kg.
Get yours at #FOSDEM
https://files.mastodon.social/media_attachments/files/115/847/408/574/894/970/original/8e65798281da784f.jpg

2026-01-04 20:37:22 GMT

Me and my beer.
https://files.mastodon.social/media_attachments/files/115/838/744/699/546/701/original/f8d33713419a2f22.jpg

2026-01-04 14:52:33 GMT

wget2 2.2.1 is released (Wget2 is the successor of Wget)

2026-01-04 10:41:20 GMT

You can do it
(I commented this on LinkedIn)
https://files.mastodon.social/media_attachments/files/115/836/401/102/747/574/original/afd9c4c9e103263a.png

2025-12-30 12:52:57 GMT

26 years ago, on December 28 1999, we migrated the main #curl source code from self-hosted to Sourceforge.
It was the new hot thing. Imagine the idea of a dedicated service devoted to nothing but hosting code!
We then kept the code there for ten years (on CVS). A period when the distributed version control systems really exploded.

2025-12-27 22:30:15 GMT

strcpy density in #curl source code
https://files.mastodon.social/media_attachments/files/115/793/891/085/777/848/original/de0e979347202d14.png

2025-12-27 10:02:05 GMT

Number of hackerone reports on #curl doubled since last year
https://files.mastodon.social/media_attachments/files/115/790/951/135/405/349/original/8beff27adf2cae45.png

2025-12-27 09:13:02 GMT

#curl has a new sponsor. Thanks #github!
https://files.mastodon.social/media_attachments/files/115/790/754/155/042/785/original/2970718cb5556d59.png

2025-12-23 15:37:09 GMT

Basically the only way to get #curl stickers (without printing your own set) is to approach me when I show up somewhere to talk.
The next big chance is at #FOSDEM where I usually give away **thousands** of curl stickers.
It is always fine to pick a few extra to hand out to your friends and grandparents.

2025-12-23 12:00:42 GMT

a #curl 2025 review
https://daniel.haxx.se/blog/2025/12/23/a-curl-2025-review/

2025-12-23 11:57:28 GMT

- reply

@nprofile…370p sure, but DNS is (traditionally) in the clear when it leaves your network - even with your own servers. DoH is one way to avoid that

2025-12-23 11:55:59 GMT

- reply

@nprofile…370p you must remember the US situation though: disabling DoH then means that your ISP instead spies on you, gather that information and sells it on

2025-12-23 10:25:12 GMT

1. User complains to #hackerone that I named his *previous* name when he renamed himself to a silly name after I banned them in a #curl report filed back in October.
2. Hackerone asks me to respond on their support forum, on which I have no account. Grrr. I refuse to.
3. Replying to the hackerone email about this instead, I get a bounce saying they don't accept emails on support@hackerone ...
Kill me now.
https://files.mastodon.social/media_attachments/files/115/768/392/632/029/963/original/de50cac6bad2d632.png

2025-12-22 22:31:12 GMT

I added a sentence to the #curl hackerone submission page:
"Please present your case briefly and to the point. Do not use an AI to help you blab hundreds of lines that will exhaust us to death instead of making us understand your claim."

2025-12-22 13:15:47 GMT

We end the year with 6 more #curl command line options than we had last new year's eve; now at 273 in total.

2025-12-22 09:35:20 GMT

#libcurl grew with a mere 100 lines of code in 2025. At 149,000 lines.

2025-12-20 21:50:22 GMT

"Subject: New financial contributor to curl: CarGurus ($3,000.00)"
I don't know what CarGurus is, but I love it.

2025-12-19 12:37:32 GMT

If your company needs #curl support for OpenSSL 1.1 in 2026, just say so and we can have you covered in no time.
OpenSSL 1 support is dropped from the regular #curl releases but is available as a commercial offer.

2025-12-19 10:12:02 GMT

When you need to shrink your SVG images to their bare minimum, this is an awesome resource: https://svgomg.net/

2025-12-19 09:40:00 GMT

make a photo realistic embroidered wall piece with the words "never expect two independent URL parsers to treat every URL identically"
okay, that failed
"again without repeating any words"
*ripping my eyes out*
https://files.mastodon.social/media_attachments/files/115/745/556/021/994/974/original/dabc5c445c13fc03.png
https://files.mastodon.social/media_attachments/files/115/745/557/554/879/363/original/fc39862cc63dcb04.png

2025-12-19 07:42:18 GMT

This is not working. The number of #hackerone report submissions for #curl in 2025 is going through the roof, while the quality is going through the floor.
And the year isn't over yet.
https://files.mastodon.social/media_attachments/files/115/745/095/462/639/644/original/bcd51c542038c21d.png

2025-12-18 22:08:08 GMT

If you've been wanting to speak securely to your garage door or whatever MQTTS capable devices you want to control with your #curl command lines, look no further:
(this is planned to merge in time for the March 2026 release)
https://github.com/curl/curl/pull/19418

2025-12-17 08:29:57 GMT

Today, twenty-nine awesome years ago, httpget 0.2 shipped. Unfortunately, both the source and the changelog for this release have been lost in time (like tears in rain).
httpget was the precursor to what later would become #curl
The internet, and the web, was different in 1996.

2025-12-17 08:17:58 GMT

Five years ago I started getting these emails about #curl from NASA. Months later we learned this probably was related to them using curl in the Mars Helicopter mission.
https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/

2025-12-16 22:23:25 GMT

20,000 issues on GitHub
https://daniel.haxx.se/blog/2025/12/16/20000-issues-on-github/
#curl

2025-12-16 10:09:15 GMT

https://files.mastodon.social/media_attachments/files/115/728/692/072/950/253/original/f7f235b07ab603cc.png

2025-12-16 07:07:08 GMT

new day, new slop

2025-12-15 23:08:13 GMT

curl.se is now at 78 terabytes/month
https://files.mastodon.social/media_attachments/files/115/726/092/695/587/554/original/b7e873a828f6f47d.png

2025-12-15 08:55:09 GMT

slip slop slap
https://hackerone.com/reports/3465094

2025-12-15 08:21:37 GMT

Please stop using AI when responding. It is enough if you answer with no more than 20 lines. The rest is just word sallad.
*shakes fist in the air*

2025-12-15 08:09:11 GMT

Microsoft will pay bug bounties even for 3rd party components:
https://www.theregister.com/2025/12/12/microsoft_more_bug_payouts

2025-12-15 06:55:00 GMT

#curl 8.18.0-rc2 is here. Take it for a spin and let us know!
https://curl.se/rc/

2025-12-14 11:09:35 GMT

Limit the (#curl) URL size more?
https://curl.se/mail/lib-2025-12/0014.html

2025-12-12 22:21:08 GMT

You can subscribe to the Daniel weekly emails. Terribly nerdy details on what I've worked on last week. About curl, open source, security and related ramblings. No sales. No ads. For free.
https://lists.haxx.se/mailman/listinfo/daniel

2025-12-12 10:38:07 GMT

I am probably getting old, but the idea to cram in lots of events in Brussels the entire week before FOSDEM is not getting my thumbs up. Or well, you can have them but I won't be there.
A regular FOSDEM already wears me out on its own. Being at the European Open Source Awards on the Thursday before FOSDEM is stretching it but I will do it.
Adding *more* events to my agenda that week would probably kill me.
Did I mention I'm old? Leave me alone.

2025-12-11 09:39:15 GMT

Made with AI. Of course.
https://files.mastodon.social/media_attachments/files/115/700/259/210/858/717/original/c9696297a75fb014.jpg

2025-12-10 09:06:38 GMT

On this day six years ago, we learned that mr Robot curls:
https://daniel.haxx.se/blog/2019/12/10/mr-robot-curls/
Exactly three years later, still this date, we found a #curl sighting in the movie Silk Road:
https://daniel.haxx.se/blog/2022/12/10/curl-sighting-silk-road/

2025-12-09 22:55:14 GMT

DHH launches something he says is Open Source but isn't. https://world.hey.com/dhh/fizzy-is-our-fun-modern-take-on-kanban-and-we-made-it-open-source-54ac41b6
Matt Mullenweg calls it false advertising: https://ma.tt/2025/12/dhh-open-source/
All this I learned from Dries Buytaert: https://dri.es/source-available-is-not-open-source-and-that-is-okay

2025-12-09 22:25:56 GMT

To get that powershell feeling
https://invoke-webrequest.haxx.se/

2025-12-09 13:22:56 GMT

⭐ ⭐ ⭐ ⭐ ⭐
The #curl repo on GitHub surpassed 40K stars: https://github.com/curl/curl
⭐ ⭐ ⭐ ⭐ ⭐

2025-12-09 12:10:56 GMT

Addressing Linux’s Missing PKI Infrastructure
"we’re starting the development of upki: a universal PKI tool. This project initially aims to close the revocation gap through the combination of a new system utility and eventual library support for common TLS/SSL libraries such as OpenSSL, GnuTLS and rustls"
https://discourse.ubuntu.com/t/addressing-linuxs-missing-pki-infrastructure/73314

2025-12-09 10:30:40 GMT

Remember the AIxCC competition? After lots of research and triaging, the conclusion has landed: not a single *real* problem was found in #curl.
My previous write-up on the rather lame injected problems they found:
https://daniel.haxx.se/blog/2025/10/22/aixcc-curl-details/

2025-12-08 23:26:06 GMT

https://files.mastodon.social/media_attachments/files/115/686/525/301/257/818/original/2393aac0c862e37a.png

2025-12-06 13:58:56 GMT

These are two of my favorite memes about companies putting AI into everything.
if you have any additional favorite ones you want to share, I wouldn't mind a few more to spice up one of my coming talks with....
https://files.mastodon.social/media_attachments/files/115/672/960/805/142/824/original/b28af433a33c9d6e.jpg

2025-12-05 22:57:59 GMT

Thanks to @nprofile…dl96 this is quickly becoming the most thorough and detailed resource on the #OpenSSL fork situation. Which fork does what and how?
https://github.com/curl/curl/wiki/OpenSSL-forks