daniel:// stenberg://

Internet protocols geek at wolfSSL. I lead the curl project. I don't know anything.

website: https://daniel.haxx.se/
github: https://github.com/bagder

Public Key

npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsvdhkcz7r724plrvs0p8t5fvyfgs6jfk0xle9ft2htfsrmgtsp9jcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dswe48fp

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe

Show more details

Last Notes

2024-07-14 14:07:47

Unchecked in #Firefox 128.
https://files.mastodon.social/media_attachments/files/112/784/758/926/674/518/original/6cc29f52a266389a.png

2024-06-25 09:48:02

Here's a user in the wild who was bitten by the Apple "backdoor" in #curl:
https://github.com/curl/curl/discussions/14009

2024-06-23 16:26:24

Here's another good idea coming from the #curl user survey:
Support "curl -h --insecure" etc to output the manpage section for the --insecure command line option in the terminal. Should be possible to work with either long or short versions of command line options.
https://github.com/curl/curl/pull/13990
Open for grabs!

2024-06-20 13:13:19

Inside 22,734 Steam games
https://daniel.haxx.se/blog/2024/06/20/inside-22734-steam-games/
#curl

2024-06-16 11:41:40

- reply

This is the same fun Windows feature biting PHP: https://arstechnica.com/security/2024/06/php-vulnerability-allows-attackers-to-run-malicious-code-on-windows-servers/

2024-06-16 10:06:20

- reply

closed a third. Turns out Windows sometimes do fun IDN-like unicide-to-ascii conversions for command lines that then allows users to insert unicode characters in cmdline argument when run on windows, and they are converted to their ASCII look-alike counterparts. Which can be abused to insert arguments and what not.
Not a curl security flaw. Just the weirdest Windows feature I've seen in a while. And probably a security problem in many places.

2024-06-15 22:51:26

- reply

one of them claimed the fact that you can run "curl http://¹²7.0.0.1" is a vulnerability.
I insist this is IDN working as designed. However crazy it may look like.You just cannot filter URLs like that and assume it will work.

2024-06-15 22:41:30

closing hackerone reports as not applicable without mercy on a Saturday night

2024-06-14 08:18:23

The #curl website has been hosted by #Fastly CDN for over seven years now. I cannot ask for a better service and a friendlier company to help us.
Starting now they offer a free tier. https://www.fastly.com/pricing/
Here's my blog post from seven years ago: https://daniel.haxx.se/blog/2017/05/02/a-curl-delivery-network/

2024-06-13 11:05:14

- reply

if you have any Qs for me ahead of time, fire them away here!

2024-06-12 16:05:56

- reply

we ran our own CVS pserver instances!

2024-06-12 09:07:36

my "advanced #libcurl" webinar runs tomorrow. Free of charge. Take the opportunity and ask me anything about (using) libcurl.
https://us02web.zoom.us/webinar/register/9316747720453/WN_zudyMou_RviqdgL-3QQXeg#/registration
https://files.mastodon.social/media_attachments/files/112/602/379/565/271/830/original/00d7149ba6ab9ebe.jpg

2024-06-11 12:01:21

Why #curl closes PRs on #GitHub
https://daniel.haxx.se/blog/2024/06/11/why-curl-closes-prs-on-github/
https://files.mastodon.social/media_attachments/files/112/597/406/532/447/211/original/aa67078fc2555598.jpg

2024-06-10 09:40:35

Experimental HTTP/3 support is soon coming to #curl on #debian. Brace for impact! https://curl.se/mail/distros-2024-06/0000.html

2024-06-07 09:10:02

On this day ten years ago, we lost our innocence as the former single page HTTP/1.1 specification (RFC2616) "exploded" into six separate new documents (RFC7230 and family). We could then no longer pretend HTTP was a simple protocol.
In June 2022, it was again updated:. "RFC 9110 and family". The spec is now split up into five main documents: semantics, caching and separate specs for each version: 1.1, 2, 3.
Those five documents hold 143,000 words combined. HTTP is not easy.

2024-06-06 22:29:21

bye bye hosting c-ares web
https://daniel.haxx.se/blog/2024/06/06/bye-bye-hosting-c-ares-web/
I passed on the duty after two decades.

2024-06-04 17:47:35

"maybe we need this in the future" is a bad idea for writing good code. If we need that flexibility in the future, other things will have changed as well. Better do it then, not complicating matters now.
Turning down needlessly flexible code like a boss.

2024-06-04 11:07:49

14.1% of #curl users say they have used it for 18 years or more

2024-06-03 23:10:31

Some of the emails I get are truly sad reflections of the complicated and rather sorry state of things we are in. Like this.
(also, apparently #curl is used in another popular game)
"Rainbow 6 Siege Activation issue"
https://bagder.github.io/emails/2024/2024-06-03.html

2024-05-31 15:04:11

"Hello Daniel, On behalf of the European Commission OSPO, I send you our gratitude for that fun, engaging and insightful presentation to our - internal - open source community."
Indoctrinating the world, one presentation at a time.

2024-05-30 09:13:14

#Windows users running stupid scanners now contact us for support regarding CVE-2023-46218 which the scanners say affects #curl 8.4.0 shipped by Microsoft.
It would, if their version was built to use #iibpsl, a prereq for this CVE, which #Microsoft does not.
Security scanners. A snake oil business.
https://curl.se/docs/CVE-2023-46218.html

2024-05-29 12:45:15

From the #Fastly dashboard showing the "Percentage of cache hits to all cacheable content over time" for the last 30 days for the #curl website:
A sustained 99.95% cache hit rate.
https://files.mastodon.social/media_attachments/files/112/523/967/008/434/940/original/005d1d6ede64cb7d.png

2024-05-23 23:40:04

"On behalf of Google Open Source, I would like to thank you for your contribution to #Curl."
https://files.mastodon.social/media_attachments/files/112/492/565/807/463/629/original/578094b07eeafbe7.png

2024-05-21 10:43:55

When #Mozilla created their new logo with :// in it, the team behind reached out to me and asked if I had any objections since #curl already was using :// in our logo.
I did not object - I approved of it. I think it validated our logo choice and I am jealous they have a name that can hold :// integrated the way they do.
(I was employed by Mozilla at the time)

2024-05-20 08:46:50

“I could rewrite #curl”
Here's my collection of some less cheerful quotes to keep me firmly grounded. Blogged three years ago today:
https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/
https://files.mastodon.social/media_attachments/files/112/472/068/305/454/249/original/9ef11f71f6248df1.png

2024-05-15 14:56:29

In the #curl project, being written in C, we always work on simplifying the code. One way is to use more internal helper functions and avoid direct use of some functions that are often involved in C mistakes/vulnerabilities.
To measure how this develops, we count number of these function calls used per every thousand lines of code. Over time.
In a graph.
https://files.mastodon.social/media_attachments/files/112/445/207/733/525/135/original/c88064dd9b1a8186.png

2024-05-14 10:24:12

What's (open source) maintaining?
https://files.mastodon.social/media_attachments/files/112/438/478/289/905/689/original/9cff85acf7ec8e75.jpg

2024-05-14 08:14:33

Please consider donating a few minutes of your time and answer the #curl user survey 2024:
https://daniel.haxx.se/blog/2024/05/14/curl-user-survey-2024/

2024-05-10 09:40:06

It has been a long time coming, but I've made it official:
"Daniel no longer answers questions on stackoverflow. Use a dedicated public curl forum for accurate and timely answers about anything #curl. "
(yes, speaking about myself in 3rd person)
https://stackoverflow.com/users/93747/daniel-stenberg

2024-05-08 07:40:07

"To me, the latest is the latest my OS provides me. If #curl maintainers dont care about pushing the latest into the OSes they support, it's not me to blame. I think curl maintainers should push Centos to provide the latest to all users. What's the purpose of you fixing multiple bugs and security holes if you dont spend time to make it available to the broader audience?"
We are obviously all just too lazy.
https://github.com/curl/curl/issues/13546

2024-05-07 10:52:46

- reply

"Is AI helpful for curl?"
- Did you mean cruel?
- 1923
- .. had a farm, AI-AI-O

2024-05-07 10:27:51

It is soon time for the annual #curl user survey. Anything in particular I need to remember to ask this time around? https://curl.se/mail/lib-2024-05/0008.html

2024-04-26 09:13:19

Over the last five years of #curl's bug-bounty we have received 489 submissions. For these 489 submissions the *median* first-response time has been, as calculated by Hackerone: 0 (zero) hours. If this does not ooze of awesomeness from a security team I don't know what does.
I presume they round or truncate to the nearest integer hour. Still means more than half of them got answered within an hour. Whenever or from wherever they were filed.
We take security seriously.

2024-04-25 08:45:12

#libcurl has proudly served as the HTTP(S) engine in #git for nineteen years now.

2024-04-24 07:54:25

Nine years ago today, a #curl command line was prominent on an even larger display...
https://daniel.haxx.se/blog/2015/04/24/curl-on-the-nasdaq-tower/
https://files.mastodon.social/media_attachments/files/112/324/641/126/499/908/original/256fc2ea173f88f6.jpg

2024-04-23 17:19:42

When in my car, I found myself in my car.
https://files.mastodon.social/media_attachments/files/112/321/198/276/987/614/original/aea7988204aef3a4.jpg

2024-04-22 10:00:38

#curl is just the hobby
https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/
https://files.mastodon.social/media_attachments/files/112/313/814/939/425/232/original/6932c2f073f909ae.jpg

2024-04-15 11:50:48

I was reminded of the great #Cisco security fix of 2019
#curl
https://files.mastodon.social/media_attachments/files/112/274/606/425/317/078/original/9c93f8e8cc3025b9.jpg

2024-04-02 10:55:58

There simply is no established or easy way to detect backdoors done the #xz way. We give powers and trust to maintainers because that is the development model.
Anyone suggesting there is an easy fix has not understood the issues at hand.
But we are Open Source which allows everyone to dig, check, read code and investigate.

2024-04-01 10:03:34

- reply

for sure. But we can all help our companies learn. Also, an excellent way to "sponsor" is to allow an employee to spend work hours to do upstream work.

2024-04-01 09:57:28

(Easy) ways to help struggling open source projects:
- step in and help review a few PRs
- help the project triage/reproduce bugs
- if code in the PR looks complicated or is hard to understand, ask for an explanation
- express your gratitude to the maintainers
- make your company sponsor projects they depend on

2024-03-31 23:10:24

I suppose his book should've given us a hint
https://files.mastodon.social/media_attachments/files/112/192/348/113/668/814/original/258624a3740240d0.png

2024-03-29 22:40:51

- reply

Maybe. I won't rule it out, but to me its a question of efforts and what we get in return. I'm sure lots of people will now ask (or tell) me to. But no one will help me or fund me do it.

2024-03-29 22:34:59

Can I just say that I have created #curl releases "the #xz way" since the 90s: I generate the release tarballs on my machine. It makes the tarball have (generated) files included that are not present in git. It's a feature. But it also makes it harder for observers to figure out if the additional files are fine or not.

2024-03-26 10:06:58

Dependency explosion is a problem and maybe the time is ripe to start thinking about how clever it is to rely on hundreds of tiny components you don't know, don't control and that keep changing.
https://tweedegolf.nl/en/blog/119/sudo-rs-depencencies-when-less-is-better

2024-03-25 13:38:59

For people with an interest in #curl in distros, there is a new mailing list being setup for this specific purpose. Sign up to curl-distros here: https://lists.haxx.se/listinfo/curl-distros
Patching, issues, collaboration etc.

2024-03-25 08:53:18

in case you too want to cross-stitch it
https://files.mastodon.social/media_attachments/files/112/155/241/936/438/692/original/3c6149c470464ff2.png