Stefan Eissing

curl maintainer, protocol droid, likes to code.

"Nobody has any idea what is actually going on."

web: https://eissing.org
github: https://github.com/icing

Public Key

npub1uncykwynxpfvy27vnzns7xg74fnqu2ma7mg5hrxj75dmyzph6p0s28cvec

NIP-05 Address

[email protected]

Profile Code

nprofile1qqswfuzt8zfnq5kz90xf3fc0ry025esw9d7ld52t3nf02xajpqmaqhcprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntrpf60v

Publishing to

relay.momostr.pink

Author Public Key

npub1uncykwynxpfvy27vnzns7xg74fnqu2ma7mg5hrxj75dmyzph6p0s28cvec

Show more details

Last Notes

2026-07-18 07:17:12 GMT

Dark and Long. @npub1dvk…2djf
about the AI mania they experience as contractors. Some good advice at the end if you caught up in this as an employee.
https://ludic.mataroa.blog/blog/ai-mania-is-eviscerating-global-decision-making/

2026-05-06 09:24:01 GMT

"That 'responsibble disclosure' Thing"
A post with the details of CVE-2026-23918, the double free vulnerability fixed in Apache httpd 2.4.67.
#apache
https://eissing.org/icing/posts/responsible-disclosure/
https://assets.chaos.social/media_attachments/files/116/526/893/252/284/471/original/356df0201944962e.jpg

2026-04-24 10:08:00 GMT

We now require proof of work before you can submit a #curl security report.
Like mowing @bagder 's lawn or washing his car.😌

2026-04-23 06:44:41 GMT

A security audit of Rust Coreutils found 70 CVEs. 44 of these could be fixed for release 0.8. The rest remain unfixed and undisclosed for now.
Ubuntu 26.04 LTS has added Rust Coreutils EXCEPT the cp, mv, and rm commands.
I assume most of the remaining 26 CVEs are therefore in cp, mv and rm.
How is your „let‘s rewrite it in Rust“ project going?
https://www.phoronix.com/news/Ubuntu-Rust-Coreutils-Audit

2026-04-20 07:12:46 GMT

https://assets.chaos.social/media_attachments/files/116/435/787/398/052/267/original/f954044e8f2c640e.png

2026-02-10 07:49:28 GMT

Do not travel to the USofA, part XXXIV:
- doing everything right is not enough
- white skin does not protect you
- detention may mean a cell shared with 70 people, fighting over food, without medical supplies
- your signature will get forged if you refuse
- judge orders for release on bail are ignored
https://www.theguardian.com/us-news/2026/feb/09/irish-man-seamus-culleton-ice-detention

2026-02-01 09:21:40 GMT

Few people know that you can continue to use curl when your DNS is broken. Just add
—resolve host:port:ip-address
to your command line*.
*) Yes, that about all DNS does for you. Prettty lame, right?💁🏻‍♂️

2026-01-19 09:19:00 GMT

There are good things in the world:
Security training on the topic of "do not click links or open attachments" is obsolete now.
The AI in your inbox will open all attachments and click on all links. Problem solved.💁🏻‍♂️

2026-01-16 08:14:07 GMT

They no longer think that people outside their country have any value (and neither half of their own).
How fascinating. Totally blind to what makes the world work. I wonder why fascism always ends in ruins?🤔
https://www.theguardian.com/world/2026/jan/15/anger-iceland-incoming-us-ambassador-52nd-state-joke

2026-01-15 17:32:05 GMT

- reply

As you are an archeologist, how many centuries are we talking about?

2026-01-13 08:39:22 GMT

To be frank: the report quality on Hackerone is so low by now that the #curl team decided to make CVEs based only on the coolness of the reporter‘s username.
💁🏻‍♂️😌

2026-01-12 08:13:03 GMT

Working on #curl‘s rate limiting again today. It‘s a fun challenge to get this „right“.
Just a few users of this feature, though. Like Steam, Roku and Netflix. That I know of, at least.
Do you use rate limiting transfers? Do you know anyone besides #curl offering this?

2026-01-10 21:49:27 GMT

- reply

Read the quote from John Steward Bell and others in https://en.wikipedia.org/wiki/Superdeterminism
It‘s still an open debate in physics.

2026-01-10 21:37:48 GMT

- reply

Interesting, would love to have been there.
When physicsists argue against determinism because it would destroy free will, I find that not convincing. That seems to require a soul independant of the universe at which point one has left physics and science.
One can have a good time speculating about such things (cocktails help), as evidence and proofs no longer apply. But knowledge is not gained by it.💁🏻‍♂️

2026-01-10 20:59:13 GMT

- reply

Even in a fully deterministic universe you are unique and a fully exact copy of all your quantum states would have to occupy the same place to be an exact copy. We interact with everything around us.
So, you are unique and only you do what you do. And it cannot be predicted from inside this universe. Detrminism does not mean their is a shortcut to finding out what you do next.

2026-01-09 10:25:41 GMT

Still my favorite meme.😌
https://assets.chaos.social/media_attachments/files/115/864/646/963/117/300/original/d81282cf7bc46f6b.jpg

2025-12-24 08:25:46 GMT

Microsoft: „1 engineer, 1 month, 1 million lines of code“
That would mean @npub1cm0…enqe
rewriting 5 #curl projects into Rust in a month.
Microsoft revising the „rewrite over a weekend“ meme to it actually taking them 6 days. For a person they have not hired yet. With tools they still have to invent.
If you are a MS customer, you‘d better start putting more money into Copilot right away!
https://www.theregister.com/2025/12/24/microsoft_rust_codebase_migration/

2025-12-23 08:57:51 GMT

When I jump from a github email notification link into a browser, github shows me the „too many requests“ error page.
Because I am not logged into GH on my phone.
So I am treated like an AI crawler.
By Microsoft. To protect itself.
https://assets.chaos.social/media_attachments/files/115/768/050/709/049/289/original/612b1b3d83f6508b.jpeg

2025-12-17 09:56:32 GMT

- reply

the shaping works by configuring "n bytes per second" and #libcurl tries to never exceed that.
If by "unstable" you mean it might become lower for a while, the next #libcurl release will continue to keep the rate and not go above due to accumulated "credit".

2025-12-17 08:51:26 GMT

When you‘re low on RAM, I recommend using a recent #curl for your internet transfers.
It can shuffle gigabytes back and forth using a few MB of your memory (mostly used by openssl).
If you develop an application, you can use #libcurl to gain its benefits.
Need to shape your traffic? For example bc you run a streaming service? #libcurl does that for you for all HTTP versions.

2025-12-15 09:09:47 GMT

The HackerOne experience.
#curl
https://assets.chaos.social/media_attachments/files/115/722/795/111/365/420/original/b9474174eed719dd.png

2025-12-14 21:37:32 GMT

Rust coreutils v0.5.0, passes 87% of the gnu coreutils test.
It‘s an achievement for the project. Congrats. It does pose questions why Ubuntu thinks it good enough for everyone, though.
*reading on*: 566 tests are passing…
What? The complete gnu coreutils has only 650 tests? For 79 commands?🤪
https://github.com/uutils/coreutils/releases/tag/0.5.0

2025-12-14 08:02:36 GMT

There are many nice people here on the fediverse. Some are smart, some are kind, some are funny, some are just there for the ride.
Many thanks to the admins and mods, for enabling this.🤗
/cc @npub16up…thtj @npub1jv8…ns8e @npub1pux…xw53

2025-12-06 08:17:28 GMT

AI slop is not only in security reports, but also in teams *handling* security reports:
‚The system owner finally relented: “to be honest, I asked ChatGPT and it said that what you said was wrong.”‘
To not waste experts any mote, let‘s fully automate this with chat AIs at both ends, leaving the humans to do something meaningful.
https://joshua.hu/ai-slop-story-nginx-leaking-dns-chatgpt

2025-11-25 05:30:19 GMT

Let‘s Encrypt has made new Root and Intermediate Certs and will start using them now in staging (test) and soon in production, submitting them to root programs (OS and browsers) for inclusion.
If you ship a „CA bundle“ somewhere, you should update that once the new roots are added.
https://letsencrypt.org/2025/11/24/gen-y-hierarchy.html

2025-11-19 06:27:16 GMT

The Cloudflare outage was caused by a Rust ‚.unwrap()‘ panic, undistinguishable to the non-connoisseur from a segfault.
(Dont @ me with undefined behaviour on mythical systems you cannot name)
The effective difference between segfault and unwrap is that the former would have caused a wave of unbearable Rust smugness in my timeline.
This way, it‘s just a coding error. We all do those.💁🏻‍♂️
https://blog.cloudflare.com/18-november-2025-outage/

2025-11-11 06:55:31 GMT

Joshua Rogers (who first successfully used ZeroPath to find curl bugs) on his experiences in an open source project where the maintainer suddenly took the AI pill.
„In general, I find this situation … really sad.“
https://joshua.hu/gixy-ng-new-version-gixy-updated-checks

2025-11-03 07:10:24 GMT

„Bye, Google Search“ - @npub19ua…53cv on making his large blog searchable without search engines.
Index files are on your own web server and pulled selectively by the browser client as needed.
Static files, computed once, scale just so nicely. Tech of the Ancients.😌
https://www.tbray.org/ongoing/When/202x/2025/11/01/Blog-Search-Pagefind

2025-10-31 07:50:51 GMT

- reply

what a bunch of crap.

2025-09-02 10:44:57 GMT

- reply

16 new lines of code per day. The mandate by the BDFL is clear!

2025-08-28 09:04:04 GMT

With only 5 open issues in the curl project, it's becoming quite urgent to write new bugs!

2025-08-21 07:16:24 GMT

https://assets.chaos.social/media_attachments/files/115/065/520/647/825/497/original/b10fc8fd422e6167.jpg

2025-08-14 11:31:51 GMT

@npub1cm0…enqe getting ready for his talk at Froscon on Saturday.
https://assets.chaos.social/media_attachments/files/115/026/893/682/479/734/original/d8b0ff7fcfc27eb8.jpeg

2025-08-07 07:18:12 GMT

OCSP at Lets Encrypt is Off.
https://letsencrypt.org/2025/08/06/ocsp-service-has-reached-end-of-life.html

2025-08-04 06:39:40 GMT

Lets Encrypt issues their first IP address certificate (in staging) and explain their plans to bring that to production later this year.
https://letsencrypt.org/2025/07/01/issuing-our-first-ip-address-certificate.html

2025-07-29 09:05:00 GMT

The 10 billion requests per month to curl.se are a strong indicator for intelligent life in the galaxy.
The Earth population is simply not large enough to explain those numbers.💁🏻‍♂️

2025-07-26 07:00:19 GMT

„Destroy to Production“

2025-07-10 05:33:28 GMT

“one-acre solar farm produces as much energy as 100 acres of corn-based ethanol.”
The countries throttling renewables now (US, but also Germany) are just accelerating their decline. The laws of physics can not be lobbied.
https://www.newyorker.com/news/annals-of-a-warming-planet/46-billion-years-on-the-sun-is-having-a-moment

2025-07-08 11:05:25 GMT

Finally back into single digit open issue numbers in curl.
It was a bit embarrassing to be in the double digits for several weeks. Being a professional project and all...😌

2025-06-30 15:22:47 GMT

AI Slop is strong on HackerOne. After some break when Daniel added the "AI disclosure" questions, people are back now (and ignoring it).
Such a silly world.

2025-06-30 10:16:05 GMT

curl's handling of small transfers are now up to 30% faster (certain conditions apply)😌
Realistically, most of you will not really see this (that much). But should you need it, curl has become a little bit better.
https://github.com/icing/blog/blob/main/curl-req-perf.md
https://assets.chaos.social/media_attachments/files/114/771/770/063/158/730/original/787e128595ec3bec.png

2025-06-25 05:32:29 GMT

So, you are very rich. You do not pay taxes. You do not build great cities. You do not enrich civilization.
But for your wedding, that special day, you want to have all that. Because…the event needs more depth and history. You cannot provide it. Neither can your spouse.
But happily, people have created such things in the past and you can rent it.
It‘s nice that the wealthy before you made that. Even though they had far less money.
You still do not get it? So close…
https://www.theguardian.com/technology/2025/jun/24/inside-the-no-space-for-bezos-movement-one-man-rents-a-city-for-three-days-thats-obscene

2025-06-17 06:26:48 GMT

Reporting a „possible memory leak“ in a 7 year old curl version, because the RSS jumps from 6.2 to 7 MB once.
Could be.
But, dear reporter, we can only try our best to be a better curl *today*. There is no changing the past (hence the name).
We outstretch our hands to you! Come and live with us in the present! Let the ancestors rest and rejoyce among the living!
#curl

2025-05-22 07:35:19 GMT

It has been "0" days that I dropped everything to look at a bogus AI security report.

2025-05-19 09:02:24 GMT

FYI: depending on your hardware, the memory of your crashed processes might be stored in a file called "ddr5".
#mondymeanderings

2025-05-07 14:43:16 GMT

The main problem with hiring a dedicated security researcher for the curl project is that we have no room for a 3rd helipad on the curl super-yacht.
Maybe we need to accelerate our plans for the project's aircraft carrier. The Anti-AI missile system still has some teething problems, though.💁🏻‍♂️

2025-04-30 16:33:57 GMT

Just politely declined a possible invitation to a UN Open Source event in New York.
Honoured to be considered, but I have no intention to encounter an immigration officer under the current US administration.
My best wishes to all who do not have the option to avoid this.🙏🏻

2025-04-28 13:27:30 GMT

- reply

https://www.eia.gov/todayinenergy/detail.php?id=54639
I cannot remember an unplanned outage in Germany in my lifetime.💁🏻‍♂️
Update: which results from less extreme weather and german over-engineering, I guess.

2025-04-28 13:22:57 GMT

- reply

Thank the higher being, not everyone has a power grid as reliable as the US.😌

2025-04-15 22:05:40 GMT

- reply

it seems a small step to just have CNAs own a permanent, published number range or prefix and an RSS feed. (which history teaches us will end up in DNS)
Anyone interested can then build their own database.

2025-04-15 21:26:39 GMT

CVEs are now called Jerries and are classed with up to five Llamas.
🦙🦙🦙🦙🦙

2025-04-09 07:20:11 GMT

- reply

They have a bit of a problem with manufacturing in general in the US, I heard. 💁🏻‍♂️

2025-04-08 07:12:58 GMT

Saw the Shopify CEO‘s memo about how it will be mandatory for their coders (all 10x already) to use the 10x AI assistants to achieve 100x greatness!
Thanks Tobi, my feelings about being self-employed just improved 1000%!

2025-03-29 10:56:46 GMT

curl is the most professionally run project I have ever been in. @npub1cm0…enqe is doing an awesome job!
There are probably many other fine projects out there, but this is definitely one of them.😌

2025-03-18 07:50:57 GMT

Let‘s Encrypt describing their ACME profiles in detail:
‚classic‘: 90 days, all as before
‚tlsserver‘: 90 days, smaller certs, cut lean for its server role and modern clients
‚shortlived‘: ~6 days, otherwise like ‚tlsserver‘
If you have no idea what the mentioned TLS extensions are about, do *not* configure a profile. But if you do, use classic.
If you have a rough idea and serve modern clients, tlsserver cuts some bytes and the auth process is tighter.
https://letsencrypt.org/docs/profiles/

2025-03-04 08:19:37 GMT

@npub1fdr…lvhs on the current things: US intellectual property rights have negative value for countries hit by US trade wars.
https://pluralistic.net/2025/03/03/friedmanite/

2025-02-27 08:26:25 GMT

- reply

if only we had the technology to capture commands and their output in something other than mp4!

2025-02-15 08:12:07 GMT

Got contacted by a friend of my sister about a US family with a queer child that need to leave Washington. They seem to have Berlin on their mind.
Anyone got an idea where they can turn to for advice and help?

2025-02-14 08:18:32 GMT

Do you realize:
someone listening to you, rolling up their sleeves and fixing things
is a really rare occurance, outside open source, once you are through puberty?💁🏻‍♂️

2025-02-13 08:17:20 GMT

We in the curl team believe in the Swedish Way of Life:
Hard coding in your underwear, drinking black coffee with its own event horizon, listening to ABBA all day long.
(I might have mixed up some details - I‘m still learning.💁🏻‍♂️)

2025-02-11 09:01:17 GMT

- reply

h2load from nghttp2 is quite good.

2025-02-08 12:07:17 GMT

- reply

https://assets.chaos.social/media_attachments/files/113/968/181/058/555/826/original/2c67eceec5ba0669.jpg

2025-02-06 11:55:35 GMT

Honored to be part of the first Sovereign Tech Fellowship program. This will support a good chunk of my work on curl and Apache during this year.
It's great to see a government realising the need to support the infrastructure so many rely on, business as well as individuals.
https://www.sovereign.tech/news/meet-the-sovereign-tech-fellows

2025-02-02 09:58:09 GMT

- reply

The segfaults must come from somewhere!

2025-02-02 09:27:10 GMT

- reply

But is the memory safe?

2025-01-27 15:59:27 GMT

Reading about 8bit floats, a topic that has never come up in my work - yet. Interesting..
https://en.wikipedia.org/wiki/Minifloat

2025-01-27 15:48:00 GMT

Don't sell those super nVidia chips to China. Let them invent their own stuff...
...NOT LIKE THAT!

2025-01-23 08:36:38 GMT

- reply

If everyone makes their own meme coin, we could all be billionaires!🍾

2024-12-26 07:50:49 GMT

On my „Keep It Simple“ aversion:
POSIX time, generally described as „Seconds since 1970-01-01“ is not really that. Time is a very messy thing by itself (you need magic to make GPS work) and dates do not make it easier.
The POSIX EPOCH *makes* something very complex seemingly simple to use. It‘s a good design with careful tradeoffs by very smart people.
Time cannot be *kept simple*.
https://aphyr.com/posts/378-seconds-since-the-epoch

2024-12-19 07:40:08 GMT

„wait until -4712-01-01“
Yeah, Copilot, let‘s get you to bed!
https://hachyderm.io/@cpu/113675526200158933

2024-12-13 07:46:13 GMT

Yesterdays link to the Let‘s Encrypt blog dragged in some people who seem to think that CAs are unnecessary or even evil.
LE is s very small group who set out to improve the terrible CA situation and the fucking middle box corruptions.
They did that successfully with a budget that a medium sized city spends on its department for car license plates.
So, my advice: don‘t yell at people who made the world somewhat better or you‘ll soon run out of ones who try.💁🏻‍♂️

2024-12-12 07:34:56 GMT

Let‘s Encrypt @npub15r4…sjlm hints they want to introduce certificates with a lifetime of 6 days.
The conditions of this „new offering“ are not detailed. Looking forward to hear more about it.
https://letsencrypt.org/2024/12/11/eoy-letter-2024/

2024-12-05 07:37:37 GMT

- reply

‚evn‘ is the one with the most portable behaviour everywhere, eg it won‘t work nowhere. 💁🏻‍♂️

2024-12-05 06:43:20 GMT

They are called „curly brackets“ because they appear a lot in the curl source code. 😌
https://mastodon.social/@FrankGevaerts/113595049606774776

2024-11-27 06:23:38 GMT

If you ever wanted to rewrite a project like curl in Rust, this is the weekend you‘ve been waiting for!🤗

2024-11-20 11:55:19 GMT

- reply

must be the flu!

2024-11-05 09:07:56 GMT

If this Election Day thing is a huge success, maybe we should prepare two release versions where people can vote on?
One with increased stability and performance. One that deletes all files from previous versions and tries to occupy all memory.
We should not be making those decisions for you!
#curl

2024-10-30 07:18:02 GMT

„How is the AI code generation, heavily promoted by our CEO, going guys?“
…everyone looks at each other…
„It‘s going well, we love it. We use it all the time!“ „Yeah, really great…“ „Actually…ow! Who kicked me?“
„Great, I‘ll pass that along! How much code is now done by AI?“
…general staring…
„Just a rough estimate, guys!“
„A quarter of us had really time to give it a try…you know, with all the layoffs…“
„So, 25%? Great! CEO will be very pleased with me…us!“
https://cyberplace.social/@GossiTheDog/113392819022170914

2024-10-29 08:25:21 GMT

I expect the kids ringing my door at halloween to not be surprised when they need to watch an ad first. 💁🏻‍♂️🎃

2024-10-27 08:52:19 GMT

If you read books, buy the paper versions.
Those you can share with friends, store for decades and reread again whenever you feel like it.
The really cherished ones, worth for centuries to come…get them as clay tablets. Anything else seems overly optimistic.😌

2024-10-12 07:21:21 GMT

Lets Encrypt will disable OCSP about 6 months after Microsoft Root program allows it to (the browsers have already okayed it).
This all could be over in a year, year and a half. If you need OCSP for your business, you need to investigate alternatives NOW - which are all proprietary.
Apache ACME will handle this change just fine. Stapling will of course no longer be provided to clients.
https://letsencrypt.org/2024/07/23/replacing-ocsp-with-crls/

2024-10-10 07:01:20 GMT

„the Jira board […] where management looks down on people who practice craftsmanship.“
„We have another saying on our team, which is ‚Stop asking questions, you're only going to hurt yourself‘.“
„I resign at 2:00 PM.“
@npub1dvk…2djf blogged about his exit. Congrats for doing it! Traded ticking down savings for my sanity as well.
https://ludic.mataroa.blog/blog/get-me-out-of-data-hell/

2024-10-05 07:24:45 GMT

I like writing code. It‘s a pleasure at the cost of testing, documenting, user support and debugging.
Let‘s say 1 part joy and 3 parts meh.
If your AI really would make me twice as fast at coding, it would shift the joy ratio to 1 in 6.
And if you AI writes more bugs than me, it could easily become 1 in 12 or worse.
Do not want.💁🏻‍♂️

2024-09-30 07:39:51 GMT

„From this [twitter/X] transparency report, they’ve suspended 464M accounts because of spam & “manipulation” just for the first six months of 2024!“
That is ~30 bot accounts per second.
https://www.techdirt.com/2024/09/29/funniest-most-insightful-comments-of-the-week-at-techdirt-129/

2024-08-28 10:25:44 GMT

Why are there no DOG 6 and 8 cables?
All our social networks only use CATs. I think this explains a lot.🤨

2024-08-19 09:19:47 GMT

When I work a year on #curl that amounts to about 1.5 milliseconds spent on each installation.
Seems worth it.😌

2024-08-13 07:22:36 GMT

Pupils right now: „I could not do my homework because there was a Massive DDoS attack!“🥸

2024-08-06 06:59:20 GMT

Again, today a 1000kg bomb from our friends in the UK/US needs to be defused in a major city. It has been buried in the ground for ~80 years.
We still need to do that several times each year. Do not let fascists rule your country. 👆
https://social.cologne/@koeln/112913725144571786

2024-08-02 07:15:52 GMT

Mastodon devs get a lot of flak these days for not solving the problems people have with abusers.
Don‘t do that to an OSS project and the people working on it. They are not obliged to solve your problems. They might want to, but are restricted to do so. In time, money, skill or depth of understanding.
Calling these devs racist for not solving the problem with racism is deeply unfair.

2024-08-01 07:27:05 GMT

Thinking about a curl kernel driver with live updates. Lots of potential.

2024-06-26 07:34:47 GMT

„Why, oh why, isn‘t there more QUIC use?“ ask people on the QUIC mailing list.
It‘s impossible to answer. Some people probably don‘t care. Some would use it if they could (thanks, OpenSSL, not). For some, they already hit their sweet spot. Some are already using it near 100% (Facebook, controlling servers and clients).
In the curl project, our goal to give you good options to use all protocols, with defaults merely for usability reasons.
You will then select what is best for you.

2024-05-28 08:23:29 GMT

Sometimes we forget what a marvel 'git' really is. Just did
git show <commit-id>
and it pulled out a curl change from 16 years ago in the fraction of a second.
Hat off to its makers and maintainers!