Nostr notes by daniel:// stenberg://

"So are you developing anything these days or are you mostly ...

2026-08-27T07:12:38Z

"So are you developing anything these days or are you mostly maintaining what is already there?"

Oh my sweet innocent child...

Hey, #curl 8.22.0-rc3 is available at https://curl.se/rc/

2026-08-26T06:55:56Z

Hey,

#curl 8.22.0-rc3 is available at https://curl.se/rc/

Mythos: 0 Aisle: 29 😱

2026-08-25T13:46:43Z

Mythos: 0
Aisle: 29

😱

Heads up! In #curl 8.23.0 (end of October 2026) SMB(S) support ...

2026-08-24T07:48:12Z

Heads up! In #curl 8.23.0 (end of October 2026) SMB(S) support will be gone.

https://github.com/curl/curl/pull/22652

I'm under no illusion that the last vulnerability has been ...

2026-08-24T06:54:22Z

In reply to nevent1q…qnqr
_________________________

I'm under no illusion that the last vulnerability has been found. It just might be that the easy ones are picked now.

We are at 9 days to the next #curl release and we have only ...

2026-08-24T06:52:20Z

We are at 9 days to the next #curl release and we have only *three* pending CVEs to announce (two low, one medium).

Three is like nothing!

(Mythos says it can't find any more. Zeropath finds no vulnerabilities. Codex security shows an empty list.)

Me and @npub1unc…cvec spotted #curl did one alloc more all of a ...

2026-08-21T09:40:34Z

Me and Stefan Eissing (npub1unc…cvec) spotted #curl did one alloc more all of a sudden and together we chased it down and it should now be gone again.

Now eagerly waiting the next round of performance tests to update the graphs so that we can confirm our beliefs.

just another day in the #curl factory

"I’d love to propose a community initiative around your ...

2026-08-20T12:06:38Z

"I’d love to propose a community initiative around your work, with the idea of creating a token inspired by curl, while giving you 100% of the fees generated."

Noooooo

Because why wouldn't your Nibe geothermal heat pump run ...

2026-08-20T07:10:54Z

Because why wouldn't your Nibe geothermal heat pump run #curl?

(Thanks Jan Lundmark)

I've talked to several new #curl customers over the last few ...

2026-08-20T06:25:12Z

I've talked to several new #curl customers over the last few weeks who want back-ported security fixes for their older curl releases. To get them secured without having to do a full version upgrade.

Stay tuned for multiple patch releases coming soon for older curl version branches. Shipped under the rock-solid curl umbrella, for paying customers.

If YOU also need a security-fixed older curl release - let's talk!

It's now 10 whole years since I tried to do my duty for the ...

2026-08-19T06:00:23Z

It's now 10 whole years since I tried to do my duty for the community and remove the #curl alias from PowerShell.

It's still there.

https://daniel.haxx.se/blog/2016/08/19/removing-the-powershell-curl-alias/

There’s a libcurl.dll in my system32 ...

2026-08-17T21:28:06Z

There’s a libcurl.dll in my system32

https://daniel.haxx.se/blog/2026/08/17/theres-a-libcurl-dll-in-my-system32/

Give the team a graph and things happen. #curl now allocates less ...

2026-08-15T21:11:29Z

Give the team a graph and things happen.

#curl now allocates less than 130,000 bytes memory to download a HTTP file of any size.

102,400 bytes of that chunk is the download buffer. curl has *never* allocated less non-download buffer memory for this use case.

All it takes is attention to detail, a sensible architecture and lots of dedication.

My week: ...

2026-08-14T21:48:47Z

My week: https://lists.haxx.se/pipermail/daniel/2026-August/000164.html

security, performance, backports, Windows, LG unit

AI slop isn't dead! https://hackerone.com/reports/3938185

2026-08-14T12:05:45Z

AI slop isn't dead!

https://hackerone.com/reports/3938185

Yeps, gnuplot's home page is still on clear text HTTP:// ... ...

2026-08-13T08:14:23Z

Yeps, gnuplot's home page is still on clear text HTTP:// ...

http://www.gnuplot.info/

(I replied:) > *What are you willing to pay for someone to ...

2026-08-11T11:38:18Z

(I replied:)

> *What are you willing to pay for someone to take care of the Windows side?*

We get exactly zero dollars for our windows version of curl and you're welcome to get a share of this revenue!

No one in the seven-person curl security team is on or runs ...

2026-08-08T21:21:48Z

No one in the seven-person curl security team is on or runs Windows. People sending us Windows-only flaws makes us groan and roll eyes. And sometimes hyperventilate a little.

Why this is so? Because no one in the team wants to be on Windows, and no other curl contributor is active enough, Windows-knowledgeable and interested in joining the team. Let me know if you are someone like that who I've just not noticed.

At times I'm thinking we should drop support for Windows. ...

2026-08-07T21:56:17Z

At times I'm thinking we should drop support for Windows. It's such a nightmare to support. #curl

My August 2024 post thus got a happy update in the end of it: ...

2026-08-06T12:28:22Z

My August 2024 post thus got a happy update in the end of it:

https://daniel.haxx.se/blog/2024/08/14/slow-tcp-connect-on-windows/

Anyone using HTTP/2 server push with libcurl? If you use this ...

2026-08-05T07:44:19Z

Anyone using HTTP/2 server push with libcurl?

If you use this feature in libcurl, please let us know. It is being deprecated all over, including in specs, browsers and servers and I believe the time has come for us to drop it from libcurl in the future as well.

So I'm curious to know if anyone actually (still) uses it.

I should get a hat. 🤠

2026-08-04T07:33:19Z

In reply to nevent1q…ndlw
_________________________

I should get a hat. 🤠

My guide on how to invite me to do a talk: ...

2026-08-04T06:58:30Z

My guide on **how to invite me to do a talk**:

https://daniel.haxx.se/how-to-invite-me.html

As an Open Source person I am apparently expected to keep doing ...

2026-08-03T21:33:51Z

As an Open Source person I am apparently expected to keep doing things for free so I get invited to participate in EU policy events in Brussels, with not even an attempt to offer me compensation for travel, lodging or time.

So I decline.

and an additional 4 minutes until that first report was closed as ...

2026-08-03T07:09:28Z

In reply to nevent1q…qf56
_________________________

and an additional 4 minutes until that first report was closed as not applicable ...

it took 30 minutes from the reopen until the first report ...

2026-08-03T07:05:58Z

In reply to nevent1q…rput
_________________________

it took 30 minutes from the reopen until the first report appeared

What the bliss taught us ...

2026-08-03T06:42:41Z

What the bliss taught us

https://daniel.haxx.se/blog/2026/08/03/what-the-bliss-taught-us/

#curl

Welcome Ramesh Adhikari as #curl commit author 1503: ...

2026-07-31T07:31:04Z

Welcome Ramesh Adhikari as #curl commit author 1503: https://github.com/curl/curl/pull/22449

If you were looking for the minimum versions of the dependencies ...

2026-07-29T12:28:01Z

If you were looking for the minimum versions of the dependencies #curl and libcurl can use, they are now all listed on this brand new page on the site:

https://curl.se/dev/dependencies.html

That image of my "AI sentiment" change over time comes ...

2026-07-28T11:23:30Z

In reply to nevent1q…uwjz
_________________________

That image of my "AI sentiment" change over time comes from a LinkedIn post by
Paul Calhoun

https://www.linkedin.com/posts/paul-c-15339644_i-made-a-sentiment-over-time-graph-of-curl-share-7468010494277210113-K0Ta/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAABYyOgBNCf2kPMYnXTQo7dtdXN7IYuIecU

Michael Winser of Alpha Omega talked about the current Open ...

2026-07-28T07:17:05Z

Michael Winser of Alpha Omega talked about the current Open Source security situation and AI at BSDCan 2026.

Lots of material in there from yours truly.

https://youtu.be/gq4-g9ELZgc

at 278 command line options(!)

2026-07-27T07:40:35Z

In reply to nevent1q…5qg7
_________________________

at 278 command line options(!)

HTTP Message Signatures with #curl ...

2026-07-27T06:55:21Z

HTTP Message Signatures with #curl

https://daniel.haxx.se/blog/2026/07/27/http-message-signatures-with-curl/

1,500 #curl authors ...

2026-07-25T14:29:49Z

1,500 #curl authors

https://daniel.haxx.se/blog/2026/07/25/1500-curl-authors/

No #curl CVEs at all during July because of bliss. Highly ...

2026-07-23T14:54:13Z

No #curl CVEs at all during July because of bliss. Highly recommended.

macOS has undocumented functions that allow applications to do ...

2026-07-20T23:00:12Z

macOS has undocumented functions that allow applications to do faster UDP...

https://github.com/curl/curl/pull/22341

glibc has this open bug to resolve link-local host names for ...

2026-07-20T21:53:26Z

glibc has this open bug to resolve link-local host names for AF_INET6 since 2012

https://sourceware.org/bugzilla/show_bug.cgi?id=14413

Now this causes problems to #curl, as it now does separate name resolves for IPv4 and IPv6 in order to start connecting once the first response is in. 😕

https://github.com/curl/curl/issues/22330

The HTTP Workshop in Basel, day three. The last day! ...

2026-07-16T20:02:07Z

The HTTP Workshop in Basel, day three. The last day!

https://daniel.haxx.se/blog/2026/07/16/workshop-basel-day-three/

You don't see people from the frontier models brag about how ...

2026-07-13T20:46:11Z

You don't see people from the frontier models brag about how many vulnerabilities they FIXED, only how many they FOUND.

The kids are alright. From an email I received today: I am ...

2026-07-12T21:30:03Z

The kids are alright. From an email I received today:

I am writing to express my huge appreciation for your incredible work and dedication to maintaining curl—one of the most essential building blocks of the modern internet.

I am a 16-year-old IT student from Poland. Inside my home server laboratory, your tool is a vital part of my daily life. Whether I am writing backend web tools, integrating APIs, or creating system automation scripts, curl is always the absolute backbone of my setups.

The current top story on the FT Magazine is pay-walled but ...

2026-07-12T18:13:14Z

The current top story on the FT Magazine is pay-walled but features some mentions of #curl and yours truly... (the picture shows the start of it)

https://www.ft.com/content/cec8df9e-b43b-4cd1-8feb-c07e804e8d33

Bliss in progress. #curl maintainer on a beach. ...

2026-07-08T06:04:22Z

Bliss in progress. #curl maintainer on a beach.

"You're a commercial user of libcurl who use it for free ...

2026-07-03T06:31:12Z

"You're a commercial user of libcurl who use it for free and you ask a volunteer to fix your problem on his spare time?"

Sometimes I need to say it.

Nostr event nevent1qqs0tveefz2thm25fnjggdw6y6pdu4qfsnfdmew024qcfwhm2ts8fkgzyrrdakqhslj4g0cmyrcf6aztpz2yx5jdneh7f226466vq76zuqfvkazr2cu

2026-07-01T07:18:20Z

"In May 2026, the GitHub Advisory Database published 1,560 ...

2026-06-29T20:34:38Z

"In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories—more than five times our typical monthly output and the highest in its history."

https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/

Do excellent vulnerability reports It is time for me to try to ...

2026-06-29T07:48:05Z

Do excellent vulnerability reports

It is time for me to try to help future reporters by providing a short guide on how to submit a truly excellent vulnerability report to an Open Source project.

https://daniel.haxx.se/blog/2026/06/29/do-excellent-vulnerability-reports/

Nine years ago I was about to get on a plane to San Francisco via ...

2026-06-28T15:26:47Z

Nine years ago I was about to get on a plane to San Francisco via London, from Stockholm. I was refused to board because "something was wrong with my ESTA"...

https://daniel.haxx.se/blog/2017/06/28/denied-entry/

I reported a possible security problem against OpenSSL 4.0.1 ...

2026-06-26T07:44:57Z

I reported a possible security problem against OpenSSL 4.0.1 found with no AI at all. Like a cave man.

my experience from working with them on and off for many months ...

2026-06-24T22:24:27Z

In reply to nevent1q…jyvh
_________________________

my experience from working with them on and off for many months now is nothing but good. Skilled, professional engineers without any bureaucracy. They know their stuff, and they've been very good at listening in and adjusting for our needs and wants.

AISLE Discovers 6 New CVEs in #curl, Including the Oldest Issue ...

2026-06-24T21:56:53Z

AISLE Discovers 6 New CVEs in #curl, Including the Oldest Issue Ever Reported

https://aisle.com/blog/aisle-discovers-6-new-cves-in-curl-including-the-oldest-issue-ever-reported

https://www.twitch.tv/curlhacker is live, the presentation starts ...

2026-06-24T08:51:45Z

https://www.twitch.tv/curlhacker is live, the presentation starts in a few minutes

all the hackerone reports for the curl 8.21.0 vulnerabilities are ...

2026-06-24T08:33:19Z

all the hackerone reports for the curl 8.21.0 vulnerabilities are now public

I hope this "flood" explains why we feel we need a summer ...

2026-06-24T06:32:19Z

In reply to nevent1q…27tr
_________________________

I hope this "flood" explains why we feel we need a summer of bliss after this.

https://daniel.haxx.se/blog/2026/06/15/curl-summer-of-bliss/

We publish 18 new #curl vulnerabilities in association with this ...

2026-06-24T06:30:08Z

In reply to nevent1q…ukx9
_________________________

We publish 18 new #curl vulnerabilities in association with this release. They are all listed in this email. 4 MEDIUM, 14 LOW.

https://curl.se/mail/lib-2026-06/0026.html

Welcome to #curl 8.21.0 ...

2026-06-24T06:03:26Z

Welcome to #curl 8.21.0

https://daniel.haxx.se/blog/2026/06/24/curl-8-21-0/

Cool to see the Linux Kernel follow #curl and ban use of strncpy ...

2026-06-23T06:12:18Z

Cool to see the Linux Kernel follow #curl and ban use of strncpy 😎

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1a3746ccbb0a97bed3c06ccde6b880013b1dddc1

Nostr event nevent1qqs2sdfplkl6e6zw37a7qlmqxyj0j8j094uez2an3ghgc27vfe8prkczyrrdakqhslj4g0cmyrcf6aztpz2yx5jdneh7f226466vq76zuqfvkw5f0jw

2026-06-22T21:45:11Z

https://daniel.haxx.se/email/2020-06-04.html

#curl may have more CVEs to report than ever, but the less ...

2026-06-18T09:21:49Z

#curl may have more CVEs to report than ever, but the less visible trend is that they are all less sever in recent years

This is the graph look with the pending announcements included. Per the year the vulnerabilities were published.

If I get a voice I think I better use it for good. I've ...

2026-06-18T06:57:09Z

If I get a voice I think I better use it for good. I've agreed to this meeting. What do you think I should bring/suggest/insist on?

I must be weird, but when people are downright rude and hostile ...

2026-06-17T06:40:16Z

I must be weird, but when people are downright rude and hostile in issues, it makes me less interested in helping out.

Surely the rude people know this, so...why do they still do it?

curl.se now advertises HTTP/3 and HTTP/2 support in DNS so you ...

2026-06-16T08:23:33Z

curl.se now advertises HTTP/3 and HTTP/2 support in DNS so you should be able to read the curl documentation several milliseconds faster than before

Today I learned that glibc has a broken %s implementation in ...

2026-06-16T07:12:09Z

Today I learned that glibc has a broken %s implementation in strftime. It applies the timezone even when we want UTC...

https://github.com/curl/curl/issues/22038

Later this week #GitHub introduces a way to limit how many pull ...

2026-06-15T20:51:41Z

Later this week #GitHub introduces a way to limit how many pull requests users without write access can have open at one time... As a way to combat heaps of low-quality PRs.

I'll start out trying with this set to 2 for #curl.

The #curl project will not accept or otherwise handle any ...

2026-06-15T05:56:09Z

The #curl project will not accept or otherwise handle any vulnerability reports during the month of July 2026. We call it the curl summer of bliss.

https://daniel.haxx.se/blog/2026/06/15/curl-summer-of-bliss/

working theory: we get fewer vulnerability reports late in the ...

2026-06-11T06:25:13Z

working theory: we get fewer vulnerability reports late in the weeks as the researchers have all run out of tokens by now...

Out of the 16 pending #curl CVEs: 13 are severity LOW 3 are ...

2026-06-09T09:19:23Z

Out of the 16 pending #curl CVEs:

13 are severity LOW
3 are severity MEDIUM
9 of them are libcurl only (not the tool)
3 are "C mistakes"
2 are younger than six months old
1 is older than 25 years

The badge ...

2026-06-04T06:43:27Z

In reply to nevent1q…hrfj
_________________________

The badge

30 minutes until me time at #bsidesvilnius ...

2026-06-04T06:42:34Z

30 minutes until me time at #bsidesvilnius

"Today, we announce dav2d, a fast decoder for the new AV2 ...

2026-06-02T15:33:52Z

"Today, we announce dav2d, a fast decoder for the new AV2 codec, developed by members of the VideoLAN community."

https://jbkempf.com/blog/2026/dav2d/

Number of Hackerone submissions to #curl the first five months of ...

2026-06-02T13:41:14Z

Number of Hackerone submissions to #curl the first five months of 2026 compared to the same period of 2025. Counted weekly. The blue is 2026. The yellow is 2025.

While the curl project does not ban the use of AI tools - ...

2026-06-02T07:33:44Z

While the curl project does not ban the use of AI tools - recognizing they can enhance development - AIs are merely tools. Humans must always drive the process, taking full responsibility for presenting, reviewing, and understanding every change.

https://github.com/curl/curl/issues/21782 and ...

2026-05-27T20:46:06Z

In reply to nevent1q…lgfc
_________________________

https://github.com/curl/curl/issues/21782 and https://github.com/curl/curl/issues/21779 for example

Pasting a huge AI generated explanation to a problem in an issue ...

2026-05-27T20:39:22Z

Pasting a huge AI generated explanation to a problem in an issue or pull-request is nothing but RUDE. Don't do it. You look stupid and the receivers of that feel insulted.

We are humans. We communicate like humans. Fine, use the tools you like, but don't insult us.

curl docs: "The curl project cannot handle vulnerability ...

2026-05-26T22:10:17Z

curl docs: "The curl project cannot handle vulnerability reports sent to us over email. We lose track of the reports. We cannot easily disclose them. Please do not send us reports over email."

reality: we get emailed reports almost daily

🤔

The pressure for us in the #curl project right now ...

2026-05-26T06:02:21Z

The pressure

for us in the #curl project right now

https://daniel.haxx.se/blog/2026/05/26/the-pressure/

I will talk "High-Quality Chaos: On finding flaws in code ...

2026-05-25T14:06:33Z

I will talk "High-Quality Chaos: On finding flaws in code with AI" later this week at KTH in Stockholm.

Free to attend for everyone, but you need to register: https://events.vtools.ieee.org/m/559728

#curl up 2026 starts today ...

2026-05-23T06:31:15Z

#curl up 2026 starts today

Thanks for your expressed concern for my well-being in these ...

2026-05-22T07:41:18Z

Thanks for your expressed concern for my well-being in these testing times.

Yes, it is exhausting and I did 50 hour work weeks already before this. My wife and family help me keep sane and are effectively "non-digital activities" that help me to momentarily let go of these things once in a while.

Also: no, there are no companies and no organizations that step up to help. Not before. Not now. We're on our own. As always.

Queue xkcd dependency image.

not even half-way through this #curl release cycle we are already ...

2026-05-22T06:48:04Z

not even half-way through this #curl release cycle we are already at 11 confirmed vulnerabilities - and there are three left in the queue to assess and new reports keep arriving at a pace of more than one/day

11 CVEs announced in a single release is our record from 2016 after the first-ever security audit (by Cure 53).

The next chance to endure my blabbing in Stockholm is in exactly ...

2026-05-21T14:28:57Z

The next chance to endure my blabbing in Stockholm is in exactly one week on KTH - open to the public but you need to register ahead of time.

https://events.vtools.ieee.org/m/559728

"The state of #curl" is my main talk at curl up on this ...

2026-05-21T07:59:02Z

"The state of #curl" is my main talk at curl up on this Saturday, now at 119 slides because I can't help myself.

Contains ego material such this (see picture below).

What a year.

C89 is like my backyard and comfort zone. That's where I want ...

2026-05-19T15:19:33Z

In reply to nevent1q…pfnh
_________________________

C89 is like my backyard and comfort zone. That's where I want to be.

What would be the biggest downside if we just stopped considering ...

2026-05-19T14:17:03Z

What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy?

Now I'm happy I wasted time making those silly sinus-moving ...

2026-05-19T13:16:02Z

Now I'm happy I wasted time making those silly sinus-moving things for the alternative #curl progress meter. (seen in the log output for a failed GitHub CI job)

Loaded with work I have had to turn down some of the talks I ...

2026-05-19T06:00:39Z

Loaded with work I have had to turn down some of the talks I previously planned to do in my near future. Sorry for that.

Thanks Dave for the advice. ...

2026-05-18T12:21:19Z

Thanks Dave for the advice.

https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/comment-page-1/#comment-27479

A slide from my talk this Thursday. How we view our role in the ...

2026-05-18T06:24:08Z

A slide from my talk this Thursday. How we view our role in the curl project.

https://www.meetup.com/openinfra-user-group-sweden/events/313615139/

50K!? 😵 ...

2026-05-17T15:39:36Z

50K!? 😵

I'll talk to a closed circle of "critical Swedish ...

2026-05-15T08:52:53Z

I'll talk to a closed circle of "critical Swedish infrastructure" leadership peeps on Monday about the current high quality chaos. It makes our current overload pain feel timely.

Register to attend my talk at KTH Stockholm on May 28: ...

2026-05-14T18:34:14Z

"An interactive terminal game for learning #curl and HTTP ...

2026-05-14T09:11:25Z

"An interactive terminal game for learning #curl and HTTP APIs through hands-on quests"

https://github.com/lite-quests/curl-quests

AAAAARGH. Trailing dots on host names in URLs is the gift that ...

2026-05-13T22:40:04Z

AAAAARGH.

Trailing dots on host names in URLs is the gift that keeps on giving, I said it already four years ago and it still generously continues to poke me in the eye.

https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/

five new reports landed just now, all within 40 minutes...

2026-05-13T22:16:38Z

In reply to nevent1q…jrz9
_________________________

*five* new reports landed just now, all within 40 minutes...

Attention is fun and good. And sometimes painful. The #curl ...

2026-05-13T21:24:00Z

Attention is fun and good. And sometimes painful. The #curl vulnerability counter keeps getting bumped... No rest for the security team.

(Yes: even after Mythos scanned the code people find issues...)

"Packages that can't be rebuilt byte-for-byte are now ...

2026-05-13T08:49:24Z

"Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch."

https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/

I like the Register's headline: "Anthropic’s ...

2026-05-12T06:28:34Z

I like the Register's headline: "Anthropic’s bug-hunting Mythos was greatest marketing stunt ever, says cURL creator"

... even though I did not say that. 😂

https://www.theregister.com/security/2026/05/11/anthropics-bug-hunting-mythos-was-greatest-marketing-stunt-ever-says-curl-creator/5238111

The hacker news thread is burning up: ...

2026-05-11T14:28:06Z

The hacker news thread is burning up: https://news.ycombinator.com/item?id=48091737

Meanwhile on LinkedIn... #curl ...

2026-05-11T10:55:53Z

Meanwhile on LinkedIn... #curl

My personal conclusion can however not end up with anything else ...

2026-05-11T06:12:06Z

In reply to nevent1q…x746
_________________________

My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.

#Mythos finds a #curl vulnerability yes, as in singular one. ...

2026-05-11T06:02:17Z

#Mythos finds a #curl vulnerability

yes, as in singular one.

https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/