a detail you probably didn't know: nowhere in any #curl documentation do we use the word "very". It is a banned word enforced by a CI check. This rule encourages us to rewrite and instead use more appropriate words. Makes us write better English.
Remote
daniel:// stenberg://
@bagder__dup_3144@mastodon.social
mastodon 4.8.0-alpha.3+pr-41085-a68fedbI write curl. I don't know anything.
52437 Followers
284 Following
47 Posts
Joined April 03, 2017
website:
github:
I keep getting offers from randos offering to setup various crypto currency things to sponsor me or curl.
I will NEVER agree to have my name associated with any crypto currency efforts/scams. There's no room for debate. A hard no.
The #curl project is soon going to move away from GitHub again for its security reporting. It simply doesn't work the way we need it to. Proper announcement will follow in the near future.
"Our proprietary AI robots independently recreate any open source project from scratch"
The button has been pressed.
The end of the #curl bug-bounty
https://daniel.haxx.se/blog/2026/01/26/the-end-of-the-curl-bug-bounty/
Boosted by @kaia@pleroma.soykaf.com
Getting ready for #EOSAwards26
I found this Veratasium documentary on the xz Jia Tan backdoor adventure quite good and surprisingly detailed:
The Internet Was Weeks Away From Disaster And No One Knew
the public consultation on "European Open Digital Ecosystems" apparently received 1,658 submissions. One of the biggest public consultations ever apparently.
Well done fellow Open Sourcers!
Boosted by @ferrix@mastodon.online
Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again today and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with 64 known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/
IRC made me do #curl
https://youtu.be/ohzzGy5K9Dk
How an IRC bot spawned the world’s most prolific software
A big and warm thank you hug to all the friends I met and talked to in Brussels this time. Two packed days of events before #FOSDEM including an awesome prize ceremony, then two intense days at ULB where I must have talked to more than a hundred persons. All the positivity, the appreciation, the smiles, the ideas, the energy.
I got to end-keynote the thing and then top it off with more drinks and countless friends - again.
I'm drained now, but in a good way. I'll be back next year.
Some of you will be glad to know that the #curl dashboard now features the "graphs in the dashboard" graph
https://curl.se/dashboard1.html#graphs-on-the-dashboard
just noticed I'm mentioned on the AI slop wikipedia page: https://en.wikipedia.org/wiki/AI_slop
10K #curl downloads per year
https://daniel.haxx.se/blog/2026/03/09/10k-curl-downloads-per-year/
Boosted by @ferrix@mastodon.online
This is not working. The number of #hackerone report submissions for #curl in 2025 is going through the roof, while the quality is going through the floor.
And the year isn't over yet.
Boosted by @ferrix@mastodon.online
the AI slop in security reports have developed slightly over time. Less mind-numbingly stupid reports now, but instead almost *everyone* writes their reports with AI so they still get overly long and complicated to plow through. And every follow-up question is another minor essay discussing pros and cons with bullet points and references to multiple specifications.
Exhausting nonetheless.
This year counts as #curl 30 years, counting from the first httpget 0.1 release in November 1996.
I'm thinking we could fly a special logo for the occasion on the #curl front page throughout the year.
Maybe *you* can make one that looks festive and still confident and trustworthy?
To trigger some thoughts, here's my take:
At the first event of the day. EU Open Source Policy Summit
I'm a little amazed by the amount of CVEs released by OpenSSL today: https://openssl-library.org/news/vulnerabilities/
12(!) of them were reported by people at Aisle.
Aisle makes an AI-powered code analyzer. That's what they use to find these flaws.
I mean if you are curious what AI can do in Open Source security when used for good.
Like every sane person, I've now added a "medals" section to my personal website. 😎
"I'm concerned about LLM code in #curl and would like to suggest a code ban"
Wget had its initial release (under a different name) in January 1996, so it has now already surpassed its 30th birthday.
curl is way behind, as it did not start its journey (under a different name) until November 11 1996
noq is a new QUIC library in town, written in rust: https://www.iroh.computer/blog/noq-announcement
One year ago, searching for "CURLOPT_SSL_VERIFYPEER, 0” gave me 153k hits on GitHub and I blogged about the sorry state of TLS certificate verification in code. (as every hit indicates code that probably disables verification)
Now? 181k hits. 20% more one year later.
The blog post from last year:
https://daniel.haxx.se/blog/2025/02/11/disabling-cert-checks-we-have-not-learned-much/
my week: https://lists.haxx.se/pipermail/daniel/2026-March/000148.html
Bug-Bounty: False, zip bombs, "just", badwords, release, new record, NTLM, SMB, 10K downloads, dependencies, nuget
curl.se over the last 30 days:
Served 77.12 TB of data at 3.81k requests/second.
95.91% of the object sizes were <1KB.
0.01% of the downloaded object sizes were 1-10MB (a tarball download)
99.69% of the content delivered was cached by the CDN.
Thanks #Fastly!
Today is two years since #curl passed its HTTP/3 security audit with flying colors:
"no major discoveries or security problems"
https://daniel.haxx.se/blog/2024/02/23/curl-http-3-security-audit/
I'm one of the early "members" of the Open Source Endowment. Eager to see where this is going:
"Truly sustainable funding for critical OSS through a community‑driven endowment"
If you need a #curl version with support for OpenSSL v1 for a few more years, we got you covered: https://rock-solid.curl.dev/
We know what a Friday needs to get good and I'm happy I can deliver it: a new graph.
#if density in curl source code over time. Fascinatingly static through the years counted per 1000 lines of code.
I return back home from #FOSDEM with only a few hundred curl stickers left. I say we did a good job.
If you're bored and are open for helping out documenting #curl, we have a list of outstanding tasks to work on in the "everything curl" book:
Why #Curl Shut Down Its Bug Bounty Program w/ Daniel Stenberg
The Creator of Curl on Why AI Is Breaking Bug Bounties w/ Daniel Stenberg
One hundred #curl graphs
https://daniel.haxx.se/blog/2026/03/15/one-hundred-curl-graphs/
The GitHub Secure Open Source Fund helped #curl and others to beef up security https://github.blog/open-source/maintainers/securing-the-ai-software-supply-chain-security-results-across-67-open-source-projects/
Remember: it is a calmer more chill life without copyright years. https://daniel.haxx.se/blog/2023/01/08/copyright-without-years/
C'mon, the protocol Gemini brought the name conflict problem on themselves long before Google made it worse by also doing a product with that name.
It's not a very creative name. Just look at the list just Wikipedia has for what the name might possibly refer to:
https://en.wikipedia.org/wiki/Gemini
Welcome Florian Imdahl as #curl commit author 1447: https://github.com/curl/curl/pull/20748
See you in Oslo on Thursday? https://ndcsecurity.com/agenda/three-decades-of-curl-0ugm/0m55j1o34kp
The third and final release candidate for #curl 8.19.0 is now available at
https://curl.se/rc/
My week: https://lists.haxx.se/pipermail/daniel/2026-February/000147.html
vacation, security, distro meeting, curl up, NDC Security, rc, lagging, rock-solid, decomplexification, netstack, user survey, foss-north