Boosted by @gvenema@fairmove.net
Buckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years.
Yes, found with AI.
Remote
daniel:// stenberg://
@bagder@mastodon.social
mastodon 4.8.0-nightly.2026-10-06I write curl. I don't know anything.
54479 Followers
285 Following
50 Posts
Joined April 03, 2017
website:
github:
GPG key : 27ED EAF2 2F3A BCEB 50DB 9A12 5CC9 08FD B71E 12C2:
Boosted by @trending@homestead.social
"The people holding up the internet"
A good-looking but somewhat depressing exposé about the people holding up current digital infrastructure as a hobby.
https://sheets.works/data-viz/holding-up-the-internet
Boosted by @trending@homestead.social
"Google freezes open-source bug bounty program amid flood of invalid AI slop submissions"
https://www.tomshardware.com/tech-industry/artificial-intelligence/google-suspends-part-of-the-oss-vrp-bug-bounty-program-due-to-an-influx-of-invalid-ai-submissions-product-vulnerability-submissions-ended-october-1
Boosted by @trending@homestead.social
"for months on end now, most of our teams have just been triaging bugs and coordinating releases. It has truly taken all the fun out of the job"
https://blog.nlnetlabs.nl/maintaining-the-love-for-coding-in-the-time-of-ai/
As of two minutes ago, #curl does no longer support SMB. 🎉
As an Open Source person I am apparently expected to keep doing things for free so I get invited to participate in EU policy events in Brussels, with not even an attempt to offer me compensation for travel, lodging or time.
So I decline.
my week: https://lists.haxx.se/pipermail/daniel/2026-September/000169.html
25 years, security, performance, Rock-solid, Development, rc2, stickers
Boosted by @trending@homestead.social
Getting invited to join an organization that has a 3,000 USD "invitation fee" and in-person-only events only in the US.
No thanks.
Organisation curl
Job title internet janitor
Attending Social: No
Filling in the registration form for a conference talk I'll do in a few weeks.
No one in the seven-person curl security team is on or runs Windows. People sending us Windows-only flaws makes us groan and roll eyes. And sometimes hyperventilate a little.
Why this is so? Because no one in the team wants to be on Windows, and no other curl contributor is active enough, Windows-knowledgeable and interested in joining the team. Let me know if you are someone like that who I've just not noticed.
Boosted by @trending@homestead.social
because obviously on Windows "CON[superscript 1]" is also a reserved file name... *sigh* And yeah, you can write that either with ISO8859-1 *or* UTF-8 ...
You couldn't even make these things up if you tried.
(I replied:)
What are you willing to pay for someone to take care of the Windows side?
We get exactly zero dollars for our windows version of curl and you're welcome to get a share of this revenue!
The Russian drone that crashed in Lithuania the other day had curl installed.
As part of a default Linux install presumably, it seems unlikely it used curl for any "drony" things.
Replying to
number of surprised Open Source maintainers: zero
Boosted by @trending@homestead.social
"So are you developing anything these days or are you mostly maintaining what is already there?"
Oh my sweet innocent child...
Pokopia black screen cant login
#inbox
https://daniel.haxx.se/email/2026-08-30.html
Boosted by @trending@homestead.social
Updated chart showing the share of #curl vulnerabilities caused by "C mistakes" as a share of all the vulns we know existed in code over time.
It's now 10 whole years since I tried to do my duty for the community and remove the #curl alias from PowerShell.
It's still there.
https://daniel.haxx.se/blog/2016/08/19/removing-the-powershell-curl-alias/
Boosted by @trending@homestead.social
A palindrome URL for your localhost.
curl 'http :// 2130706433:80#08:3346070312//:ptth'
Boosted by @harblinger@wizard.casa
None of the Flock camera teardowns seems to specifically list curl as part of those software stacks, but as they run fairly stock Android installs it is likely that they too run curl.
Replying to
@nlnetlabs@social.nlnetlabs.nl meanwhile, I sit here with at least 20 new curl CVEs in the queue to publish in sync with the next #curl release...
#curl surpassed 16,000 closed PRs
Can you believe that NetBSD 6.0.X shipped (in 2013) with broken non-blocking sockets and of course someone managed to run a modern libcurl on that and... yeps, got into trouble.
Replying to
@eletrotupi@lonely.town @argv_minus_one@mastodon.sdf.org I think rather that the marketing was all that noise back in spring and now they don't care anymore...
Heads up! In #curl 8.23.0 (end of October 2026) SMB(S) support will be gone.
https://github.com/curl/curl/pull/22652
Replying to
can I also remind you all that curl already speaks SCP and SFTP, in command line tool and library...
Boosted by @trending@homestead.social
Anyone using HTTP/2 server push with libcurl?
If you use this feature in libcurl, please let us know. It is being deprecated all over, including in specs, browsers and servers and I believe the time has come for us to drop it from libcurl in the future as well.
So I'm curious to know if anyone actually (still) uses it.
Replying to
and an additional 4 minutes until that first report was closed as not applicable ...
Replying to
@codingWombat@social.tchncs.de this period of forced calmness has been a true blessing for us and we have truly enjoyed it. We found the fun again. We got the chance to go back to do a lot of things we've been wanting to do for a while.This was possibly our best project decision in a long while.
Replying to
I'm working on a performance measurement system for curl, so I'm running countless builds, runs various things and then plot them to visualize how it behaves...
Sneak preview of the top-most test:
https://curl.se/ just got a menu refresh, try it out! All new, but looks similar to before...
Should work better on small screens/mobile and with keyboard navigation.
Heavy lifting done by Rito Rhymes.
See https://github.com/curl/curl-www/pull/611
Replying to
it took 30 minutes from the reopen until the first report appeared
As the #FOSDEM 2027 weekend is confirmed, It might be time to check out my FOSDEM guide and help me polish it further: https://github.com/bagder/FOSDEM
Welcome to try out #curl 8.22.0-rc1 https://curl.se/rc/
Thanks for flying curl.
Weird AI :video about curl that is still mostly accurate: https://youtu.be/qZHGxmV4MJU?is=PTTxfjlOuEkXyQg2
How curl Quietly Took Over the World
24 hours to #curl release: 10 CVEs, 6 changes, ~300 bugfixes, 85 contributors, 43 authors, 4 new command line options...
Replying to
@sstendahl@floss.social if you show up to a speaking gig without HDMI support and knowledge it'll work, you're certainly a betting man. I don't do it.
It might be time for #curl performance/benchmark testing:
https://github.com/curl/curl/discussions/22465
Boosted by @GroupNebula563@mastodon.social
I'm sorry but I'm not going to speak at NDC Techdown 2026 in September as previously planned.