Documentation and ramblings of Daniel Stenberg, founder and lead developer of curl.
Visit daniel.haxx.se → On Hacker News Dec 2010 – Aug 2026
Software Engineering 58Security & Privacy 21Networking & Internet 13Life, Learning & Writing 12Tech Industry & Business 12Web & Frontend 10
Modern cars have fancy infotainment setups, big screens and all sorts of computers with networked functionality built-in. Part of that fanciness is increasingly often a curl install. curl is a part of the standard GenIVI and Tizen offers for cars and is used in lots of other independent software installs too. This…
The curl project will not accept or otherwise handle any vulnerability reports during the month of July 2026. We call it the curl summer of bliss. curl's submission form on Hackerone will be paused starting July 1, 2026. Summer of bliss starts: July 1, 2026. 00:00 CEST Submissions resume: August 3 2026. 09:00 CEST The…
yes, as in singular one. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead … Continue…
You might know that I've posted funny emails I've received on my blog several times in the past. The kind of emails people send me when they experience problems with some device they own (like a car) and they contact me because my email address happens to be visible somewhere. People sometimes say I should … Continue…
For some reason, this post got picked up again and is debated today in 2021, almost 4 years since I wrote it. Some things have changed in the mean time and I might've phrased a few things differently if I had written this today. But still, what's here below is what I wrote back then. … Continue reading curl is C →
The protocol that's been called HTTP-over-QUIC for quite some time has now changed name and will officially become HTTP/3. This was triggered by this original suggestion by Mark Nottingham. The QUIC Working Group in the IETF works on creating the QUIC transport protocol. QUIC is a TCP replacement done over UDP…
Time flies when you are having fun. Today is curl's 25th birthday. The curl project started out very humbly as a small renamed URL transfer tool that almost nobody knew about for the first few years. It scratched a personal itch of mine, Me back then I made that first curl release and I've packaged … Continue reading…
Today we celebrate the fact that it is exactly 17 years since the first public release of curl. I have always been the lead developer and maintainer of the project. When I released that first version in the spring of 1998, we had only a handful of users and a handful of contributors. curl was … Continue reading curl…
tldr: work has started to make Hyper work as a backend in curl for HTTP. curl and its data transfer core, libcurl, is all written in C. The language C is known and infamous for not being memory safe and for being easy to mess up and as a result accidentally cause security problems. At … Continue reading rust in curl…
Back in December I got a desperate email from this person. A woman who said her Instagram had been hacked and since she found my contact info in the app she mailed me and asked for help. I of course replied and said that I have nothing to do with her being hacked but I … Continue reading “Subject: Urgent Warning” →
-- "Have you ever detected anyone trying to add a backdoor to curl?" -- "Have you ever been pressured by an organization or a person to add suspicious code to curl that you wouldn't otherwise accept?" -- "If a crime syndicate would kidnap your family to force you to comply, what backdoor would you be … Continue…
Today I landed yet another small change to libcurl internals that further reduces the number of small mallocs we do. This time the generic linked list functions got converted to become malloc-less (the way linked list functions should behave, really). Instrument mallocs I started out my quest a few weeks ago by…
Vodafone UK has taken it on themselves to make the world better by marking this website (daniel.haxx.se) "adult content". I suppose in order to protect the children. It was first reported to me on May 2, with this screenshot from a Vodafone customer: And later followed up with some more details from another user in ……
I'm awarded the Swedish Polhem Prize 2017. (Link to a Swedish-speaking site.) The Polhem Prize (Polhemspriset in Swedish), is awarded "for a high-level technological innovation or an ingenious solution to a technical problem." The Swedish innovation must be available and shown competitive on the open market. This…
I have held back on writing anything about AI or how we (not) use AI for development in the curl factory. Now I can't hold back anymore. Let me show you the most significant effect of AI on curl as of today - with examples. Bug Bounty Having a bug bounty means that we offer … Continue reading The I in LLM stands for…
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
When Mac OS X first launched they did so without an existing poll function. They later added poll() in Mac OS X 10.3, but we quickly discovered that it was broken (it returned a non-zero value when asked to wait for nothing) so in the curl project we added a check in configure for that … Continue reading poll on mac…
It is often said that Imitation is the Sincerest Form of Flattery. Also, remember libcrurl? That was the name of the thing Google once planned to do: reimplement the libcurl API on top of their Chrome networking library. Flattery or not, it never went anywhere. The other day I received an email asking me about ……
On Friday January 21, 2022 I received this email. I tweeted about it and it took off like crazy. The email comes from a fortune-500 multi-billion dollar company that apparently might be using a product that contains my code, or maybe they have customers who do. Who knows? My guess is that they do this … Continue…
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
Collected quotes and snippets from people publicly sneezing off or belittling what curl is, explaining how easy it would be to make a replacement in no time with no effort or generally not being very helpful. These are statements made seriously. For all I know, they were not ironic. If you find others to add ……
In a recent pull-request for curl, I clarified to the contributor that their change would only be accepted and merged into curl's git code repository if they made sure that the change was done in a way so that it did not break (testing) for and on legacy platforms. In that thread, I could almost … Continue reading…
Here's the complete timeline of events. From my first denial to travel to the US until I eventually received a tourist visa. And then I can't go anyway. December 5-11, 2016 I spent a week on Hawaii with Mozilla - my employer at the time. This was my 12th visit to the US over a … Continue reading a US visa in 937 days →
In my view, wget is not a curl competitor. It is a companion tool that has a feature overlap with curl. Use the tool that does the job. Getting the job done is the key. If that means using wget instead of curl, then that is good and I don't mind. Why would I? To … Continue reading The curl-wget Venn diagram →
- Sorry, you're not allowed entry to the US on your ESTA. The lady who delivered this message to me this early Monday morning, worked behind the check-in counter at the Arlanda airport. I was there, trying to check-in to my two-leg trip to San Francisco to the Mozilla "all hands" meeting of the summer … Continue…
"the overall impression of the state of security and robustness of the cURL library was positive." I asked for, and we were granted a security audit of curl from the Mozilla Secure Open Source program a while ago. This was done by Mozilla getting a 3rd party company involved to do the job and footing … Continue…
Not the entire thing, just "a subset". It's not stated very clearly exactly what that subset is but the easy interface is mentioned in the Chrome bug about this project. What? The Chromium bug states that they will create a library of their own (named libcrurl) that will offer (parts of) the libcurl API and … Continue…
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
tldr: Apple thinks it is fine. I do not. On December 28 2023, bugreport 12604 was filed in the curl issue tracker. We get a lot issues filed most days so this fact alone was hardly anything out of the ordinary. We read the reports, investigate, ask follow-up questions to see what we can learn … Continue reading the…
On December 19 2017, Microsoft announced that since insider build 17063 of Windows 10, curl is now a default component. I've been away from home since then so I haven't really had time to sit down and write and explain to you all what this means, so while I'm a bit late, here it comes! … Continue reading Microsoft…