Documentation and ramblings of Daniel Stenberg, founder and lead developer of curl.
Visit daniel.haxx.se → On Hacker News Dec 2010 – Aug 2026
Software Engineering 58Security & Privacy 21Networking & Internet 13Life, Learning & Writing 12Tech Industry & Business 12Web & Frontend 10
Today Mozilla revealed the new logo and "refreshed identity". The new Mozilla logo uses the colon-slash-slash sequence already featured in curl's logo as I've discussed previously here from back before the final decision (or layout) was complete. The sentiment remains though. We don't feel that we can in any way claim…
Some time ago I mentioned that we went through the curl source code and eventually got rid of all strncpy() calls. strncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes. Quite frankly, most code bases are probably better off completely ……
I have previously blogged about the relatively new trend of AI slop in vulnerability reports submitted to curl and how it hurts and exhausts us. This trend does not seem to slow down. On the contrary, it seems that we have recently not only received more AI slop but also more human slop. The latter … Continue reading…
DNS over HTTPS (DOH) is a feature where a client shortcuts the standard native resolver and instead asks a dedicated DOH server to resolve names. Compared to regular unprotected DNS lookups done over UDP or TCP, DOH increases privacy, security and sometimes even performance. It also makes it easy to use a name server…
There is again a pull-request submitted to the curl project to bring support for the Gemini protocol. It seems like a worthwhile effort that I support, even if it is also a lot of work involved and it might take some time before it reaches the state in which it can be merged. A previous … Continue reading The Gemini…
A generous member of the wider curl community stepped up and donated an unused Mac mini m1 model to me to be used for curl development. Today it arrived at my home. An 8C CPU/16GB/1TB/8C GPU/1GbE model as per the sticker on the box. The m1 mac mini, still wrapped in plastic. Apple is not … Continue reading An m1 for…
Easter egg; noun: An unexpected or undocumented feature in a piece of computer software, included as a joke or a bonus. There are no Easter eggs in curl. For the good. I've been asked about this many times. Among the enthusiast community, people seem to generally like the concept of Easter eggs and hidden treasures, ……
Every now and then I get questions on how to work with git in a smooth way when developing, bug-fixing or extending curl - or how I do it. After all, I work on open source full time which means I have very frequent interactions with git (and GitHub). Simply put, I work with git … Continue reading This is how I git →
This is a story consisting of several little building blocks and they occurred spread out in time and in different places. It is a story that shows with clarity how our current system with CVE Ids and lots of power given to NVD is a completely broken system. CVE-2020-19909 On August 25 2023, we got … Continue reading…
tldr: we stick to C89 for now. The curl project builds on foundations that started in late 1996 with the tool named httpget. ANSI C became known as C89 In 1996 there were not too many good alternatives for making a small and efficient command line tool for doing Internet transfers. I am not saying … Continue reading…
your case is still going through administrative processing and we don't know when that process will be completed. Last year I was denied to go to the US when I was about to travel to San Francisco. Me and my employer's legal team never got answers as to why this happened so I've personally tried … Continue reading…
My name and email address can be found in the VPN client application made by Cisco called AnyConnect. They are present there as part of the curl license, because this product - like thousands of others - uses libcurl. My name appears in many products. Apparently, people often have problems finding an appropriate…
Jan Gampe took things to the next level by actually making this cross-stitch out of the pattern I previously posted online. The flowers really gave it an extra level of charm I think. As a cross-stitch As a pillow This quote is from a comment by an upset user on my blog, replying to one … Continue reading curl is just…
When I started the precursor to the curl project, httpget, back in 1996, I wrote my first URL parser. Back then, the universal address was still called URL: Uniform Resource Locators. That spec was published by the IETF in 1994. The term "URL" was then used as source for inspiration when naming the tool and … Continue…
One of the least favorite habits of curl during all these years, I've been told, is when users forget to instruct the command line tool where to store the downloaded file and as a direct consequence, curl instead sends a lot of binary "gunk" to the terminal. The end result of that is at best … Continue reading curl…
Thursday October 19, 2017, I arrived at the Technical Museum in Stockholm together with my two kids just a short while before 17:30. A fresh, cool and clear autumn evening. For this occasion I had purchased myself a brand new suit as I hadn't gotten one since almost twenty years before this and it had … Continue…
Next week, Mozilla will release Firefox 57. Also referred to as Firefox Quantum, from the project name we've used for all the work that has been put into making this the most awesome Firefox release ever. This is underscored by the fact that I've gotten mailed release-swag for the first time during my four years ……
I posted curl is C a few days ago and it raced on hacker news, reddit and elsewhere and got well over a thousand comments in those forums alone. The blog post has been read more than 130,000 times so far. Addendum a few days later Many commenters of my curl is C post struck … Continue reading Yes C is unsafe, but… →
Right. I said in the 8.0.0 blog post that it might be a good release. It was. Apart form the little bug that caused it to crash in several test cases. So now we shipped curl 8.0.1, which is almost identical apart from a single commit that was reverted. Exactly why this was not discovered … Continue reading curl 8.0.1…
During October 2015 the curl web site sent out 1127 gigabytes of data. This was the first time we crossed the terabyte limit within a single month. Looking at the stats a little closer, I noticed that in July 2015 a particular single package started to get very popular. The exact URL was…
Exactly one month since the previous release, we are happy to give you curl 8.0.0 released on curl's official 25th birthday. This a major version number bump but without any ground-breaking changes or fireworks. We decided it was about time to reset the minor number down to more a manageable level and doing it exactly…
A few years years ago the curl project signed up and became a CNA. This means that we are masters of and can allocate our own CVE identifiers. For any security problems within our territory, it is we who decides if the issue should get a CVE or not. No more bogus CVEs. 57 CVEs … Continue reading a CVE dispute →
curl, along with every other Internet tool with aspirations, supports proxies. A proxy is a (usually known) middle-man in a network operation; instead of going directly to the remote end server, the client goes via a proxy. curl has supported proxies since the day it was born. Which proxy? Applications that do…
The original logo for the curl project was created in 1998 by Henrik Hellerstedt. When we started version controlling the web site contents in June 2001 it had already been revised slightly and it looked like this I subsequently did the slightly refreshed version that's been visible on the site since early 2003 which…
The ride is coming to an end. The experiment is done. We tried, but we admit defeat. Four years ago we started adding support for an alternative HTTP backend in curl. It would use a library written in rust, called hyper. The idea was to introduce an alternative implementation of HTTP internals that you could ……
Why I insist on people to keep issues on the mailing list(s) A recent twitter discussion I had with Andrei Neculau contributed to his blog post on this subject, basically arguing that I'm wrong but with many words and explanations. It triggered me to write up my primary reasons for why I strongly object to … Continue…
(Recap: I founded the curl project, I am still the lead developer and maintainer) When asking curl to get a URL it'll send the output to stdout by default. You can of course easily change this behavior with options or just using your shell's redirect feature, but without any option it'll spew it out to … Continue…
"given enough eyeballs, all bugs are shallow" The saying (also known as Linus' law) doesn't say that the bugs are found fast and neither does it say who finds them. My version of the law would be much more cynical, something like: "eventually, bugs are found", emphasizing the 'eventually' part. (Jim Zemlin apparently…
It has been eighteen years of libcurl ABI stability.
One of my hobbies is to collect information about where curl is used. The following car brands feature devices, infotainment and/or navigation systems that use curl - in one or more of their models. These are all brands about which I've found information online (for example curl license information), received photos…