Documentation and ramblings of Daniel Stenberg, founder and lead developer of curl.
Visit daniel.haxx.se → On Hacker News Dec 2010 – Aug 2026
Software Engineering 58Security & Privacy 21Networking & Internet 13Life, Learning & Writing 12Tech Industry & Business 12Web & Frontend 10
Right. I said in the 8.0.0 blog post that it might be a good release. It was. Apart form the little bug that caused it to crash in several test cases. So now we shipped curl 8.0.1, which is almost identical apart from a single commit that was reverted. Exactly why this was not discovered … Continue reading curl 8.0.1…
Exactly one month since the previous release, we are happy to give you curl 8.0.0 released on curl's official 25th birthday. This a major version number bump but without any ground-breaking changes or fireworks. We decided it was about time to reset the minor number down to more a manageable level and doing it exactly…
curl, along with every other Internet tool with aspirations, supports proxies. A proxy is a (usually known) middle-man in a network operation; instead of going directly to the remote end server, the client goes via a proxy. curl has supported proxies since the day it was born. Which proxy? Applications that do…
The ride is coming to an end. The experiment is done. We tried, but we admit defeat. Four years ago we started adding support for an alternative HTTP backend in curl. It would use a library written in rust, called hyper. The idea was to introduce an alternative implementation of HTTP internals that you could ……
(Recap: I founded the curl project, I am still the lead developer and maintainer) When asking curl to get a URL it'll send the output to stdout by default. You can of course easily change this behavior with options or just using your shell's redirect feature, but without any option it'll spew it out to … Continue…
"given enough eyeballs, all bugs are shallow" The saying (also known as Linus' law) doesn't say that the bugs are found fast and neither does it say who finds them. My version of the law would be much more cynical, something like: "eventually, bugs are found", emphasizing the 'eventually' part. (Jim Zemlin apparently…
It has been eighteen years of libcurl ABI stability.
One of my hobbies is to collect information about where curl is used. The following car brands feature devices, infotainment and/or navigation systems that use curl - in one or more of their models. These are all brands about which I've found information online (for example curl license information), received photos…
IDN, International Domain Names, is the concept that lets us register and use international characters in domain names, and by international we of course mean characters outside of the ASCII range. Recently I have fought some battles against IDN and IDN decoding so I felt this urge to write a lot of words about it ……
First: performance is tricky and bechmarking even more so. I will talk some numbers in this post but of course they are what I have measured for my specific tests on my machine. Your numbers for your test cases will be different. Over the last six months or so, curl has undergone a number of … Continue reading curl 8…
About a year ago I blogged about games that use curl. In that post I listed a bunch of well-known titles I knew use curl and there was a list of 136 additional games giving credit to curl. Kind of amazing that over one hundred games decided to use curl! At the time, lots of … Continue reading Inside 22,734 Steam games…
I spent a lot of time and effort digging up the numbers and facts for this post! Lots of people keep referring to the awesome summary put together by a friendly pseudonymous "Tim" which says that "53 out of 95" (55.7%) security flaws in curl could've been prevented if curl had been written in Rust. … Continue reading…
Another notch on the wall as we've reached the esteemed age of 18 years in the cURL project. 9 releases were shipped since our last birthday and we managed to fix no less than a total of 457 bugs in that time. On this single day in history... 20,000 persons will be visiting the web … Continue reading curl is 18 years…
Don't trust. Verify. I could not resist making a fake book cover Here follows a brief description on how you can detect if the curl package would ever make an xz. xz (and its library liblzma) was presumably selected as a target because it is an often used component and by extension via systemd it … Continue reading…
https://www.youtube.com/watch?v=kCJmAyUr1j4 This is the video recording of my talk with this title, done at February 4, 2024 10:00 in the K1.105 room at FOSDEM 2024. The room can hold some 800 people but there were a few hundred seats still unoccupied. Several people I met up with later have insisted that 10 am on a ……
In this little piece I'll explain why there won't be any version 8 of curl and libcurl in a long time. I won't rule out that it might happen at some point in the future. Just that it won't happen anytime soon and explain the reasons why. Seven point twenty nine, really? We've done 29 … Continue reading Why no curl 8 →
trurl is a tool in a similar spirit of tr but for URLs. Here, tr stands for translate or transpose. trurl is a small command line tool that parses and manipulates URLs, designed to help shell script authors everywhere. URLs are tricky to parse and there are numerous security problems in software because of this. ……
Do you remember this exact day, twenty years ago? March 20, 1998. What exactly happened that day? I'll tell you what I did then. First a quick reminder of the state of popular culture at the time: three days later, on the 23rd, the movie Titanic would tangent the record and win eleven academy awards. … Continue…
libcurl has done internet transfers specified as URLs for a long time, but the URLs you'd tell libcurl to use would always just get parsed and used internally. Applications that pass in URLs to libcurl would of course still very often need to parse URLs, create URLs or otherwise handle them, but libcurl has not ……
Everyone knows that on most systems you can specify IPv4 addresses just 4 decimal numbers separated with periods (dots). Example: 192.168.0.1 Useful when you for example want to ping your local wifi router and similar. "ping 192.168.0.1" Other bases The IPv4 string is usually parsed by the inet_addr() function or at…
It is a somewhat common question to me: how do we write C in curl to make it safe and secure for billions of installations? Some precautions we take and decisions we make. There is no silver bullet, just guidelines. As I think you can see for yourself below they are also neither strange nor … Continue reading Writing…
MOAR DOX! Whenever we ask curl users what they lack in our project and what we should improve, the response is always clear: documentation. Here are the most common curl command line options when doing HTTP operations. This is the web page rendered as an image, click it to get to the web version. The … Continue…
On the completely impossible situation of blocking the Tor .onion TLD to avoid leaks, but at the same time not block it to make users able to do what they want. dot-onion leaks The onion TLD is a Tor specific domain that does not mean much to the world outside of Tor. If you try … Continue reading Leeks and leaks →
If you are anything like me, you appreciate solving your every day simple tasks directly from the command line. Creating crafty single shot command lines or a small shell script to solve that special task you figured out you needed and makes your day go a little smoother. A fellow command line cowboy. Video…
This is not a command line option of the week post, but I feel a need to tell you a little about our brand new addition! --write-out [format] This option takes a format string in which there are a number of different "variables" available that let's a user output information from the previous transfer. For … Continue…
I occasionally do talks about curl. In these talks I often include a few slides that say something abut curl's coverage and presence on different platforms. Mostly to boast of course, but also to help explain to the audience how curl has manged to reach its ten billion installations. This is current incarnation of…
curl turns 25 years old and what better way to celebrate this than to join fellow curl friends, developers and fans online on the exact birthday? At 17:00 UTC March 20, 2023. We run an Online birthday party open for everyone to join. Consider muting yourself when you join, but feel encouraged to leave the … Continue…
PowerShell is a spiced up command line shell made by Microsoft. According to some people, it is a really useful and good shell alternative. Already a long time ago, we got bug reports from confused users who couldn't use curl from their PowerShell prompts and it didn't take long until we figured out that Microsoft ……