Documentation and ramblings of Daniel Stenberg, founder and lead developer of curl.
Visit daniel.haxx.se → On Hacker News Dec 2010 – Aug 2026
Software Engineering 58Security & Privacy 21Networking & Internet 13Life, Learning & Writing 12Tech Industry & Business 12Web & Frontend 10
IDN, International Domain Names, is the concept that lets us register and use international characters in domain names, and by international we of course mean characters outside of the ASCII range. Recently I have fought some battles against IDN and IDN decoding so I felt this urge to write a lot of words about it ……
First: performance is tricky and bechmarking even more so. I will talk some numbers in this post but of course they are what I have measured for my specific tests on my machine. Your numbers for your test cases will be different. Over the last six months or so, curl has undergone a number of … Continue reading curl 8…
About a year ago I blogged about games that use curl. In that post I listed a bunch of well-known titles I knew use curl and there was a list of 136 additional games giving credit to curl. Kind of amazing that over one hundred games decided to use curl! At the time, lots of … Continue reading Inside 22,734 Steam games…
I spent a lot of time and effort digging up the numbers and facts for this post! Lots of people keep referring to the awesome summary put together by a friendly pseudonymous "Tim" which says that "53 out of 95" (55.7%) security flaws in curl could've been prevented if curl had been written in Rust. … Continue reading…
Another notch on the wall as we've reached the esteemed age of 18 years in the cURL project. 9 releases were shipped since our last birthday and we managed to fix no less than a total of 457 bugs in that time. On this single day in history... 20,000 persons will be visiting the web … Continue reading curl is 18 years…
Don't trust. Verify. I could not resist making a fake book cover Here follows a brief description on how you can detect if the curl package would ever make an xz. xz (and its library liblzma) was presumably selected as a target because it is an often used component and by extension via systemd it … Continue reading…
https://www.youtube.com/watch?v=kCJmAyUr1j4 This is the video recording of my talk with this title, done at February 4, 2024 10:00 in the K1.105 room at FOSDEM 2024. The room can hold some 800 people but there were a few hundred seats still unoccupied. Several people I met up with later have insisted that 10 am on a ……
In this little piece I'll explain why there won't be any version 8 of curl and libcurl in a long time. I won't rule out that it might happen at some point in the future. Just that it won't happen anytime soon and explain the reasons why. Seven point twenty nine, really? We've done 29 … Continue reading Why no curl 8 →
The InterPlanetary File System (IPFS) is according to the Wikipedia description: "a protocol, hypermedia and file sharing peer-to-peer network for storing and sharing data in a distributed file system.". It works a little like bittorrent and you typically access content on it using a very long hash in an ipfs:// URL…
trurl is a tool in a similar spirit of tr but for URLs. Here, tr stands for translate or transpose. trurl is a small command line tool that parses and manipulates URLs, designed to help shell script authors everywhere. URLs are tricky to parse and there are numerous security problems in software because of this. ……
The largest ever single-shot monetary donation to the curl project just happened when indeed.com graciously boosted our economy with 10,000 USD. (It happened before the new year but as I was away then I haven't had the chance to blog about it until now.) curl remains a small project with no major financial backing…
Do you remember this exact day, twenty years ago? March 20, 1998. What exactly happened that day? I'll tell you what I did then. First a quick reminder of the state of popular culture at the time: three days later, on the 23rd, the movie Titanic would tangent the record and win eleven academy awards. … Continue…
libcurl has done internet transfers specified as URLs for a long time, but the URLs you'd tell libcurl to use would always just get parsed and used internally. Applications that pass in URLs to libcurl would of course still very often need to parse URLs, create URLs or otherwise handle them, but libcurl has not ……
Everyone knows that on most systems you can specify IPv4 addresses just 4 decimal numbers separated with periods (dots). Example: 192.168.0.1 Useful when you for example want to ping your local wifi router and similar. "ping 192.168.0.1" Other bases The IPv4 string is usually parsed by the inet_addr() function or at…
There is something about having your product installed in over twenty billion instances all over the world and even out of the globe. In my case it helps me remain focused on and committed to working on the security aspects of curl. Ideally, we will never have our heartbleed moment. Security is also a generally ……
Pádraig Brady taught me a great trick in a comment to a previous blog post and it was so neat I feel a need to highlight it further as it also makes it easier for me to find it again later! To simulate a far away server, add RTT time to the localhost device. For … Continue reading Add latency to localhost →
It is a somewhat common question to me: how do we write C in curl to make it safe and secure for billions of installations? Some precautions we take and decisions we make. There is no silver bullet, just guidelines. As I think you can see for yourself below they are also neither strange nor … Continue reading Writing…
MOAR DOX! Whenever we ask curl users what they lack in our project and what we should improve, the response is always clear: documentation. Here are the most common curl command line options when doing HTTP operations. This is the web page rendered as an image, click it to get to the web version. The … Continue…
On the completely impossible situation of blocking the Tor .onion TLD to avoid leaks, but at the same time not block it to make users able to do what they want. dot-onion leaks The onion TLD is a Tor specific domain that does not mean much to the world outside of Tor. If you try … Continue reading Leeks and leaks →
If you are anything like me, you appreciate solving your every day simple tasks directly from the command line. Creating crafty single shot command lines or a small shell script to solve that special task you figured out you needed and makes your day go a little smoother. A fellow command line cowboy. Video…
This is not a command line option of the week post, but I feel a need to tell you a little about our brand new addition! --write-out [format] This option takes a format string in which there are a number of different "variables" available that let's a user output information from the previous transfer. For … Continue…
At around 06:49 CEST on the morning of August 27 2014, Google deployed an HTTP/2 draft-14 implementation on their front-end servers that handle logins to Google accounts (and possibly others). Those at least take care of all the various login stuff you do with Google, G+, gmail, etc. The little problem with that was…
It's been five great years, but now it is time for me to move on and try something else. During these five years I've met and interacted with a large number of awesome people at Mozilla, lots of new friends! I got the chance to work from home and yet work with a global team … Continue reading I’m leaving Mozilla →
I attended a TCP/IP Geeks Stockholm meetup yesterday and did a talk about HTTP/2. Below is the slide set, but as usual it might not be entirely self explanatory... HTTP/2 - for TCP/IP Geeks Stockholm from Daniel Stenberg
I occasionally do talks about curl. In these talks I often include a few slides that say something abut curl's coverage and presence on different platforms. Mostly to boast of course, but also to help explain to the audience how curl has manged to reach its ten billion installations. This is current incarnation of…
$ curl ‐‐http2 https://daniel.haxx.se/ curl: (1) Unsupported protocol curl on mac curl has been shipped by default on Mac OS X since many years - I actually couldn't even manage to figure out exactly how many. It is built and bundled with the operating system by Apple itself and on Apple's own terms and even ……
curl turns 25 years old and what better way to celebrate this than to join fellow curl friends, developers and fans online on the exact birthday? At 17:00 UTC March 20, 2023. We run an Online birthday party open for everyone to join. Consider muting yourself when you join, but feel encouraged to leave the … Continue…
PowerShell is a spiced up command line shell made by Microsoft. According to some people, it is a really useful and good shell alternative. Already a long time ago, we got bug reports from confused users who couldn't use curl from their PowerShell prompts and it didn't take long until we figured out that Microsoft ……