Documentation and ramblings of Daniel Stenberg, founder and lead developer of curl.
Visit daniel.haxx.se → On Hacker News Dec 2010 – Aug 2026
Software Engineering 58Security & Privacy 21Networking & Internet 13Life, Learning & Writing 12Tech Industry & Business 12Web & Frontend 10
yes, as in singular one. Back in April 2026 Anthropic caused a lot of media noise when they concluded that their new AI model Mythos is dangerously good at finding security flaws in source code. Apparently Mythos was so good at this that Anthropic would not release this model to the public yet but instead … Continue…
For some reason, this post got picked up again and is debated today in 2021, almost 4 years since I wrote it. Some things have changed in the mean time and I might've phrased a few things differently if I had written this today. But still, what's here below is what I wrote back then. … Continue reading curl is C →
Time flies when you are having fun. Today is curl's 25th birthday. The curl project started out very humbly as a small renamed URL transfer tool that almost nobody knew about for the first few years. It scratched a personal itch of mine, Me back then I made that first curl release and I've packaged … Continue reading…
Today we celebrate the fact that it is exactly 17 years since the first public release of curl. I have always been the lead developer and maintainer of the project. When I released that first version in the spring of 1998, we had only a handful of users and a handful of contributors. curl was … Continue reading curl…
tldr: work has started to make Hyper work as a backend in curl for HTTP. curl and its data transfer core, libcurl, is all written in C. The language C is known and infamous for not being memory safe and for being easy to mess up and as a result accidentally cause security problems. At … Continue reading rust in curl…
-- "Have you ever detected anyone trying to add a backdoor to curl?" -- "Have you ever been pressured by an organization or a person to add suspicious code to curl that you wouldn't otherwise accept?" -- "If a crime syndicate would kidnap your family to force you to comply, what backdoor would you be … Continue…
Today I landed yet another small change to libcurl internals that further reduces the number of small mallocs we do. This time the generic linked list functions got converted to become malloc-less (the way linked list functions should behave, really). Instrument mallocs I started out my quest a few weeks ago by…
I'm awarded the Swedish Polhem Prize 2017. (Link to a Swedish-speaking site.) The Polhem Prize (Polhemspriset in Swedish), is awarded "for a high-level technological innovation or an ingenious solution to a technical problem." The Swedish innovation must be available and shown competitive on the open market. This…
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH. While the advisory contains all the necessary details. I figured I would use a few additional ……
When Mac OS X first launched they did so without an existing poll function. They later added poll() in Mac OS X 10.3, but we quickly discovered that it was broken (it returned a non-zero value when asked to wait for nothing) so in the curl project we added a check in configure for that … Continue reading poll on mac…
It is often said that Imitation is the Sincerest Form of Flattery. Also, remember libcrurl? That was the name of the thing Google once planned to do: reimplement the libcurl API on top of their Chrome networking library. Flattery or not, it never went anywhere. The other day I received an email asking me about ……
On Friday January 21, 2022 I received this email. I tweeted about it and it took off like crazy. The email comes from a fortune-500 multi-billion dollar company that apparently might be using a product that contains my code, or maybe they have customers who do. Who knows? My guess is that they do this … Continue…
Thursday, September 22nd 2016. An email popped up in my inbox. Subject: ares_create_query OOB write As one of the maintainers of the c-ares project I'm receiving mails for suspected security problems in c-ares and this was such a one. In this case, the email with said subject came from an individual who had reported a…
Collected quotes and snippets from people publicly sneezing off or belittling what curl is, explaining how easy it would be to make a replacement in no time with no effort or generally not being very helpful. These are statements made seriously. For all I know, they were not ironic. If you find others to add ……
In a recent pull-request for curl, I clarified to the contributor that their change would only be accepted and merged into curl's git code repository if they made sure that the change was done in a way so that it did not break (testing) for and on legacy platforms. In that thread, I could almost … Continue reading…
In my view, wget is not a curl competitor. It is a companion tool that has a feature overlap with curl. Use the tool that does the job. Getting the job done is the key. If that means using wget instead of curl, then that is good and I don't mind. Why would I? To … Continue reading The curl-wget Venn diagram →
"the overall impression of the state of security and robustness of the cURL library was positive." I asked for, and we were granted a security audit of curl from the Mozilla Secure Open Source program a while ago. This was done by Mozilla getting a 3rd party company involved to do the job and footing … Continue…
Not the entire thing, just "a subset". It's not stated very clearly exactly what that subset is but the easy interface is mentioned in the Chrome bug about this project. What? The Chromium bug states that they will create a library of their own (named libcrurl) that will offer (parts of) the libcurl API and … Continue…
Let me tell you a story about how Windows users are deleting files from their installation and as a consequence end up in tears. Background The real and actual curl tool has been shipped as part of Windows 10 and Windows 11 for many years already. It is called curl.exe and is located in the … Continue reading deleting…
On December 19 2017, Microsoft announced that since insider build 17063 of Windows 10, curl is now a default component. I've been away from home since then so I haven't really had time to sit down and write and explain to you all what this means, so while I'm a bit late, here it comes! … Continue reading Microsoft…
Today Mozilla revealed the new logo and "refreshed identity". The new Mozilla logo uses the colon-slash-slash sequence already featured in curl's logo as I've discussed previously here from back before the final decision (or layout) was complete. The sentiment remains though. We don't feel that we can in any way claim…
Some time ago I mentioned that we went through the curl source code and eventually got rid of all strncpy() calls. strncpy() is a weird function with a crappy API. It might not null terminate the destination and it pads the target buffer with zeroes. Quite frankly, most code bases are probably better off completely ……
A generous member of the wider curl community stepped up and donated an unused Mac mini m1 model to me to be used for curl development. Today it arrived at my home. An 8C CPU/16GB/1TB/8C GPU/1GbE model as per the sticker on the box. The m1 mac mini, still wrapped in plastic. Apple is not … Continue reading An m1 for…
Easter egg; noun: An unexpected or undocumented feature in a piece of computer software, included as a joke or a bonus. There are no Easter eggs in curl. For the good. I've been asked about this many times. Among the enthusiast community, people seem to generally like the concept of Easter eggs and hidden treasures, ……
Every now and then I get questions on how to work with git in a smooth way when developing, bug-fixing or extending curl - or how I do it. After all, I work on open source full time which means I have very frequent interactions with git (and GitHub). Simply put, I work with git … Continue reading This is how I git →
tldr: we stick to C89 for now. The curl project builds on foundations that started in late 1996 with the tool named httpget. ANSI C became known as C89 In 1996 there were not too many good alternatives for making a small and efficient command line tool for doing Internet transfers. I am not saying … Continue reading…
Jan Gampe took things to the next level by actually making this cross-stitch out of the pattern I previously posted online. The flowers really gave it an extra level of charm I think. As a cross-stitch As a pillow This quote is from a comment by an upset user on my blog, replying to one … Continue reading curl is just…
One of the least favorite habits of curl during all these years, I've been told, is when users forget to instruct the command line tool where to store the downloaded file and as a direct consequence, curl instead sends a lot of binary "gunk" to the terminal. The end result of that is at best … Continue reading curl…
Next week, Mozilla will release Firefox 57. Also referred to as Firefox Quantum, from the project name we've used for all the work that has been put into making this the most awesome Firefox release ever. This is underscored by the fact that I've gotten mailed release-swag for the first time during my four years ……
I posted curl is C a few days ago and it raced on hacker news, reddit and elsewhere and got well over a thousand comments in those forums alone. The blog post has been read more than 130,000 times so far. Addendum a few days later Many commenters of my curl is C post struck … Continue reading Yes C is unsafe, but… →