daniel:// stenberg://

I write curl. I don't know anything.

website: https://daniel.haxx.se/
github: https://github.com/bagder
GPG key : 27ED EAF2 2F3A BCEB 50DB 9A12 5CC9 08FD B71E 12C2: https://daniel.haxx.se/mykey.asc

Public Key

npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsvdhkcz7r724plrvs0p8t5fvyfgs6jfk0xle9ft2htfsrmgtsp9jcprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyqq2hu8ht

Publishing to

relay.momostr.pink

Author Public Key

npub1cm0ds9u8u42r7xeq7zwhgjcgj3p4ynv7dlj2jk4wknq8kshqzt9smpenqe

Show more details

Last Notes

2026-06-17 06:40:16 UTC

I must be weird, but when people are downright rude and hostile in issues, it makes me less interested in helping out.
Surely the rude people know this, so...why do they still do it?

2026-06-04 06:43:27 UTC

- reply

The badge
https://files.mastodon.social/media_attachments/files/116/690/479/088/538/426/original/bbf8761eda56db77.mp4

2026-06-04 06:42:34 UTC

30 minutes until me time at #bsidesvilnius
https://files.mastodon.social/media_attachments/files/116/690/471/185/159/918/original/039bdd761ee90bfb.jpg
https://files.mastodon.social/media_attachments/files/116/690/471/495/689/564/original/fc80bc73317ee4ff.jpg
https://files.mastodon.social/media_attachments/files/116/690/472/826/653/316/original/54947da9e0a31657.jpg

2026-05-19 14:17:03 UTC

What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy?

2026-05-17 15:39:36 UTC

50K!? 😵
https://files.mastodon.social/media_attachments/files/116/590/663/800/912/365/original/9fae68af3ca35f80.png

2026-05-15 08:52:53 UTC

I'll talk to a closed circle of "critical Swedish infrastructure" leadership peeps on Monday about the current high quality chaos. It makes our current overload pain feel timely.

2026-05-13 22:40:04 UTC

AAAAARGH.
Trailing dots on host names in URLs is the gift that keeps on giving, I said it already four years ago and it still generously continues to poke me in the eye.
https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/

2026-05-13 22:16:38 UTC

- reply

*five* new reports landed just now, all within 40 minutes...

2026-05-13 21:24:00 UTC

Attention is fun and good. And sometimes painful. The #curl vulnerability counter keeps getting bumped... No rest for the security team.
(Yes: even after Mythos scanned the code people find issues...)

2026-05-13 08:49:24 UTC

"Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch."
https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/

2026-05-11 14:28:06 UTC

The hacker news thread is burning up: https://news.ycombinator.com/item?id=48091737

2026-05-11 06:12:06 UTC

- reply

My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.

2026-05-11 06:02:17 UTC

#Mythos finds a #curl vulnerability
yes, as in singular one.
https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

2026-05-03 22:16:30 UTC

Open Source AI reality - Daniel Stenberg. From #fossnorth 2026.
The video is not top notch quality, but I think my message gets through.
https://youtu.be/VQ0kLuST800

2026-04-30 08:09:15 UTC

Approaching zero bugs?
Is it possible? Are we close? When will it happen?
https://daniel.haxx.se/blog/2026/04/30/approaching-zero-bugs/

2026-04-29 20:42:10 UTC

Reading this brings me close to medal-receiving levels of joy.
https://files.mastodon.social/media_attachments/files/116/489/922/528/512/449/original/239d1a10f8c02879.png

2026-04-29 11:56:35 UTC

RE: https://toot.yosh.is/@yosh/116487778402803336
Excuses. They forgot to run their site as they should and instead got lost working on AI features we never asked for. That's why.
#note1cmv…7jk5

2026-04-29 06:35:04 UTC

in the curl 8.20.0 release there are still 903 lines of production code last modified before the year 2000

2026-04-29 06:27:32 UTC

I feel honored to present to you: #curl 8.20.0
https://daniel.haxx.se/blog/2026/04/29/curl-8-20-0/

2026-04-29 05:55:54 UTC

If you would guess, do you think GitHub sends me a 500 now when I try to publish a new #curl release... ☹️

2026-04-28 21:42:30 UTC

This is week 18 and tomorrow will become the third #curl release ever done on April 29. A popular day.
https://files.mastodon.social/media_attachments/files/116/484/505/561/346/107/original/69ea5b0a20425223.png

2026-04-28 11:22:26 UTC

I spoke about the Open Source AI Reality at #fossnorth this morning. Awesome crowd. Excellent questions. (video pending)
Now going back home to do a #curl release tomorrow.
https://files.mastodon.social/media_attachments/files/116/482/057/572/100/483/original/1e934581d34900fc.jpg

2026-04-28 05:32:01 UTC

24 hours to next #curl release and at least eight new CVEs getting published

2026-04-25 14:23:23 UTC

"Pre-built GitHub profiles with five-year commit histories and Arctic Code Vault Contributor badges sell for approximately $5,000 on Telegram."
https://awesomeagents.ai/news/github-fake-stars-investigation/

2026-04-25 08:19:04 UTC

Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload.
Ask yourself what you do to make the situation better.
Make sure your employer does as well.

2026-04-24 16:05:17 UTC

*Zero* out of the six pending #curl CVEs are C mistakes. They are all logical mistakes that would have happened anyway even if we had used another language.

2026-04-24 14:35:46 UTC

Another opportunity for your Swedish training as I'm featured again:
https://www.realtid.se/it-tech/svenska-kodaren-nar-miljarder-anvandare-fran-vinden-i-huddinge/

2026-04-24 06:54:25 UTC

A Windows developer who wants a #curl bug to work on? Here's a good one:
https://github.com/curl/curl/pull/21433

2026-04-23 13:48:31 UTC

"AI's ability to find major software bugs is growing 490% year on year"
With some comments from me.
https://mashable.com/article/ai-discovered-zero-day-bug-reports-crisis

2026-04-22 12:54:45 UTC

Welcome Dio Putra as #curl commit author 1463: https://github.com/curl/curl/pull/21411

2026-04-22 11:45:38 UTC

High-Quality chaos. This is where we're at right now, security reporting wise.
https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/

2026-04-20 07:14:54 UTC

RE: https://chaos.social/@icing/116435790527643905
This is quickly becoming a new trend ... "look, if I totally destroy internals by abusing a private function, something bad can happen"
#note1qqg…y7x3

2026-04-18 20:57:20 UTC

Testing an alternative text under the image.
Better than the real 2001 quote?
https://files.mastodon.social/media_attachments/files/116/427/701/523/856/561/original/904f2f38979c0acc.jpg
https://files.mastodon.social/media_attachments/files/116/427/706/815/117/544/original/8cee47f343c9da01.jpg

2026-04-17 20:24:01 UTC

After just having responded to the third #curl security report for the evening I noticed a post that cheered me up...
Have a good Friday everyone!
https://www.linkedin.com/posts/moekatib_millions-of-people-look-up-to-steve-jobs-activity-7450947453085749248-K1w-
https://files.mastodon.social/media_attachments/files/116/421/903/118/671/945/original/c3f9ac3a99d21a03.png

2026-04-17 07:44:51 UTC

You're not alone. We don't see any point in running OpenSSF's scorecard either.

2026-04-17 07:14:24 UTC

On this day, eight years ago, I entered the US embassy in Stockholm to apply for a Visa, after I had been denied travel to the US the year before. No explanation, no motivation. Just denied.
It took 937 days for me to get the visa.
When I was about to use it for the first time, I caught covid and couldn't go.
Since then, the US administration scares me since I have this in my background, so I stay away.
The visa remains unused since November 2020. It expires in 2030.

2026-04-16 07:10:18 UTC

Average number of hours between #curl security reports
Material for a pending presentation
https://files.mastodon.social/media_attachments/files/116/413/128/360/699/982/original/1864b291d16f5e08.png

2026-04-15 09:23:17 UTC

Six years ago #Firefox announced they followed Chrome and removed FTP. #curl did not. Still hasn't.
https://daniel.haxx.se/blog/2020/04/15/curl-is-not-removing-ftp/

2026-04-15 06:56:42 UTC

- reply

I want to emphasize this because when I talk about AI security reports now, half my readers seem to believe those are AI slop. They're not. They are found with AI tools and normally high quality bug reports.
The weakest part is that they tend to overstress the vulnerability angle. Lots of them are well phrased bug reports that are still "just bugs".

2026-04-15 06:44:23 UTC

The AI slop security reporting is basically extinct. It almost does not happen anymore. At all.

2026-04-15 06:18:27 UTC

"I am submitting this via direct email as I am currently unable to use the HackerOne platform due to account restrictions for new reporters."
In case someone was wondering what happens when we try to make it harder for new accounts to submit new reports.

2026-04-14 14:40:04 UTC

RE: https://mastodon.social/@Mastodon/116402716327956884
"Mastodon has been awarded a €614k service agreement by the Sovereign Tech Fund"
#note1qc3…6yyg

2026-04-14 09:55:04 UTC

How to follow my writing:
0. chitchat in the #curl IRC channel on libera.chat (or Matrix if you insist)
1. Ramblings here on Mastodon
2. Blogs at https://daniel.haxx.se/blog/ (incl RSS)
3. Weekly emails at https://lists.haxx.se/listinfo/daniel
4. Occasional repeats of the above on LinkedIn: https://www.linkedin.com/in/danielstenberg
5. My mastodon posts are bridged to Bluesky: https://bsky.app/profile/bagder.mastodon.social.ap.brid.gy

2026-04-14 06:08:57 UTC

before: script kiddies
now: AI kiddies

2026-04-13 08:16:15 UTC

Finally: Doom played over #curl
https://github.com/xsawyerx/curl-doom
https://files.mastodon.social/media_attachments/files/116/396/399/022/479/872/original/f61480acb58dacf1.png

2026-04-13 07:11:10 UTC

- reply

my latest absolutely correct: https://hackerone.com/reports/3669305

2026-04-13 07:05:27 UTC

You are absolutely correct.

2026-04-12 08:42:15 UTC

I'm quoted (in Swedish) about AI tooling in DN: https://www.dn.se/ekonomi/linus-larsson-har-ar-ai-systemet-som-ar-for-farligt-for-varlden/

2026-04-11 15:23:52 UTC

Ah yes, I also gave some comments to The Register: https://www.theregister.com/2026/04/10/project_glasswing/

2026-04-11 12:38:04 UTC

I talked with NPR: https://www.npr.org/2026/04/11/nx-s1-5778508/anthropic-project-glasswing-ai-cybersecurity-mythos-preview

2026-04-10 07:25:38 UTC

Work in progress title slide for my coming talk at foss north
https://foss-north.se/2026/speakers-and-talks.html#dstenberg
https://files.mastodon.social/media_attachments/files/116/379/214/364/919/968/original/2afbfdf730fc8bf2.jpg

2026-04-09 08:06:33 UTC

I ran a quick git log grep just now. Over the last ~6 months or so, we have fixed over 200 bugs in #curl found with "AI tools".

2026-04-08 07:27:28 UTC

a LinkedIn post of the motivational kind:
#curl
https://files.mastodon.social/media_attachments/files/116/367/898/117/373/477/original/20be85921bf0c4c4.png

2026-04-08 05:58:18 UTC

Nope, no one from Anthropic Glasswing has been in touch.

2026-04-07 08:15:16 UTC

- reply

Apache httpd, curl, Django, Firefox, glibc, GnuTLS, Haproxy, libssh, Linux kernel, python, Temporal, Wireshark, wolfSSL
More?

2026-04-07 07:30:56 UTC

#curl is git cloned every second second
https://files.mastodon.social/media_attachments/files/116/362/248/028/775/283/original/8ace562209119cfd.png

2026-04-07 06:38:40 UTC

If your Open Source project sees a steep increase in number of high quality security reports (mostly done with AI) right now (#curl, Linux kernel, glibc confirmed) please tell me the name of this project.
(I'd like to make a little list for my coming talk on this.)

2026-04-06 17:56:21 UTC

RFC 9421 HTTP Message Signatures support in #curl maybe?
https://github.com/curl/curl/pull/21239

2026-04-05 20:59:26 UTC

There is virtually **no** AI slop security reports anymore submitted about #curl. They don't seem to happen any longer.
Almost everyone still uses AI though.

2026-04-05 14:44:27 UTC

- reply

someone in another open source project (to remain anonymous here) replied to my weekly email and said "as a comparison, we received 70 reports last week"
The ongoing "security report overload" is systematic and everywhere now.
Endure fellow maintainers!

2026-04-05 14:37:48 UTC

We have received more security reports against #curl in 2026 so far than we did during the entire year back in 2024.
During the first three months we have received twice the amount of reports/week as we did last year.

2026-04-02 15:10:18 UTC

Look mum I'm in the paper (today's Svenska Dagbladet, Sweden's number two morning newspaper)
https://files.mastodon.social/media_attachments/files/116/335/743/170/839/955/original/85b8e60f048d2d84.png

2026-03-31 06:32:52 UTC

Hey OpenSSF, maybe talk to the peeps you work with and tell them to NOT do it like this: https://github.com/curl/wcurl/issues/90

2026-03-30 20:17:29 UTC

For your Swedish training, as surely you won't cheat with a translation service. Me in Swedish media: https://www.aftonbladet.se/nyheter/a/JOOGBJ/han-kan-slacka-halva-internet-vi-maste-skydda-oss

2026-03-29 09:04:25 UTC

"Unfortunately in the bank where i work it is not easy to change the version, it requires lots of resources to retest." says reporter who uses a ten years old #curl version with a suspected bug... The problem is not open source.

2026-03-27 09:33:54 UTC

- reply

I concur. We see lots of accurate finds reported with AI tools in curl as well.

2026-03-27 08:19:22 UTC

- reply

"researchers" can go to extreme lengths to argue for and claim there are vulnerabilities in code, but yet almost none of them ever works on actually fixing the issue. Whatever the assessment of the issue is.

2026-03-27 08:18:09 UTC

One reason to fix minor code issues the AI tools find is that if we don't, we know there's an army of "friendly helpers" who will soon report them as "probable security problems" down the line. Because they can run the AI tools too.

2026-03-25 10:11:44 UTC

"The biggest change after Heartbleed was probably the creation of the OpenSSF which turns free time into meetings."
/ @npub16g6…s9jn

2026-03-25 08:13:27 UTC

- reply

there are some true gems in the collection!

2026-03-25 08:06:06 UTC

One hundred weirdo emails
https://daniel.haxx.se/blog/2026/03/25/one-hundred-weirdo-emails/
Yeps, they are now one hundred.

2026-03-24 06:57:37 UTC

RE: https://hachyderm.io/@kees/116282745861595200
Fun to see the Linux kernel follow in #curl's footsteps! 😎 (we removed the last strncpy from curl in late 2025)

2026-03-23 21:52:34 UTC

A random guy telling the world how to install some new software. An illustration.
https://files.mastodon.social/media_attachments/files/116/280/701/251/044/654/original/05a23fb2fad9f277.png

2026-03-23 08:05:12 UTC

git used curl before curl used git 💚

2026-03-23 08:02:41 UTC

16 years ago #curl officially switched over to using #git
https://daniel.haxx.se/blog/2010/03/23/curl-goes-git/

2026-03-22 11:41:30 UTC

NTLM and SMB go opt-in
https://daniel.haxx.se/blog/2026/03/22/ntlm-and-smb-go-opt-in/
#curl

2026-03-22 09:09:11 UTC

- reply

vi tror på dig! 💚

2026-03-21 14:06:37 UTC

bye bye RTMP
https://daniel.haxx.se/blog/2026/03/21/bye-bye-rtmp/
#curl

2026-03-20 12:11:12 UTC

noq is a new QUIC library in town, written in rust: https://www.iroh.computer/blog/noq-announcement

2026-03-18 07:56:16 UTC

"I'm concerned about LLM code in #curl and would like to suggest a code ban"
https://github.com/curl/curl/discussions/20972

2026-03-16 10:59:14 UTC

Does anyone have a script - in any language - that can scan the .github/workflow directory and tell how many individual "CI jobs" they kick off?

2026-03-16 08:29:25 UTC

commit time zone distribution in #curl
https://github.com/curl/stats/pull/24
https://files.mastodon.social/media_attachments/files/116/237/906/627/601/150/original/daff6f3aab72326c.png

2026-03-15 10:45:27 UTC

- reply

let me know if you have an idea for an interesting new graph.

2026-03-15 10:43:03 UTC

One hundred #curl graphs
https://daniel.haxx.se/blog/2026/03/15/one-hundred-curl-graphs/

2026-03-15 09:10:26 UTC

Some of you will be glad to know that the #curl dashboard now features the "graphs in the dashboard" graph
https://curl.se/dashboard1.html#graphs-on-the-dashboard
https://files.mastodon.social/media_attachments/files/116/232/407/372/570/005/original/184f229296bd7769.png

2026-03-13 09:15:07 UTC

In two weeks we run the #curl distro meeting. You are invited!
https://daniel.haxx.se/blog/2026/01/28/curl-distro-meeting-2026/

2026-03-12 22:06:35 UTC

chicken nuget
Insecure #curl packages hosted by Microsoft. They think it's fine.
https://daniel.haxx.se/blog/2026/03/12/chicken-nuget/

2026-03-12 13:06:44 UTC

"Our proprietary AI robots independently recreate any open source project from scratch"
https://malus.sh/

2026-03-12 08:08:59 UTC

CVE-2026-3784 beat a new #curl record. This flaw existed in curl source code for 24.97 years before it was discovered.
Illustrated in the slightly hard-to-read graph below. The average age of a curl vulnerability when reported is eight years.
https://curl.se/docs/CVE-2026-3784.html
https://files.mastodon.social/media_attachments/files/116/215/174/823/355/871/original/7c3e9f02c17c94ac.png

2026-03-10 13:33:35 UTC

Let's play slop or not! Here's the input:
https://hackerone.com/reports/3595753

2026-03-10 08:36:41 UTC

Dependency tracking is hard
https://daniel.haxx.se/blog/2026/03/10/dependency-tracking-is-hard/

2026-03-09 22:51:27 UTC

An amusing and telling picture that shows how dependency tracking for #curl and libcurl does not work at all, is to check out GitHub's view of all repositories that depend on curl.
I mean, there are quite a few repositories on there, so the number could be high.
Or it could be... one.
https://files.mastodon.social/media_attachments/files/116/201/660/155/386/634/original/1260c2479926ee75.png

2026-03-09 22:33:09 UTC

10K #curl downloads per year
https://daniel.haxx.se/blog/2026/03/09/10k-curl-downloads-per-year/

2026-03-08 22:26:51 UTC

I keep getting offers from randos offering to setup various crypto currency things to sponsor me or curl.
I will NEVER agree to have my name associated with any crypto currency efforts/scams. There's no room for debate. A hard no.

2026-03-08 22:10:52 UTC

On this Wednesday, March 11, we will ship the 273rd #curl release ever. We call it curl 8.19.0.
It contains over 250 bugfixes, done by the help from over 75 contributors during the 63 days since the previous release.
We will also announce at least four CVEs in sync with this.
Amusingly, the 273rd release supports 273 command line options.

2026-03-07 21:48:14 UTC

Looking back at all (now) published vulnerabilities in #curl that were present in code from 2020 until now, at no point in those years was the share of "C mistakes" higher than 15% of all vulns.
Through all years, the C mistake share of all vulnerabilities in #curl was never above 45% at any single point in history.
https://files.mastodon.social/media_attachments/files/116/190/088/538/446/707/original/b0f9322a90d54083.png

2026-03-05 16:00:29 UTC

After conference beer in Oslo with the Mrs. Living the open source celeb life. Not bad.

2026-03-05 05:50:05 UTC

- reply

My not at all surprised face: "After careful investigation, this case has been assessed as not a vulnerability and does not meet Microsoft's bar for immediate servicing."

2026-03-03 15:23:44 UTC

The Open Infra meetup on May 21 in Stockholm is open for registration.
I'll chip in with a light-weight blab I call "State actors, sleeper agents and plain bugs. Curl security matters."
https://www.meetup.com/openinfra-user-group-sweden/events/313615139/

2026-03-02 21:47:26 UTC

a detail you probably didn't know: no where in any #curl documentation do we use the word "very". It is a banned word enforced by a CI check. This rule encourages us to rewrite and instead use more appropriate words. Makes us write better English.