Nostr notes by daniel:// stenberg://

I must be weird, but when people are downright rude and hostile ...

2026-06-17T06:40:16Z

I must be weird, but when people are downright rude and hostile in issues, it makes me less interested in helping out.

Surely the rude people know this, so...why do they still do it?

The badge ...

2026-06-04T06:43:27Z

In reply to nevent1q…hrfj
_________________________

The badge

30 minutes until me time at #bsidesvilnius ...

2026-06-04T06:42:34Z

30 minutes until me time at #bsidesvilnius

What would be the biggest downside if we just stopped considering ...

2026-05-19T14:17:03Z

What would be the biggest downside if we just stopped considering severity low or medium security bugs CVE worthy?

50K!? 😵 ...

2026-05-17T15:39:36Z

50K!? 😵

I'll talk to a closed circle of "critical Swedish ...

2026-05-15T08:52:53Z

I'll talk to a closed circle of "critical Swedish infrastructure" leadership peeps on Monday about the current high quality chaos. It makes our current overload pain feel timely.

AAAAARGH. Trailing dots on host names in URLs is the gift that ...

2026-05-13T22:40:04Z

AAAAARGH.

Trailing dots on host names in URLs is the gift that keeps on giving, I said it already four years ago and it still generously continues to poke me in the eye.

https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/

five new reports landed just now, all within 40 minutes...

2026-05-13T22:16:38Z

In reply to nevent1q…jrz9
_________________________

*five* new reports landed just now, all within 40 minutes...

Attention is fun and good. And sometimes painful. The #curl ...

2026-05-13T21:24:00Z

Attention is fun and good. And sometimes painful. The #curl vulnerability counter keeps getting bumped... No rest for the security team.

(Yes: even after Mythos scanned the code people find issues...)

"Packages that can't be rebuilt byte-for-byte are now ...

2026-05-13T08:49:24Z

"Packages that can't be rebuilt byte-for-byte are now blocked from entering Debian's testing branch."

https://itsfoss.com/news/debian-makes-reproducible-builds-mandatory/

The hacker news thread is burning up: ...

2026-05-11T14:28:06Z

The hacker news thread is burning up: https://news.ycombinator.com/item?id=48091737

My personal conclusion can however not end up with anything else ...

2026-05-11T06:12:06Z

In reply to nevent1q…x746
_________________________

My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.

#Mythos finds a #curl vulnerability yes, as in singular one. ...

2026-05-11T06:02:17Z

#Mythos finds a #curl vulnerability

yes, as in singular one.

https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/

Open Source AI reality - Daniel Stenberg. From #fossnorth 2026. ...

2026-05-03T22:16:30Z

Open Source AI reality - Daniel Stenberg. From #fossnorth 2026.

The video is not top notch quality, but I think my message gets through.

https://youtu.be/VQ0kLuST800

Approaching zero bugs? Is it possible? Are we close? When will it ...

2026-04-30T08:09:15Z

Approaching zero bugs?

Is it possible? Are we close? When will it happen?

https://daniel.haxx.se/blog/2026/04/30/approaching-zero-bugs/

Reading this brings me close to medal-receiving levels of joy. ...

2026-04-29T20:42:10Z

Reading this brings me close to medal-receiving levels of joy.

RE: https://toot.yosh.is/@yosh/116487778402803336 Excuses. They ...

2026-04-29T11:56:35Z

RE: https://toot.yosh.is/@yosh/116487778402803336

Excuses. They forgot to run their site as they should and instead got lost working on AI features we never asked for. That's why.

quoting
note1cmv…7jk5

In case people are wondering why GitHub has been having some issues as of late - the GitHub COO recently shared that they're handling up to an order of magnitude more traffic than they were a year ago.

It's not like GitHub is just serving up pictures and text - things like the core git backend and actions are quite complex to host at scale. Idk, I guess I'm not surprised there are some stability issues when they're going from handling 1 billion commits/year to 14 billion commits/year.

in the curl 8.20.0 release there are still 903 lines of ...

2026-04-29T06:35:04Z

in the curl 8.20.0 release there are still 903 lines of production code last modified before the year 2000

I feel honored to present to you: #curl 8.20.0 ...

2026-04-29T06:27:32Z

I feel honored to present to you: #curl 8.20.0

https://daniel.haxx.se/blog/2026/04/29/curl-8-20-0/

If you would guess, do you think GitHub sends me a 500 now when I ...

2026-04-29T05:55:54Z

If you would guess, do you think GitHub sends me a 500 now when I try to publish a new #curl release... ☹️

This is week 18 and tomorrow will become the third #curl release ...

2026-04-28T21:42:30Z

This is week 18 and tomorrow will become the third #curl release ever done on April 29. A popular day.

I spoke about the Open Source AI Reality at #fossnorth this ...

2026-04-28T11:22:26Z

I spoke about the Open Source AI Reality at #fossnorth this morning. Awesome crowd. Excellent questions. (video pending)

Now going back home to do a #curl release tomorrow.

24 hours to next #curl release and at least eight new CVEs ...

2026-04-28T05:32:01Z

24 hours to next #curl release and at least eight new CVEs getting published

"Pre-built GitHub profiles with five-year commit histories ...

2026-04-25T14:23:23Z

"Pre-built GitHub profiles with five-year commit histories and Arctic Code Vault Contributor badges sell for approximately $5,000 on Telegram."

https://awesomeagents.ai/news/github-fake-stars-investigation/

Remember: this is a time when every open source project out there ...

2026-04-25T08:19:04Z

Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload.

Ask yourself what you do to make the situation better.

Make sure your employer does as well.

Zero out of the six pending #curl CVEs are C mistakes. They are ...

2026-04-24T16:05:17Z

*Zero* out of the six pending #curl CVEs are C mistakes. They are all logical mistakes that would have happened anyway even if we had used another language.

Another opportunity for your Swedish training as I'm featured ...

2026-04-24T14:35:46Z

Another opportunity for your Swedish training as I'm featured again:

https://www.realtid.se/it-tech/svenska-kodaren-nar-miljarder-anvandare-fran-vinden-i-huddinge/

A Windows developer who wants a #curl bug to work on? Here's ...

2026-04-24T06:54:25Z

A Windows developer who wants a #curl bug to work on? Here's a good one:

https://github.com/curl/curl/pull/21433

"AI's ability to find major software bugs is growing 490% ...

2026-04-23T13:48:31Z

"AI's ability to find major software bugs is growing 490% year on year"

With some comments from me.

https://mashable.com/article/ai-discovered-zero-day-bug-reports-crisis

Welcome Dio Putra as #curl commit author 1463: ...

2026-04-22T12:54:45Z

Welcome Dio Putra as #curl commit author 1463: https://github.com/curl/curl/pull/21411

High-Quality chaos. This is where we're at right now, ...

2026-04-22T11:45:38Z

High-Quality chaos. This is where we're at right now, security reporting wise.

https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/

RE: https://chaos.social/@icing/116435790527643905 This is ...

2026-04-20T07:14:54Z

RE: https://chaos.social/@icing/116435790527643905

This is quickly becoming a new trend ... "look, if I totally destroy internals by abusing a private function, something bad can happen"

quoting
note1qqg…y7x3

Testing an alternative text under the image. Better than the real ...

2026-04-18T20:57:20Z

Testing an alternative text under the image.

Better than the real 2001 quote?

After just having responded to the third #curl security report ...

2026-04-17T20:24:01Z

After just having responded to the third #curl security report for the evening I noticed a post that cheered me up...

Have a good Friday everyone!

https://www.linkedin.com/posts/moekatib_millions-of-people-look-up-to-steve-jobs-activity-7450947453085749248-K1w-

You're not alone. We don't see any point in running ...

2026-04-17T07:44:51Z

You're not alone. We don't see any point in running OpenSSF's scorecard either.

On this day, eight years ago, I entered the US embassy in ...

2026-04-17T07:14:24Z

On this day, eight years ago, I entered the US embassy in Stockholm to apply for a Visa, after I had been denied travel to the US the year before. No explanation, no motivation. Just denied.

It took 937 days for me to get the visa.

When I was about to use it for the first time, I caught covid and couldn't go.

Since then, the US administration scares me since I have this in my background, so I stay away.

The visa remains unused since November 2020. It expires in 2030.

Average number of hours between #curl security reports Material ...

2026-04-16T07:10:18Z

Average number of hours between #curl security reports

Material for a pending presentation

Six years ago #Firefox announced they followed Chrome and removed ...

2026-04-15T09:23:17Z

Six years ago #Firefox announced they followed Chrome and removed FTP. #curl did not. Still hasn't.

https://daniel.haxx.se/blog/2020/04/15/curl-is-not-removing-ftp/

I want to emphasize this because when I talk about AI security ...

2026-04-15T06:56:42Z

In reply to nevent1q…6z3h
_________________________

I want to emphasize this because when I talk about AI security reports now, half my readers seem to believe those are AI slop. They're not. They are found with AI tools and normally high quality bug reports.

The weakest part is that they tend to overstress the vulnerability angle. Lots of them are well phrased bug reports that are still "just bugs".

The AI slop security reporting is basically extinct. It almost ...

2026-04-15T06:44:23Z

The AI slop security reporting is basically extinct. It almost does not happen anymore. At all.

"I am submitting this via direct email as I am currently ...

2026-04-15T06:18:27Z

"I am submitting this via direct email as I am currently unable to use the HackerOne platform due to account restrictions for new reporters."

In case someone was wondering what happens when we try to make it harder for new accounts to submit new reports.

RE: https://mastodon.social/@Mastodon/116402716327956884 ...

2026-04-14T14:40:04Z

RE: https://mastodon.social/@Mastodon/116402716327956884

"Mastodon has been awarded a €614k service agreement by the Sovereign Tech Fund"

quoting
note1qc3…6yyg

We’re happy to share that Mastodon has been awarded a service agreement from the Sovereign Tech Fund Sovereign Tech Agency (npub1yng…nhrk) 🎉

This covers five major initiatives through 2026 and 2027. We are very grateful for this support. Read about the details in our blog post.

https://blog.joinmastodon.org/2026/04/sovereign-tech-agency-funding/

How to follow my writing: 0. chitchat in the #curl IRC channel on ...

2026-04-14T09:55:04Z

How to follow my writing:

0. chitchat in the #curl IRC channel on libera.chat (or Matrix if you insist)
1. Ramblings here on Mastodon
2. Blogs at https://daniel.haxx.se/blog/ (incl RSS)
3. Weekly emails at https://lists.haxx.se/listinfo/daniel
4. Occasional repeats of the above on LinkedIn: https://www.linkedin.com/in/danielstenberg
5. My mastodon posts are bridged to Bluesky: https://bsky.app/profile/bagder.mastodon.social.ap.brid.gy

before: script kiddies now: AI kiddies

2026-04-14T06:08:57Z

before: script kiddies

now: AI kiddies

Finally: Doom played over #curl ...

2026-04-13T08:16:15Z

Finally: Doom played over #curl

https://github.com/xsawyerx/curl-doom

my latest absolutely correct: ...

2026-04-13T07:11:10Z

In reply to nevent1q…a4un
_________________________

my latest absolutely correct: https://hackerone.com/reports/3669305

Nostr event nevent1qqsxm0lakv4aesxrppffzrhemh5thprc5adkvhuzzmqyt8f7e0vwcpgzyrrdakqhslj4g0cmyrcf6aztpz2yx5jdneh7f226466vq76zuqfvkse5l0l

2026-04-13T07:05:27Z

You are absolutely correct.

I'm quoted (in Swedish) about AI tooling in DN: ...

2026-04-12T08:42:15Z

I'm quoted (in Swedish) about AI tooling in DN: https://www.dn.se/ekonomi/linus-larsson-har-ar-ai-systemet-som-ar-for-farligt-for-varlden/

Ah yes, I also gave some comments to The Register: ...

2026-04-11T15:23:52Z

Ah yes, I also gave some comments to The Register: https://www.theregister.com/2026/04/10/project_glasswing/

I talked with NPR: ...

2026-04-11T12:38:04Z

I talked with NPR: https://www.npr.org/2026/04/11/nx-s1-5778508/anthropic-project-glasswing-ai-cybersecurity-mythos-preview

Work in progress title slide for my coming talk at foss north ...

2026-04-10T07:25:38Z

Work in progress title slide for my coming talk at foss north

https://foss-north.se/2026/speakers-and-talks.html#dstenberg

I ran a quick git log grep just now. Over the last ~6 months or ...

2026-04-09T08:06:33Z

I ran a quick git log grep just now. Over the last ~6 months or so, we have fixed over 200 bugs in #curl found with "AI tools".

a LinkedIn post of the motivational kind: #curl ...

2026-04-08T07:27:28Z

a LinkedIn post of the motivational kind:

#curl

Nostr event nevent1qqsvr5rxr27d9yr6u4mk4087w4nd03qadxmlx9yhgwkclp2t8z086dqzyrrdakqhslj4g0cmyrcf6aztpz2yx5jdneh7f226466vq76zuqfvkj2er4w

2026-04-08T05:58:18Z

Nope, no one from Anthropic Glasswing has been in touch.

Apache httpd, curl, Django, Firefox, glibc, GnuTLS, Haproxy, ...

2026-04-07T08:15:16Z

In reply to nevent1q…mjhw
_________________________

Apache httpd, curl, Django, Firefox, glibc, GnuTLS, Haproxy, libssh, Linux kernel, python, Temporal, Wireshark, wolfSSL

More?

#curl is git cloned every second second ...

2026-04-07T07:30:56Z

#curl is git cloned every second second

If your Open Source project sees a steep increase in number of ...

2026-04-07T06:38:40Z

If your Open Source project sees a steep increase in number of high quality security reports (mostly done with AI) right now (#curl, Linux kernel, glibc confirmed) please tell me the name of this project.

(I'd like to make a little list for my coming talk on this.)

RFC 9421 HTTP Message Signatures support in #curl maybe? ...

2026-04-06T17:56:21Z

RFC 9421 HTTP Message Signatures support in #curl maybe?

https://github.com/curl/curl/pull/21239

There is virtually no AI slop security reports anymore ...

2026-04-05T20:59:26Z

There is virtually **no** AI slop security reports anymore submitted about #curl. They don't seem to happen any longer.

Almost everyone still uses AI though.

someone in another open source project (to remain anonymous here) ...

2026-04-05T14:44:27Z

In reply to nevent1q…9tgs
_________________________

someone in another open source project (to remain anonymous here) replied to my weekly email and said "as a comparison, we received 70 reports last week"

The ongoing "security report overload" is systematic and everywhere now.

Endure fellow maintainers!

We have received more security reports against #curl in 2026 so ...

2026-04-05T14:37:48Z

We have received more security reports against #curl in 2026 so far than we did during the entire year back in 2024.

During the first three months we have received twice the amount of reports/week as we did last year.

Look mum I'm in the paper (today's Svenska Dagbladet, ...

2026-04-02T15:10:18Z

Look mum I'm in the paper (today's Svenska Dagbladet, Sweden's number two morning newspaper)

Hey OpenSSF, maybe talk to the peeps you work with and tell them ...

2026-03-31T06:32:52Z

Hey OpenSSF, maybe talk to the peeps you work with and tell them to NOT do it like this: https://github.com/curl/wcurl/issues/90

For your Swedish training, as surely you won't cheat with a ...

2026-03-30T20:17:29Z

For your Swedish training, as surely you won't cheat with a translation service. Me in Swedish media: https://www.aftonbladet.se/nyheter/a/JOOGBJ/han-kan-slacka-halva-internet-vi-maste-skydda-oss

"Unfortunately in the bank where i work it is not easy to ...

2026-03-29T09:04:25Z

"Unfortunately in the bank where i work it is not easy to change the version, it requires lots of resources to retest." says reporter who uses a ten years old #curl version with a suspected bug... The problem is not open source.

I concur. We see lots of accurate finds reported with AI tools in ...

2026-03-27T09:33:54Z

In reply to nevent1q…7d7d
_________________________

I concur. We see lots of accurate finds reported with AI tools in curl as well.

"researchers" can go to extreme lengths to argue for and ...

2026-03-27T08:19:22Z

In reply to nevent1q…3x9n
_________________________

"researchers" can go to extreme lengths to argue for and claim there are vulnerabilities in code, but yet almost none of them ever works on actually fixing the issue. Whatever the assessment of the issue is.

One reason to fix minor code issues the AI tools find is that if ...

2026-03-27T08:18:09Z

One reason to fix minor code issues the AI tools find is that if we don't, we know there's an army of "friendly helpers" who will soon report them as "probable security problems" down the line. Because they can run the AI tools too.

"The biggest change after Heartbleed was probably the ...

2026-03-25T10:11:44Z

"The biggest change after Heartbleed was probably the creation of the OpenSSF which turns free time into meetings."

/ Josh Bressers (npub16g6…s9jn)

there are some true gems in the collection!

2026-03-25T08:13:27Z

In reply to nevent1q…dyer
_________________________

there are some true gems in the collection!

One hundred weirdo emails ...

2026-03-25T08:06:06Z

One hundred weirdo emails

https://daniel.haxx.se/blog/2026/03/25/one-hundred-weirdo-emails/

Yeps, they are now one hundred.

RE: https://hachyderm.io/@kees/116282745861595200 Fun to see the ...

2026-03-24T06:57:37Z

RE: https://hachyderm.io/@kees/116282745861595200

Fun to see the Linux kernel follow in #curl's footsteps! 😎 (we removed the last strncpy from curl in late 2025)

A random guy telling the world how to install some new software. ...

2026-03-23T21:52:34Z

A random guy telling the world how to install some new software. An illustration.

Nostr event nevent1qqsrtrhcansjl0am3trxxn6nfzsaaw6cg573sm7chd75c7n8y3pmjuszyrrdakqhslj4g0cmyrcf6aztpz2yx5jdneh7f226466vq76zuqfvklseszl

2026-03-23T08:05:12Z

git used curl before curl used git 💚

16 years ago #curl officially switched over to using #git ...

2026-03-23T08:02:41Z

16 years ago #curl officially switched over to using #git

https://daniel.haxx.se/blog/2010/03/23/curl-goes-git/

NTLM and SMB go opt-in ...

2026-03-22T11:41:30Z

NTLM and SMB go opt-in

https://daniel.haxx.se/blog/2026/03/22/ntlm-and-smb-go-opt-in/

#curl

vi tror på dig! 💚

2026-03-22T09:09:11Z

In reply to nevent1q…rt3z
_________________________

vi tror på dig! 💚

bye bye RTMP https://daniel.haxx.se/blog/2026/03/21/bye-bye-rtmp/ ...

2026-03-21T14:06:37Z

bye bye RTMP

https://daniel.haxx.se/blog/2026/03/21/bye-bye-rtmp/

#curl

noq is a new QUIC library in town, written in rust: ...

2026-03-20T12:11:12Z

noq is a new QUIC library in town, written in rust: https://www.iroh.computer/blog/noq-announcement

"I'm concerned about LLM code in #curl and would like to ...

2026-03-18T07:56:16Z

"I'm concerned about LLM code in #curl and would like to suggest a code ban"

https://github.com/curl/curl/discussions/20972

Does anyone have a script - in any language - that can scan the ...

2026-03-16T10:59:14Z

Does anyone have a script - in any language - that can scan the .github/workflow directory and tell how many individual "CI jobs" they kick off?

commit time zone distribution in #curl ...

2026-03-16T08:29:25Z

commit time zone distribution in #curl

https://github.com/curl/stats/pull/24

let me know if you have an idea for an interesting new graph.

2026-03-15T10:45:27Z

In reply to nevent1q…cvn2
_________________________

let me know if you have an idea for an interesting new graph.

One hundred #curl graphs ...

2026-03-15T10:43:03Z

One hundred #curl graphs

https://daniel.haxx.se/blog/2026/03/15/one-hundred-curl-graphs/

Some of you will be glad to know that the #curl dashboard now ...

2026-03-15T09:10:26Z

Some of you will be glad to know that the #curl dashboard now features the "graphs in the dashboard" graph

https://curl.se/dashboard1.html#graphs-on-the-dashboard

In two weeks we run the #curl distro meeting. You are invited! ...

2026-03-13T09:15:07Z

In two weeks we run the #curl distro meeting. You are invited!

https://daniel.haxx.se/blog/2026/01/28/curl-distro-meeting-2026/

chicken nuget Insecure #curl packages hosted by Microsoft. They ...

2026-03-12T22:06:35Z

chicken nuget

Insecure #curl packages hosted by Microsoft. They think it's fine.

https://daniel.haxx.se/blog/2026/03/12/chicken-nuget/

"Our proprietary AI robots independently recreate any open ...

2026-03-12T13:06:44Z

"Our proprietary AI robots independently recreate any open source project from scratch"

https://malus.sh/

CVE-2026-3784 beat a new #curl record. This flaw existed in curl ...

2026-03-12T08:08:59Z

CVE-2026-3784 beat a new #curl record. This flaw existed in curl source code for 24.97 years before it was discovered.

Illustrated in the slightly hard-to-read graph below. The average age of a curl vulnerability when reported is eight years.

https://curl.se/docs/CVE-2026-3784.html

Let's play slop or not! Here's the input: ...

2026-03-10T13:33:35Z

Let's play slop or not! Here's the input:

https://hackerone.com/reports/3595753

Dependency tracking is hard ...

2026-03-10T08:36:41Z

Dependency tracking is hard

https://daniel.haxx.se/blog/2026/03/10/dependency-tracking-is-hard/

An amusing and telling picture that shows how dependency tracking ...

2026-03-09T22:51:27Z

An amusing and telling picture that shows how dependency tracking for #curl and libcurl does not work at all, is to check out GitHub's view of all repositories that depend on curl.

I mean, there are quite a few repositories on there, so the number could be high.

Or it could be... one.

10K #curl downloads per year ...

2026-03-09T22:33:09Z

10K #curl downloads per year

https://daniel.haxx.se/blog/2026/03/09/10k-curl-downloads-per-year/

I keep getting offers from randos offering to setup various ...

2026-03-08T22:26:51Z

I keep getting offers from randos offering to setup various crypto currency things to sponsor me or curl.

I will NEVER agree to have my name associated with any crypto currency efforts/scams. There's no room for debate. A hard no.

On this Wednesday, March 11, we will ship the 273rd #curl release ...

2026-03-08T22:10:52Z

On this Wednesday, March 11, we will ship the 273rd #curl release ever. We call it curl 8.19.0.

It contains over 250 bugfixes, done by the help from over 75 contributors during the 63 days since the previous release.

We will also announce at least four CVEs in sync with this.

Amusingly, the 273rd release supports 273 command line options.

Looking back at all (now) published vulnerabilities in #curl that ...

2026-03-07T21:48:14Z

Looking back at all (now) published vulnerabilities in #curl that were present in code from 2020 until now, at no point in those years was the share of "C mistakes" higher than 15% of all vulns.

Through all years, the C mistake share of all vulnerabilities in #curl was never above 45% at any single point in history.

After conference beer in Oslo with the Mrs. Living the open ...

2026-03-05T16:00:29Z

After conference beer in Oslo with the Mrs. Living the open source celeb life. Not bad.

My not at all surprised face: "After careful investigation, ...

2026-03-05T05:50:05Z

In reply to nevent1q…drr3
_________________________

My not at all surprised face: "After careful investigation, this case has been assessed as not a vulnerability and does not meet Microsoft's bar for immediate servicing."

The Open Infra meetup on May 21 in Stockholm is open for ...

2026-03-03T15:23:44Z

The Open Infra meetup on May 21 in Stockholm is open for registration.

I'll chip in with a light-weight blab I call "State actors, sleeper agents and plain bugs. Curl security matters."

https://www.meetup.com/openinfra-user-group-sweden/events/313615139/

a detail you probably didn't know: no where in any #curl ...

2026-03-02T21:47:26Z

a detail you probably didn't know: no where in any #curl documentation do we use the word "very". It is a banned word enforced by a CI check. This rule encourages us to rewrite and instead use more appropriate words. Makes us write better English.