Search

Items tagged with: curl

With 20 days left to next #curl release

Stats so far this cycle:

Commits: 530 (total 37258)
Commit authors: 27, 9 new (total 1425)
Contributors: 52, 24 new (total 3559)
Bugfixes logged: 290 (7.99 per day)

#curl

We currently have three pending CVEs to be announced in the next #curl release (severity low + medium x 2)

All three found with AI powered tooling.

So it is happening.

#curl

Cartero looks solid!

But for a fair comparison, let's put #curl on the chart.

#curl

On this day six years ago, we learned that mr Robot curls:

daniel.haxx.se/blog/2019/12/10…

Exactly three years later, still this date, we found a #curl sighting in the movie Silk Road:

daniel.haxx.se/blog/2022/12/10…


Mr Robot curls

The Mr Robot TV series features a security expert and hacker lead character, Elliot. Season 4, episode 8 Vasilis Lourdas reported that he did a "curl sighting" in the show and very well I took a closer peek and what do we see some 37 minutes 36 secon…
daniel.haxx.se
#curl

⭐ ⭐ ⭐ ⭐ ⭐

The #curl repo on GitHub surpassed 40K stars: github.com/curl/curl

⭐ ⭐ ⭐ ⭐ ⭐


GitHub - curl/curl: A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, T

A command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP...
GitHub
#curl

Remember the AIxCC competition? After lots of research and triaging, the conclusion has landed: not a single *real* problem was found in #curl.

My previous write-up on the rather lame injected problems they found:

daniel.haxx.se/blog/2025/10/22…


AIxCC curl details

At the AIxCC competition at DEF CON 33 earlier this year, teams competed against each other to find vulnerabilities in provided Open Source projects by using (their own) AI powered tools.
daniel.haxx.se
#curl

#curl

Your regular reminder that an #IPv4 address is just a 32-number, and yes, #curl accepts it as such.
curl to a 32-bit number, working
#curl #ipv4

#curl

#curl

Speaking day at Build Stuff. Better wear my best shirt. #curl
Jimmy wearing a green tshirt with the curl logo on it.
#curl

#curl

A new Hackerone issue was submitted for #curl and I had it closed as not applicable within four minutes. A new personal record I believe.

(It will be disclosed asap.)

#curl

Today December 4, at 18:00 CET I will talk tiny #curl. With a bird-themed slide set!

us02web.zoom.us/webinar/regist…

tiny curl, December 4 2025, Daniel Stenberg
Smaller devices - a few megabytes of RAM and storage - don’t run Linux - often need fewer features - still need HTTPS done securely - often using HW vendors’ sample code

Welcome! You are invited to join a webinar: tiny-curl 101: Secure Communication with a Small Footprint. After registering, you will receive a confirmation email about joining the webinar.

Join curl founder Daniel Stenberg on December 4th at 9 AM PT for a focused introduction to tiny-curl, the lightweight version of curl designed for resource-constrained environments and embedded users.
Zoom
#curl

YES 🙌 It’s thanks to #curl that I’ve been able to install the superb #YunoHost on my VPS… and YunoHost has been life changing and incredibly empowering…

so thank you Daniel 🙏

#yunohost #curl

Reminder. #curl runs in all your devices. So I made a slide to show some of them.

(yeah, I've used and shown this slide numerous times before and I will probably do it again...)

image showing numerous devices, vehicles, games, services etc that all use curl inside
#curl

#curl

#curl

I was wondering whether #curl somehow does its own parsing of /etc/hosts, because it does something _very_ weird, and it seems it's c-ares who is guilty
#curl

#curl

On Thursday next week (Dec 4) I will do a tiny #curl webinar. Sign up for it here: us02web.zoom.us/webinar/regist…

It will be made available on video after the fact.

tiny-curl is a libcurl flavor designed for the smaller devices. Same API. Same reliability. With some protocols and features cut out making a (much) smaller footprint. See curl.se/tiny/


Welcome! You are invited to join a webinar: tiny-curl 101: Secure Communication with a Small Footprint. After registering, you will receive a confirmation email about joining the webinar.

Join curl founder Daniel Stenberg on December 4th at 9 AM PT for a focused introduction to tiny-curl, the lightweight version of curl designed for resource-constrained environments and embedded users.
Zoom
#curl

just discovered that `curl --help` takes an optional category as an argument. nice! #curl
#curl

#curl

Interesting numbers.

#curl on my Linux machine can download a large file from http://localhost at 5.0GiB/sec. Pointing to the file:// version of the exact same file "only" increases the speed to .8.8GiB/sec.

#curl

So, curl doesn’t integrate with libsecret in any way? I assume that since there’s no discussion on the main mailing list of in the GitHub issues for it that I’m somehow being dumb thinking I want it.
If the service that I’m authenticating to uses basic auth, and I don’t want to store my passwords in a .netrc in my HOME or pass it in clear on the command-line, what are my best options?
@bagder
#curl #gnome_libsecret #infosec #LazyWeb
#infosec #curl #gnome_libsecret #lazyweb @daniel:// stenberg://

I believe I have actually gotten several awards for my work on #curl for at least partly those reasons...
#curl

#curl

#curl

On this day nine years ago, #curl received its first security audit report.

daniel.haxx.se/blog/2016/11/23…


curl security audit

"the overall impression of the state of security and robustness of the cURL library was positive." I asked for, and we were granted a security audit of curl from the Mozilla Secure Open Source program a while ago.
daniel.haxx.se
#curl

#curl

How AI helps us build higher bar charts in the #curl project
Chart showing number of Hackerone submissions per year, showing 2025 being higher than all other years and yet the number of confirmed vulnerabilities is lower than the four previous years...
#curl

Ah, #curl still in use, I see:

> otool -L ~/.cargo/bin/rustup
...
/usr/lib/libcurl.4.dylib

and cargo itself is:
~/.cargo/bin/cargo -> rustup

We try to keep it all safe to the best of our abilities.😌

#curl

We crank it up to over 3,000 this year. #curl
lots of vertical bars showing commits per year in the curl project. 2025 raises above all others with 3011 commits so far
#curl

#curl

In today's edition of #ChatGPT imagines a non-existent #curl feature, much to @bagder 's dismay...

As passed along by my colleague who discovered this, the prompt included: "find a website that is actually hosted on physical infrastructure in Guam"

and ChatGPT suggested one on #Akamai but then suggested using the no-existent --no-cdn flag to skip straight to the origin. Please don't take this as a suggestion to implement such a feature. 🙂

Prompt was: "If your goal is to find a website that is actually hosted on physical infrastructure in Guam (not just “serving Guam” or using a Guam-themed domain), here are the reliable ways to identify or locate such sites, plus a few examples." Response contained: 5. Guam Visitors Bureau https:/jwww.visitguam.com » + Mixed hosting (Akamai CDN). e BUT: Their origin server (not the CDN edges) is in Guam. If you use —-no-cdn via curl tricks or DNS origin lookup, you will hit the Guam origin.
#chatgpt #curl #Akamai @daniel:// stenberg://

A real Hackerone #curl report title!:

"Out-of-bounds read in *** potential crash. This is sharp, <reporter name>. We've got a real memory safety bug"

The AI is helpfully cheering the guy onwards to slopping. Of course, it is a false positive.

#curl

In 2007 I did a talk about #curl at the FSCONS conference. The video is lost in time but today I realized that FSF Europe is still hosting the torrent file.

Not too many seeders of that content left though... 😎

download.fsfeurope.org/torrent…

#curl

#curl

#curl

⇧