Today I added the following paragraph to #curl's hackerone page informing about our bug-bounty program:
Reports are made public
All security reports that are submitted to the curl project are subject for disclosure once they have been dealt with and they are deemed "insensitive". We are an Open Source project for which transparency is important, which then includes showing the world all our security reports as well.
One of these rare chances to get your hands on #curl stickers materializes tomorrow in Rotterdam when I appear at the Joy of Coding conference with a load of stickers waiting for new homes.
@cr I don't have a lot of experience to compare with. Fastly sponsors this for us (making it entirely gratis for us, the #curl project) and their service has been just flawless so I have nothing but praise to give.
curl passes down the capath directly to the backends. OpenSSL will then delimiter-separate this path internally to support multiple directories (using its certificate hash scheme). However, the oth...
When the code was originally written, entry = NULL was supported. However, after 59e351a this check has became redundant. It will never succeed because the *entry = NULL; statement at the start of ...
curl supports getting built with eleven different TLS libraries. Six of these libraries are OpenSSL or forks of OpenSSL. Allow me to give you a glimpse of their differences, similarities and some insights into what it takes to support them all.
TIL #curl help categories. When invoked with cli flag '-h' curl can provide you infos about command-line flags related to certain categories, e.g. http, smtp, ... Thanks for that @bagder
Implements a seperate read thread for STDIN on Windows when curl is run with -T/--upload-file .
This uses a similar technique to the nmap/ncat project, spawning a seperate thread which creates a lo...
In INSTALL.md file, the link that points to CURL-DISABLE was broken, so I fixed this issue changing the link from only "CURL-DISABLE.md" to "https://github.com/curl/curl/blob/master/...
Allow prequotes to be sent after curl has changed the working directory, just before the listing command if the URL is a directory.
FTP state machine is updated with the new FTP_LIST_PREQUOTE state...
What follows is a public spec related to the Ubuntu Server seeds. It does not contain specific definitions about seeds, how they relate to the ISOs, nor a long history. It is an implementation spec to show changes planned for 25.10.
So today it is Friday the 13th and apparently I should have stayed in my bed.
Just spent way too much time troubleshooting why the curl requests I got from Firefox by using "copy request to cUrl" did not work. Turns out it is a Firefox bug. For unknown reason it adds a caret "^" before each parameter separator in the query string in the curl request, breaking everything. 😞
I ran strace on curl and noticed that it is doing a lot of very short reads, of exactly 5 bytes, followed by a larger read.
strace Before
recvfrom(4, "\27\3\3@\30", 5, 0, NULL, NULL) = 5
...
I ran strace on curl and noticed that it is doing a lot of very short reads, of exactly 5 bytes, followed by a larger read.
strace Before
recvfrom(4, "\27\3\3@\30", 5, 0, NULL, NULL) = 5
...
Thanks to Calvin Ruocco, Dan Fandrich, Daniel Stenberg, denandz on github, Ethan Everett, Jacob Mealey, Jeremy Drake, Jeroen Ooms, John Bampton, Kadambini Nema, Michael Kaufmann, Rasmus Melchior Jacobsen, Ray Satiro, Samuel Henrique, Stefan Eissing, Viktor Szakats, x-xiang on github, Yedaya Katsman, Yuyi Wang, z2_
This is a patch-release done only a week since the previous version with no changes merged only bugfixes. Because some of the regressions in 8.14.0 were a little too annoying to leave unattended for a full cycle.
On Cygwin, it is unsafe to call POSIX functions from DllMain, which OPENSSL_thread_stop does. Additionally, it should be unnecessary as OpenSSL uses pthread_key_create to register a thread destruc...
If I'm going to be totally honest: implementing anything in #curl is about fourteen times easier and more fun than the thread- and object-spaghetti that is #Firefox code... But don't tell anyone I said this.
I did this Tried to download a resource with --http2 parameter. I expected the following The Windows build, available via winget (winget install cURL.cURL), has neither HTTP/2 nor HTTP/3 (QUIC) sup...
