Search

Items tagged with: Curl

Are you interested in helping out to make a Network.framework SSL backend for #curl?

The Secure Transport one is going away and this could be a new way to use the native Apple system.

But code does not write itself. There is an embryo started, but it needs love.

github.com/curl/curl/pull/1750…


lib: add Network.framework SSL backend by conradev · Pull Request #17506 · curl/curl

Hi everyone! I started working on a Network.framework backend for curl a bit ago. I had a few motivations for writing this: Wanting to use curl with system SSL without compiling anything on iOS/wa...
GitHub
#curl

Did my duty for the pending #curl patch release on Wednesday. The photo.
curl 8.14.1
#curl

FYI: HTTP/3 support in #curl is not experimental anymore if built to use ngtcp2 + nghttp3
#curl

Referring sites for visitors to #curl's GitHub repository over the last 14 days.

Interesting I think.

1. Google 2. curl.se 3. github.com 4. Bing 5. daniel.haxx.se ...
#curl

The #curl bug-bounty has paid 91,900 USD in reward money

For 80 confirmed security problems.

A graph with a plot gradually growing from zero USD in 2018 to >91,000 USD in mid 2025.
#curl

FTP is quite unique in the #curl collection of protocols due to its (weird) mandatory use of a separate TCP connection for the data transfer (and the fact that it can be setup in either direction, client to server or server to client) . It is complicated for users, for sysadmins and it is a complication in source code and internal curl TCP management as well.

So yeah, it also keeps causing us headaches to this day.

#curl

Circa five years ago the browsers dropped FTP support.

#curl still supports it. In 2024, 23% of curl users said they used FTP within the past two years.

My post from April 2020:

daniel.haxx.se/blog/2020/04/15…


curl is not removing FTP

FTP is going out of style. The Chrome team has previously announced that they are deprecating and removing support for FTP. Mozilla also announced their plan for the deprecation of FTP in Firefox.
daniel.haxx.se
#curl

#curl

#curl

#curl

How can #OpenSource and #security be interconnected?
What will be the future of funding the open source-dependent public digital infrastructure?

These and many other questions will guide the discussion of our panelists:
🔸@bagder from #cURL
🔸@melanierieback from @ros
🔸Matteo Mole from @EuropeanCyber SecurityOrganisation
🔸Nicholas Gates from @OpenForumEurope
🔸Mirko Boehm from #TheLinuxFoundation

Join the webinar : europeanopensource.academy/for…

Webinar Open Source and Cybersecurity Registration Form | European Open Source Academy

europeanopensource.academy
#opensource #security #curl #thelinuxfoundation @daniel:// stenberg:// @OpenForum Europe @Radically Open Security @Melanie Rieback

#curl

#curl

The two #curl CVEs we publish today are both rated medium and affect QUIC connections when curl is built to use wolfSSL

Hiroki Kurosawa reported both and he is rewarded 2540 USD for each from the curl bug-bounty.

With these two, the total bug-bounty payout from #curl now exceeds 90,000 USD over the last few years.

curl.se/docs/bugbounty.html

(thanks to IBB for sponsoring our bug-bounty program!)

curl - Bug Bounty

curl.se
#curl

#curl 8.14.0 is here with new stuff, bugfixes and two security advisories.

Live-streamed presentation at 08:00 UTC today.

daniel.haxx.se/blog/2025/05/28…


curl 8.14.0

Welcome to another curl release. Release presentation At 8:00 UTC (10:00 CEST), I do a live-streamed release presentation over at Twitch where I talk about all that is new in this release.
daniel.haxx.se
#curl

I chatted with @bagder about #Curl and the recent #AI happenings

It's always fun talking to Daniel, and I think there's a lot of good ideas in this one, especially on how to approach AI fueled contributions that aren't slop. And even suggestions on how to deal with slop contributions :)

opensourcesecurity.io/2025/202…


Curl vs AI with Daniel Stenberg

Daniel Stenberg, the maintainer of Curl, discusses the increase in AI security reports that are wasting the time of maintainers. We discuss Curl’s new policy of banning the bad actors while establishing some pretty sane AI usage guidelines.
Josh Bressers (Open Source Security)
#AI #curl @daniel:// stenberg://

#curl 8.14.0 arrives tomorrow but let me give you some numbers already now...
269 command line options (+1) 96 public libcurl functions 308 curl_easy_setopt options (+1)
56 days since previous release 9931 days since inception
Release 267
Participation 91 contributors, 48 new, 3427 in total 37 authors, 17 new, 1375 In total
#curl

Had a small photo session to get some new material for the #curl release slide set for the release presentation tomorrow. Daisy the cat was not impressed.
A wooden robot and tiles saying "team curl"
A wooden robot, tiles saying "team curl" and a cat looking away
#curl

The #curl eight week release cycle explained in a single image
A circle diagram explaining the different phases in the curl release cycle: cool down, feature window, feature freeze and the three different release candidate drops.
#curl

When #curl turns into an evil empire, we already have the flag done.
the curl evil empire flag. A cog, the curl symbol, a fist. In red circles on a black flag.
#curl

#curl

with 48 hours left until release, I took the mandatory #curl "release photo"
8 14 0 in wooden tiles and a curl sticker
#curl

Starting with #curl 8.14.0 coming on Wednesday May 28, the wcurl script comes bundled and gets installed on "make install".

curl.se/wcurl/

wcurl

curl.se
#curl

Me yesterday in front of a huge #curl number of lines of code graph.
Daniel on stage in front of huge graph shown behind, number of lines of code in the curl project over time.
#curl

#curl

#curl

One week from the pending next #curl release, I uploaded the final release candidate, rc3 to curl.se/rc/

Please consider taking this for a spin and verify that everything seems to work as they should.

Thanks for flying curl.

curl release candidates

curl.se
#curl

I ran a quick SFTP performance test with #curl built to use #libssh 0.11.1 vs one built that uses #libssh2 1.11.1 over a 400ms latency connection.

One of them managed to perform this at 1049K/sec, the other reached only 249K/sec.

And the winner is...

libssh2

Funny detail: I sped it up for this kind of use case **fifteen years ago** and blogged about it: daniel.haxx.se/blog/2010/12/08…


Making SFTP transfers fast

SFTP, the SSH File Transfer Protocol, is a misleading name. It gives you the impression that it might be something like a secure version of FTP, perhaps something like FTPS but modeled over SSH instead of SSL.
daniel.haxx.se
#curl #libssh2 #libssh

#curl

Google go home, you are drunk

#curl

A google "sugested answer" reading: What is the Linux equivalent of curl? Wget
#curl

I frequently drive past this mailbox and think of @bagder and #curl. I like to imagine the owners contacting Daniel for random plumbing issues after finding the curl license in their home owners insurance policy.
Midwestern United States mailbox with the word "CURL" on a sign.
#curl @daniel:// stenberg://

#curl

#curl

#curl

@bagder Essentially, #curl commit 0ae0abbe72514a75c10bfc4108d9f254f594c086 broke updating #HardenedBSD packages for certain users who use HardenedBSD behind a fully Tor-ified network (a network that uses transparent Tor proxying).

Those users were unable to update their HardenedBSD systems since the package manager uses libcurl behind-the-scenes. Some of these users live in malicious environments (malicious to human life), with actively-exploited applications.

So, this prohibition had a real negative impact, putting our users in harm's way.

If curl had a way to bypass the prohibition, we would've been able to keep our users safe.

This is why I mention #Radicle: they, too, do not support the .onion TLD by default, but can be configured to provide that support.

Radicle has three options:

  1. Default: No support, .onion domain lookups will fail.
  2. SOCKS support where .onion lookups succeed.
  3. Explicit transparent proxying support, so .onion lookups succeed

curl is missing that third option.

#curl #hardenedbsd #radicle @daniel:// stenberg://

#curl build updates: curl-for-win Windows builds are now signed with cosign. Download page now includes links to these and to GPG signatures. The latest build uses zlib-ng instead of classic zlib as an experiment. curl.se/windows
Daily builds (also for Linux and macOS) are also signed now with GPG and cosign: github.com/curl/curl-for-win/a…

daily · Workflow runs · curl/curl-for-win

Reproducible, static, curl binaries for Linux, macOS and Windows - daily · Workflow runs · curl/curl-for-win
GitHub
#curl

#Tor #HumanRights #curl #libcurl #radicle #torproject

#curl

#curl

⇧