Search

Items tagged with: curl


This day shall be remembered as the last day #curl was still just 4 digits days old.
#curl


#curl


#curl


I spent over three hours yesterday debugging the latest #curl hackerone report. I think I understand it now.

Next tricky step is now to assess the security impact. Is there one?

#curl



So I'm thinking of adding support for %time{} in #curl's -w function.

One reason for doing this is for users who use -w for logging and want to include the time of the event (post-transfer) in a convenient way.

github.com/curl/curl/pull/1811…

Feel free to share your opinion!

#curl


#curl


On this day 26 years ago, the #curl website premiered on the host "curl.haxx.nu", as it moved over from having been hosted on my personal [company]/~dast/curl sub page previously.

Less than a year later we switched again to curl.haxx.se. We could not use the .se domain earlier because of limits in the TLD ruleset before that point.

We would then stay on that hostname for some twenty years.

#curl


#curl


#curl


#curl


#curl


#curl


The "good" people at Emerson for some reason couldn't think for themselves when I responded to them on behalf of #curl and instead continue and send the same questions to the #libssh2 project with the same "demands".

"This is a gentle reminder regarding our earlier request for your input on the cybersecurity risk assessment of the software component “libssh2” version 1.11.0, as part of our compliance efforts with the EU Cyber Resilience Act (CRA)."


#curl


#curl


Native Schannel TLS stack of #Windows was so unreliable it got axed from #curl:
* Never worked reliably under real‑world loads.
* Quirky, cumbersome API/architecture that broke integrations.
* Zero developer interest—nobody tested or maintained it.
* Pure maintenance drag with no real benefit.

So #Microsoft again shipped a built‑in that nobody uses, and projects ditch it entirely in favor of better third‑party alternatives.

daniel.haxx.se/blog/2025/07/29…


Carving out msh3. #curl drops an HTTP/3 backend.

daniel.haxx.se/blog/2025/07/29…

#curl


--out-null is #curl's 270th command line option.

Discard all response output of a transfer silently. This is the more efficient
and portable version of

curl host.example -o /dev/null

The transfer is done in full, all data is received and checked, but the bytes are not written anywhere. --out-null is associated with a single URL. Use it once per URL when you use several URLs in a command line.

#curl


#curl


starting in the pending #curl 8.16.0, curl will default to TLS 1.2 as a minimum even if the TLS library can do lower versions
#curl


#curl


#curl


take a guess if the same company now emailed the exact same CRA compliance questionnaire they sent to the #curl project last week, to the libssh2 project!

Correct. They did.

#curl


#curl


#curl


If you go to #FroSCon in August you could hear me blab "AI slop attacks on the #curl project".


#curl


the #curl release live-stream starts now at twitch.tv/curlhacker
#curl


I'm happy to say that we have zero #curl CVEs to announce this time.
#curl


My gut feeling says you need a new #curl release. So here is curl 8.15.0 just for you.

daniel.haxx.se/blog/2025/07/16…

#curl


Even as #curl is soon 10000 days, here's a list of changes and features that we have queued up for the coming next release. And these are just things we think have a chance of getting merged. (But not all of them will manage, most likely.)
#curl


the accumulated work done with the help from more than 3460 individuals. 10474 days since that fine November day in 1996 when httpget first saw light.

9980 days since the first release we called #curl

#curl


Seven day embargo limit for #curl: git.hardenedbsd.org/shawn.webb…

It can take the #HardenedBSD project a full month to rebuild its package repos. And since we've built this software monoculture against libcurl, this will be FUN!

#infosec #libcurl