Search

Items tagged with: Curl

#curl

#curl

if you are not happy on your FIPS system with modern #curl treatment of TLSv1.3, why not simply refrain from using curl?

Or take an older version and maintain it yourself.💁🏻‍♂️

github.com/curl/curl/pull/1934…


openssl: respect system crypto policy for TLS max version by jacekmigacz · Pull Request #19342 · curl/curl

When no explicit --tls-max option is provided, curl should respect OpenSSL's system-wide crypto policy configuration instead of overriding it. Previously, curl called SSL_CTX_set_max_proto_vers...
GitHub
#curl

#development #curl

Should the default #curl progress meter use 1000-based units instead of 1024-based ones ?

  • 1000 (16%, 179 votes)
  • 1024 (83%, 904 votes)
1083 voters. Poll end: 2 months ago

#curl

What was the name of the project between #httpget and #curl?
#curl #httpget

Twenty-nine years ago on this day, #httpget 0.1 was released.

I found the tool a few days later and within a few months I became the maintainer. We later renamed it. Twice. The last name it got is #curl. It stuck.

httpget was my first insight and lesson into HTTP and since then I have kept learning it.

httpget 0.1 was written by Rafael Sagula, who unfortunately is not with us anymore.

#curl #httpget

six #curl security reports received within the last eight hours

I'm not getting the sense that things are improving.

#curl

#curl

one of the most common security reports we get in #curl is claims of various CRLF injections where a user injects a CRLF into their own command lines and that's apparently "an attack".

We have documented this risk if you pass in junk in curl options but that doesn't stop the reporters from reporting this to us. Over and over.

Here's a recent one.

hackerone.com/reports/3418616


curl disclosed on HackerOne: SMTP CRLF Injection in curl/libcurl...

SMTP CRLF Injection Vulnerability in curl/libcurl ## Vulnerability ID: CURL-SMTP-CRLF-2024 ## CWE-93: Improper Neutralization of CRLF Sequences ### Executive Summary curl/libcurl contains a CRLF...
HackerOne
#curl

In the #curl security team, we get to exercise deep protocol knowledge into the bits for many protocols including version variations and exploring funny quirks we have for adapting to many 3rd party libraries as well as a thorough understanding of the C language, how ABIs work, OS/platform variations and the occasional CPU peculiarity. Did I mention build systems?

And that's only for the issues we received this weekend.

#curl

You'd think merging on average eight bugfixes per day during the last #curl release cycle we would slow down a little now.

5 days after the release we are at:

Bugfixes logged: 48 (9.43 per day)

#curl

#curl

#curl #rtmp

#mqtt #curl

In #curl land, @vsz made a CI job that builds curl with fil-C and it runs the tests fine. Just slightly limited due to lack of dependencies as they all need to be built with fil-C as well.

github.com/curl/curl/pull/1939…


GHA/linux: add minimal Fil-C build with tests by vszakats · Pull Request #19391 · curl/curl

Requirements for Fil-C: not to accidentally pick up system headers. E.g. from /usr/include on Linux. It can happen when any dependency is auto-detected on this header path. This makes Fil-C find t...
GitHub
#curl @vsz

#curl

While on the topic of colorful #curl graphs. Complexity distribution in the source code over time. The recent effort to simplify code in curl has been done by multiple people through the last year or so. The graph's cyclomatic complexity is the score shown by the pmccabe tool.
Graph showing complexity distribution in curl source code over time. Showing recent code being all less than 70, with large portions of time having pieces > 200.
#curl

#curl #homebrew

More than half of #curl's source code lines have been changed within the last four years. 1,101 lines from before year 2000 still remain "untouched".
Graph showing curl's source code age over time
#curl

24 hours since a dot-zero #curl release with 400+ bugfixes and not a single annoying regression reported yet.

I'm not sure how to handle this.

#curl

1 open #curl issue for some Kerberos header file on IBM OS400 platforms…

I expected more from you…🦧

#curl

#curl

#curl

#curl #trurl

#curl

#curl

yes of course there is a graph of all #curl releases ever done. This includes the releases done using the previous names (httpget and urlget) as well
Y axis: number of release, X axies is time. 270 release done until yesterday
#curl

this is the 3rd #curl release ever done on November 5, as I trust you remember 7.19.0 and 7.39.0 back in 2008 and 2014
#curl

The #curl release on GitHub is now marked as "immutable" and there's even something they call "release attestation" there now.

Just remember that the curl canonical releases are the signed tarballs uploaded by me. Reproducible, so you can verify them at will to not contain bad things. Signed to prove I did them.

Made with love and care, I promise.

#curl

#curl

As per tradition, I will do a live-streamed #curl release presentation tomorrow 10:00 CET (my local time) over at twitch.tv/curlhacker

curlhacker - Twitch

I'm Daniel Stenberg, maintainer and lead developer in the curl project. I stream curl related stuff. Release presentations, curl development and related topics.
Twitch
#curl

#curl

curl.se, the domain itself, celebrates five years as home of #curl today.

I told the story back then:

daniel.haxx.se/blog/2020/11/04…


The journey to a curl domain

Good things come to those who wait? When I created and started hosting the first websites for curl I didn't care about the URL or domain names used for them, but after a few years I started to think that maybe it would be cool to register a curl doma…
daniel.haxx.se
#curl

Educational moment on the #curl wikipedia page 😎
screenshot showing wikipedia (mistakenly) explaining the SMBS protocol as "super mario bros" instead of "Server Message Block" or SMB over TLS.
#curl

#curl

yeah, in the #curl case I hope and wish that the people making the curl packages for distros (or build curl for other purposes) do the reproducible check - so that they know for sure that the one doing the curl releases didn't smuggle anything in. It also usually also requires that a few people do it and can trigger the alarm if they would find something odd.

At least we make it possible.

#curl

one thing we finally made real in #curl as a direct consequence of the xz attack was reproducible builds. Since the xz release added things into the release that did not come from autotools nor git, verifying reproducible builds would have caught that. Having that in place forces attackers to land their backdoor in git to be able to ship it, which should increase the bar significantly.
#curl

#curl

#curl humility is among the greatest is the world
#curl

⇧