daniel:// stenberg://

Attention is fun and good. And sometimes painful. The #curl vulnerability counter keeps getting bumped... No rest for the security team.
(Yes: even after Mythos scanned the code people find issues...)

2026-04-30 08:09:15 UTC

Approaching zero bugs?
Is it possible? Are we close? When will it happen?
https://daniel.haxx.se/blog/2026/04/30/approaching-zero-bugs/

2026-04-29 20:42:10 UTC

Reading this brings me close to medal-receiving levels of joy.
https://files.mastodon.social/media_attachments/files/116/489/922/528/512/449/original/239d1a10f8c02879.png

2026-04-29 11:56:35 UTC

RE: https://toot.yosh.is/@yosh/116487778402803336
Excuses. They forgot to run their site as they should and instead got lost working on AI features we never asked for. That's why.
#note1cmv…7jk5

2026-04-29 06:35:04 UTC

in the curl 8.20.0 release there are still 903 lines of production code last modified before the year 2000

2026-04-29 06:27:32 UTC

I feel honored to present to you: #curl 8.20.0
https://daniel.haxx.se/blog/2026/04/29/curl-8-20-0/

2026-04-29 05:55:54 UTC

If you would guess, do you think GitHub sends me a 500 now when I try to publish a new #curl release... ☹️

2026-04-28 21:42:30 UTC

This is week 18 and tomorrow will become the third #curl release ever done on April 29. A popular day.
https://files.mastodon.social/media_attachments/files/116/484/505/561/346/107/original/69ea5b0a20425223.png

2026-04-28 11:22:26 UTC

I spoke about the Open Source AI Reality at #fossnorth this morning. Awesome crowd. Excellent questions. (video pending)
Now going back home to do a #curl release tomorrow.
https://files.mastodon.social/media_attachments/files/116/482/057/572/100/483/original/1e934581d34900fc.jpg

2026-04-28 05:32:01 UTC

24 hours to next #curl release and at least eight new CVEs getting published

2026-04-25 14:23:23 UTC

"Pre-built GitHub profiles with five-year commit histories and Arctic Code Vault Contributor badges sell for approximately $5,000 on Telegram."
https://awesomeagents.ai/news/github-fake-stars-investigation/

2026-04-25 08:19:04 UTC

Remember: this is a time when every open source project out there suffers from an extreme issue and security report avalanche and overload.
Ask yourself what you do to make the situation better.
Make sure your employer does as well.

2026-04-24 16:05:17 UTC

*Zero* out of the six pending #curl CVEs are C mistakes. They are all logical mistakes that would have happened anyway even if we had used another language.

2026-04-24 14:35:46 UTC

Another opportunity for your Swedish training as I'm featured again:
https://www.realtid.se/it-tech/svenska-kodaren-nar-miljarder-anvandare-fran-vinden-i-huddinge/

2026-04-24 06:54:25 UTC

A Windows developer who wants a #curl bug to work on? Here's a good one:
https://github.com/curl/curl/pull/21433

2026-04-23 13:48:31 UTC

"AI's ability to find major software bugs is growing 490% year on year"
With some comments from me.
https://mashable.com/article/ai-discovered-zero-day-bug-reports-crisis

2026-04-22 12:54:45 UTC

Welcome Dio Putra as #curl commit author 1463: https://github.com/curl/curl/pull/21411

2026-04-22 11:45:38 UTC

High-Quality chaos. This is where we're at right now, security reporting wise.
https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/

2026-04-22 06:14:10 UTC

*The* pillow has its two year anniversary today:
https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/
(Made my @npub1np2…ztqz)

2026-04-20 07:14:54 UTC

RE: https://chaos.social/@icing/116435790527643905
This is quickly becoming a new trend ... "look, if I totally destroy internals by abusing a private function, something bad can happen"
#note1qqg…y7x3

2026-04-18 20:57:20 UTC

Testing an alternative text under the image.
Better than the real 2001 quote?
https://files.mastodon.social/media_attachments/files/116/427/701/523/856/561/original/904f2f38979c0acc.jpg
https://files.mastodon.social/media_attachments/files/116/427/706/815/117/544/original/8cee47f343c9da01.jpg

2026-04-17 20:24:01 UTC

After just having responded to the third #curl security report for the evening I noticed a post that cheered me up...
Have a good Friday everyone!
https://www.linkedin.com/posts/moekatib_millions-of-people-look-up-to-steve-jobs-activity-7450947453085749248-K1w-
https://files.mastodon.social/media_attachments/files/116/421/903/118/671/945/original/c3f9ac3a99d21a03.png

2026-04-17 07:44:51 UTC

You're not alone. We don't see any point in running OpenSSF's scorecard either.

2026-04-17 07:14:24 UTC

On this day, eight years ago, I entered the US embassy in Stockholm to apply for a Visa, after I had been denied travel to the US the year before. No explanation, no motivation. Just denied.
It took 937 days for me to get the visa.
When I was about to use it for the first time, I caught covid and couldn't go.
Since then, the US administration scares me since I have this in my background, so I stay away.
The visa remains unused since November 2020. It expires in 2030.

2026-04-16 07:10:18 UTC

Average number of hours between #curl security reports
Material for a pending presentation
https://files.mastodon.social/media_attachments/files/116/413/128/360/699/982/original/1864b291d16f5e08.png

2026-04-15 09:23:17 UTC

Six years ago #Firefox announced they followed Chrome and removed FTP. #curl did not. Still hasn't.
https://daniel.haxx.se/blog/2020/04/15/curl-is-not-removing-ftp/

2026-04-15 06:56:42 UTC

- reply

I want to emphasize this because when I talk about AI security reports now, half my readers seem to believe those are AI slop. They're not. They are found with AI tools and normally high quality bug reports.
The weakest part is that they tend to overstress the vulnerability angle. Lots of them are well phrased bug reports that are still "just bugs".

2026-04-15 06:44:23 UTC

The AI slop security reporting is basically extinct. It almost does not happen anymore. At all.

2026-04-15 06:18:27 UTC

"I am submitting this via direct email as I am currently unable to use the HackerOne platform due to account restrictions for new reporters."
In case someone was wondering what happens when we try to make it harder for new accounts to submit new reports.

2026-04-14 14:40:04 UTC

RE: https://mastodon.social/@Mastodon/116402716327956884
"Mastodon has been awarded a €614k service agreement by the Sovereign Tech Fund"
#note1qc3…6yyg

2026-04-14 09:55:04 UTC

How to follow my writing:
0. chitchat in the #curl IRC channel on libera.chat (or Matrix if you insist)
1. Ramblings here on Mastodon
2. Blogs at https://daniel.haxx.se/blog/ (incl RSS)
3. Weekly emails at https://lists.haxx.se/listinfo/daniel
4. Occasional repeats of the above on LinkedIn: https://www.linkedin.com/in/danielstenberg
5. My mastodon posts are bridged to Bluesky: https://bsky.app/profile/bagder.mastodon.social.ap.brid.gy

2026-04-14 06:08:57 UTC

before: script kiddies
now: AI kiddies

2026-04-13 08:16:15 UTC

Finally: Doom played over #curl
https://github.com/xsawyerx/curl-doom
https://files.mastodon.social/media_attachments/files/116/396/399/022/479/872/original/f61480acb58dacf1.png

2026-04-13 07:11:10 UTC

- reply

my latest absolutely correct: https://hackerone.com/reports/3669305

2026-04-13 07:05:27 UTC

You are absolutely correct.

2026-04-12 08:42:15 UTC

I'm quoted (in Swedish) about AI tooling in DN: https://www.dn.se/ekonomi/linus-larsson-har-ar-ai-systemet-som-ar-for-farligt-for-varlden/

2026-04-11 15:23:52 UTC

Ah yes, I also gave some comments to The Register: https://www.theregister.com/2026/04/10/project_glasswing/

2026-04-11 12:38:04 UTC

I talked with NPR: https://www.npr.org/2026/04/11/nx-s1-5778508/anthropic-project-glasswing-ai-cybersecurity-mythos-preview

2026-04-10 07:25:38 UTC

Work in progress title slide for my coming talk at foss north
https://foss-north.se/2026/speakers-and-talks.html#dstenberg
https://files.mastodon.social/media_attachments/files/116/379/214/364/919/968/original/2afbfdf730fc8bf2.jpg

2026-04-09 08:06:33 UTC

I ran a quick git log grep just now. Over the last ~6 months or so, we have fixed over 200 bugs in #curl found with "AI tools".

2026-04-08 07:27:28 UTC

a LinkedIn post of the motivational kind:
#curl
https://files.mastodon.social/media_attachments/files/116/367/898/117/373/477/original/20be85921bf0c4c4.png

2026-04-08 05:58:18 UTC

Nope, no one from Anthropic Glasswing has been in touch.

2026-04-07 08:15:16 UTC

- reply

Apache httpd, curl, Django, Firefox, glibc, GnuTLS, Haproxy, libssh, Linux kernel, python, Temporal, Wireshark, wolfSSL
More?

2026-04-07 07:30:56 UTC

#curl is git cloned every second second
https://files.mastodon.social/media_attachments/files/116/362/248/028/775/283/original/8ace562209119cfd.png

2026-04-07 06:38:40 UTC

If your Open Source project sees a steep increase in number of high quality security reports (mostly done with AI) right now (#curl, Linux kernel, glibc confirmed) please tell me the name of this project.
(I'd like to make a little list for my coming talk on this.)

2026-04-06 17:56:21 UTC

RFC 9421 HTTP Message Signatures support in #curl maybe?
https://github.com/curl/curl/pull/21239

2026-04-05 20:59:26 UTC

There is virtually **no** AI slop security reports anymore submitted about #curl. They don't seem to happen any longer.
Almost everyone still uses AI though.

2026-04-05 14:44:27 UTC

- reply

someone in another open source project (to remain anonymous here) replied to my weekly email and said "as a comparison, we received 70 reports last week"
The ongoing "security report overload" is systematic and everywhere now.
Endure fellow maintainers!

2026-04-05 14:37:48 UTC

We have received more security reports against #curl in 2026 so far than we did during the entire year back in 2024.
During the first three months we have received twice the amount of reports/week as we did last year.

2026-04-02 15:10:18 UTC

Look mum I'm in the paper (today's Svenska Dagbladet, Sweden's number two morning newspaper)
https://files.mastodon.social/media_attachments/files/116/335/743/170/839/955/original/85b8e60f048d2d84.png

2026-03-31 06:32:52 UTC

Hey OpenSSF, maybe talk to the peeps you work with and tell them to NOT do it like this: https://github.com/curl/wcurl/issues/90

2026-03-30 20:17:29 UTC

For your Swedish training, as surely you won't cheat with a translation service. Me in Swedish media: https://www.aftonbladet.se/nyheter/a/JOOGBJ/han-kan-slacka-halva-internet-vi-maste-skydda-oss

2026-03-29 09:04:25 UTC

"Unfortunately in the bank where i work it is not easy to change the version, it requires lots of resources to retest." says reporter who uses a ten years old #curl version with a suspected bug... The problem is not open source.

2026-03-27 09:33:54 UTC

- reply

I concur. We see lots of accurate finds reported with AI tools in curl as well.

2026-03-27 08:19:22 UTC

- reply

"researchers" can go to extreme lengths to argue for and claim there are vulnerabilities in code, but yet almost none of them ever works on actually fixing the issue. Whatever the assessment of the issue is.

2026-03-27 08:18:09 UTC

One reason to fix minor code issues the AI tools find is that if we don't, we know there's an army of "friendly helpers" who will soon report them as "probable security problems" down the line. Because they can run the AI tools too.

2026-03-25 10:11:44 UTC

"The biggest change after Heartbleed was probably the creation of the OpenSSF which turns free time into meetings."
/ @npub16g6…s9jn

2026-03-25 08:13:27 UTC

- reply

there are some true gems in the collection!

2026-03-25 08:06:06 UTC

One hundred weirdo emails
https://daniel.haxx.se/blog/2026/03/25/one-hundred-weirdo-emails/
Yeps, they are now one hundred.

2026-03-24 06:57:37 UTC

RE: https://hachyderm.io/@kees/116282745861595200
Fun to see the Linux kernel follow in #curl's footsteps! 😎 (we removed the last strncpy from curl in late 2025)

2026-03-23 21:52:34 UTC

A random guy telling the world how to install some new software. An illustration.
https://files.mastodon.social/media_attachments/files/116/280/701/251/044/654/original/05a23fb2fad9f277.png

2026-03-23 08:05:12 UTC

git used curl before curl used git 💚

2026-03-23 08:02:41 UTC

16 years ago #curl officially switched over to using #git
https://daniel.haxx.se/blog/2010/03/23/curl-goes-git/

2026-03-22 11:41:30 UTC

NTLM and SMB go opt-in
https://daniel.haxx.se/blog/2026/03/22/ntlm-and-smb-go-opt-in/
#curl

2026-03-22 09:09:11 UTC

- reply

vi tror på dig! 💚

2026-03-21 14:06:37 UTC

bye bye RTMP
https://daniel.haxx.se/blog/2026/03/21/bye-bye-rtmp/
#curl

2026-03-20 12:11:12 UTC

noq is a new QUIC library in town, written in rust: https://www.iroh.computer/blog/noq-announcement

2026-03-18 07:56:16 UTC

"I'm concerned about LLM code in #curl and would like to suggest a code ban"
https://github.com/curl/curl/discussions/20972

2026-03-16 10:59:14 UTC

Does anyone have a script - in any language - that can scan the .github/workflow directory and tell how many individual "CI jobs" they kick off?

2026-03-16 08:29:25 UTC

commit time zone distribution in #curl
https://github.com/curl/stats/pull/24
https://files.mastodon.social/media_attachments/files/116/237/906/627/601/150/original/daff6f3aab72326c.png

2026-03-15 10:45:27 UTC

- reply

let me know if you have an idea for an interesting new graph.

2026-03-15 10:43:03 UTC

One hundred #curl graphs
https://daniel.haxx.se/blog/2026/03/15/one-hundred-curl-graphs/

2026-03-15 09:10:26 UTC

Some of you will be glad to know that the #curl dashboard now features the "graphs in the dashboard" graph
https://curl.se/dashboard1.html#graphs-on-the-dashboard
https://files.mastodon.social/media_attachments/files/116/232/407/372/570/005/original/184f229296bd7769.png

2026-03-13 09:15:07 UTC

In two weeks we run the #curl distro meeting. You are invited!
https://daniel.haxx.se/blog/2026/01/28/curl-distro-meeting-2026/

2026-03-12 22:06:35 UTC

chicken nuget
Insecure #curl packages hosted by Microsoft. They think it's fine.
https://daniel.haxx.se/blog/2026/03/12/chicken-nuget/

2026-03-12 13:06:44 UTC

"Our proprietary AI robots independently recreate any open source project from scratch"
https://malus.sh/

2026-03-12 08:08:59 UTC

CVE-2026-3784 beat a new #curl record. This flaw existed in curl source code for 24.97 years before it was discovered.
Illustrated in the slightly hard-to-read graph below. The average age of a curl vulnerability when reported is eight years.
https://curl.se/docs/CVE-2026-3784.html
https://files.mastodon.social/media_attachments/files/116/215/174/823/355/871/original/7c3e9f02c17c94ac.png

2026-03-10 13:33:35 UTC

Let's play slop or not! Here's the input:
https://hackerone.com/reports/3595753

2026-03-10 08:36:41 UTC

Dependency tracking is hard
https://daniel.haxx.se/blog/2026/03/10/dependency-tracking-is-hard/

2026-03-09 22:51:27 UTC

An amusing and telling picture that shows how dependency tracking for #curl and libcurl does not work at all, is to check out GitHub's view of all repositories that depend on curl.
I mean, there are quite a few repositories on there, so the number could be high.
Or it could be... one.
https://files.mastodon.social/media_attachments/files/116/201/660/155/386/634/original/1260c2479926ee75.png

2026-03-09 22:33:09 UTC

10K #curl downloads per year
https://daniel.haxx.se/blog/2026/03/09/10k-curl-downloads-per-year/

2026-03-08 22:26:51 UTC

I keep getting offers from randos offering to setup various crypto currency things to sponsor me or curl.
I will NEVER agree to have my name associated with any crypto currency efforts/scams. There's no room for debate. A hard no.

2026-03-08 22:10:52 UTC

On this Wednesday, March 11, we will ship the 273rd #curl release ever. We call it curl 8.19.0.
It contains over 250 bugfixes, done by the help from over 75 contributors during the 63 days since the previous release.
We will also announce at least four CVEs in sync with this.
Amusingly, the 273rd release supports 273 command line options.

2026-03-07 21:48:14 UTC

Looking back at all (now) published vulnerabilities in #curl that were present in code from 2020 until now, at no point in those years was the share of "C mistakes" higher than 15% of all vulns.
Through all years, the C mistake share of all vulnerabilities in #curl was never above 45% at any single point in history.
https://files.mastodon.social/media_attachments/files/116/190/088/538/446/707/original/b0f9322a90d54083.png

2026-03-05 16:00:29 UTC

After conference beer in Oslo with the Mrs. Living the open source celeb life. Not bad.

2026-03-05 05:50:05 UTC

- reply

My not at all surprised face: "After careful investigation, this case has been assessed as not a vulnerability and does not meet Microsoft's bar for immediate servicing."

2026-03-03 15:23:44 UTC

The Open Infra meetup on May 21 in Stockholm is open for registration.
I'll chip in with a light-weight blab I call "State actors, sleeper agents and plain bugs. Curl security matters."
https://www.meetup.com/openinfra-user-group-sweden/events/313615139/

2026-03-02 21:47:26 UTC

a detail you probably didn't know: no where in any #curl documentation do we use the word "very". It is a banned word enforced by a CI check. This rule encourages us to rewrite and instead use more appropriate words. Makes us write better English.

2026-03-02 15:38:28 UTC

- reply

but I took it to the big generic security portal and submitted a report there. Let's see what happens.

2026-03-02 15:35:51 UTC

- reply

"Microsoft is no longer accepting new submissions through secure@microsoft.com. Please use the Microsoft Researcher Portal "...
😠

2026-03-02 15:05:14 UTC

Three years ago I blogged about #nuget serving outdated #curl packages.
They then removed the packages I found.
I checked nuget again *today* and immediately found a nine year old curl package that is downloaded at the rate of 1,000 times/week from there... with **64** known vulnerabilities.
The blog post from back then: https://daniel.haxx.se/blog/2023/03/02/the-curl-nuget-story/

2026-03-02 08:54:46 UTC

On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?
https://curl.se/mail/archive-2026-03/0000.html

2026-03-02 07:31:36 UTC

just noticed I'm mentioned on the AI slop wikipedia page: https://en.wikipedia.org/wiki/AI_slop

2026-03-01 08:49:54 UTC

IRC made me to make curl
https://youtu.be/ohzzGy5K9Dk?si=YH1JcSQ7z6-YlktW

2026-02-26 10:11:00 UTC

#curl is secured for the billions - the steps we take. There is no silver bullet. No magic solution. Just plain engineering and doing everything as good as we can and to keep tightening every bolt there is.
(slide for upcoming presentation)
https://files.mastodon.social/media_attachments/files/116/136/379/941/562/938/original/b2697ca785de6d80.jpg

2026-02-26 08:48:44 UTC

I found this Veratasium documentary on the xz Jia Tan backdoor adventure quite good and surprisingly detailed:
https://www.youtube.com/watch?v=aoag03mSuXQ

2026-02-25 13:26:37 UTC

This the new introductory text for curl security reports on https://hackerone.com/curl
https://files.mastodon.social/media_attachments/files/116/131/492/192/392/423/original/5a616c32b3bf679d.png

2026-02-25 11:08:23 UTC

New draft of my CV. (or perhaps a WIP slide for a coming talk)
https://files.mastodon.social/media_attachments/files/116/130/948/956/045/677/original/929b11689f966f32.jpg