Stefan Eissing

curl maintainer, protocol droid, likes to code.

"Nobody has any idea what is actually going on."

Public Key

npub179eu5lkc7wklv8f44w6fz4qpc8gpkk2x8e32k7ha43pgvyj4jkqqqnr96e

NIP-05 Address

icing@chaos-social.mostr.pub

Profile Code

nprofile1qqs0zu720mv08t0kr566hdy32squr5qmt9rruc4t0t76cs5xzf2etqqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsu7lt60

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub179eu5lkc7wklv8f44w6fz4qpc8gpkk2x8e32k7ha43pgvyj4jkqqqnr96e

Show more details

Last Notes

2026-08-14 18:59:42 UTC

I made a PR for #curl that saves a few operations and bytes, but…
you can use a curl handle now only for ~500,000 years continuously…
So, I‘m not sure. Should we document this?
Then again, the timestamps in QUIC (ngtcp2) only work for 500 years. Maybe it‘s fine?
Decisions, decisions…
https://github.com/curl/curl/pull/22584

2026-08-11 09:28:56 UTC

We should change #curl 's progress bar to show '3.5" Floppy Discs / second(FLOPS)'.
It's just gives a better speed idea.😌

2026-08-06 12:29:20 UTC

Clankers: code had several
strcasecmp("XYZ", s, 3)
strcasecmp("ABCD", s, 4)
I added
strcasecmp("MN", s, strlen(s))
and Copilot says: "No, no, no. This will read past the length of "MN". Change the length parameter.
🙈

2026-07-31 06:04:56 UTC

OpenAI: „Our software can commit crimes! And we let it!“
Anthropic: „Our software can commit crimes, too! We also let it!“
Cyberdyne Systems: „Interesting approach!“
https://www.theregister.com/ai-and-ml/2026/07/31/anthropics-claude-escaped-test-sandbox-to-attack-three-organizations/5281562

2026-07-28 07:35:17 UTC

- reply

@nprofile…v2v2 @nprofile…yzy8 Yeah, I have the T-shirt.😌
Good practice is to always change/add log statements and check they show up. Especially when you make a patch for someone to test on their own system.

2026-07-24 07:43:05 UTC

When the internet started, we did not have many cat pictures to send around.
Digital photography was very expensive and cats never held still in the cat scanners.
It was a difficult time.💁🏻‍♂️

2026-07-23 07:40:08 UTC

github more bonkers this morning than usual., has trouble processing new commits to a PR.

2026-07-23 06:38:25 UTC

I feel the urge to make #curl faster and safer. And I feel like blogging about design choices, which I have no expectation of anyone having an interest in.
Also I should invent a test case for a combination a clanker said was not working. Hmmm..
Happy Thursday, everyone!

2026-07-22 06:44:05 UTC

I have an old Apple laptop that is really dangerous as well.
It has written several CVEs into open source projects over the years.
@nprofile…l9z3 do you think I can rent it to the US military for some nice money?

2026-07-21 17:17:57 UTC

- reply

@nprofile…3z2k @nprofile…v2v2 Forking BSD to fix things is tech of the Ancients. Good to see it continued. 😌

2026-07-18 07:17:12 UTC

Dark and Long. @nprofile…0ykf
about the AI mania they experience as contractors. Some good advice at the end if you caught up in this as an employee.
https://ludic.mataroa.blog/blog/ai-mania-is-eviscerating-global-decision-making/

2026-07-14 06:43:26 UTC

„Linked lists are not real“
@nprofile…4wec funny as usual.
Should you never use them? I think they are ok as a private data structure, locally, with little code exposure.
But as something visible in your application? I advise against it.
We had such lists in #curl and replaced them with an array and bitsets. All problems solved, zero regrets.
https://m.youtube.com/watch?v=-TMdron2JhY

2026-07-10 20:03:46 UTC

- reply

@nprofile…w5un @nprofile…v2v2 Writing that down: „nobody can program c++“
I think it‘s beautiful. 😌

2026-07-07 06:53:18 UTC

- reply

@nprofile…2vzh @nprofile…xnqz @nprofile…7eu0
Yeah, I think I understand the intention behind this, eg a CDN offloading its ipv4 endpoints over time, but
- non happy eyeballing clients will not see this
- HE clients already give high preference to ipv6
- telling clients they MUST NOT use ipv4, although the records are there and ipv6 hasn‘t responded yet, is silly. It will not be obeyed.💁🏻‍♂️

2026-07-02 11:29:04 UTC

- reply

@nprofile…9z0u An executive order from the WH...may no longer carry the weight it used to.🙂‍↔️

2026-07-01 06:19:35 UTC

I would have thought writing IETF RFCs is a primary use case for LLMs.
It‘s all words, there is plenty of training data and no test cases. We could have a hundred thousand new standards by now!

2026-06-29 06:17:03 UTC

Today is „I don‘t know“ day.

2026-06-28 18:57:56 UTC

- reply

@nprofile…hg73 I can‘t think of an empire that repaired itself from within. But with the US, you never know…💁🏻‍♂️

2026-06-26 13:30:54 UTC

If you really want to value a #goose, you first have to learn to love yourself!🪿

2026-06-24 06:10:45 UTC

Oh no! „Squidbleed“ found by Mythos! When using http:// urls via a squid proxy, an attacker might see the data!😱
Maybe we should all be using https: on the internet or expect our traffic to be public. Wait…we already do that since Lets Encrypt started a decade ago!
This vulnerability could have been a bug report.💁🏻‍♂️
https://www.theregister.com/security/2026/06/23/mythos-discovers-squidbleed-a-memory-leak-thats-gone-undetected-since-clinton-era/5260367

2026-06-22 13:05:12 UTC

Today I found a bug in my new #curl code that none of the AI reviews had detected.
How can that be?😅

2026-06-15 14:43:27 UTC

- reply

@nprofile…m7g4 Great!

2026-06-09 12:54:20 UTC

- reply

@nprofile…4424 it uses QUIC, right? Must be...😌

2026-06-05 17:21:35 UTC

Given the current AI and billionaire bullshit, maybe it's time to study the "Zünfte" again.
German/Swiss organizations of craftsmen to forward their interests in the late medieval times until recently.
They regulated education, work times, pay and quality of work produced. In opposition to the lords of the cities and lands.
One wonders why they became necessary...
https://de.wikipedia.org/wiki/Zunft

2026-05-31 07:33:04 UTC

When I get a report which is obviously LLM output, I do not read it.
Instead, I ask the sender to summarize the novella in their own words, because I do not have the time, unless they explain to me why it‘s worthwhile.
My advice: do the same. Deflect, politely, LLM dumps. Let‘s make this a conversational norm.

2026-05-30 07:07:58 UTC

This is @nprofile…tz6j being asked to revert to the pre-vibe rsync in Debiam.
@nprofile…zvpj plans to switch to openrsync in Alpine.
Important decisions to be made here.
It‘s about trust, not technology. rsync has earned trust over the years. Now it has increased changes using Claude with no second person reviewing.
That people feel uneasy about this, for a tool that copies exabytes of important data every day, is very understandable.
The LLM is the minor player here.
https://bugs.debian.org/cgi-bin/%3Ca%20href=%22bugreport.cgi?bug=1138239%22%3E1138239%3C/a%3E

2026-05-27 11:58:02 UTC

- reply

@nprofile…h7f2 @nprofile…2vzh Can *anyone*, though?😌

2026-05-26 10:26:47 UTC

- reply

@nprofile…hg73 I believe this is what teenagers already do to evade parental supervision.

2026-05-26 10:24:10 UTC

- reply

@nprofile…hg73 back to ROT13 again?

2026-05-21 06:59:27 UTC

- reply

@nprofile…6380 @nprofile…2vzh lots of CI jobs and AI crawlers in sandboxes, I assume.

2026-05-21 06:56:11 UTC

- reply

@nprofile…2vzh So, a clone is made every ~600ms.🤦🏻‍♂️

2026-05-21 06:04:48 UTC

to goosle:
chasing links on the web, while hissing at AI nonsense and flapping your arms in a threatening way.

2026-05-15 06:10:10 UTC

First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening.
They are edge cases under highly constructed preconditions. Yes, not impossible, but unlikely to be ever encountered.
Before LLMs, no researcher would have invested the time to explore those scenarios. my guess.
Yes, we fix them. But, they could also have been a bug report.💁🏻‍♂️

2026-05-13 11:28:52 UTC

When you hear people abandoning Open Source because of the AI exploit threat, ask them if we should keep our laws secret as well.
Because there is a huge industry of accountants and lawyers specialized in finding exploits in those.
No? Thought so.

2026-05-13 06:48:13 UTC

Flyingpenguin on the curl/Mythos thing.
https://www.flyingpenguin.com/curl-toe-to-toe-with-mythos-big-nothingburger-leaves-bad-taste/

2026-05-11 12:04:52 UTC

on IRC: "How does curl have so few open issues? I'm surprised for a project of this size and age"
Thanks for noticing!😍

2026-05-09 06:53:40 UTC

- reply

@nprofile…mry7 Learning from the DNS people?

2026-05-09 06:02:10 UTC

I‘m sure @nprofile…2vzh is already typing the toot/blog post about the avalanche of Mythos findings in #curl.
So, let‘s wait for that.😌

2026-05-09 05:59:42 UTC

Ten years of ACME certificates issuing and people have forgotten how unreliable and fucked it was before.
*sigh*
[If your ACME client is not able to handle a service outage correctly, get another client. srsly]
#acme #letsencrypt

2026-05-07 09:21:13 UTC

I propose to reserve CVE-0000-00000 for reported *potential* security vulnerabilities that all projects can hand out to reporters.
That should make everyone happy.😌

2026-05-07 05:38:38 UTC

Look, we here in Europe really are the bad guys. If only we hadn‘t allowed this migration to the US during the last 250 years…
Lots of poor people and religious zealots left here, crossed the ocean and started incubating. Should have seen it coming!💁🏻‍♂️
https://www.theguardian.com/us-news/2026/may/07/new-trump-counterterrorism-strategy-targets-europe-terrorism-migration

2026-05-06 10:42:24 UTC

- reply

@nprofile…wt2h If developing and confirming the fix in a few days is feasible, I would prefer to wait, yes. Just to avoid more hassle by everyone polling for the fix.
In case the fix can not be made for some reason, publishing an unfixed CVE might be a good idea.

2026-05-06 10:32:49 UTC

- reply

@nprofile…wt2h if I understand correctly, you prefer publishing the CVE before the fix has been made?

2026-05-06 09:24:01 UTC

"That 'responsibble disclosure' Thing"
A post with the details of CVE-2026-23918, the double free vulnerability fixed in Apache httpd 2.4.67.
#apache
https://eissing.org/icing/posts/responsible-disclosure/
https://assets.chaos.social/media_attachments/files/116/526/893/252/284/471/original/356df0201944962e.jpg

2026-05-05 10:13:42 UTC

THE ATTACKER CAN MAKE A CURL REQUESTS FAIL, ENTERING IT IN FRONT OF THE KEYBOARD.
What a time to be alive, eh?🤪

2026-04-24 10:08:00 UTC

We now require proof of work before you can submit a #curl security report.
Like mowing @bagder 's lawn or washing his car.😌

2026-04-22 08:39:21 UTC

- reply

@nprofile…s7cz I have counter evidence from the #curl CI. 😅

2026-04-20 07:12:46 UTC

https://assets.chaos.social/media_attachments/files/116/435/787/398/052/267/original/f954044e8f2c640e.png

2026-04-17 14:35:36 UTC

- reply

That is the report from today.
https://assets.chaos.social/media_attachments/files/116/420/542/172/811/463/original/bf1fb99f654615aa.png

2026-04-17 14:23:03 UTC

That CAs are no longer allowed to issue client certificates was announced about a year ago.
This is not enough time for some, even though LE bravely help push that date to July this year.
Now, Apache httpd is asked to add a switch to disable checking of the certificate purpose bits.
Not sure if we want that. It'll probably then stay in use forever?
https://bz.apache.org/bugzilla/show_bug.cgi?id=70003

2026-04-14 09:04:38 UTC

Did I say github is aiming for the 5 eights in reliability?
The last days every second CI run has jobs that fail to download packages from Azure servers. Nuts!

2026-04-14 08:06:17 UTC

When you use an AI to check on an AI, assuming they operate indendent, their combined success rate is multiplicative.
E.g. 80% success rate, applied twice gives 64% success rate.
(They might not be independent, training for Sycophancy might make it worse.)

2026-04-13 09:15:19 UTC

If you use Apache httpd ACME (mod_md) and restart your server via a "notification" script, I'd recommend getting v.2.6.10.
There were conditions where the certificate renewal was no longer happening when the server was restarted at "a bad time". Normally very rare, unless the server restarted when notification scripts were currently in call.
#apache #acme
https://github.com/icing/mod_md/releases/tag/v2.6.10

2026-04-10 19:11:45 UTC

AI business models could work if Moore‘s Law still held. But it no longer does.
Token costs are not going down. Worse, answers use more of them to become better, in order to convince people it is all worth it.
The latest model burns so much money that Anthropic is unwilling to let people use it (yet wants to boast).
There is no cost-equivalent replacement for brains. So far, maybe never. Evolution is hard to beat.
Which is where you can feel good about yourself!🤗

2026-04-10 07:06:29 UTC

- reply

@nprofile…mxfy Could you stay on the train and we send you some #curl testcases now and then? Those are interesting network conditions… 💁🏻‍♂️

2026-04-04 07:28:28 UTC

The security reporting situation that I see at the ASF and in #curl is
- huge increase in reports
- increase of valid reports
- appearance of duplicate/triplicate reports of the same issue by different people
A high profile project needs to deal with 2-4 new reports each day. This is nuts.
One *may* hope this to go down again later this year bc
- unhallucinated issues are finite (see the fuzzing wave)
- eventually it will cost real money to generate these reports

2026-04-02 20:49:02 UTC

Lots of posts about AI. It‘s important that people exchange their views.
My own:
- the AI business plan is to dominate humanity, no exaggeration.
- LLMs can be a serious technology, code reviews have become good.
- AI is costly. The human brain is more efficient with superior capabilities.
- Idiots with LLMs suck and remain idiots. Probably forever.
- Bad code is bad code, who/whatever made it. Banning LLM code policies miss the point. Deny code you don‘t like, subjectively. Remain in charge.

2026-04-02 15:11:01 UTC

- reply

@nprofile…2vzh Can I call you "Hans" from now on?😌

2026-03-22 09:41:30 UTC

„Wow, look how smart this AI code anslyser is!“ - people, when AI finds a bug
„Wow, you are even smarter than the AI!“ - no one, when I research the AI finding to be a false positive
It‘s a lose-lose game.💁🏻‍♂️

2026-03-10 06:39:34 UTC

Anthropic: "Reviews are billed on token usage and generally average $15–25, scaling with PR [pull request] size and complexity,"
Code reviews on average take about 20 minutes to complete.
In #curl, we could employ at least one person full time only for code reviews for that money.
If we had that money, of course.💁🏻‍♂️
https://www.theregister.com/2026/03/09/anthropic_debuts_code_review/

2026-03-05 09:32:05 UTC

You can‘t tell me all the cats in @nprofile…7q7j posts gave their consent!

2026-03-05 08:17:49 UTC

- reply

@nprofile…yy9u Wheel World comes to mind: https://en.wikipedia.org/wiki/Wheel_World

2026-03-03 09:16:04 UTC

Look, if hardcore Amiga and Atari "freaks" can work peacefully together on the #curl project, there is hope for humanity yet.😌

2026-03-03 06:26:03 UTC

Everyone is saturated with LLM related articles. Here is another good one by Joshua Rogers.
https://joshua.hu/code-is-art-llm-people-losers

2026-03-01 09:51:08 UTC

I‘d like a 🤝 to end a conversation thread with someone on Fedi, as a UI feature.
Now, it seems common custom to just „like“ the last post of each other and stop writing. But it‘s never 100% clear.

2026-03-01 09:29:39 UTC

- reply

@nprofile…u7sp Then you are pbly correct that the article somewhat hijacked the Maven talk to make a point about non-GH hosted repositories.
( #curl project is guilty of this too, as we have lots of CI jobs pulling dependencies. We try to cache as best as we can, but still it is supersized by the „free“ github CI power we get sponsored)

2026-03-01 09:21:03 UTC

Thinking about making sites slow again. Like really slow. Per source IP.
Because serving fast is no longer in the common interest. Quite the opposite.
I‘d like to keep mail/ssh etc fast, so maybe just in the http(s) ports? Anyone knows how linux traffic shaping can do that?

2026-03-01 08:55:24 UTC

- reply

@nprofile…u7sp The maven source is at https://gitbox.apache.org/repos/asf/maven-sources.git
The github one is a readonly mirror.

2026-03-01 08:29:01 UTC

- reply

@nprofile…u7sp Not sure I get your point. It‘s about cloning/pulling source repositories, not packages, as I understand it.

2026-03-01 08:08:00 UTC

https://www.theregister.com/2026/02/28/open_source_opinion/

2026-02-28 09:28:46 UTC

@nprofile…ph0g While I see the savings for CTLogs, using the unsigned certs in a TLS handshake (what google seems to want), means clients will need up-to-date meta information, right?
Which would result in clients either needing to contact logs live during the handshake or having access to an updating infrastructure (as browsers do for CRLs now).
If I got this right, won't this split browser/non-browser clients further apart?
https://datatracker.ietf.org/doc/draft-ietf-plants-merkle-tree-certs/

2026-02-27 13:17:09 UTC

Can cloudflare have a DNS outage already? So I can test my new #curl dns resolve code? Is it asking too much?

2026-02-25 10:27:16 UTC

I am taking ~10.000 IUs of vitamin D3 and some omega3 fish oil daily for 3 months now. Taking low dose of Sertralin for 20 years now, the D3/omega3 additions have greatly increased my well being.
I started when my dentist checked by D3 blood levels and they were rock bottom.
Just fyi, in case you struggle, it might be worth a try. Everyone is different, ymmv.

2026-02-24 07:05:10 UTC

„The paper cites a race condition that an agent attempted to fix by inserting a delay in the code with a Thread.Sleep“
Meaning, it was in its training data.
Meaning, for better agents you need better training data. You need better code. You need to avoid code produced by previous models.
Now, where would AI companies find such code?🙃
https://www.theregister.com/2026/02/23/microsoft_ai_entry_level_russinovich_hanselman/

2026-02-21 06:37:13 UTC

Whatever you can pay, the AI hyperscalers will pay more. Because their money is free, as long as they keep the wheel spinning.
https://www.theregister.com/2026/02/20/ai_blamed_again_as_hard_drives_sell_out/

2026-02-20 11:53:22 UTC

- reply

@nprofile…w48x Yes, especially renaming function parameters is nasty stuff. Naughty boy!😌

2026-02-20 07:39:34 UTC

I waded in #curl rebasing pain with a bunch of stacked PRs yesterday. That was unfun and took the whole day.
Maybe I have not found the best way to handle stacked PRs with current git, yet.
Otoh, the colleague who changed variable names all over the code for fun and merged it without review is luckily working remote…😌

2026-02-19 08:17:28 UTC

Can someone explain to me why unsupported FOSS projects should care about CVEs?
It seems that everyone thinks they should. But I could not explain why.🤷🏻‍♂️

2026-02-01 09:21:40 UTC

Few people know that you can continue to use curl when your DNS is broken. Just add
—resolve host:port:ip-address
to your command line*.
*) Yes, that about all DNS does for you. Prettty lame, right?💁🏻‍♂️

2026-02-01 09:06:35 UTC

Fosdem people: @nprofile…2vzh is at the cafeteria around 11, handing out curl stickers.
Remember: if your laptop has #curl installed, you need a sticker or it will stop working after the grace period!😌

2026-01-26 10:01:33 UTC

- reply

@nprofile…7q7j If you come to Europe, you need to first get a Celsius license, learn the meter and kilo/centi/milli modifiers.
Also, you cannot bring your guns and you cannot just buy new ones either. Furthermore, you might be asked to ride a bicycle/train/bus during your stay.
And last, do not tell people you love their accent. Most of them prefer another language and are accomodating for your lack of skill.

2026-01-22 09:13:59 UTC

I once came into a commercial project assigned to company A for writing the requirement specification and company B for doing the implementation.
A had already used up 80% of the total budget. B was getting a bit netvous.
I did not stay long.💁🏻‍♂️

2026-01-12 09:03:13 UTC

- reply

@nprofile…z99u ah, thanks for clarifying.

2026-01-12 08:13:03 UTC

Working on #curl‘s rate limiting again today. It‘s a fun challenge to get this „right“.
Just a few users of this feature, though. Like Steam, Roku and Netflix. That I know of, at least.
Do you use rate limiting transfers? Do you know anyone besides #curl offering this?

2026-01-09 10:25:41 UTC

Still my favorite meme.😌
https://assets.chaos.social/media_attachments/files/115/864/646/963/117/300/original/d81282cf7bc46f6b.jpg

2026-01-09 09:10:40 UTC

Pro tip: when your application logs curl traces, write them to the file in the order they happen...🤦🏻‍♂️

2025-12-19 07:03:28 UTC

The Register is on WaterFox. I tried it a little, appeares fast and responsive. In comparision, I found Vivaldi a bit sluggish. Ymmv.
Will start using WaterFox. See how that goes.
https://www.theregister.com/2025/12/18/firefox_no_ai_alternative_waterfox/

2025-12-15 08:03:10 UTC

- reply

@nprofile…6rpq @nprofile…59nr one of our CI jobs is building #curl with Fil-C and running our test suite. So far, no bugs have been found to my knowledge.

2025-12-14 21:37:32 UTC

Rust coreutils v0.5.0, passes 87% of the gnu coreutils test.
It‘s an achievement for the project. Congrats. It does pose questions why Ubuntu thinks it good enough for everyone, though.
*reading on*: 566 tests are passing…
What? The complete gnu coreutils has only 650 tests? For 79 commands?🤪
https://github.com/uutils/coreutils/releases/tag/0.5.0

2025-12-14 08:02:36 UTC

There are some nice people here on the fediverse. Some are smart, some are kind, some are funny, some are just there for the ride.
Many thanks to the admins and mods, for enabling this.🤗
/cc @nprofile…a3qk

2025-11-27 14:50:51 UTC

- reply

@nprofile…u2ft The question is why the file in /etc/ssl was not updated by your system/distro.

2025-11-27 14:49:43 UTC

- reply

@nprofile…u2ft browsers have their own CA trust anchors and do not use the system one.

2025-11-23 12:09:01 UTC

- reply

@nprofile…azj9 Not recommend to use such an LTS? No, seems insane.

2025-11-21 13:04:14 UTC

Ah, #curl still in use, I see:
> otool -L ~/.cargo/bin/rustup
...
/usr/lib/libcurl.4.dylib
We try to keep it all safe to the best of our abilities.😌

2025-11-21 07:51:18 UTC

- reply

@nprofile…02fp Above infinity, it wraps around to negative infinity.

2025-11-20 09:23:04 UTC

- reply

The disclosed report: https://hackerone.com/reports/3434510

2025-11-20 08:08:21 UTC

A real Hackerone #curl report title!:
"Out-of-bounds read in *** potential crash. This is sharp, <reporter name>. We've got a real memory safety bug"
The AI is helpfully cheering the guy onwards to slopping. Of course, it is a false positive.

2025-11-18 08:52:32 UTC

There are only a few days left to de-sensitize us, so let's speed it up!
#whamageddon
https://soundcloud.com/teruhai/last-christmas-sped-up

2025-11-14 14:40:10 UTC

- reply

@nprofile…txev
https://assets.chaos.social/media_attachments/files/115/548/564/845/874/154/original/38328044abff2d8a.png

2025-11-14 13:00:34 UTC

If you really, closely watch a CI job run and keenly look for any errors, it has a higher chance to succeed!
It must be the observation of the Copenhagen Interpretation that interferes here.💁🏻‍♂️