Stefan Eissing

curl maintainer, protocol droid, likes to code.

"Nobody has any idea what is actually going on."

Public Key

npub179eu5lkc7wklv8f44w6fz4qpc8gpkk2x8e32k7ha43pgvyj4jkqqqnr96e

NIP-05 Address

icing@chaos-social.mostr.pub

Profile Code

nprofile1qqs0zu720mv08t0kr566hdy32squr5qmt9rruc4t0t76cs5xzf2etqqpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43qe73kwu

Publishing to

relay.ditto.pub

Author Public Key

npub179eu5lkc7wklv8f44w6fz4qpc8gpkk2x8e32k7ha43pgvyj4jkqqqnr96e

Show more details

Last Notes

2026-05-15 06:10:10 UTC

First of all, *most* of FOSS security reports nowadays (that I see in #curl and #apache httpd) are non-threatening.
They are edge cases under highly constructed preconditions. Yes, not impossible, but unlikely to be ever encountered.
Before LLMs, no researcher would have invested the time to explore those scenarios. my guess.
Yes, we fix them. But, they could also have been a bug report.💁🏻‍♂️

2026-05-09 06:53:40 UTC

- reply

@nprofile…mry7 Learning from the DNS people?

2026-05-09 06:02:10 UTC

I‘m sure @nprofile…2vzh is already typing the toot/blog post about the avalanche of Mythos findings in #curl.
So, let‘s wait for that.😌

2026-05-09 05:59:42 UTC

Ten years of ACME certificates issuing and people have forgotten how unreliable and fucked it was before.
*sigh*
[If your ACME client is not able to handle a service outage correctly, get another client. srsly]
#acme #letsencrypt

2026-05-07 09:21:13 UTC

I propose to reserve CVE-0000-00000 for reported *potential* security vulnerabilities that all projects can hand out to reporters.
That should make everyone happy.😌

2026-05-07 05:38:38 UTC

Look, we here in Europe really are the bad guys. If only we hadn‘t allowed this migration to the US during the last 250 years…
Lots of poor people and religious zealots left here, crossed the ocean and started incubating. Should have seen it coming!💁🏻‍♂️
https://www.theguardian.com/us-news/2026/may/07/new-trump-counterterrorism-strategy-targets-europe-terrorism-migration

2026-05-06 10:42:24 UTC

- reply

@nprofile…wt2h If developing and confirming the fix in a few days is feasible, I would prefer to wait, yes. Just to avoid more hassle by everyone polling for the fix.
In case the fix can not be made for some reason, publishing an unfixed CVE might be a good idea.

2026-05-06 10:32:49 UTC

- reply

@nprofile…wt2h if I understand correctly, you prefer publishing the CVE before the fix has been made?

2026-05-06 09:24:01 UTC

"That 'responsibble disclosure' Thing"
A post with the details of CVE-2026-23918, the double free vulnerability fixed in Apache httpd 2.4.67.
#apache
https://eissing.org/icing/posts/responsible-disclosure/
https://assets.chaos.social/media_attachments/files/116/526/893/252/284/471/original/356df0201944962e.jpg

2026-05-05 10:13:42 UTC

THE ATTACKER CAN MAKE A CURL REQUESTS FAIL, ENTERING IT IN FRONT OF THE KEYBOARD.
What a time to be alive, eh?🤪

2026-04-24 10:08:00 UTC

We now require proof of work before you can submit a #curl security report.
Like mowing @bagder 's lawn or washing his car.😌

2026-04-22 08:39:21 UTC

- reply

@nprofile…s7cz I have counter evidence from the #curl CI. 😅

2026-04-20 07:12:46 UTC

https://assets.chaos.social/media_attachments/files/116/435/787/398/052/267/original/f954044e8f2c640e.png

2026-04-17 14:35:36 UTC

- reply

That is the report from today.
https://assets.chaos.social/media_attachments/files/116/420/542/172/811/463/original/bf1fb99f654615aa.png

2026-04-17 14:23:03 UTC

That CAs are no longer allowed to issue client certificates was announced about a year ago.
This is not enough time for some, even though LE bravely help push that date to July this year.
Now, Apache httpd is asked to add a switch to disable checking of the certificate purpose bits.
Not sure if we want that. It'll probably then stay in use forever?
https://bz.apache.org/bugzilla/show_bug.cgi?id=70003

2026-04-14 09:04:38 UTC

Did I say github is aiming for the 5 eights in reliability?
The last days every second CI run has jobs that fail to download packages from Azure servers. Nuts!

2026-04-14 08:06:17 UTC

When you use an AI to check on an AI, assuming they operate indendent, their combined success rate is multiplicative.
E.g. 80% success rate, applied twice gives 64% success rate.
(They might not be independent, training for Sycophancy might make it worse.)

2026-04-10 19:11:45 UTC

AI business models could work if Moore‘s Law still held. But it no longer does.
Token costs are not going down. Worse, answers use more of them to become better, in order to convince people it is all worth it.
The latest model burns so much money that Anthropic is unwilling to let people use it (yet wants to boast).
There is no cost-equivalent replacement for brains. So far, maybe never. Evolution is hard to beat.
Which is where you can feel good about yourself!🤗

2026-04-10 07:06:29 UTC

- reply

@nprofile…mxfy Could you stay on the train and we send you some #curl testcases now and then? Those are interesting network conditions… 💁🏻‍♂️

2026-04-04 07:28:28 UTC

The security reporting situation that I see at the ASF and in #curl is
- huge increase in reports
- increase of valid reports
- appearance of duplicate/triplicate reports of the same issue by different people
A high profile project needs to deal with 2-4 new reports each day. This is nuts.
One *may* hope this to go down again later this year bc
- unhallucinated issues are finite (see the fuzzing wave)
- eventually it will cost real money to generate these reports

2026-04-02 20:49:02 UTC

Lots of posts about AI. It‘s important that people exchange their views.
My own:
- the AI business plan is to dominate humanity, no exaggeration.
- LLMs can be a serious technology, code reviews have become good.
- AI is costly. The human brain is more efficient with superior capabilities.
- Idiots with LLMs suck and remain idiots. Probably forever.
- Bad code is bad code, who/whatever made it. Banning LLM code policies miss the point. Deny code you don‘t like, subjectively. Remain in charge.

2026-04-02 15:11:01 UTC

- reply

@nprofile…2vzh Can I call you "Hans" from now on?😌

2026-03-22 09:41:30 UTC

„Wow, look how smart this AI code anslyser is!“ - people, when AI finds a bug
„Wow, you are even smarter than the AI!“ - no one, when I research the AI finding to be a false positive
It‘s a lose-lose game.💁🏻‍♂️

2026-03-10 06:39:34 UTC

Anthropic: "Reviews are billed on token usage and generally average $15–25, scaling with PR [pull request] size and complexity,"
Code reviews on average take about 20 minutes to complete.
In #curl, we could employ at least one person full time only for code reviews for that money.
If we had that money, of course.💁🏻‍♂️
https://www.theregister.com/2026/03/09/anthropic_debuts_code_review/

2026-03-05 09:32:05 UTC

You can‘t tell me all the cats in @nprofile…7q7j posts gave their consent!

2026-03-05 08:17:49 UTC

- reply

@nprofile…yy9u Wheel World comes to mind: https://en.wikipedia.org/wiki/Wheel_World

2026-03-03 09:16:04 UTC

Look, if hardcore Amiga and Atari "freaks" can work peacefully together on the #curl project, there is hope for humanity yet.😌

2026-03-03 06:26:03 UTC

Everyone is saturated with LLM related articles. Here is another good one by Joshua Rogers.
https://joshua.hu/code-is-art-llm-people-losers

2026-03-01 09:51:08 UTC

I‘d like a 🤝 to end a conversation thread with someone on Fedi, as a UI feature.
Now, it seems common custom to just „like“ the last post of each other and stop writing. But it‘s never 100% clear.

2026-03-01 09:29:39 UTC

- reply

@nprofile…u7sp Then you are pbly correct that the article somewhat hijacked the Maven talk to make a point about non-GH hosted repositories.
( #curl project is guilty of this too, as we have lots of CI jobs pulling dependencies. We try to cache as best as we can, but still it is supersized by the „free“ github CI power we get sponsored)

2026-03-01 09:21:03 UTC

Thinking about making sites slow again. Like really slow. Per source IP.
Because serving fast is no longer in the common interest. Quite the opposite.
I‘d like to keep mail/ssh etc fast, so maybe just in the http(s) ports? Anyone knows how linux traffic shaping can do that?

2026-03-01 08:55:24 UTC

- reply

@nprofile…u7sp The maven source is at https://gitbox.apache.org/repos/asf/maven-sources.git
The github one is a readonly mirror.

2026-03-01 08:29:01 UTC

- reply

@nprofile…u7sp Not sure I get your point. It‘s about cloning/pulling source repositories, not packages, as I understand it.

2026-03-01 08:08:00 UTC

https://www.theregister.com/2026/02/28/open_source_opinion/

2026-02-28 09:28:46 UTC

@nprofile…ph0g While I see the savings for CTLogs, using the unsigned certs in a TLS handshake (what google seems to want), means clients will need up-to-date meta information, right?
Which would result in clients either needing to contact logs live during the handshake or having access to an updating infrastructure (as browsers do for CRLs now).
If I got this right, won't this split browser/non-browser clients further apart?
https://datatracker.ietf.org/doc/draft-ietf-plants-merkle-tree-certs/

2026-02-27 13:17:09 UTC

Can cloudflare have a DNS outage already? So I can test my new #curl dns resolve code? Is it asking too much?

2026-02-25 10:27:16 UTC

I am taking ~10.000 IUs of vitamin D3 and some omega3 fish oil daily for 3 months now. Taking low dose of Sertralin for 20 years now, the D3/omega3 additions have greatly increased my well being.
I started when my dentist checked by D3 blood levels and they were rock bottom.
Just fyi, in case you struggle, it might be worth a try. Everyone is different, ymmv.

2026-02-24 07:05:10 UTC

„The paper cites a race condition that an agent attempted to fix by inserting a delay in the code with a Thread.Sleep“
Meaning, it was in its training data.
Meaning, for better agents you need better training data. You need better code. You need to avoid code produced by previous models.
Now, where would AI companies find such code?🙃
https://www.theregister.com/2026/02/23/microsoft_ai_entry_level_russinovich_hanselman/

2026-02-21 06:37:13 UTC

Whatever you can pay, the AI hyperscalers will pay more. Because their money is free, as long as they keep the wheel spinning.
https://www.theregister.com/2026/02/20/ai_blamed_again_as_hard_drives_sell_out/

2026-02-20 11:53:22 UTC

- reply

@nprofile…w48x Yes, especially renaming function parameters is nasty stuff. Naughty boy!😌

2026-02-20 07:39:34 UTC

I waded in #curl rebasing pain with a bunch of stacked PRs yesterday. That was unfun and took the whole day.
Maybe I have not found the best way to handle stacked PRs with current git, yet.
Otoh, the colleague who changed variable names all over the code for fun and merged it without review is luckily working remote…😌

2026-02-19 08:17:28 UTC

Can someone explain to me why unsupported FOSS projects should care about CVEs?
It seems that everyone thinks they should. But I could not explain why.🤷🏻‍♂️

2026-02-01 09:21:40 UTC

Few people know that you can continue to use curl when your DNS is broken. Just add
—resolve host:port:ip-address
to your command line*.
*) Yes, that about all DNS does for you. Prettty lame, right?💁🏻‍♂️

2026-02-01 09:06:35 UTC

Fosdem people: @nprofile…2vzh is at the cafeteria around 11, handing out curl stickers.
Remember: if your laptop has #curl installed, you need a sticker or it will stop working after the grace period!😌

2026-01-26 10:01:33 UTC

- reply

@nprofile…7q7j If you come to Europe, you need to first get a Celsius license, learn the meter and kilo/centi/milli modifiers.
Also, you cannot bring your guns and you cannot just buy new ones either. Furthermore, you might be asked to ride a bicycle/train/bus during your stay.
And last, do not tell people you love their accent. Most of them prefer another language and are accomodating for your lack of skill.

2026-01-22 09:13:59 UTC

I once came into a commercial project assigned to company A for writing the requirement specification and company B for doing the implementation.
A had already used up 80% of the total budget. B was getting a bit netvous.
I did not stay long.💁🏻‍♂️

2026-01-12 09:03:13 UTC

- reply

@nprofile…z99u ah, thanks for clarifying.

2026-01-12 08:13:03 UTC

Working on #curl‘s rate limiting again today. It‘s a fun challenge to get this „right“.
Just a few users of this feature, though. Like Steam, Roku and Netflix. That I know of, at least.
Do you use rate limiting transfers? Do you know anyone besides #curl offering this?

2026-01-09 10:25:41 UTC

Still my favorite meme.😌
https://assets.chaos.social/media_attachments/files/115/864/646/963/117/300/original/d81282cf7bc46f6b.jpg

2026-01-09 09:10:40 UTC

Pro tip: when your application logs curl traces, write them to the file in the order they happen...🤦🏻‍♂️

2025-12-19 07:03:28 UTC

The Register is on WaterFox. I tried it a little, appeares fast and responsive. In comparision, I found Vivaldi a bit sluggish. Ymmv.
Will start using WaterFox. See how that goes.
https://www.theregister.com/2025/12/18/firefox_no_ai_alternative_waterfox/

2025-12-15 08:03:10 UTC

- reply

@nprofile…6rpq @nprofile…59nr one of our CI jobs is building #curl with Fil-C and running our test suite. So far, no bugs have been found to my knowledge.

2025-12-14 08:02:36 UTC

There are some nice people here on the fediverse. Some are smart, some are kind, some are funny, some are just there for the ride.
Many thanks to the admins and mods, for enabling this.🤗
/cc @nprofile…a3qk

2025-11-27 14:50:51 UTC

- reply

@nprofile…u2ft The question is why the file in /etc/ssl was not updated by your system/distro.

2025-11-27 14:49:43 UTC

- reply

@nprofile…u2ft browsers have their own CA trust anchors and do not use the system one.

2025-11-23 12:09:01 UTC

- reply

@nprofile…azj9 Not recommend to use such an LTS? No, seems insane.

2025-11-21 07:51:18 UTC

- reply

@nprofile…02fp Above infinity, it wraps around to negative infinity.

2025-11-14 14:40:10 UTC

- reply

@nprofile…txev
https://assets.chaos.social/media_attachments/files/115/548/564/845/874/154/original/38328044abff2d8a.png

2025-11-14 13:00:34 UTC

If you really, closely watch a CI job run and keenly look for any errors, it has a higher chance to succeed!
It must be the observation of the Copenhagen Interpretation that interferes here.💁🏻‍♂️

2025-11-14 05:55:50 UTC

- reply

@nprofile…wjds
We are making free software, but we do not work for free.
If a profit seeking entity has special needs, we are happy to talk to them about a support contract. Or they take our code and adapt/maintain it themselves.

2025-11-13 13:17:31 UTC

if you are not happy on your FIPS system with modern #curl treatment of TLSv1.3, why not simply refrain from using curl?
Or take an older version and maintain it yourself.💁🏻‍♂️
https://github.com/curl/curl/pull/19342

2025-11-10 06:51:16 UTC

Microsoft about to offer „AI Employees“.
Own email address and user account, participating in meetings and org charts.
AI Employees are paid on how many tokens they consume and can write themselves a new minivan.
https://www.theregister.com/2025/11/10/microsoft_agentic_users_a365/

2025-11-06 08:17:57 UTC

Homebrew is planning to enable Apple's SecTrust use in #curl. Nice to see them bringing this to their users!
#homebrew
https://github.com/Homebrew/homebrew-core/pull/253125#issuecomment-3493798481

2025-11-03 07:10:24 UTC

„Bye, Google Search“ - @nprofile…d2jh on making his large blog searchable without search engines.
Index files are on your own web server and pulled selectively by the browser client as needed.
Static files, computed once, scale just so nicely. Tech of the Ancients.😌
https://www.tbray.org/ongoing/When/202x/2025/11/01/Blog-Search-Pagefind

2025-10-31 06:44:16 UTC

- reply

@nprofile…zwws So, we have an island of former sea lords with decades of lousy governments, nuclear missiles, and now no access to porn?

2025-10-29 21:37:57 UTC

- reply

@nprofile…ytqe I got eviscerated yesterday for a light comment to a US person.
Maybe we should all switch to another language. 🤷🏻‍♂️

2025-10-29 21:29:41 UTC

- reply

@nprofile…zmxz must be a new lover. congrats!😌

2025-10-29 14:19:51 UTC

Reminder: I do not speak American.🤷‍♂️
https://assets.chaos.social/media_attachments/files/115/457/880/860/930/105/original/63d37fe9144c9eb3.png

2025-10-28 14:11:34 UTC

- reply

@nprofile…4sdv what a bucket of sunshine we are today!🌞

2025-10-24 07:16:35 UTC

Youtube auto-dubbing, or when I lost any remaining desire to watch anything on that hellsite ever again. 🤮

2025-10-23 07:56:15 UTC

AWS on what happened on Monday:
https://aws.amazon.com/message/101925/
Updater A and B run in parallel, independently by design the code:
n.a: Set new configuration n
n.b: Remove configurations < n
Monday:
A1.a blocked
B1.a success
B1.b success
A1.a blocked
B2.a success
A1.a success
B2.b success
-> no more configuration exists

2025-10-22 20:26:16 UTC

Has anyone named „Butler“ stepped forward yet?
They will definitely not be corporate or VC funded. Just checking, don‘t wanna miss this. Could be any day now…😌

2025-10-22 06:06:35 UTC

ubool64_t

2025-10-20 11:05:53 UTC

Had some weird errors this morning, then realised I had installed a macOS update over the weekend which reduced maxfiles back to 256. Thanks Apple!

2025-10-20 10:42:40 UTC

If you DNS is not working, just reply with the hostname you need and I do a resolve!
#fedidns 😎

2025-10-20 10:39:37 UTC

FYI: www.bassdrive.com/pop-up/ is working, in case you need some dnb on this monday.💁‍♂️

2025-10-09 07:05:17 UTC

- reply

@nprofile…kxk4 we need to pause now to not exceed our yearly commit budget.

2025-09-05 08:41:36 UTC

- reply

@nprofile…7x4s maybe it was named "Final" for a reason. 🤷
(it's always sad to see a favourie game botched.)

2025-08-28 09:04:04 UTC

With only 5 open issues in the curl project, it's becoming quite urgent to write new bugs!

2025-08-21 11:23:23 UTC

Fun with `pthread_cancel()` in curl. How I got that working and what challenges I encountered.
#curl #dns #pthreads
https://eissing.org/icing/posts/pthread_cancel/

2025-08-19 07:41:54 UTC

- reply

@nprofile…r95k @nprofile…85uh A Python AI chatbot for f-strings, basically. 😌

2025-08-13 11:34:10 UTC

- reply

@nprofile…vjwa another nice thing not mentioned is the use of `pytest.param(..., id='good-name')
That way is is easier to grasp what the case tests and the names in verbose mode are more telling as well.

2025-08-12 06:01:40 UTC

So, the github CEO saying „AI is here to stay“ is leaving.
GH degraded to just another part of the CoreAI ‚team‘ which is led by a former Meta executive.
*cough*
Did we already develop a FediGit or is that still on our todo list? Also, we need a curl screensaver that runs CI everywhere…
https://www.theverge.com/news/757461/microsoft-github-thomas-dohmke-resignation-coreai-team-transition

2025-07-28 07:01:31 UTC

- reply

@nprofile…68km what are those units?

2025-07-28 05:54:48 UTC

„On average, around the world, about 6,000 lightning bolts occur between clouds and the Earth every minute.“
100 bolt/s, continuously 🤯
https://apod.nasa.gov/apod/ap250727.html

2025-07-17 05:16:05 UTC

„the AI‘s security reports are often incorrect“
It‘s not as bad as that.
They have *always*been incorrect.
Which saves a lot of work once I see the many-paged, bullet-pointed prose with lots of general truthy statements („water is often wet.“), my brain goes „Whatever!“ and passes on.💁🏻‍♂️

2025-07-15 05:22:38 UTC

Tell me you are cheap, stupid and don‘t care without telling me you are cheap, stupid and just don‘t care.💁🏻‍♂️
https://assets.chaos.social/media_attachments/files/114/855/572/631/737/498/original/0f3a8f7b3158caf7.png

2025-07-14 13:41:32 UTC

I have only a very shallow opinion about SBOMs. They sound like a true bean counters' strategy:
If we'd only label everything meticulously enough, the chaos in the world will disappear.
Oh, and the ones writing the labels (or pass them on) will never lie, of course. They must not!
It's really that simple. 😌

2025-07-12 06:54:07 UTC

- reply

@nprofile…kxk4 Ah, it‘s that kind of „open source“ summit, where 80% of people are corporate IT and the remainder are Stealth Sales forces.

2025-07-10 05:33:28 UTC

“one-acre solar farm produces as much energy as 100 acres of corn-based ethanol.”
The countries throttling renewables now (US, but also Germany) are just accelerating their decline. The laws of physics can not be lobbied.
https://www.newyorker.com/news/annals-of-a-warming-planet/46-billion-years-on-the-sun-is-having-a-moment

2025-06-30 10:16:05 UTC

curl's handling of small transfers are now up to 30% faster (certain conditions apply)😌
Realistically, most of you will not really see this (that much). But should you need it, curl has become a little bit better.
https://github.com/icing/blog/blob/main/curl-req-perf.md
https://assets.chaos.social/media_attachments/files/114/771/770/063/158/730/original/787e128595ec3bec.png

2025-06-13 11:16:30 UTC

- reply

@nprofile…h77u Hmm...tricky.
Erfahrungsbasiertgenervtseinbevorespassiertigkeit.

2025-06-12 06:22:26 UTC

What I read about people coding with LLMs successfully is that they let the AI take a couple of shots, identify one that is a decent start and fix/add the right pieces.
Fair enough. But what I am missing here is how one identifies the „almost good“ part. How does one acquire that skill?
The AI definitely does not have it. So where does it come from?

2025-05-28 09:23:20 UTC

- reply

@nprofile…ppdn @nprofile…03wc
Selbst geschrieben oder mit Hilfe eines anderen Open Source Autors?

2025-05-20 07:18:24 UTC

MCP 😂😂😂😂😂😂😂😂😂
Someone putting typescr^H^H^Hlipstick on SOAP, adding „stdio“ as transport and inventing new „file:///„ like url schemes for funsies.
Vibe Protocol design

2025-04-28 14:22:52 UTC

- reply

@nprofile…j7g3 I expect the number of power grid experts has sky rocketed in the last hourse.

2025-04-15 21:26:39 UTC

CVEs are now called Jerries and are classed with up to five Llamas.
🦙🦙🦙🦙🦙

2025-04-12 09:38:03 UTC

- reply

@nprofile…68km I did not mean there were necessarily having sane idea. But it's easier to detect insanity in human coding than in AI.

2025-04-12 08:35:20 UTC

- reply

With human code, you read and understand what they were thinking. You quickly know if these people were smart, reckless, ignorant or stupid.
With Vibe code, you do not get that. It most likely appears smart. But there are no intellects behind it.
Maybe it is possible to learn these models, like in „Ah, these lines are from BlaBla v4.51 which tends to drag in pieces from the North Korean Code Poisoning of 2027! I know how to fix those!“
But I doubt it.

2025-04-12 08:13:52 UTC

„What‘s your hourly rate for fixing code?“
„Human or Vibe code?“