Notices by daniel:// stenberg:// (bagder@mastodon.social)

Welcome Pavel Sobolev as #curl commit author 1498: https://github.com/curl/curl/pull/22363

You don't see people from the frontier models brag about how many vulnerabilities they FIXED, only how many they FOUND.

The kids are alright. From an email I received today:

I am writing to express my huge appreciation for your incredible work and dedication to maintaining curl—one of the most essential building blocks of the modern internet.

I am a 16-year-old IT student from Poland. Inside my home server laboratory, your tool is a vital part of my daily life. Whether I am writing backend web tools, integrating APIs, or creating system automation scripts, curl is always the absolute backbone of my setups.

Today I spotted that musl's inet_ntop() function does not output "::[ipv4]" when asked to output an IPv6 address RFC4291 style. Something both glibc and curl's internal replacements do...

@edwintorok POSIX does not mandate that format for 12 leading zero bytes, but several implementations do it as RFC 4291 suggests. @musl makes no attempt to: https://git.musl-libc.org/cgit/musl/tree/src/network/inet_ntop.c?h=v1.2.3

As I want a stable behavior for curl, I need the same output independently of libc...

@edwintorok @musl sure, but I need consistent output and the deprecated output is still widely supported...

The biggest selling Danish game ever, 007: First Light, uses #libcurl.

"You're a commercial user of libcurl who use it for free and you ask a volunteer to fix your problem on his spare time?"

Sometimes I need to say it.

Crap, I was looking for an email from January 2000 ...

One not too surprising effect of announcing *18* CVEs in one go for #curl tomorrow, is that then all of a sudden the second newest release suddenly contains eighteen known vulnerabilities.

Going back further, the most vulnerable curl release through all time contains 101 known vulnerabilities by tomorrow. That's curl 7.34.0, released in December 2013...

ImageMagick gets a summer of bliss as well: https://www.linkedin.com/posts/dirk-lemstra_curl-summer-of-bliss-share-7472732623891644417-HjHV/

Today I learned that glibc has a broken %s implementation in strftime. It applies the timezone even when we want UTC...

https://github.com/curl/curl/issues/22038

The #curl project will not accept or otherwise handle any vulnerability reports during the month of July 2026. We call it the curl summer of bliss.

https://daniel.haxx.se/blog/2026/06/15/curl-summer-of-bliss/

working theory: we get fewer vulnerability reports late in the weeks as the researchers have all run out of tokens by now...

Out of the 16 pending #curl CVEs:

13 are severity LOW
3 are severity MEDIUM
9 of them are libcurl only (not the tool)
3 are "C mistakes"
2 are younger than six months old
1 is older than 25 years

Pasting a huge AI generated explanation to a problem in an issue or pull-request is nothing but RUDE. Don't do it. You look stupid and the receivers of that feel insulted.

We are humans. We communicate like humans. Fine, use the tools you like, but don't insult us.

The pressure

for us in the #curl project right now

https://daniel.haxx.se/blog/2026/05/26/the-pressure/

#curl up day two

Thanks for your expressed concern for my well-being in these testing times.

Yes, it is exhausting and I did 50 hour work weeks already before this. My wife and family help me keep sane and are effectively "non-digital activities" that help me to momentarily let go of these things once in a while.

Also: no, there are no companies and no organizations that step up to help. Not before. Not now. We're on our own. As always.

Queue xkcd dependency image.

last year at this time, #curl was git cloned 23,900 times per day

over the last two weeks, it has been git cloned 54,286 times per day