Notices by daniel:// stenberg:// (bagder@mastodon.social), page 7

@ariadne @quasar we provide it because people want it and use it. We don't really know why.

But it offers an easy way for people stuck on legacy distros to run modern curl versions.

Support for RFC 9421 - HTTP Message Signatures in #curl ?

https://github.com/curl/curl/discussions/13376

@foosel that's the genuine "fix" for a reported security problem against some of their devices at the time, yes indeed

I was reminded of the great #Cisco security fix of 2019

#curl

@CodingThunder thanks, will fix

@CodingThunder it would be utterly naive of me to assume that it would A) show the correct country always and B) that just because they login from a specific country they live there or are residents of that country...

Verified #curl.

Don't trust. Verify.

https://daniel.haxx.se/blog/2024/04/10/verified-curl/

I don't think there are any magic tricks or silver bullets for how to stay sane and not burn out as an open source maintainer with your code running in billions of devices.

https://un.curl.dev/life/stay-sane

@kaia curl is written in ancient and very conservative C so it *usually* still works just fine. Sometimes with a little hands-on. But there are also the times when the machine is so special and ancient that it's hard to help much...

when using a C compiler last patched nineteen years ago, on Solaris, there this issue...

Today's episode in "ancient machines that never dies" and they all (try to) run #curl.

ln -s [one] [two]

the arguments are done in the same order as if you would have done it with cp.

Yes, it really is that easy. You can stop worrying about it now.

Them: we're excited to offer the #curl project a grant of $2,000 in USDC.

(USDC? Quick Google. What's that?)

Me:Sorry, I'm not interested in any crypto currencies. If you can't pay real money then I'm not interested.

(Easy) ways to help struggling open source projects:

- step in and help review a few PRs

- help the project triage/reproduce bugs

- if code in the PR looks complicated or is hard to understand, ask for an explanation

- express your gratitude to the maintainers

- make your company sponsor projects they depend on

I suppose his book should've given us a hint

💚 Stay strong xz maintainer(s). We're with you.💚

Can I just say that I have created #curl releases "the #xz way" since the 90s: I generate the release tarballs on my machine. It makes the tarball have (generated) files included that are not present in git. It's a feature. But it also makes it harder for observers to figure out if the additional files are fine or not.

(doxygen etc) generated docs for your API is only better than nothing. If you want *good* documentation, you need to put in a little more work.

#curl 8.7.0 is here! Some new stuff. 160+ bugfixes. 4 CVEs announced (low and medium severity)

https://daniel.haxx.se/blog/2024/03/27/curl-8-7-0/

Dependency explosion is a problem and maybe the time is ripe to start thinking about how clever it is to rely on hundreds of tiny components you don't know, don't control and that keep changing.

https://tweedegolf.nl/en/blog/119/sudo-rs-depencencies-when-less-is-better

"The *only* reason curl is popular, is because it is *free* and it might have been first. Using curl is a temporary cost cutting measure. curl is a tool for the poor. "

Aart de Vries apparently knows.

https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-security-incident-12604/comment-page-1/#comment-26945