← Feed

Posts

• View post

  state of #curl dev in three graphs

• View post

  Guess which project that just had *24* sweet hours of not a single vuln report coming in? This is like holiday. Wohoo. ⛱️ 🍹 😎

• View post

  Thanks team for the massively successful redirect actions this week. Hardly anyone looks at the curl code right now. 😎

• View post

  gosh, a vulnerability report just arrived that was... *gasp* seemingly written by a human!

• View post

  Coffee cup for the current Open Source workload and situation.

• View post

  “ignore the slop” https://daniel.haxx.se/blog/2026/10/22/ignore-the-slop/

• View post

  A key four everyone

• View post

  you know its a special day when the curl signal group is busier than the mastodon feed

• View post

  Original AI word salad describing a flaw: 241 words and 1322 characters. My human summary of the same problem: 27 words,. 142 characters.

• View post

  "Ignoring the slop" cannot be done and it doesn't help. These reports created with the help of AIs point out actual problems, and sometimes vulnerabilities. Ignoring real vulnerabilities because they were found by AI does not make users safe and secure. It makes them vulnerable. We don't want that. (I don't call this "slop" because it's typically accurate and correct, even if too wordy)

• View post

  Imagine having been cleaning your apartment for days until it is all shiny and you've polished every surface and detail you can think of. Spotless. Perfect. Then your friends arrive. One by one they all leave you a list each of about 7 different things you missed, forgot or did a bad job with. This is what we have now with the AI vulnerability reports. A really long line of friends queuing to point out more flaws to you. Clean better dammit.

• View post

  A Saturday email that makes my chores easier. I want to extend this to my fellow maintainers in these testing times; I'm not doing curl by myself. Hi Daniel, With all the nonsense going on related to AI slop bug reporting and PRs, just looking in from the outside is exhausting, I imagine it must be even worse for you and the other contributors. I wanted to say thank you for all the time and energy you put into cURL, the tool really is a joy to use and never lets me down.

• View post

  #curl's law: Everything eventually runs curl A trend in society over the last decade and I don't see it changing anytime soon.

• View post

  Thirteen years ago since this golden email arrived in my inbox: https://daniel.haxx.se/email/2013-10-16.html

• View post

  PSA "The existing maintainers will cease their involvement in their development and maintenance of Mbed TLS from April 2027." https://lists.trustedfirmware.org/archives/list/mbed-tls@lists.trustedfirmware.org/thread/YPIGCB7WN6GCHOGEGKOJXUYAP7OK527W/#BSRM3JY6JFNWWEHKMY4JQQON5QB3LP5U

• View post

  A UAF turned RCE In the #curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time. We grade it severity HIGH. It is known as CVE-2026-92392 with the title HTTP/2 upload Use-After-Free. https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/

• View post

  We're all "happy" for the pending curl release... #cats #catsofMastodon

• View post

  I just want to express my gratitude and thanks to Daniel Gustafsson for all the time and efforts spent on #curl over the years. Daniel has decided to step down from the curl security team and has asked to get his "commit bit" revoked. Thanks Daniel, you are always welcome back when you feel like it!

• View post

  I am awarded a gold medal by the Royal Swedish Academy of Sciences for my work on #curl https://daniel.haxx.se/blog/2025/10/21/a-royal-gold-medal/

• View post

  "The people holding up the internet" A good-looking but somewhat depressing exposé about the people holding up current digital infrastructure as a hobby. https://sheets.works/data-viz/holding-up-the-internet

• View post

  Buckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years. Yes, found with AI.

• View post

  "Google freezes open-source bug bounty program amid flood of invalid AI slop submissions" https://www.tomshardware.com/tech-industry/artificial-intelligence/google-suspends-part-of-the-oss-vrp-bug-bounty-program-due-to-an-influx-of-invalid-ai-submissions-product-vulnerability-submissions-ended-october-1

• View post

  my week: https://lists.haxx.se/pipermail/daniel/2026-September/000169.html 25 years, security, performance, Rock-solid, Development, rc2, stickers

• View post

  Organisation curl Job title internet janitor Attending Social: No Filling in the registration form for a conference talk I'll do in a few weeks.

• View post

  because obviously on Windows "CON[superscript 1]" is also a reserved file name... *sigh* And yeah, you can write that either with ISO8859-1 *or* UTF-8 ... You couldn't even make these things up if you tried.

• View post

  The Russian drone that crashed in Lithuania the other day had curl installed. As part of a default Linux install presumably, it seems unlikely it used curl for any "drony" things.

• View post

  None of the Flock camera teardowns seems to specifically list curl as part of those software stacks, but as they run fairly stock Android installs it is likely that they too run curl.

• View post

  "for months on end now, most of our teams have just been triaging bugs and coordinating releases. It has truly taken all the fun out of the job" https://blog.nlnetlabs.nl/maintaining-the-love-for-coding-in-the-time-of-ai/

• View post

  Weird AI :video about curl that is still mostly accurate: https://youtu.be/qZHGxmV4MJU?is=PTTxfjlOuEkXyQg2

• View post

  As of two minutes ago, #curl does no longer support SMB. 🎉