iiinova — where your digital self keeps evolving

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 22/10/2026

Coffee cup for the current Open Source workload and situation.

A hand holding a black mug with the text NEVER SLEEP AGAIN in red

3115 15

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 21/10/2026

I'm in Borås today. I'll blab after lunch. Brought stickers.

1111 11

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 17/10/2026

#curl's law: Everything eventually runs curl A trend in society over the last decade and I don't see it changing anytime soon.

If it isn’t powered now, it will be soon
If it is powered, it will be networked
If it is networked, it needs Internet access
If it needs Internet access, curl helps

22014 20

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 14/10/2026

Never forget: A library doesn't take a genius to maintain, this isn't a big deal. (it's a tweet I captured back in 2021)

060 6

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 13/10/2026

We're all "happy" for the pending curl release...

curl 8.23.0 release photo, including Daisy the cat looking fairly grumpy and "unconcerned".

2212 21

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 12/10/2026

Updated graph with the findings we will publish this week. Maybe - maybe - that is the beginning of a drop ? I've long theorized that we should see (a more distinct) plot drop when we start to reach the end of "the wave" of reports.

Accumulated vulnerability age when reported, showing a slight drop at the end of 2026

032 3

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 12/10/2026

Number of published #curl vulnerabilities on October 14 and the 2026 projection.

095 9

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 05/10/2026

No, AI is not causing a PR or commit author explosion in #curl (so far)

commit authors per year in the curl project, showing 2026 pretty much on par with recent years

commits per year in the curl project, showing 2026 slightly behind last year

092 9

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 25/09/2026

my week: lists.haxx.se/pipermail/daniel/2026… 25 years, security, performance, Rock-solid, Development, rc2, stickers

191 9

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 25/09/2026

If you're heading to the #OpenSSL conf in Prague Oct 13-15 make sure you chase down @jimfuller and unload him of a few #curl stickers. He's going to be our official distributor there. You can have your fix from him. For free. You know you need one. Or two.

130 3

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 23/09/2026

Dan Lorenc at Chainguard posted this statement about #curl on LinkedIn...

We put curl 8.22.0 through an eight-and-a-half-hour automated tree search, about 4,100 tool calls and roughly 190 million tokens of model work (the vast majority cache reads), aimed only at High and Critical outcomes: memory safety on an ASan build across the HTTP/1, HTTP/2, HTTP/3, WebSocket, FTP, IMAP, POP3, SMTP, SMB, LDAP, cookie, and NTLM/Digest/Negotiate parsers under tens of thousands of hostile server responses, plus integrity hunts for TLS verification bypass under an on-path attacker,
STARTTLS and 1implicit-TLS downgrade, cross-handle response confusion, CONNECT tunnel handling, credential leakage through redirects, file writes outside the output directory, and Alt-Svc and HSTS guarantees. Thirty-one lines of attack closed clean with no sanitizer report and no verification
bypass; all that surfaced were three Medium-class edges, one of which the curl team had already fixed on master days before we looked. That outcome is a credit to the project: years of continuous fuzzing, the maintainers' own audits, and a codebase where every server-controlled length is bounded
before use left a persistent automated adversary with nowhere to go. Congratulations to the curl team, and thanks for making our negative result so thoroughly earned.

One note on the token figure: the run log records usage for only about 400 of the turns (18.6 million tokens, 46,500 per turn on average), so the 190 million is that average scaled to the 4,103 tool-call turns.

21714 17

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 17/09/2026

Between all the vulnerability report work, I made curl's date parser twice as fast as before... curl.se/perf/#dateparser

date parsing speed dropping from ~59ns down to 27ns per invoke (on a test with 180 different date strings)

072 7

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 16/09/2026

"for months on end now, most of our teams have just been triaging bugs and coordinating releases. It has truly taken all the fun out of the job"

unbound vulnerabilities year to year showing 2026 take off like a rocket

15010 50

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 09/09/2026

Updated chart showing the share of #curl vulnerabilities caused by "C mistakes" as a share of all the vulns we know existed in code over time.

C mistakes among the vulnerabilities present in code

2174 17

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 07/09/2026

I switched the #curl performance tests from debug builds to optimized builds. Here's the HTTP/1 parallel requests test as a sample of what difference it made. curl.se/perf/#h1-requests

HTTP/1 parallel requests, jumped from ~34K/s to 52K/s

082 8

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 05/09/2026

It feels a little embarrassing that I could speed up URL (percent) encoding in #curl 500% with this: github.com/curl/curl/pull/22780

URL encode performance graph comparing speed in curl builds showing a drop from > 2000 ns to below 400 ns.

050 5

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 04/09/2026

Over the last 14 days, 60,000 unique cloners cloned the #curl git repository 1.2 million times.

031 3

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 04/09/2026

Today for the first time ever, we no longer see my name on most number of production source code lines in #curl when asking git blame. @icing just overtook me!

Stefan Eissing 31.80%
Daniel Stenberg 31.74%
(the rest much smaller shares)

2130 13

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 01/09/2026

These are the #curl top sponsors in September 2026. Friends of ours.

081 8

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 01/09/2026

security reports on #hackerone for #curl, September 1. 1/3 of the year remaining. (and this does not include all of those submitted via other channels)

261 submitted so far in 2026
181 were submitted during the whole of 2025
86 in 2024

060 6

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 01/09/2026

@kura number of #curl command line options over time: We have not removed any options the last twenty years, but some have lost their meaning.

041 4

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 31/08/2026

I'll keynote the Netnod Tech Meeting on October 6, 2026. Right in the Stockholm city center. I'll bring stickers. www.netnod.se/netnod-tech-meeting-2…

Daniel Stenberg, Founder and lead developer, cURL

050 5

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 29/08/2026

I occasionally still get annoyed by the weird performance metrics ada-url shows for libcurl's URL parser over at: www.ada-url.com/performance

260 6

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 27/08/2026

Hackerone submission stats for #curl this year vs last year. Can you spot the summer of bliss?

040 4

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 27/08/2026

screenshot from our hackerone inbox right now:

220 2

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 26/08/2026

maybe even more important, its memory consumption:

150 5

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 26/08/2026

#curl does HTTP/3 uploads *a little* faster in the next release thanks to @icing

1142 14

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 23/08/2026

I'm now ahead of @icing with a mere 0.09 percentage points... This counts share of lines of #curl production code with our names on when you do git blame - right now in git master.

top-40 authors with production code remaining in master

021 2

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 21/08/2026

I bet you then ask yourself: when you limit the speed like that, how fast does it actually transfer all those files? How accurate is it? Answer: the span is +-1385 bytes/second, 0.03% of the mean value. Pretty darn accurate. The graph is slightly amusing as […] [Original post on mastodon.social]

Limit-rate network speed, curl performance testing

020 2

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 21/08/2026

Download ten files in parallel from localhost using HTTP/1 over HTTPS, 10 times each - with #curl. Each file is 100MB. Limit the download speed to 5000KB/sec. How much CPU is "good" to spend on this on a modern intel arch? Perhaps a median of 2.73% of an […] [Original post on mastodon.social]

Limit-rate CPU use, curl performance testing

250 5

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 20/08/2026

Happy to appear (via screenshot) in a sec conference talk about AI vuln discoveries held by the CVE program the other week. The video of the whole thing is here: www.youtube.com/watch?v=fV_X57aD188

The screen grab on the right is from a LinkedIn post by Daniel Stenberg about the large number of vulns reported earlier this year.

071 7

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 20/08/2026

Because why wouldn't your Nibe geothermal heat pump run #curl? (Thanks Jan Lundmark)

12010 20

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 15/08/2026

Give the team a graph and things happen. #curl now allocates less than 130,000 bytes memory to download a HTTP file of any size. 102,400 bytes of that chunk is the download buffer. curl has *never* allocated less non-download buffer memory for this use case […] [Original post on mastodon.social]

Allocated memory for a single HTTP transfer

1811 11

daniel:// stenberg:// @bagder.mastodon.social.ap.brid.gy · 11/08/2026

After @icing trimmed off some bytes in a core struct yesterday:

Allocated memory for a single HTTP transfer (single-maxalloc)

050 5