Your rich ivory halls are birthing martyrs of late, shouldering great responsibility and prophesying great plagues upon humanity. It seems, they say, your AIs are not just writing emails anymore.…

Comments

**Location:** Lincoln, Nebraska, USA **Employment type:** Volunteer **Term:** Permanent **Compensation:** $0 **Reports to:** The community **Direct reports:** None **Start date:** Immediate We’re looking for a passionate, self-directed engineer to take full ownership of one of the most widely deployed libraries in the ecosystem. This is a rare opportunity to make a real impact on software that millions of developers depend on every single day. If you thrive on autonomy, love working in the open, and want to wear many hats in a fast-paced environment, we’d love to hear from you. **About the role** As Senior Open Source Maintainer you will be the primary technical owner and public face of the project. You’ll drive the roadmap, ship releases, support a global user base, and champion the project across the wider industry. This is a highly visible individual contributor role with enormous scope. No two days are the same, and you’ll have full autonomy to decide how you spend your time. **What you’ll do** * Own the technical roadmap and long-term architectural direction * Review and merge contributions from a diverse, global community of open source developers * Triage and prioritise the issue tracker and feature request backlog * Maintain comprehensive documentation, examples, migration guides, and API references * Ensure project websites and documentation meet current accessibility standards * Cut releases across all supported major version lines and write the release notes * Own the CI pipeline, release automation, and package publishing infrastructure * Keep dependencies current and promptly action automated update pull requests * Support users on GitHub, Discord, Slack, Stack Overflow, Mastodon, Bluesky, and email * Ensure compatibility across all current runtimes, operating systems, and architectures * Preserve backwards compatibility, including widely relied-upon undocumented behaviour * Coordinate release timing with downstream distributions, registries, and redistributors **You’ll also** * Participate in the on-call rotation for incidents at downstream production deployments * Support enterprise consumers where project issues block business-critical systems * Define and communicate support, deprecation, and end-of-life policies for all release lines * Provide migration guidance to adopters upgrading from end-of-life releases * Coordinate advisories, CVE records, disclosure timelines, and researcher credits * Ship embargoed CVE patches across all supported version lines within the disclosure window * Produce SBOMs, VEX statements, and signed provenance attestations for every release * Maintain reproducible builds and independently verifiable release artifacts * Complete supplier security assessments and questionnaires for enterprise consumers * Remediate findings from OpenSSF Scorecard, dependency scanners, and compliance platforms **As well as** * Review high volumes of contributions from AI coding agents and automated refactoring tools * Triage vulnerability reports generated by commercial AI security scanners * Champion the project at international conferences, on podcasts, and across social media * Moderate all community spaces and enforce the Code of Conduct * Engage constructively with feedback shared on social media and public forums * Represent the project in working groups, standards bodies, and regulatory consultations * Prepare grant applications and quarterly reports for current and prospective funders * Administer domains, trademarks, signing keys, cloud accounts, and social media * Advise enterprise legal teams on licensing, patent, warranty, and export control matters * Own the succession plan: identify, recruit, and onboard your replacement **How we’ll measure success** * GitHub stars * Time to first response on issues and pull requests * Release cadence and mean time to patch for disclosed vulnerabilities * Open issue and stale pull request backlog * Dependency freshness * OpenSSF Scorecard result and other automated project scoring * Community sentiment across public channels * Downstream adoption * Bus factor **What we’re looking for** * 8+ years of professional software engineering experience * Deep expertise in one systems language and professional proficiency in at least four others * Written communication pitched to audiences from first-time contributors to Fortune 500 CISOs * Consistent release cadence with minimal dependency churn and no breaking changes * Comfortable across engineering, support, security, community, marketing, finance, and legal * Balances contributors, enterprises, security researchers, regulators, and automated systems * Comfortable receiving direct public feedback and turning it into improvements * Availability overlapping core business hours in AMER, EMEA, and APAC * Able to respond to time-sensitive security matters outside normal working hours * Provides own hardware, reliable internet, and test environments for all supported platforms **Nice to have** * Prior experience in technical writing, developer relations, or community management * Experience migrating existing codebases to memory-safe languages * Working knowledge of licence compatibility and international trademark registration * Grant writing and nonprofit financial reporting experience * Media training * An established personal audience on at least one major social platform * Conversational proficiency in a second and third language * A second job **What we offer** * 100% remote, work from anywhere in the world * Complete flexibility over your working hours * High-impact work depended on by startups and Fortune 500 companies alike * Exceptional visibility and personal brand building opportunities * Regular speaking slots at leading industry events * The opportunity to develop close working relationships with several national CERTs * A passionate, highly engaged global user community * GitHub Sponsors enabled on the repository **How to apply** Please submit a CV, a link to your GitHub profile, and a short cover letter telling us what ownership means to you. Our interview process consists of a recruiter screen, a technical interview, a system design round, a take-home exercise, and a final community panel. If you don’t meet every requirement listed above, we’d still encourage you to apply. We are committed to building a diverse and inclusive community and welcome applicants from all backgrounds. This position will remain open until filled. Due to the volume of applications received, we are unable to respond to every candidate individually. _This role is not eligible for relocation assistance or visa sponsorship._

Comments

YouTube video by Riton Les canons

After telemetry data from Mozilla reported the P99 DNS resolution differences between A and AAAA responses to by 21ms, reduce curl's resolution delay to 25ms. What could possibly go wrong?

_tldr: the live version is here:https://curl.se/perf/_ How fast is “fast” and is it good enough? Does it run as fast now as it did before or was there a regression? What exactly needs to be fast? How fast is it? These are questions that many projects and products face, and in curl we are no different. Yet, performance testing and comparisons are _hard_ and full of landmines and time-wasting efforts. For many years we have occasionally brought up the idea of a performance test suite for curl only to shut it down again because the challenges seemed hard and no one was volunteering to do this. This week it changed. ## Let’s do this I started out trying to find existing projects that host performance results for Open Source projects so that we could just feed our results something else and get great visualizations and data management. I did not find any such. I then took a look at what existing tools there are for this purpose, and most pointers seemed to suggest that Grafana is a popular and maybe even a good solution to build something like this with. But man, that is a complicated machine and it felt more than a little overwhelming just figure out where or how to start with it. I decided to postpone that take as well. ## Let _me_ do this I decided that instead of trying to do this the best and optimal way – I shouldn’t let perfect be the enemy of good – I would start out by doing the things I know how to do and take it as far as I can one step at a time. _Something should be better than nothing_. Performance testing needs decently stable system conditions so that repeated runs produce reasonably similar results, when all involved factors remain identical. This is basically impossibly to accomplish using most cloud infrastructure since those are almost always shared with countless other users. At least on the cheap and free tiers we use. We probably need our own dedicated hardware for this, but instead of trying to figure out where to get that and arrange for that, I would start by running performance tests on my own local development machine. I am a single user on this and it has many cores and runs decently fast. It should be good enough to get this going on. I created a first shell script that updates the curl source code from git, it configures and builds it. Then it runs a bunch of tests, outputs a bunch of data and logs all the output in a single log file. I started out with a few simple tests. How fast does curl download a 100 GB file from localhost, how many allocations and how big allocations does it need for a single HTTP download? My second script parses all the test log files from the previous builds and generates summaries and graphs for them. To make it possible for humans to see how the performance changes between builds and ideally to automatically detect when something changes more than what should be tolerated. As I am a graph addict already since before, and that journey has taught me a little gnuplot, I decided that even while there probably are much better tools and fancy JavaScript things that _could_ be used, I don’t know them and learning them now is an endeavor I rather avoid. So I stick to what I know and can get results with quickly. I third script is invoked from a crontab every twenty minutes, sets up some variables and invokes the runner script. Once the basics started to work, I showed my curl friends the early versions and I soon created a new git repository for the code. ## It’s live baby After a little more poking, I soon made my locally produced performance test summary get packaged and automatically transferred to the curl website after each build, and voila, the first public curl performance tests were live and public. Getting this data available immediate triggered curl developers. It only took hours until we had the first proposed changes to improve some numbers, and soon we had a few merges to that affect. Visibility really helps! The performance numbers we get are still varying to a certain degree, partially of course because I still use my machine for my daily development things, but also because most of them do real (localhost) networking and that is by its nature a little… _varying_. The system builds and runs a new round every twenty minutes and it does that using the latest commits from git. This setup makes it sometimes run many rounds on the same commit and it might also mean that it sometimes updates and get several new commits at once, so it might skip a round for some commits. I might reconsider this design later, but since it is still a twenty minute time window, the number of commits is still limited. When the script makes multiple build rounds on the same commit, it accumulates the numbers and for the graph it stores the maximum, the median and the minimum value. It helps show the variation per commit and allows us to cram more into the graphs. It is still early days, but there will be a maximum limit to how many commits that can be displayed in a single graph and still be helpful. HTTP/2 parallel download speed through 31 build rounds ## Distribution To help visualize the distribution and data spread per test, I created a separate illustration that shows the Minimum, maximum, P25, P75, Medium and Mean values in a _Box-and-Whisker Plot_. A Box-and-Whisker Plot showing the HTTP/2 parallel download speed data distribution. ## Changing conditions An obvious downside with me just storing build logs in files, is that it will not scale up to the millions. I did however decide that I’m not designing this system for that. At least not now. Performance tests are highly specific and dependent on the exact machine it runs on, the exact third party libraries and their versions that are used, the other components involved in the tests, such as the servers, and more. I expect that we will change conditions for the tests every once in a while that makes it hard to compare the current numbers with past numbers or at last hard to do much about the differences. Therefore I think the performance test numbers and values are primarily useful in the short term. To help us spot if we land something that subtly and _unintentionally_ degrades something. ## Stakes To detect extremely slow and long-term changes in performance and even making sure we can better survive wiping all the existing build logs etc, I introduced a concept I call _stakes_. As in a stake pole. A marker. An arbitrary threshold set manually for each specific test. This value can be used to measure performance test results against, now and later. As conditions change and maybe something makes the results go up or down and we are fine with those changes because they are motivated and expected, then we just change the stakes. If it works out, I might the system automatically detect and maybe highlight tests that deviate too much from its set stake (at least if done in the _wrong_ direction) . It could be a signal that something bad was merged. ## Balances As with everything in life, things are often balanced out. We already ran into this when we eagerly merged several changes to reduce the number of allocations to do a single HTTP download, only to realize that one of the optimizations we did had the side effect that it expanded the size one of the main structs. Changes in one area might come at an expense in another. With sufficient tests and data we can improve curl for users, and at the same time make sure that our improvements don’t come with a cost we are not prepared to pay. Exactly how to make the balance is of course a question we need to deal with, discuss and decide. Possibly for whatever change we do. ## The tests As I write this, we have 24 tests and a full test round completes in about six minutes on my machine. We can of course do multiple builds using different hardware, different operating systems, different build options, different third party libraries and different test servers to check more angles of performance, and I am certainly open for and prepared to do that going forward. I will however first let this single-flavor run for a while so that we get more data, get a change to tweak it and make it as usable as possible for curl developers. As with everything there is no end to what we _can_ make this do. This is a start. I sure we can take it further as we move along. In particular if people join in and help out. Both with ideas and proposals for visualizations, graphs and new tests to add, but also with actual pull-requests and code. ## Build volumes and graphs Over the last year, we have merged, on average, about 10 commits per day. If we keep this pace up and this performance test setup can show 100 commits conveniently into a single graph, that is just ten days of development. Probably not enough. Once we reach one hundred builds or so in the first graphs I need to consider adding separate _long term_ graphs that use select data-points to display data development over a longer time. Some googling told me the Largest-Triangle-Three-Buckets, or LTTB for short, is a fine algorithm to use for this. I now do a separate “long term” graph that “downsamples” the full range down to something that can be shown in a reasonable way. I suppose we will see properly in the future how this works. ## Spotting change The _stake_ thing I mentioned is one way to help us spot gradual performance changes over time. Another googling told me that there’s a _Mann-Kendall Test + Sen’s Slope_ algorithm to use to identify trends in graphs like this and it can be used to plot a trend. It might work as a helper to better identify… yeah, the data _trend_ for each test. The HTTP/2 parallel download speed trend at a specific moment ## Developing This setup has only existed for a few days. There is lots to do, lots to learn and much more to experiment with. Your comments, help and pull-requests will be appreciated!

Mozilla is hiring a Necko Student Worker in Remote Canada, Firefox, New Products, Firefox, Core Services, Firefox, Mozilla Foundation, Core Services, Mozilla.org, New…

Gerrit Code Review

At this exact moment curl’s summer of bliss 2026 ends. We (the maintainers of curl) took the entire month of July off from vulnerability reporting and in this post I will try to explain how this went. (If you feel like skipping the wordy blab below, the single word answer is: _fine_) **This was possibly our best project decision in a long while.** ## Zero vulnerability reports Already before this, we have been refusing to answer emails about vulnerabilities. Partly because we can’t keep track of them that way but even more so because it makes it much harder to properly disclose and publish the entire report sequence after the fact. On our Hackerone page we informed visitors that we were on pause and that they could come back in August. We had I believe _one_ vulnerability report sent to my private email address in this period in spite of that messaging, but for all intents and purposes this worked out exactly as good as we hoped it would. I just ignored that email. That was easy. ## Bliss The effect was almost immediate. Just a few days into the bliss, my fellow curl maintainers all agreed with me that we felt a sense of relief, of vacation and that a load had been taken off our chests. We felt free, _unchained_ , and now suddenly able to do what we wanted. We could now spend time reviewing some of the queued up pull-requests for features and changes we like. We could suddenly again work on code in areas we had been leaving behind lately as vulnerability reports sucked all the air out the room. We polished details on the website, we found document gaps to tighten. It felt like the good old days again. The _fun_ days. We got reminded why we do Open Source and how fun it is. We took time off, saw some other corners of the world and enjoyed some time away from the keyboards. We truly healed and re-energized. ## CNA Before we took off on the bliss, we were informed in clear terms that the CNA rules (we are a CNA) mandate that we must respond within 72 hours for some critical vulnerabilities so we can’t just ignore them. I told them sure we can, but in the worst case case our “root” could do some emergency assignments. I figured the risk was minimal and it turns out I was right, Nothing like that was needed and no CVE assignments were necessary during the bliss. ## Customers I got a curious question or two from existing support customers on how the bliss would affect them, but that was easy: it did not affect them. Now, post-bliss, I think they all can confirm that it really did not. ## New customers? As I promised to keep up the contact with and support for paying customers even during the bliss, you could possibly imagine that this would have been an incentive for worried commercial curl users out there to sign up for support contracts. This did not happen – at all. By this I think we should conclude that (commercial) curl users were not worried either. ## The outside world Lots of fellow open source maintainers and most people in my surrounding have been super positive and downright supportive of our _taking some time off_. I can’t recall having receiving a single negative comment about the curl summer of bliss! ## Fellow blissers I was moved to see that several other Open Source projects followed our example and also took some time off in order to recharge and relax. In addition to giving us a little vacation, it helps sending a signal and a reminder that Open Source is to a large extent done voluntarily and even maintainers need a break at times. ## Major incidents? Have we opened ourselves up for dangerous attacks and flaws now? Have the bad guys an edge on all curl users out there now because we lived in bliss for a month? We don’t know yet, but it would surprise me. ## Queues During this slow-down, we slowly got more open issues and pull-requests lingering on GitHub than usual. No surprise there. Once we started to come back to life again, we have since managed to return them back to the normal amounts. ## Flood gates Yes, there is an obvious risk that there are now a whole range of queued up reports that will hit us in a short period time as we open up for vulnerability reports again. Presumably the risk for duplicates among these reports should also be significantly higher than usual. I suppose I need to do an update post in a month or two and let you know what happened. We always treat vulnerability reports and project security with topmost priority and we will continue to do so. We will simply work with what we have and make sure our users and by extension, the world, are safe. Since I am a member of a few other (non-curl) security teams that did not have a summer of bliss, I have seen that the flood of vuln reports have not really slowed down so it might depend a lot on the details of each specific project. ## Some emails were read All individual curl maintainers of course handled this gift in their own ways. We did not all just disconnect to sit on a remote beach for the whole time. Some of us did that part of the time, but we mostly enjoyed the lower stress level and the absence of pressure. It was mentally relaxing. So, even if some of us kept up with emails, occasionally responded to issues or even submitted some pull requests of our own, it was still vacation. It was still blissful. ## Rebliss? Will we do another summer/winter of bliss? I think yes. It was simply great, with virtually no downsides for the people involved but instead lots of positiveness. Ideally a reduced workload going further will remove the need for another one, but it is not easy to tell what the future holds. ## Just transfers After all, curl just does transfers. Fast. Reliably. Secure.

Nebula and Picturehouse present Jet Lag: The Game - Japanorama (Season 19) Premiere Event across the UK with Sam Denby, Ben Doyle, and Adam Chase