THE COMPANY INDEX TRACKED BLOG
Ideas, decisions, and lessons from the team.
daniel.haxx.se (opens on the source site)On October 14 2026 we will ship curl 8.23.0. The next iteration in the never-ending series of version bumps from the curl project. We always think of the next release as the best version we ever did – and this time is no exception. Decades of collected experiences and meticulous polishing has lead us to … Continue reading Twenty-two pending curl vulnerabilities →
Read at the sourceExactly on this day, September 25 2001, Apple shipped version 10.1 of their OS X operating system. The one they later would rename to macOS. Exactly twenty-five years ago today. Within all their fancy release presentations and videos there are barely no mentions of curl. In their technical notes page, there is just this short … Continue reading 25 years on Apple computers →
Read at the sourceWelcome to this new release. Get it as always from https://curl.se. If you rather want a security-patched older release branch, stay tuned for the follow-up Rock-solid curl announcement within a few days. Release presentation At 10:00 CEST (08:00 UTC) Daniel makes a live-streamed release presentation on Twich. Numbers the 276th release6 changes70 days (total: 10,887)302 … Continue reading curl 8.22.0 →
Read at the sourceThis afternoon I had a meeting with IT people at a huge US power infrastructure company. They had found a libcurl.dll file in their C:\Windows\System32 directory and asked us for help to upgrade it. Their vulnerability scanner identified it as vulnerable to several publicly known vulnerabilities. Can we bump it to the latest version please? … Continue reading There’s a libcurl.dll in my system32 →
Read at the sourcetldr: the live version is here: https://curl.se/perf/ How fast is “fast” and is it good enough? Does it run as fast now as it did before or was there a regression? What exactly needs to be fast? How fast is it? These are questions that many projects and products face, and in curl we are … Continue reading curl performance →
Read at the sourceAt this exact moment curl’s summer of bliss 2026 ends. We (the maintainers of curl) took the entire month of July off from vulnerability reporting and in this post I will try to explain how this went. (If you feel like skipping the wordy blab below, the single word answer is: fine) This was possibly … Continue reading What the bliss taught us →
Read at the sourceThe recently published RFC 9421 describes how to do HTTP Message Signatures, and starting just now, curl experimentally supports them. Message Signatures The specification describes this as a mechanism for creating, encoding, and verifying digital signatures or message authentication codes over components of an HTTP message. It is a way to verify that selected parts … Continue reading HTTP Message Signatures with curl →
Read at the sourceIt takes a village to make curl. A rather big village. I have not been a solo maintainer of curl for a long time and I don’t even do half of the commits anymore Since today, the curl git repository holds the accumulated efforts from 1,500 separate and named individuals. Only 4.5 years since we … Continue reading 1,500 curl authors →
Read at the sourceSee also: day one, day two. There is only one thing that is better than two days of HTTP workshop, and that is of course three days of HTTP workshop. The final day of this edition of the series started out with us again shuffling around where we parked ourselves around the big table. Except … Continue reading Workshop Basel day three →
Read at the sourceIf you missed it. I already described day one. Caffeinated and ready, we all gathered in the same spacious room as yesterday, but seated in new places as “suggested” by our captain. Some of us even remembered to move over the name tags we wrote yesterday to our new seats. No time was wasted on … Continue reading Workshop Basel day two →
Read at the sourceOn this hot summer’s day in Basel, Switzerland, the seventh HTTP workshop started. These events tend to work roughly the same way and the people in the room are also to large extent familiar and known since previous editions. Forty people in a meeting room, where we take turns in doing short talks on HTTP … Continue reading Workshop Basel day one →
Read at the sourceOver the years, we have received, read and handled way over one thousand vulnerability reports filed against curl. We have seen most kinds. It is time for me to try to help future reporters by providing a short guide on how to submit a truly excellent vulnerability report to an Open Source project. Researchers We … Continue reading Do excellent vulnerability reports →
Read at the sourceOne of my favorite visuals for known vulnerabilities in curl is the mountain. It shows how many currently known vulnerabilities were present in the code through-out curl’s history. In the end of June 2026 it looks like this: Over time we get more vulnerabilities reported. Since every flaw has a version range during which the … Continue reading A curl mountain movie →
Read at the source