@bagder@mastodon.social cover
@bagder@mastodon.social avatar

bagder

@bagder@mastodon.social

Internet protocols geek at wolfSSL. I lead the curl project. I don't know anything.

This profile is from a federated server and may be incomplete. For a complete list of posts, browse on the original instance.

bagder , to random
@bagder@mastodon.social avatar

Here's a user in the wild who was bitten by the Apple "backdoor" in :

https://github.com/curl/curl/discussions/14009

bagder , to random
@bagder@mastodon.social avatar

closing hackerone reports as not applicable without mercy on a Saturday night

bagder OP ,
@bagder@mastodon.social avatar

one of them claimed the fact that you can run "curl http://¹²7.0.0.1" is a vulnerability.

I insist this is IDN working as designed. However crazy it may look like.You just cannot filter URLs like that and assume it will work.

bagder OP ,
@bagder@mastodon.social avatar

closed a third. Turns out Windows sometimes do fun IDN-like unicide-to-ascii conversions for command lines that then allows users to insert unicode characters in cmdline argument when run on windows, and they are converted to their ASCII look-alike counterparts. Which can be abused to insert arguments and what not.

Not a curl security flaw. Just the weirdest Windows feature I've seen in a while. And probably a security problem in many places.

bagder , to random
@bagder@mastodon.social avatar

The website has been hosted by CDN for over seven years now. I cannot ask for a better service and a friendlier company to help us.

Starting now they offer a free tier. https://www.fastly.com/pricing/

Here's my blog post from seven years ago: https://daniel.haxx.se/blog/2017/05/02/a-curl-delivery-network/

bagder , to random
@bagder@mastodon.social avatar

Experimental HTTP/3 support is soon coming to on . Brace for impact! https://curl.se/mail/distros-2024-06/0000.html

bagder , to random
@bagder@mastodon.social avatar

On this day ten years ago, we lost our innocence as the former single page HTTP/1.1 specification (RFC2616) "exploded" into six separate new documents (RFC7230 and family). We could then no longer pretend HTTP was a simple protocol.

In June 2022, it was again updated:. "RFC 9110 and family". The spec is now split up into five main documents: semantics, caching and separate specs for each version: 1.1, 2, 3.

Those five documents hold 143,000 words combined. HTTP is not easy.

bagder , to random
@bagder@mastodon.social avatar

"maybe we need this in the future" is a bad idea for writing good code. If we need that flexibility in the future, other things will have changed as well. Better do it then, not complicating matters now.

Turning down needlessly flexible code like a boss.

bagder , to random
@bagder@mastodon.social avatar

#Windows users running stupid scanners now contact us for support regarding CVE-2023-46218 which the scanners say affects #curl 8.4.0 shipped by Microsoft.

It would, if their version was built to use #iibpsl, a prereq for this CVE, which #Microsoft does not.

Security scanners. A snake oil business.

https://curl.se/docs/CVE-2023-46218.html

bagder , to random
@bagder@mastodon.social avatar

When #Mozilla created their new logo with :// in it, the team behind reached out to me and asked if I had any objections since #curl already was using :// in our logo.

I did not object - I approved of it. I think it validated our logo choice and I am jealous they have a name that can hold :// integrated the way they do.

(I was employed by Mozilla at the time)

bagder , to random
@bagder@mastodon.social avatar

“I could rewrite ”

Here's my collection of some less cheerful quotes to keep me firmly grounded. Blogged three years ago today:

https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/

bagder , to random
@bagder@mastodon.social avatar

Remember to take the user survey 2024 - if you can spare a few minutes.

https://daniel.haxx.se/blog/2024/05/14/curl-user-survey-2024/

bagder , to random
@bagder@mastodon.social avatar

What's (open source) maintaining?

bagder , to random
@bagder@mastodon.social avatar

Please consider donating a few minutes of your time and answer the user survey 2024:

https://daniel.haxx.se/blog/2024/05/14/curl-user-survey-2024/

bagder , to random
@bagder@mastodon.social avatar

It has been a long time coming, but I've made it official:

"Daniel no longer answers questions on stackoverflow. Use a dedicated public curl forum for accurate and timely answers about anything . "

(yes, speaking about myself in 3rd person)

https://stackoverflow.com/users/93747/daniel-stenberg

bagder , to random
@bagder@mastodon.social avatar

"To me, the latest is the latest my OS provides me. If maintainers dont care about pushing the latest into the OSes they support, it's not me to blame. I think curl maintainers should push Centos to provide the latest to all users. What's the purpose of you fixing multiple bugs and security holes if you dont spend time to make it available to the broader audience?"

We are obviously all just too lazy.

https://github.com/curl/curl/issues/13546

bagder , to random
@bagder@mastodon.social avatar

Over the last five years of 's bug-bounty we have received 489 submissions. For these 489 submissions the median first-response time has been, as calculated by Hackerone: 0 (zero) hours. If this does not ooze of awesomeness from a security team I don't know what does.

I presume they round or truncate to the nearest integer hour. Still means more than half of them got answered within an hour. Whenever or from wherever they were filed.

We take security seriously.

bagder , to random
@bagder@mastodon.social avatar

#libcurl has proudly served as the HTTP(S) engine in #git for nineteen years now.

bagder , to random
@bagder@mastodon.social avatar

Nine years ago today, a command line was prominent on an even larger display...

https://daniel.haxx.se/blog/2015/04/24/curl-on-the-nasdaq-tower/

bagder , to random
@bagder@mastodon.social avatar

When in my car, I found myself in my car.

bagder , to random
@bagder@mastodon.social avatar

is just the hobby

https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/

bagder , to random
@bagder@mastodon.social avatar

I was reminded of the great security fix of 2019

bagder , to random
@bagder@mastodon.social avatar

Nowadays when I post something on my blog I almost always have to delete one or more comments that are highly offensive or outright attacking me verbally.

Can't we all just be friends instead?

bagder , to random
@bagder@mastodon.social avatar

Verified .

Don't trust. Verify.

https://daniel.haxx.se/blog/2024/04/10/verified-curl/

bagder , to random
@bagder@mastodon.social avatar

ln -s [one] [two]

the arguments are done in the same order as if you would have done it with cp.

Yes, it really is that easy. You can stop worrying about it now.

bagder , to random
@bagder@mastodon.social avatar

I suppose his book should've given us a hint

bagder , to random
@bagder@mastodon.social avatar

in case you too want to cross-stitch it

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • test
  • worldmews
  • mews
  • All magazines
    •