[Daniel's week] May 10, 2024

[Daniel Stenberg]

Hi friends!

Another busy week cycle ends. I kept busy.

## curl up

Last weekend several core curl contributors came to Stockholm and we spent a
weekend talking curl [1]. It was super fun, I did several presentation and
ended up totally exhausted by Sunday evening. Everything worked out fine and I
got positive feedback on the event from several attendees. For more details,
read my blog post.

## TLS 1.3

As a direct result of discussions at curl up I brought back the previous
discussion about deprecating support for TLS libraries that don't support 1.3
in the future [2]. This is still an ongoing discussion and the cut-off date is
not decided, but I must say that it leans towards us making this decision.

While this PR was discussed, support for using curl with mbedTLS and TLS 1.3
landed, so now that library at least won't be affected by this deprecation
idea any more.

This proposal thus only possibly affects curl's support for BearSSL and Secure
Transport.

I'll keep the discussion alive for a while longer to see if we get more views
and opinions before we make a decision.

## cookies

The RFC 6265bis draft is now in working group last call [4]. This is the
updated cookie spec, ten years after RFC 6265 was published. Most of the
updates in this version seems to apply to browsers and not so much for curl,
so I don't expect us to have to do a lot of work to comply. One of the things
we will adapt is capping the max life-time of cookies to 400 days [3].

## user survey

The annual user survey is about to launch and this week I have tried to poll
the curl community for idea of new or updated questions. Since this is the
only real way we have to get feedback from users for another year, it is worth
making sure we ask for the right things and provide the right set of
alternatives.

I will launch the survey on the coming Tuesday and then we will have it
running for 14 days. Just like we normally do. I will try to push for it
everywhere, and I will of course appreciate all the help I can get in
spreading the link.

It helps is guide what to do next.

## stackoverflow

I have officially declared that I have stopped answering questions on
stackoverflow [5]. To rather encourage users to come to curl focused forums to
ask curl questions, because stackoverflow is an annoying place to try to give
correct answers and then on top of that their latest strong-arming of people
after they decided to sell all our collective answers to AI companies. I have
not been very active on that site recently anyway so not much of a change for
me really.

## Experimental

We have added "graduation requirements" for each feature we have marked as
experimental in curl [6]. We should of course already have had that as now it
is much clearer to everyone what exactly is required from an experiment before
we can remove that label from it.

Of course we still have the problem that experimental code tends to not be
used very much so we don't get a lot of feedback on them so it makes it hard
for us to get them out of the experimental state...

## State machine

In early April I tweaked the top-level state machine in curl and introduced a
new state when fixing a long-standing bug. It has since then bothered me a
little bit that the state machine diagram in the everything curl book [7] is
now inaccurate, so I have worked a little this week on tweaking that old
schematics to create an updated drawing of the the libcurl transfer state
machine.

I'll have to iterate a little more on it and maybe torture my Mastodon
followers with it first before I can consider myself done for this time. Stay
tuned!

## HTTP/3 talk

I'm doing a talk about HTTP/3 in Gothenburg on May 30, and this week they
opened up for registrations [8]. When I type this, there are a few seats still
available.

Also: if you are up for meeting up with in me Gothenburg for a beer that
evening after the event, do make yourself known.

## Coming up

- interview with publication about using AI for bug-bounties
- curl user survey 2024 launches on Tuesday
- get started on my curl presentation for May 20 (and 29)

## Links

[1] = https://daniel.haxx.se/blog/2024/05/06/i-survived-curl-up-2024/
[2] = https://github.com/curl/curl/pull/13544
[3] = https://github.com/curl/curl/pull/13543
[4] = https://www.ietf.org/archive/id/draft-ietf-httpbis-rfc6265bis-14.html
[5] = https://stackoverflow.com/users/93747/daniel-stenberg?tab=profile
[6] = https://github.com/curl/curl/blob/master/docs/EXPERIMENTAL.md
[7] = https://everything.curl.dev/internals/statemachines.html
[8] = https://www.meetup.com/webbhuset/events/300590515/


-- 

  / daniel.haxx.se