From daniel at haxx.se Sat Aug 1 23:06:36 2026 From: daniel at haxx.se (Daniel Stenberg) Date: Sat, 1 Aug 2026 23:06:36 +0200 (CEST) Subject: [Daniel's week] August 1, 2026 Message-ID: <69990p51-6o58-7621-0q37-q8080rsnp276@unkk.fr> Hello! Things are back to normal, and now my weekly email back on track! ## bliss We are quickly approaching the end of our curl of bliss summer. I?ll do a full blog post about it on Monday so for now I will just say that it was great. ## HTTP Message Signatures One of the larger new things we have merged recently is the new support for HTTP Message Signatures [1] - at experimental status. Read about the details in my blog post, but perhaps even more important is that I want you to enable this, test it and report back to us how it went. Both good and bad experiences are interesting feedback in these early days. ## Apple Fast UDP Apple has a few undocumented functions that allow applications such as curl to do faster UDP by the means of sending multiple UDP messages per call. This should ideally make curl do QUIC and thus HTTP/3 slightly faster than when using the ordinary functions. We just merged support for this into curl [2] and we consider this functionality experimental and opt-in of course. Here again, we value feedback and people testing this out so that we can learn, adapt, iterate and make further decisions on how to treat this. ## logo page Someone asked me about the curl logo and if they are allowed to use it to print their own tshirts (yes you are), and when doing so I checked the logo page on the website [3] and realized it was... subpar. When we refreshed the logo files a few months ago, we also broke the page so that it showed the logos in giant sizes and it looked really... odd. After some poking it cleaned up nicely and now follows the rest of the site in look and style. ## website menu We have received a pull-request for the website [6] that updates the menu system and makes it better for mobile and keyboard-driven operations. I?m happy with this work and I think it is about time we got this sorted. Ideally we get this merged soon! ## out of experimental status I posted two emails to the curl mailing lists this week about moving features out of experimental mode. The first was about HTTPS-RR and ECH [4] and the second about SSL session import/export [5]. Since experimental features are always opt-in we often end up in a situation where we have features we want people to test and report their problems with, but too few people actually enable it. We also discourage people from using them in production, which doesn?t make it easier. At some point we just have to consider the lack of feedback as a sign in itself and move forward anyway. Otherwise the features risk staying limbo indefinitely. ## everything curl We recently tried to fix the CSP (the content-security-policy header) for the ?everything curl? site [7], which broke fonts, images and javascripts and since we all just pretend to know web stuff it took us a number of attempts until the site was fully functional again. Similarly, I tried to tweak the caching on the site to make Fastly cache a bit more, but so far that seems to have gone in the opposite direction and I need to spend some more time to figure this out... As I poked on those things and tested out the site, I fell over some inaccuracies and outdated info on the site which then made me polish and rework a whole range of pages and sections over the last week. I think I will continue on this cleanup spree for at least a few more days. If you haven?t checked out everything curl in a while, please do, and do tell me what you think we should improve there. ## Coming up - The bliss is over on Monday. Maybe the vulnerability flood gates open then? - The feature window is open another week ## Links [1] = https://daniel.haxx.se/blog/2026/07/27/http-message-signatures-with-curl/ [2] = https://github.com/curl/curl/pull/22417 [3] = https://curl.se/logo/ [4] = https://curl.se/mail/lib-2026-07/0013.html [5] = https://curl.se/mail/lib-2026-07/0023.html [6] = https://github.com/curl/curl-www/pull/611 [7] = https://everything.curl.dev -- / daniel.haxx.se From daniel at haxx.se Sat Aug 8 22:59:55 2026 From: daniel at haxx.se (Daniel Stenberg) Date: Sat, 8 Aug 2026 22:59:55 +0200 (CEST) Subject: [Daniel's week] August 8, 2026 Message-ID: Hi! Another week and here's some things I worked on: # August 7, 2026 ## security We opened up for receiving curl vulnerability reports on Hackerone again on Monday. It only took 30 minutes for the first report to arrive but it turned out that the avalanche we feared would come because we have had the intake closed for a whole month did not happen. As I write this, we have received seven reports this week out of which one is a confirmed new vulnerability with low severity. It means that we now have two pending CVE announcements to do together with the next curl release. With almost a month left, I?m convinced there will be at least a few more by then. I also published a blog post about the summer of bliss [1]. ## menu The website menu work I mentioned last week was merged and now the site is a tad bit more accessible I think [2]. There are only minor visual differences so most people won?t notice... I also took the opportunity to follow-up and introduce a ?security? top-level menu option in the docs section of the site [3] to make it easier to find and maneuver to that information. ## localhost connect Marcel Jamin contacted us on the libcurl mailing list and proposed a way to fix the problem I blogged about two years ago [4]: Windows is really slow to detect TCP connect problems for localhost. I took his proposed solution and massaged it into something that ran green in CI [5] (without being able to build or test it myself locally as I have no Windows machines). Marcel also reported the problem and fix to Chrome[7] and then merged their corresponding version [8] as well, even with a link to my blog post in a comment in the source code. I then asked Valentin and Max on the Firefox networking team if they already have this fix or not, which led to them creating a bugzilla entry about it [9]. ## typos We have two spellcheck CI jobs that both also scan source code and occasionally they drive me in how they complain about source code that is perfectly fine but might use a variable that looks like a misspelled English word. At one point a few months ago when I yet again got sad about such a complaint, I started writing a tool that scans a C source code file, blanks out all code and just keeps all comments and strings in the output. The idea would be that those are the parts that we primarily want spellchecked anyway, and neither of the tools offered that feature. This week after I saw Stefan get upset about some new false positives and I too experienced some, I went back to my tool [10], polished it a little bit more and I have a proposed PR [11] that changes the spellcheck CI jobs to only check strings and comments. ## Server Push I made a call on the libcurl mailing list [12] and on Mastodon if there are any users out there who are using HTTP/2 Server Push with libcurl. Not a single person has responded saying they do, and now we have put that feature up for deprecation [13] and removal from curl in 2027. ## 26 years On August 7 2000 the first ever libcurl was released as part of the curl 7.1 release [6]. ## Coming up - The curl feature window closes today - curl 8.22.0-rc1 ships today ## Links [1] = https://daniel.haxx.se/blog/2026/08/03/what-the-bliss-taught-us/ [2] = https://curl.se/ [3] = https://curl.se/docs/ [4] = https://daniel.haxx.se/blog/2024/08/14/slow-tcp-connect-on-windows/ [5] = https://github.com/curl/curl/pull/22494 [6] = https://curl.se/ch/7.1.html [7] = https://issues.chromium.org/issues/542261173 [8] = https://chromium-review.googlesource.com/c/chromium/src/+/8212039/5/net/socket/tcp_socket_win.cc [9] = https://bugzilla.mozilla.org/show_bug.cgi?id=2061349 [10] = https://github.com/bagder/c-comments [11] = https://github.com/curl/curl/pull/22509 [12] = https://curl.se/mail/lib-2026-08/0003.html [13] = https://curl.se/dev/deprecate.html#http2-server-push -- / daniel.haxx.se From daniel at haxx.se Fri Aug 14 23:46:11 2026 From: daniel at haxx.se (Daniel Stenberg) Date: Fri, 14 Aug 2026 23:46:11 +0200 (CEST) Subject: [Daniel's week] August 14, 2026 Message-ID: <00o177q9-5rp6-o473-q4o6-46r87n2pnrs5@unkk.fr> Hello! Happy to report that another work week has ended. ## security No new vulnerabilities confirmed this week. Part of the week was spent working on addressing the third one we have in the queue, reported last Friday. The report frequency continues to be rather low and we are happy. Today however we got confirmation that the era of AI slop submissions is not entirely passed as we received a case where the security researcher seems to have been grossly misled by his AI[1]. Banned now. ## performance I spent a large portion of this week writing up a performance test system for curl. It was about time and it starts to look decent now [2]. ## backports are coming A new customer requested backported vulnerability fixes for a few older curl versions, and once we have agreed to the finer details in my plan work on this will commence. Official curl patch releases will happen, starting in a few weeks. These releases will be done under the rock-solid [3] label and will not become publicly available. This is hard work so we really need compensation to make this possible. If you too are interested in getting older security-patched curl releases, get in touch. The original releases, all the code on GitHub and all coming curl releases are of course still available for free and at no charge as usual. ## Windows Early this week I was complaining on Mastodon [6] about the fact that receiving information about Windows related problems for curl is problematic as nobody in the curl security uses or runs Windows. This was picked up by heise.de [5] and I even received a few emails from people offering to help out, but it is not an easy task. This is what I responded to one of the persons: Hi! Thanks for offering to help out and contribute to the curl project.We do have a lack of Windows contributors and developers so all additional help is appreciated! curl is an Open Source project. No one pays for the Windows version so there is no short-term monetary gain here, and we are not in a position where we are able to pay anyone for this help. Yes, Microsoft has been shipping curl as part of Windows since several years back and yes there are many commercial applications on Windows that use curl or libcurl, but (with the exception of a single sponsor) none of them pays anything for that. The way to help out in the curl project, be it with Windows specific things or with anything else, is to join the conversation and speak up when you have something to add or assist with. Don?t wait for an invitation. Show up. Pick up something that needs work and go. My guess is that in order to actually get to a position where you are able to help us in a meaningful way, you need to get familiar with the project: with our ways of working, with our CI setup, how you build curl, how we communicate, the basic architecture and layout of the source code but also to have a decent knowledge and awareness of the specific network protocols that are involved in the area of the code where you think you might want to poke. But that?s just me. You decide for yourself how you want to go about it. There is no ?accepting? or ?letting you in? to becoming a curl contributor. You?re already welcome and you can join and participate at your own will whenever you want at the level you yourself decide. Everyone can do this and everyone is welcome to join, to participate, to help, to answer questions, to offer pull-requests, to help debug issues, etc. For Windows related issues and pull-requests, we try to mark them with the Windows tag. Feel free to dig around them to see where we currently could use assistance. We also have this starter point on how to get started helping out in the curl project: https://curl.se/docs/help-us.html Welcome! ## LG unit I got a brand new contribution to the screenshotted curl credits collection [4] this week: an LG air-condition controller. Judging by the version number shown, it is probably decently old. If you check the collection, the new entry is all the way at the bottom of the page. ## Coming up - curl 8.22.0-rc2 ships Monday - get started on backports - keep polishing the performance test setup and website ## Links [1] = https://hackerone.com/reports/3938185 [2] = https://daniel.haxx.se/blog/2026/08/14/curl-performance-2/ [3] = https://rock-solid.curl.dev/ [4] = https://daniel.haxx.se/blog/2016/10/03/screenshotted-curl-credits/ [5] = https://www.heise.de/en/news/curl-Nobody-wants-to-work-with-Windows-11409147.html [6] = https://mastodon.social/@bagder/117061983160992793 -- / daniel.haxx.se