[Daniel's week] August 1, 2026

[Daniel Stenberg]

Hello!

Things are back to normal, and now my weekly email back on track!

## bliss

We are quickly approaching the end of our curl of bliss summer. I’ll do a full 
blog post about it on Monday so for now I will just say that it was great.

## HTTP Message Signatures

One of the larger new things we have merged recently is the new support for 
HTTP Message Signatures [1] - at experimental status. Read about the details 
in my blog post, but perhaps even more important is that I want you to enable 
this, test it and report back to us how it went. Both good and bad experiences 
are interesting feedback in these early days.

## Apple Fast UDP

Apple has a few undocumented functions that allow applications such as curl to 
do faster UDP by the means of sending multiple UDP messages per call. This 
should ideally make curl do QUIC and thus HTTP/3 slightly faster than when 
using the ordinary functions. We just merged support for this into curl [2] 
and we consider this functionality experimental and opt-in of course. Here 
again, we value feedback and people testing this out so that we can learn, 
adapt, iterate and make further decisions on how to treat this.

## logo page

Someone asked me about the curl logo and if they are allowed to use it to 
print their own tshirts (yes you are), and when doing so I checked the logo 
page on the website [3] and realized it was... subpar. When we refreshed the 
logo files a few months ago, we also broke the page so that it showed the 
logos in giant sizes and it looked really... odd. After some poking it cleaned 
up nicely and now follows the rest of the site in look and style.

## website menu

We have received a pull-request for the website [6] that updates the menu 
system and makes it better for mobile and keyboard-driven operations. I’m 
happy with this work and I think it is about time we got this sorted. Ideally 
we get this merged soon!

## out of experimental status

I posted two emails to the curl mailing lists this week about moving features 
out of experimental mode. The first was about HTTPS-RR and ECH [4] and the 
second about SSL session import/export [5]. Since experimental features are 
always opt-in we often end up in a situation where we have features we want 
people to test and report their problems with, but too few people actually 
enable it. We also discourage people from using them in production, which 
doesn’t make it easier. At some point we just have to consider the lack of 
feedback as a sign in itself and move forward anyway. Otherwise the features 
risk staying limbo indefinitely.

## everything curl

We recently tried to fix the CSP (the content-security-policy header) for the 
“everything curl” site [7], which broke fonts, images and javascripts and 
since we all just pretend to know web stuff it took us a number of attempts 
until the site was fully functional again. Similarly, I tried to tweak the 
caching on the site to make Fastly cache a bit more, but so far that seems to 
have gone in the opposite direction and I need to spend some more time to 
figure this out...

As I poked on those things and tested out the site, I fell over some 
inaccuracies and outdated info on the site which then made me polish and 
rework a whole range of pages and sections over the last week. I think I will 
continue on this cleanup spree for at least a few more days.

If you haven’t checked out everything curl in a while, please do, and do tell 
me what you think we should improve there.

## Coming up

- The bliss is over on Monday. Maybe the vulnerability flood gates open then?
- The feature window is open another week

## Links

[1] = https://daniel.haxx.se/blog/2026/07/27/http-message-signatures-with-curl/
[2] = https://github.com/curl/curl/pull/22417
[3] = https://curl.se/logo/
[4] = https://curl.se/mail/lib-2026-07/0013.html
[5] = https://curl.se/mail/lib-2026-07/0023.html
[6] = https://github.com/curl/curl-www/pull/611
[7] = https://everything.curl.dev

-- 

  / daniel.haxx.se