Daniel Stenberg

Of course, Amazon loves the US and is concerned about her safety, that's why they have been found to sell to sanctioned individuals [0]. Also, outside marketing, there is no reason to presume GPT-5.5 to be any less capable in this aspect. Yes, Glasswing lead to a lot of findings, but for one, as curl has proven, these were often oversold [1] and B, Glasswing was heavily subsidised [2], alongside being exclusive, so naturally the entities that had access were going to heavily use it while they had this access, thus inflating findings. A lot of Glasswing also happened prior to GPT-5.5 being accessible, again tilting the numbers towards Mythos being more capable, simply by being a few weeks earlier. [0] https://ofac.treasury.gov/media/44311/download [1] https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerabili… [2] https://www.anthropic.com/glasswing

I’m not sure how to reconcile anthropic’s update / some of the exuberant comments here with recent feedback like the following from curl maintainer Daniel Steinberg: “I see no evidence that this setup [Mythos] finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing.” https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerabili…

> Why does it matter? Because AI gets things wrong, often, in ways that can be very difficult to catch. By their very nature LLMs write text that sounds plausible enough to bypass manual review (see https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/), so some find it best to avoid using it at all when writing documentation.

> Why would/should they? Because they care. That's it. > I've never paid for curl. I'm sure people who develop it doesn't want money and fame, but they're just doing what they like. However, curl has commercial support contracts if you need. > Who even develops it? Daniel Stenberg et al. Daniel can be found at https://daniel.haxx.se. > Sounds like a thankless job to fix obscure worstfit bugs. It may look thankless, but it's not. curl is critical infrastructure at this point. While https://xkcd.com/2347/ applies squarely to cURL, it's actually nice that the lead developer is making some money out of his endeavor.

Here's my "reply-guy" comment of the day: if you are posting about where you buy your wall decoration and you get negative feedback, well, maybe it's not worth to tell strangers where you buy wall decoration. But sometimes somebody puts a lot of effort on creating things for other people to enjoy. It can be a youtube video, a tutorial, a technical opinion. Or curl[^1]. Feedback provided on such an effort often takes a minuscule fraction of the work the creator put in, and they can be really nasty. I just think that providing opinions should require some effort. An affordable amount of effort, but not too low. Maybe if I do something worth of notice someday, I'll invite feedback by creating a public Minecraft server and asking people to log in there and post their comments on the book at coordinates 1000, -58, 1000. [^1]: https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/

That's CVEs in general it seems "if you set input parameters of curl to absolute nonsense, something bad will happen" 9.8/10 https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-everything-th… https://daniel.haxx.se/blog/2023/09/05/bogus-cve-follow-ups/

From Daniel’s homepage¹: > I work for wolfSSL doing commercial curl support. If you need help to fix curl problems, fix your app's use of libcurl, add features to curl, fix curl bugs, optimize your curl use or libcurl education for your developers... Then I'm your man. Contact us! From Wikipedia’s wolfSSL page²: > In February 2019, Daniel Stenberg, the creator of cURL, joined the wolfSSL project. Given that, saying cURL is “a popular personal project that brings [Daniel] a lot of cash” seems like a bit of a stretch. ¹ https://daniel.haxx.se ² https://en.wikipedia.org/wiki/WolfSSL#History

The death of the comment section has been greatly exaggerated...one comment, that the moderator didn't even see fit to remove. Ain't much. Also funny that you wonder if people would take the hurdle to send an email instead. In this particular case, the author has in fact written about the torrent of email abuse he faces on multiple occasions, for example here [1]. Is his 2021 post evidence that email is a thing of the past? https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/

> Docker should have been a neat tool made by one enthusiast, just like curl is. I have nothing but mad respect for Daniel Stenberg. 25 years of development of great software, for which he had been threatened[1] and had ridiculous US travel visa obtaining issues[2]. [1] https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/ [1] https://news.ycombinator.com/item?id=26192025 [2] https://daniel.haxx.se/blog/2020/11/09/a-us-visa-in-937-days/

> Adding advanced features are nice, but IMO this might lead to over-engineering and it might be hard to maintain down the line. Well, one person [1] has been maintaining it since 1998. It's a good thing that HTTP doesn't change that often. [1] https://daniel.haxx.se/

Surprised nobody mentioned https://curl.se and it's author: https://daniel.haxx.se

Just for the sake of completeness: https://daniel.haxx.se/blog/2022/01/24/logj4-security-inquiry-response… has a link at the end to the following HN and Reddit discussions: > https://news.ycombinator.com/item?id=30059404 > https://www.reddit.com/r/opensource/comments/sboj1l/entitled_fortune50…

Actually, we mean: sub.domain.com, sub.domain.com. { reverse_proxy localhost:8080 } But seriously. Can you stop posting about this every single time there's even a vague mention of Caddy on HN? It's tired. You've gotten your answer before. Huge majority of people don't care about trailing dot domains. Trailing dots are complicated and really not worth the complexity it would involve to support them. See https://daniel.haxx.se/blog/2022/05/12/a-tale-of-a-trailing-dot/

> cURL (still single person AFAIK) That person is Daniel Stenberg. He's been the main driver[0] (esp since its been called "curl"), and is still the majority committer, but the project has ~1000[1][2] commit authors (disclosure, I'm one). I'm in no way trying to diminish Daniel's work. It is excellent. Curl has however taken on a life of its own to an extent, with a few other heavy lifters and lots of occasional contributers. I actually think this speaks well to Daniels leadership; he seems to have a loose grip that guides the project and keeps things on the rails with minimal perturbation. He's still a heavy lifter, but not entirely Atlas[3]. [0] https://curl.se/docs/governance.html [1] https://curl.se/docs/thanks.html [2] https://daniel.haxx.se/blog/2022/01/30/1000-commit-authors/ [3] https://en.wikipedia.org/wiki/Atlas_(mythology)

A nice follow up is also here https://daniel.haxx.se/blog/2021/01/21/more-on-less-curl-memory/

> Why would shitty clones with malware existing somehow damage the original app? Best case, you get angry emails. Hell, Daniel Stenberg of curl fame got “I will slaughter you” because someone bundled libcurl and included a copyright notice.[1] Worst case, certain scammers are very good at pretending to the the real thing. [1] https://daniel.haxx.se/blog/2021/02/19/i-will-slaughter-you/

Really good read on this recently, "The QUIC API OpenSSL Will Not Provide"[1]. Having read that, very nice to see this, a proper more directly targeted plea for sensibility go out. [1] https://daniel.haxx.se/blog/2021/10/25/the-quic-api-openssl-will-not-p… https://news.ycombinator.com/item?id=29038728

Don't think HTTP is a great example either. The most used HTTP stack in Rust was integrated into curl :) https://daniel.haxx.se/blog/2020/10/09/rust-in-curl-with-hyper/

As an example of how widely curl is used, the author has posted things like the support emails he gets from people whose car or IoT device uses curl: https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/ I love using Rust for new development but curl is _everywhere_ and a port would need to spend a lot of time copying old quirks. Given how clunky C APIs are, I’d think it’d be better to migrate more of the callers to a higher-level interface anyway.

Sounds exactly like what I'm doing. What I wondered was if and when other developers deviate from that workflow. After the first release? After the first collaborator has joined? Never? Are there textbook developers who use a strict strategy like the one Daniel Stenberg [1] is following from day 1? [1] https://daniel.haxx.se/blog/2020/11/09/this-is-how-i-git/

This is my favourite example of why letting random users send in complaints is bad: https://daniel.haxx.se/blog/2016/11/14/i-have-toyota-corola/

While I am disconnected from twitter, you can always reach me at: Mastodon: @[email protected] Keybase: https://keybase.io/bagder IRC: #curl on freenode Email: [email protected] website: https://daniel.haxx.se/

This to me is a great example of why the WHATWG url specification is so terrible. It's so much harder to implement than RFC 3986. You're not the only one who thinks that: https://daniel.haxx.se/blog/2016/05/11/my-url-isnt-your-url/ (Be sure to read the link to the WHATWG's GitHub issue.)

https://daniel.haxx.se/blog/2017/06/28/denied-entry/ I can't see any follow-up on why he was denied entry though.

Daniel has contributed valuable time and energy to ensuring that the requirements of the Core Infrastructure Initiative Best Practices Badge [0] were realistic and meaningful. To get an idea what it's like developing software that is used by more than a billion people, look at this classic blog post from Daniel [1]. [0] http://bestpractices.coreinfrastructure.org/ [1] https://daniel.haxx.se/blog/2016/01/19/subject-urgent-warning/

This has nothing to do with the travel ban, but it is about the author of curl. (Though referring to Daniel as a "Mozilla employee" is, I don't know, demeaning almost.) https://daniel.haxx.se/

I agree completely! ... Well, almost agree completely. Daniel Stenberg is the author of curl: https://daniel.haxx.se/ Nicolas Cannasse is the (main) author of haxe: https://medium.com/@ncannasse Both are awesome in their own right. I wrote the Lua target announced here, and am happy to answer any questions.

Such an amazingly useful tool -- just a couple hours ago I was using it to setup and launch an entire website from the command-line after having just learned that Dreamhost has a REST API for setting up DNS (which works in tandem with AWS's s3api CLI tool) -- and so actively yet quietly updating for nearly 20 years now... Daniel Stenberg (curl's creator) posted a talk he gave at Google's Stockholm offices a few months ago...I'm sure he's told the origin story many times before but it was the first I've heard of its truly humble and hacker-DIY origins (he needed a convenient way to access currency rates while chatting in IRC): http://daniel.haxx.se/blog/2015/09/17/blabbed-about-curl-at-google/ The talk is worth watching just to hear not about what it's like to maintain a "hobby project" for a billion users, but for a nostalgic tour of Internet protocols at the time of curl's birth.

> we've had say superhuman competitive programming performance for awhile Fair. Question though, is this when compared to competitive programmers, or developers in general? > extremely strong performance (super-p90-engineer) on say language-to-language porting I'd need to see the methodology here and could easily be wrong, but I suspect this is largely down to "faster" and "willing to do a lot more of it without complaining" > RE-bench (ML research engineering benchmark from METR) is already clearly above human perf This pretty much has to be "relative to devs who don't specialize in that area", because if it wasn't the frontier labs wouldn't be paying a fortune to hire ML researchers. > Mythos clearly has superior cyber capabilities Based on Daniel Stenberg's experience with it [0], it seems like it's at best roughly on par with human experts. It's advantage is cost/speed. > Also, why do you discount speed and cost so much? Because in all the domains LLMs are applicable to, getting something cheaper/faster at the expense of quality isn't new or particularly interesting. > Every model iteration is a significant bump up in performance according to a lot of complementary and principled measurements. What's been the thing that hasn't been true? That they were good enough. To reuse the baby analogy, if every week your friend told you that their infant child was now heavier than an elephant (while acknowledging that the baby was lighter than one the previous week),…

sudo makes sense as a name, but it is worth noting that it hurts the original projects. Famously, the curl project receives tonnes of issues and support requests from people who run `curl` in PowerShell, not knowing it is an alias meant for convenience instead of the actual curl command[1]. Sudo for windows is already relatively old and doesn't seem to have been adopted much, but my prediction is that adoption would mean people would complain on forums that commands they found on the internet don't work. "Why wouldnt it? I have sudo?". Then people will have to explain to them that "No you do not have sudo, you have the windows version of sudo, which is not real sudo" and it will confuse. When it comes to tools, I strongly believe naming things similarly to concepts the user already knows is a disservice to the user. This isn't UX for your mom and pop, it is a tool to perform a job, and learners get confused when suddenly the same thing isn't actually the same thing at all. It is mislearning, and I would argue almost anyone who does mentoring has seen this in action. [1]: https://daniel.haxx.se/blog/2016/08/19/removing-the-powershell-curl-al…