curl

Your bug bounty was a rate limiter, not a filter curl shut down its bug bounty in January 2026. The reason is boring and it applies to every intake channel you run: the payment was buying volume the security team could not absorb. The commit is small and worth reading: BUG-BOUNTY.md: we stop the bug-bounty end of Jan 2026 touches 11 files and removes 82 lines from the bounty doc. What is left is 16 lines, and the load-bearing paragraph says a bug bounty "gives people too strong incentives to find and make up 'problems' in bad faith that cause overload and abuse." Same commit, less noticed: the issue template's security link moved from hackerone.com/curl to the project's own security advisories page. seven reports in sixteen hours, zero vulnerabilities Daniel Stenberg's weekly post from January 16, 2026 is the receipt (mailing list). Seven HackerOne issues inside sixteen hours. Some were real bugs. None described a vulnerability. Twenty submissions for 2026 already, by mid-January. His stated goal for killing the program: "remove the incentive for people to submit crap and non-well researched reports to us. AI generated or not." And the line that tells you what it cost: "The current torrent of submissions put a high load on the curl security team and this is an attempt to reduce the noise." The Register covered it under the headline that the program was shut to remove the incentive for submitting AI slop. What I find more useful than the framing is the mechanism. Nothing about the reports changed in kind. What changed is the cost of producing a plausible one, and the program's payout was still sized for an era when producing one cost a researcher an afternoon. a payout is a price, and the price sets the false-positive rate A bounty is a price on a submission. Set the price high enough and you attract attempts up to its expected value. When generation gets cheap, the expected value of an attempt goes up even though the quality of the average attempt goes down, and the marginal submitter becomes someone with an agent, a plausible story, and no reproduction. You cannot filter your way out of a mispriced channel, because filtering is labor and labor is the thing you were trying to protect. Removing the payout does not improve report quality. It removes the reason to file a low-effort one. curl still takes reports, just without a check at the end. So the question I would ask about any intake channel: who pays for a false positive? If the sender pays nothing and you pay the reading time, volume rises until the channel stops working, and then someone posts a sad note about mental health and closes the program. the same flood shows up with no payout at all Worth being precise here, because the payout story is only half of it. Postgres has never offered a bounty (their security page says so in as many words), and it got flooded anyway. I counted commit trailers on the master branch for April 8 to September 25 in both 2025 and 2026, paging the commits API and counting trailer lines. Reported-by: lines went from 309 to 563. Distinct reporter names went from 182 to 249. 202 of the 2026 names never appear in the 2025 window at all. In 2025, zero of those strings named a model vendor, an agent product, or a security automation shop. In 2026 the field contains "Xint Code", "Claude Code (via Noah Misch)", "OpenAI Codex Security", "Anthropic OSS program", plus entries attributed to Aisle and DepthFirst. Commits carrying a Security: CVE-... trailer went from 5 to 58. That is two different problems wearing the same coat. curl had an incentive problem, where the payout set the noise floor. Postgres had a capacity problem, where the noise arrives whether or not anyone is paying. Most teams running a review or triage queue have both, and the fix for one does nothing for the other. I wrote the full set of numbers and the query on the aicodereview.io blog. what to measure before you change your intake Four numbers, all cheap, all from data you already have: 1. Acceptance rate per week. Reports closed as fixed divided by reports opened. If it is falling while volume grows, the channel is mispriced or understaffed, and you need to know which before you touch anything. 2. Median time to first human response. Growing means triage is the bottleneck, and adding a scanner upstream will make it worse. 3. Share of reports that arrive with a reproduction you can run. This is the number that separates noise from work, and it is the one almost nobody tracks. 4. Cost per confirmed report. Hours spent reading divided by reports fixed, quarter over quarter. Then the decision splits cleanly. Acceptance falling with growing volume and a low reproduction share: gate on reproduction, meaning no runnable repro and observed output means no queue entry and no payment. Acceptance flat with growing volume: you have a capacity problem, and the fix is people, not tooling. one more thing about text filters Scoring incoming reports with a classifier is the wrong first move, and not because the models are bad. A report that reads well and does not reproduce passes every readability filter you can build, which is exactly the class of report that is eating your week. Reproduction is the only check that stays cheap as volume grows, and a reproduction you can run is a stronger signal than any amount of fluent prose. The free version of this: if your issue template does not ask for the exact command that triggers the bug and the observed output, add those two fields today. curl's new template points people at the advisory form instead of a bounty form, and the fields are the reason. If you want to know whether your intake is actually the problem, pull your last 20 submissions and count how many came with a reproduction. If that number is low, change the intake before you change anything about the reviewer.

As a workaround, you can patch them manually (example from Curl's CI) github.com/curl/curl/blob/f0da5390ad9d380807cc83e…

Welcome Stefan Reinauer as #curl commit author 1571: curl#23695

Declined a 25 LPA PPO with a 2 year bond for a 5.75 LPA service company. One year later I am on a PIP. Was I wrong? TL;DR: In final year I picked the safe offer over a high paying bonded one. The safe offer turned into a bench year, a PIP and 20+ postponed HR meetings. Meanwhile the stuff I built on my own is the only thing keeping my profile alive. Genuinely want your takes, especially if you are choosing right now. If you were around this sub 5 months ago, you might remember my post about how my dad's phone storage issue accidentally turned into my first real open source project: reddit.com This post is the other side of that story. The project did well. The job did not. The decision (final year, 2025): I interned at a crypto focused product startup and got a PPO of roughly 25 LPA. It came with a 2 year bond and some contractual terms I was not comfortable signing. I panicked about the lock in and declined it, then took the safe 5.75 LPA offer from a big service based IT company. Felt responsible at the time. Still not sure it was right. What the safe option actually looked like: joined in June 2025. Barely any real project allocation. Got removed from the internal project pool. Now on a PIP. Discussions about my situation have been postponed more than 20 times across 4 months. Nobody will say what happens next. Quick update on the project since some of you asked about it back then: it crossed 138 GitHub stars, I spoke about it in the AOSP devroom at IndiaFOSS 2026, and last week I got PRs merged into Neovim and curl within two days. Daniel Stenberg reshared the curl one. SocketSweep repo: VishnuSrivatsava/SocketSweep IndiaFOSS talk: youtube.com Neovim PR (regexp engine crash fix): neovim#42560 curl fix: github.com/curl/curl/commit/a4eed8c7 Not trying to promote anything, it is just context for the question below. What I would tell final year me: a bond is a price tag on your freedom for two years, price it honestly against the company and not against fear. Bench time is yours to fill, nobody at a services company will fill it for you. And HR delays are the answer. Question: knowing this, would you take the 2 year bond at 25, or the safe 5.75? And if you are benched right now, what has actually worked for you? Edit: cant edit the title so adding this here, the 25 headline was around 8 base plus a good chunk in their own coin, that is how the offer quoted it. The 2 year bond was the real issue.

My first year in IT hasn't gone as expected. Looking for advice on moving forward as a software engineer. I'm a 2025 CSE graduate. I joined a large service-based IT company as a Software Engineer in June 2025, expecting to start working on real engineering projects and grow as a developer. There's a decision from my final year that I keep thinking about. I had received a PPO from a product-focused startup where I'd previously interned, for around ₹25 LPA CTC. I declined it because I wasn't comfortable with the two-year bond and some contractual terms. I eventually joined my current company at ₹5.75 LPA. At the time, I felt it was the right decision, but looking back, I'm honestly not sure. Unfortunately, things haven't gone as expected. I've had very little meaningful project responsibility since joining. I was eventually put on PIP and removed from the internal project pool. For the past four months, discussions about my situation have been postponed more than 20 times, with very little clarity about what happens next. I didn't want to spend all this time just waiting, so I've been trying to improve my skills and work on things independently. A few things I've managed to accomplish: - Built SocketSweep, an Android storage analyser using a parallel C++17 scanner and Rust/Tauri. It's now at 138 GitHub stars and scanned 93,239 files across 51 GB in 7.7 seconds on my S24 Ultra. - Got selected to speak at IndiaFOSS 2026, where I presented SocketSweep in the AOSP devroom. - Contributed fixes to Neovim and curl, both merged upstream within two days of each other. Daniel Stenberg also reshared my LinkedIn post about the curl contribution! - Built a working internal Python/FastAPI AI incident-management POC at my current company using Microsoft Foundry, involving RCA processing, duplicate detection and LLM-generated incident communications. The Neovim and curl contributions getting merged within two days was honestly one of the most exciting moments of my engineering journey. For reference, here are the upstream contributions: Neovim PR #42560 (merged): neovim#42560 curl commit (merged): github.com/curl/curl/commit/a4eed8c7 These experiences have made me realise that I'm particularly interested in systems programming, C/C++, Rust, Linux, Android internals, backend engineering and developer tooling. I'm now trying to figure out the best way forward. I'd appreciate advice from people who've been in similar situations or have experience hiring engineers. A few things I'm wondering: 1. How much value do companies place on meaningful open-source contributions when evaluating candidates? 2. How do I demonstrate engineering ability when I haven't had much professional project ownership? 3. Given my background, should I focus on getting another development role first, or keep targeting roles closer to my technical interests? 4. Looking back, how would you evaluate the decision between a higher-paying PPO with restrictive contractual terms and a lower-paying offer without those terms? I'm actively exploring my next opportunity and would genuinely appreciate some perspective.

The developer of curl — github.com/curl, Daniel Stenberg, talks at FOSSCOMM 2026 — 2026.fosscomm.gr. Amazingly, curl has reached 30 billion installations. Here's a slide of products and services using it.

The developer of curl — github.com/curl, Daniel Stenberg, talks at FOSSCOMM 2026 — 2026.fosscomm.gr. Amazingly, curl has reached 30 billion installations. Here's a slide of products and services using it. t.co

Two upstream merges in two days: Neovim and curl. An update since my IndiaFOSS post! A couple of months ago, I posted here about SocketSweep, the Android storage analyser I built because MTP was painfully slow when analysing my dad's phone. A quick update: I finally delivered the talk at the AOSP devroom at IndiaFOSS 2026! The talk covers why MTP becomes a bottleneck, how I use an ADB-pushed native C++ daemon and a local socket instead, and the C++/Rust architecture behind SocketSweep. Still waiting for the dedicated 4K recording, but the talk is available in the event livestream! The last two days have been absolutely unreal. I got contributions merged into two projects I've been following: - Neovim: Fixed a regexp engine crash on invalid multibyte input. PR #42560 was merged. - curl: Fixed percent-decoding of protocol identifiers in Alt-Svc headers for RFC 7838 compliance. The curl fix went through multiple review iterations. Daniel Stenberg suggested reusing curl's existing URL-decoding helper instead of my initial custom implementation. I reworked it, added validation for decoded control characters and NUL bytes, and expanded regression coverage. The final patch covers 15 regression cases. All 82 unit tests and 59 simulated allocation-failure cases passed locally. And the cherry on top: Daniel Stenberg himself reshared my LinkedIn post about the contribution. Still feels like a dream! A little personal context: I joined Capgemini in June 2025, but have spent close to a year without meaningful project responsibilities. I was eventually put on PIP and removed from the project pool. For the past four months, discussions about my situation have been postponed more than 20 times, with very little clarity about what happens next. I didn't want to keep waiting, so I spent that time building, learning and contributing to projects I genuinely care about. I'm now looking for my next opportunity, particularly in C/C++, Linux, systems engineering, Android, backend infrastructure or developer tooling. For anyone who's moved from a service company into a product or systems engineering role: how did you make that transition? How much did upstream contributions help? Would genuinely appreciate advice and happy to connect with teams working in these areas. Links: IndiaFOSS talk (livestream): youtube.com Neovim PR #42560: neovim#42560 curl commit: github.com/curl/curl/commit/a4eed8c7 SocketSweep repository: VishnuSrivatsava/SocketSweep

@UK_Daniel_Card CURLOPT_ENCODING = 'gzip,deflate' is not a reliable Brotli block. It changes what libcurl requests, but a server can return a different encoding. With automatic decoding enabled, Brotli may still be processed.  github.com/curl/curl/blob/master/docs/libcurl/opt…

Welcome to the new #curl vulnerability disclosure policy: curl.se 13 pending security advisories currently being worked on in the public: github.com/curl/curl-www/pulls