8 ms·
Curl 8.0.0
- azov 4y agoHow many applications will delay getting those security patches because they assume that 8.x is a breaking change? There's probably a fair number of setups that more-or-less automatically upgrade to the next minor version, but not the next major.
- coolgoose 4y agoIn before somebody is going to say they can rewrite curl in a weekend hackaton.
- aew4ytasghe5 4y ago25 years of CVE:s, why not.
- lionkor 4y agoto be fair, if you have ever used the curl C api, you can see why there are 25 years of CVEs, and not 25 years of reliable secure bug free networking (not that its possible). I love C as much as the next guy, hell, I even write it for fun when I'm feeling down -- but the one thing I won't do, beyond a little "i wrote an http 1.0 server in C" joke project, is networking. Keep your C offline. If I do networking, it has to be modern C++ with static analyzers, good practices, boost asio, unit testing, and sanitizers, or just Rust, Erlang/Elixir, or whatever other non-C language. Ive never seen a library get as abused and misused as Curl in source code - well maybe zlib. I think it's great that curl exists, and Im glad its so old that the bugs are mostly worked out, but writing a subset of curl that doesnt have a million issues in a weekend is not so unrealistic.
- bayindirh 4y agoWhy try not, then? Edit: Just found this[0], hehe. :) [0]: https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/ https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/
- jamespo 4y agowhat have you created in the last 25 years?
- return_to_monke 4y agoof course I can ! just pull in libcurl and then it is just parsing cli arguments
- mfrw 4y agoThere is a blogpost about this exactly where Daniel collects similar responses: https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/ https://daniel.haxx.se/blog/2021/05/20/i-could-rewrite-curl/
- 2OEH8eoCRo0 4y ago"We sold a curl exploit" is a nice short story of everything wrong with our rotten industry.
- selfmodruntime 4y agoLobsters and HN have really become a hotspot for arrogant contrarians. You can observe this best in the comment section of any thread that dares to mention modern web development.
- intelVISA 4y agoA whole weekend?! With GPT4 and C++23 on the horizon that's more of an afternoon delight.
- noduerme 4y agoHah. Goddamn. This comment was depressing enough to shock me into leaving HN for the night. We have so little time left. I should spend it reading good books.
- colonwqbang 4y agoHalf of which is just waiting for the code to compile.
- gchamonlive 4y agoYou could ask for gpt to pretend to be a Linux machine and predict how the c++ code would run without compiling with 99% accuracy and just a little chance of hallucinating the target endpoint responding with 418
- charcircuit 4y agoWhat's stopping you from making a basic version? Just about everything supports HTTP 1.0 still so you can make a quick program that sends: GET / HTTP/1.0 Host: example.com over a socket and that's already mostly working. Figure out TLS. Then you just have to do command line parsing and add the stuff you parsed into your request.
- parker_mountain 4y ago"Figure out TLS." Is this sarcasm? A joke?
- charcircuit 4y agoOpenSSL or your TLS library of choice will likely have documentation and examples showing you how to use it. I'm not sure I understand your point.
- distcs 4y agoHave you looked at the documentation or are you just guessing? When you realize how impenetrable OpenSSL or any TLS lib documentation looks to people untrained in cryptography, you would gain a new appreciation for Git man pages!
- dimman 4y agoKind of makes you think that the subject at hand is quite complex in its nature, thus untrained people might do best to steer away until properly trained.
- magicalhippo 4y agoI used mbedTLS a while ago when implementing my own HTTPS server from scratch. I had no particular crypto or TLS knowledge, though I did know about ciphers, hashes and certificates from a high level. Between the docs[1][2] and the examples[3] I was up and running using my own IO stack in a couple of evenings. If I had used the IO stack from the library it would have been very easy. Another couple of evenings and I had it integrated with Windows' certificate store. In the end it wasn't very difficult to implement, but it was a bit more of a challenge figuring out the documentation and how it related to mbedTLS. Definitely a rewarding experience, gave me some nice insights into the plumbing. edit: Note, not trying to argue replacing libcurl is a weekend project! [1]: https://mbed-tls.readthedocs.io/projects/api/en/latest/ https://mbed-tls.readthedocs.io/projects/api/en/latest/ [2]: https://mbed-tls.readthedocs.io/projects/api/en/latest/api/group/group__ssltls__communication__module/ https://mbed-tls.readthedocs.io/projects/api/en/latest/api/g... [3]: https://github.com/Mbed-TLS/mbedtls/blob/development/programs/ssl/ssl_server.c https://github.com/Mbed-TLS/mbedtls/blob/development/program...
- scottlamb 4y agoThe most charitable view I can take of such comments is to mentally paraphrase them to: "I can rewrite the small subset of the curl CLI that I personally use, in a modern language, on top of an existing HTTP library, in a weekend hackathon". That doesn't seem so crazy.
- jve 4y agoYeah, especially using libcurl. writing stuff I use is not that much of an effort. However providing various configuration options, handling edge cases and scenarios millions of programmers would like to use... different league.
- Razengan 4y agoDone https://news.ycombinator.com/item?id=35229588 https://news.ycombinator.com/item?id=35229588
- nusaru 4y ago> There is no API nor ABI break in this version. I don’t know why, but this really, really bothers me. Why even use semver then?
- deleted 4y ago[deleted]
- Semaphor 4y ago> Why even use semver then? They don’t?
- nusaru 4y agoWell yeah, but it looks like semver. Again, I don’t know why it bothers me, but it just... does.
- justeleblanc 4y agoIt's rather than semver looks like it. Curl predates semver by 15 years. People have been numbering their software release as $major.$minor.$patch forever.
- avgcorrection 4y agoOh yeah. The `x.y.z` notation that already existed and that SemVer just adopted is totally a surefire signal that “SemVer Here”. You’ve got the order of events all mixed up.
- Semaphor 4y agoThat’s a version number. Semver is a way of versioning. Now, saying "it bothers me that they don’t use semver" (which has them in the company of other small projects like typescript or the linux kernel) is a statement you can make, but "why use semver" when they don’t makes little sense.
- nusaru 4y agoTrue. I could have phrased that better. I’ll take this as a sign to go to bed. Good night!
- ManuelKiessling 4y agoService comment: Daniel was live at https://www.twitch.tv/curlhacker https://www.twitch.tv/curlhacker.
- Svip 4y agoStill no IRC support. Which - considering the project that became curl started out as an IRC bot - is slightly ironic.
- Faaak 4y agoYou're welcome to make a PR :-)
- rakoo 4y agoHow would that work ? cURL is built for request-reply usecases, with potentially long-lived connections, but once connected the handling happens outside of curl. irc is an interactive protocol, meaning that requests and replies would be handled inside cURL.
- Svip 4y agoAn example: A git hook that joins a channel every time a commit is pushed to its master branch, to inform an existing IRC bot, that it is time to pull the newest changes from the repository.
- misnome 4y agoThis _really_ sounds out of scope for what curl is
- nequo 4y agoUse netcat instead? printf "NICK gitbot42\nUSER foo bar baz\nPRIVMSG #gitevents :pull now\nQUIT :foobar\n" | nc irc.server.foo 6667
- Svip 4y agoOh of course, I am not waiting on cURL to support IRC. Rather I was suggesting a use case, where essentially the client logs in, performs a series of commands and then disconnects. And I feel that is fitting with how cURL operates.
- 4y ago
- low_tech_love 4y agoNo big deal. I could write it in a 3 day weekend.