4 ms·

In the defense of some of the particularly jerk-inducing ones, they're conflating libcurl with curl. Sure if you want to fetch a file from the internet you cou

In the defense of some of the particularly jerk-inducing ones, they're conflating libcurl with curl. Sure if you want to fetch a file from the internet you could do it with one line (see the person I'm replying to); I'd love to see the look on some of these people's faces when they find out that tool/software/whatever they use is actually using libcurl under the hood. Good luck even getting on the internet in the first place without that router, switch, PC, modem or anything else that's also running curl/libcurl. I don't know whether it's just my age showing, but thinking you could do anything remotely like curl in 3 days is .... well, my 1 year old probably talks more sense when he says "no".

ddtaylor 4y ago
> I'd love to see the look on some of these people's faces when they find out that tool/software/whatever they use is actually using libcurl under the hood. Python dependencies (does not include curl) https://devguide.python.org/getting-started/setup-building/index.html https://devguide.python.org/getting-started/setup-building/i... The "requests" module in Python (does not use curl) https://github.com/psf/requests https://github.com/psf/requests
- woodrowbarlow 4y ago
  yes, python and some other languages have more-or-less re-implemented parts of libcurl. requests is one example created by a particularly prolific author and it has been evolving for over a decade. that's perfect evidence that, no, a common developer cannot "re-write" curl in a few days.
  - ddtaylor 4y ago
    Where do you draw the line then? Is someone making a 3-day project expected to re-implement everything from the ground up?
    - p00f 4y ago
      People who claim they can do it are expected to do it, yes
pcthrowaway 4y ago
I was going through my Prius's "software license information" a while ago and I noticed the daniel@haxx email. No way would I run software in my car that someone hacked together in 3 days.
- ddtaylor 4y ago
  I think this problem is similar to the OpenSSL problem. The idea being that we have a library that has a giant attack surface because it does a LOT of different things and attackers find clever ways to abuse those extra features that most users don't actually want enabled. Your car probably wants to use some relatively pedestrian things like HTTPS, but do you think it should have any capability of doing GOPHER, SMBS, SFTP, POP3, LDAP, IMAP, TELNET, TFTP, SCP or any of the other stuff curl supports out of the box? We can hope that the version of curl used for the car was compiled without support for some of these protocols. I don't even know if we have a good way to verify that. More likely is that whatever the stock configuration (all the protocols) is what is being used in most applications.
- thunky 4y ago
  > No way would I run software in my car that someone hacked together in 3 days So no Tesla for you then.
- alias_neo 4y ago
  I was updating my car a few months ago and found it runs Linux for the user-facing systems, and of course uses libcurl, according to the open source licenses.

ddtaylor 4y ago

> I'd love to see the look on some of these people's faces when they find out that tool/software/whatever they use is actually using libcurl under the hood. Python dependencies (does not include curl) https://devguide.python.org/getting-started/setup-building/index.html https://devguide.python.org/getting-started/setup-building/i... The "requests" module in Python (does not use curl) https://github.com/psf/requests https://github.com/psf/requests

woodrowbarlow 4y ago
yes, python and some other languages have more-or-less re-implemented parts of libcurl. requests is one example created by a particularly prolific author and it has been evolving for over a decade. that's perfect evidence that, no, a common developer cannot "re-write" curl in a few days.
- ddtaylor 4y ago
  Where do you draw the line then? Is someone making a 3-day project expected to re-implement everything from the ground up?
  - p00f 4y ago
    People who claim they can do it are expected to do it, yes

pcthrowaway 4y ago

I was going through my Prius's "software license information" a while ago and I noticed the daniel@haxx email. No way would I run software in my car that someone hacked together in 3 days.

ddtaylor 4y ago
I think this problem is similar to the OpenSSL problem. The idea being that we have a library that has a giant attack surface because it does a LOT of different things and attackers find clever ways to abuse those extra features that most users don't actually want enabled. Your car probably wants to use some relatively pedestrian things like HTTPS, but do you think it should have any capability of doing GOPHER, SMBS, SFTP, POP3, LDAP, IMAP, TELNET, TFTP, SCP or any of the other stuff curl supports out of the box? We can hope that the version of curl used for the car was compiled without support for some of these protocols. I don't even know if we have a good way to verify that. More likely is that whatever the stock configuration (all the protocols) is what is being used in most applications.
thunky 4y ago
> No way would I run software in my car that someone hacked together in 3 days So no Tesla for you then.
alias_neo 4y ago
I was updating my car a few months ago and found it runs Linux for the user-facing systems, and of course uses libcurl, according to the open source licenses.