7 ms·

Curl is just the hobby

219 points by TangerineDream 2y ago

polycaster 2y ago
> while curl is my hobby, I also work on curl as a full-time job. It is a business and I serve and communicate with many customers on a daily basis. While it's not my business, I still wonder how this business looks like. Is curl sponsored? If so, is this a common thing for foundational tools alike?
- polycaster 2y ago
  From Daniel's contact page: > Just don’t send me private emails about the open source projects I participate in – unless you want to pay for commercial and private support! So it's support basically, I suppose.
  - aitchnyu 2y ago
    So who do I email when I'm angry at my car's screen and get lost at the "open source licenses" screen?
    - UncleEntity 2y ago
      RMS I would presume.
- TheDong 2y ago
  If you look around, you'll see the sponsors page: https://curl.se/sponsors.html https://curl.se/sponsors.html Some sponsorship is through opencollective, which includes transparent information about donations: https://opencollective.com/curl#category-BUDGET https://opencollective.com/curl#category-BUDGET So opencollective has it at $280k USD since sometime in 2018, not bad, that's like half of what the average Googler makes in 1 year (except spread over 5 years). You can also see there hadn't been many big single donations in 2020 from this post: https://daniel.haxx.se/blog/2020/01/03/curl-receives-10k-usd-donation/ https://daniel.haxx.se/blog/2020/01/03/curl-receives-10k-usd...
  - nwellnhof 2y ago
    They also received €195,000 from Sovereign Tech Fund in 2022: https://www.sovereigntechfund.de/tech/curl https://www.sovereigntechfund.de/tech/curl
- jraph 2y ago
  He probably still works for WolfSSL [1], who I think lets him work on Curl full time. [1] https://en.wikipedia.org/wiki/Daniel_Stenberg https://en.wikipedia.org/wiki/Daniel_Stenberg
- fragmede 2y ago
  hence: https://xkcd.com/2347/ https://xkcd.com/2347/
vermilingua 2y ago
Off topic but I find it wild that SF has API ads on bus shelters. Is that unusual/right in a dev hotspot, or have I been well underestimating just how intrinsic the tech culture is there? (I’m an Australian, so I guess my question applies to the US as much as SF)
- jraph 2y ago
  The same thing stroke me, I assumed it is specific to an area where there are many software engineers. I think people mostly don't know about Curl and PUT requests, it probably would be a huge waste of money to advertize like this in the wild. Not that I don't think ads are a huge waste in general.
  - mbcrosier 2y ago
    hi, Stytch team member here who worked on the PUT request ad from Daniel's post -- feel free to AMA TL;DR on 'why pay to put a curl request on an ad' is what you all have already said -- (1) unique concentration of tech in SF; and (2) to specifically engage software engineers. More on each... (1) We wouldn't have run this ad in Sydney, or New York, or LA. SF definitely has an uniquely tech-oriented culture, and in particular has lots of startups in our ideal customer persona (ICP) at Stytch - in this case, engineers building B2B SaaS apps. But in addition to the people who live in SF, even more software engineers visit the city for conferences, or events, or to fundraise. For example, while our ads are up over the next month, SF will host Stripe Sessions and POSTCon (two entire conferences focused around APIs), plus RSA (security focused). (2) And although even with that, only a small segment of the pop will understand the ads, those people might be intrigued enough to actually look at them - and our ultimate goal is to get more engineers to look at our code & our docs. Another perk is that engineers can't use ad blockers if the ad is on a bus shelter :) So that was a bit of the thinking for us - on why SF & why a PUT request on a billboard. We're also making the physical ads into an anchor for a 'marketing moment' for Stytch -- so pair offline ads with digital marketing, as well. So if we're successful, maybe you'll see more on that, soon.
- thecosmicfrog 2y ago
  When in an Uber from the airport in San Francisco, I remember seeing a giant billboard for Twilio. I had a similar reaction.
throwaway_4228 2y ago
> I would personally perhaps protest against the use of PUT for POSTing JSON, but nobody asked me. Just wondering, if the resource ID is known, I thought PUT is the recommended method? We usually use POST for creating a new resource for which you don't know an ID yet.
- omnibrain 2y ago
  I also wondered, did some research and look at some examples and came to the opposite conclusion for my API.
- sublinear 2y ago
  Auth requests are for a new session ID, not a new user ID. It's a (C)reate in CRUD, not an (U)pdate. POST - Create, GET - Retrieve, PUT - Update, DELETE - Delete
  - plextoria 2y ago
    PUT can be used for Create too, if the user ID is generated by the client
    - ascar 2y ago
      According to the RFC's PUT can be used to create a resource as long as the request has a clear target. That doesn't necessarily mean an ID, but just some kind of identifier (composite key, hash of content, url, etc.). When a create instead of update happens the server should respond with a 201 CREATED, which should indicate the location or identifier of the created resource.
  - rvnx 2y ago
    The protocol could be: CREATE /xxx READ /zzz UPDATE /yyy DELETE /abcd
    - bayindirh 2y ago
      Why not create an RFC and start the process? :)
JonChesterfield 2y ago
> https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site. That's aggravating. What's the workaround? edit0: Chrome made more progress, then collided with Vodafone's shitty approximation to infrastructure which is known unsolvable. edit1: Magic: https://web.archive.org/web/20240422091821/https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/ https://web.archive.org/web/20240422091821/https://daniel.ha... We are in trouble when some organisation manages to kill archive.org
- reaperman 2y ago
  I thought this was fairly common?
  - shaftoe 2y ago
    It is and it's a best practice. I've never heard anyone complain about this. Most security scanning software will ding any site that doesn't use HSTS
    - JonChesterfield 2y ago
      You don't see why Firefox refusing to connect would be annoying? I don't care whether the blog about curl is encrypted in transit or not and I do care about a forced change to chrome to see the content.
      - cuu508 2y ago
        Firefox connects to https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/ https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... fine. Are you connecting to a http:// http:// URL instead? If yes, why?
      - dewey 2y ago
        But it's working just fine in my Firefox, so it sounds more like there's something wrong on your end by either security software or on the network level.
throwaw12 2y ago
Imagine having a hobby project, installed on billions of devices. MBA: they must be making 10B$/year? Engineer: no, this is just a hobby
- xandrius 2y ago
  A bit unfair as the main reason it is installed on billions of devices is that it is FOSS. It's like giving to charity and then being aggravated that it was used to generate lots of money, you can't retroactively change your mind. Although they can always stop updating curl if it is that bad for them.
  - throwaw12 2y ago
    > A bit unfair as the main reason it is installed on billions of devices is that it is FOSS. You are right, but I wanted to show current mindset. Redis, ElasticSearch, Mongo, HashiCorp stack were also FOSS and landscape is changing. Same could have happened to cURL
- 082349872349872 2y ago
  We're living at the bottom of a gravity well, so we don't pay for air. Once upon a time, even economists thought that automation could make food, shelter, and routine health care too cheap to meter; in such a world would we then be interacting with each other —as the XIX aristocracy did?— chiefly via shared interests and hobbies? Lagniappe: https://cepr.org/voxeu/columns/downton-abbey-effect-british-aristocratic-matches-american-business-heiresses-late https://cepr.org/voxeu/columns/downton-abbey-effect-british-...
augustk 2y ago
Shouldn't there be a comma after "business"? I read it wrong the first time.
- terabytest 2y ago
  No. That would not be correct, grammatically speaking.
  - tengwar2 2y ago
    It would be grammatically correct, with different semantics.
- mjlee 2y ago
  Just in case you're not familiar with the phrase - https://www.collinsdictionary.com/dictionary/english/have-no-business https://www.collinsdictionary.com/dictionary/english/have-no...
phh 2y ago
Does that mean Daniel Stenberg can't use Llama3?
deleted 2y ago
[deleted]
AtlasBarfed 2y ago
If a man knows how to save the world from imminent asteroid impact, how much should he be paid? If he does it without pay but asks afterwards for pay commensurate with delivered value, how much should he be paid? Who pays it?
- throwaway78245 2y ago
  At least he should not get angry comments (as mentioned in the article) about how saving the world is the job of NASA, and he had no business saving the world as an individual

> while curl is my hobby, I also work on curl as a full-time job. It is a business and I serve and communicate with many customers on a daily basis. While it's not my business, I still wonder how this business looks like. Is curl sponsored? If so, is this a common thing for foundational tools alike?

polycaster 2y ago
From Daniel's contact page: > Just don’t send me private emails about the open source projects I participate in – unless you want to pay for commercial and private support! So it's support basically, I suppose.
- aitchnyu 2y ago
  So who do I email when I'm angry at my car's screen and get lost at the "open source licenses" screen?
  - UncleEntity 2y ago
    RMS I would presume.
TheDong 2y ago
If you look around, you'll see the sponsors page: https://curl.se/sponsors.html https://curl.se/sponsors.html Some sponsorship is through opencollective, which includes transparent information about donations: https://opencollective.com/curl#category-BUDGET https://opencollective.com/curl#category-BUDGET So opencollective has it at $280k USD since sometime in 2018, not bad, that's like half of what the average Googler makes in 1 year (except spread over 5 years). You can also see there hadn't been many big single donations in 2020 from this post: https://daniel.haxx.se/blog/2020/01/03/curl-receives-10k-usd-donation/ https://daniel.haxx.se/blog/2020/01/03/curl-receives-10k-usd...
- nwellnhof 2y ago
  They also received €195,000 from Sovereign Tech Fund in 2022: https://www.sovereigntechfund.de/tech/curl https://www.sovereigntechfund.de/tech/curl
jraph 2y ago
He probably still works for WolfSSL [1], who I think lets him work on Curl full time. [1] https://en.wikipedia.org/wiki/Daniel_Stenberg https://en.wikipedia.org/wiki/Daniel_Stenberg
fragmede 2y ago
hence: https://xkcd.com/2347/ https://xkcd.com/2347/

vermilingua 2y ago

Off topic but I find it wild that SF has API ads on bus shelters. Is that unusual/right in a dev hotspot, or have I been well underestimating just how intrinsic the tech culture is there? (I’m an Australian, so I guess my question applies to the US as much as SF)

jraph 2y ago
The same thing stroke me, I assumed it is specific to an area where there are many software engineers. I think people mostly don't know about Curl and PUT requests, it probably would be a huge waste of money to advertize like this in the wild. Not that I don't think ads are a huge waste in general.
- mbcrosier 2y ago
  hi, Stytch team member here who worked on the PUT request ad from Daniel's post -- feel free to AMA TL;DR on 'why pay to put a curl request on an ad' is what you all have already said -- (1) unique concentration of tech in SF; and (2) to specifically engage software engineers. More on each... (1) We wouldn't have run this ad in Sydney, or New York, or LA. SF definitely has an uniquely tech-oriented culture, and in particular has lots of startups in our ideal customer persona (ICP) at Stytch - in this case, engineers building B2B SaaS apps. But in addition to the people who live in SF, even more software engineers visit the city for conferences, or events, or to fundraise. For example, while our ads are up over the next month, SF will host Stripe Sessions and POSTCon (two entire conferences focused around APIs), plus RSA (security focused). (2) And although even with that, only a small segment of the pop will understand the ads, those people might be intrigued enough to actually look at them - and our ultimate goal is to get more engineers to look at our code & our docs. Another perk is that engineers can't use ad blockers if the ad is on a bus shelter :) So that was a bit of the thinking for us - on why SF & why a PUT request on a billboard. We're also making the physical ads into an anchor for a 'marketing moment' for Stytch -- so pair offline ads with digital marketing, as well. So if we're successful, maybe you'll see more on that, soon.
thecosmicfrog 2y ago
When in an Uber from the airport in San Francisco, I remember seeing a giant billboard for Twilio. I had a similar reaction.

throwaway_4228 2y ago

> I would personally perhaps protest against the use of PUT for POSTing JSON, but nobody asked me. Just wondering, if the resource ID is known, I thought PUT is the recommended method? We usually use POST for creating a new resource for which you don't know an ID yet.

omnibrain 2y ago
I also wondered, did some research and look at some examples and came to the opposite conclusion for my API.
sublinear 2y ago
Auth requests are for a new session ID, not a new user ID. It's a (C)reate in CRUD, not an (U)pdate. POST - Create, GET - Retrieve, PUT - Update, DELETE - Delete
- plextoria 2y ago
  PUT can be used for Create too, if the user ID is generated by the client
  - ascar 2y ago
    According to the RFC's PUT can be used to create a resource as long as the request has a clear target. That doesn't necessarily mean an ID, but just some kind of identifier (composite key, hash of content, url, etc.). When a create instead of update happens the server should respond with a 201 CREATED, which should indicate the location or identifier of the created resource.
- rvnx 2y ago
  The protocol could be: CREATE /xxx READ /zzz UPDATE /yyy DELETE /abcd
  - bayindirh 2y ago
    Why not create an RFC and start the process? :)

JonChesterfield 2y ago

> https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... has a security policy called HTTP Strict Transport Security (HSTS), which means that Firefox can only connect to it securely. You can’t add an exception to visit this site. That's aggravating. What's the workaround? edit0: Chrome made more progress, then collided with Vodafone's shitty approximation to infrastructure which is known unsolvable. edit1: Magic: https://web.archive.org/web/20240422091821/https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/ https://web.archive.org/web/20240422091821/https://daniel.ha... We are in trouble when some organisation manages to kill archive.org

reaperman 2y ago
I thought this was fairly common?
- shaftoe 2y ago
  It is and it's a best practice. I've never heard anyone complain about this. Most security scanning software will ding any site that doesn't use HSTS
  - JonChesterfield 2y ago
    You don't see why Firefox refusing to connect would be annoying? I don't care whether the blog about curl is encrypted in transit or not and I do care about a forced change to chrome to see the content.
    - cuu508 2y ago
      Firefox connects to https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/ https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobb... fine. Are you connecting to a http:// http:// URL instead? If yes, why?
    - dewey 2y ago
      But it's working just fine in my Firefox, so it sounds more like there's something wrong on your end by either security software or on the network level.

throwaw12 2y ago

Imagine having a hobby project, installed on billions of devices. MBA: they must be making 10B$/year? Engineer: no, this is just a hobby

xandrius 2y ago
A bit unfair as the main reason it is installed on billions of devices is that it is FOSS. It's like giving to charity and then being aggravated that it was used to generate lots of money, you can't retroactively change your mind. Although they can always stop updating curl if it is that bad for them.
- throwaw12 2y ago
  > A bit unfair as the main reason it is installed on billions of devices is that it is FOSS. You are right, but I wanted to show current mindset. Redis, ElasticSearch, Mongo, HashiCorp stack were also FOSS and landscape is changing. Same could have happened to cURL
082349872349872 2y ago
We're living at the bottom of a gravity well, so we don't pay for air. Once upon a time, even economists thought that automation could make food, shelter, and routine health care too cheap to meter; in such a world would we then be interacting with each other —as the XIX aristocracy did?— chiefly via shared interests and hobbies? Lagniappe: https://cepr.org/voxeu/columns/downton-abbey-effect-british-aristocratic-matches-american-business-heiresses-late https://cepr.org/voxeu/columns/downton-abbey-effect-british-...

augustk 2y ago

Shouldn't there be a comma after "business"? I read it wrong the first time.

terabytest 2y ago
No. That would not be correct, grammatically speaking.
- tengwar2 2y ago
  It would be grammatically correct, with different semantics.
mjlee 2y ago
Just in case you're not familiar with the phrase - https://www.collinsdictionary.com/dictionary/english/have-no-business https://www.collinsdictionary.com/dictionary/english/have-no...

phh 2y ago

Does that mean Daniel Stenberg can't use Llama3?

deleted 2y ago

[deleted]

AtlasBarfed 2y ago

If a man knows how to save the world from imminent asteroid impact, how much should he be paid? If he does it without pay but asks afterwards for pay commensurate with delivered value, how much should he be paid? Who pays it?

throwaway78245 2y ago
At least he should not get angry comments (as mentioned in the article) about how saving the world is the job of NASA, and he had no business saving the world as an individual