Viktor Petersson logo

Podcast

Follow Me

Join Viktor, a proud nerd and seasoned entrepreneur, whose academic journey at Santa Clara University in Silicon Valley sparked a career marked by innovation and foresight. From his college days, Viktor embarked on an entrepreneurial path, beginning with YippieMove, a groundbreaking email migration service, and continuing with a series of bootstrapped ventures.

Daniel Stenberg on Curl's Journey: From C64 Demos to Internet Transfers

Play On Listen to podcast on YouTube Listen to podcast on Spotify Listen to podcast on Apple Listen to podcast on Amazon music
28 JUL • 2024 1 hour 26 mins
Share:

Welcome to another exciting episode of “Nerding Out with Viktor!” where our host, Viktor Petersson, sits down with Daniel Stenberg, the brilliant mind behind Curl, a powerful command-line tool that has revolutionized internet transfers for developers worldwide. This engaging conversation delves into the fascinating world of open-source software, security, and community building, offering valuable insights and takeaways for tech enthusiasts.

Daniel’s journey in programming began on the Commodore 64 and Amiga, where he honed his skills in the demo scene, creating demos and forming a demo group with friends. This experience laid the foundation for his deep understanding of programming and computers, eventually leading him to Unix systems and IBM, where he developed Curl. With over 26 years of maintaining an open-source project, Daniel shares his expertise on community building, reducing friction for contributors, and creating a welcoming environment for new developers.

One of the most entertaining aspects of their conversation is when Daniel recounts some of the craziest support requests he’s received, showcasing the widespread use of Curl and the amusing misunderstandings users sometimes have about open-source software. His patience and good humor shine through as he shares these anecdotes, offering a glimpse into the real-world applications and challenges of using such a powerful tool.

The conversation also delves into the future roadmap of Curl, focusing on the adoption of new standards and the importance of backward compatibility. Daniel explains the careful consideration that goes into deprecating features and ensuring minimal disruption for users, highlighting the complexities of supporting protocols like HTTP and HTTPS. He also discusses the measures Curl takes to prevent supply chain attacks and ensure the integrity of its code, making security a major theme in their conversation.

Daniel shares his experiences with handling security vulnerabilities in open-source projects, providing insights into the challenges faced by maintainers. His dedication to maintaining the highest standards of security and quality is evident throughout the discussion, emphasizing the importance of corporate support and community contributions in sustaining open-source projects and ensuring their long-term viability.

The episode also touches on the future of open-source funding, with Daniel sharing his thoughts on how projects like Curl can secure financial support. He emphasizes the role of sponsorships and community contributions in sustaining open-source projects, making this conversation a must-listen for anyone interested in the inner workings of tech companies and the innovative ideas driving their growth.

Join Viktor Petersson as he delves into the fascinating world of open-source software with Daniel Stenberg, a true pioneer in the tech industry. Whether you’re a seasoned developer, an open-source enthusiast, or simply curious about the journey of one of the most widely used tools in software development, this episode is for you.

Transcript

Show/Hide Transcript
[00:00] Viktor Petersson
Welcome back to nerding out with Victor.
[00:02] Viktor Petersson
Today I have a very special guest, a guest that was on my initial roster of people that I wanted to have on my podcast when I started scoping this out back in December of last year.
[00:12] Viktor Petersson
It's Daniel Stenberg.
[00:14] Viktor Petersson
Welcome.
[00:15] Daniel Stenberg
Hello.
[00:16] Daniel Stenberg
Hi.
[00:16] Daniel Stenberg
Thanks.
[00:17] Viktor Petersson
And for those not familiar with you are the founder of a tool that I would be very surprised if not every single guest on the.
[00:25] Viktor Petersson
Every.
[00:25] Viktor Petersson
Sorry, every single viewer of this podcast has used in one capacity or another.
[00:30] Viktor Petersson
Which is curlae.
[00:32] Daniel Stenberg
Exactly.
[00:32] Daniel Stenberg
Yeah.
[00:33] Viktor Petersson
And for those, surprisingly, who have never heard of Curl, how would you describe Curl?
[00:41] Daniel Stenberg
I always struggled with how to describe it because Curl is a command line tool that just does Internet transfers, uploads and downloads specified as a URL.
[00:51] Daniel Stenberg
And of course, it supports 28 different URL schemes or protocols.
[00:59] Daniel Stenberg
Well, that's what Curl is, the tool.
[01:01] Daniel Stenberg
Then, of course it has a library to libcurl, which is usually the thing that gets me to cover more installations everywhere because that's a component used by a lot of others.
[01:13] Daniel Stenberg
So it's running in a lot of places doing Internet transfers for the world.
[01:19] Daniel Stenberg
Really?
[01:20] Viktor Petersson
Yeah.
[01:21] Viktor Petersson
I would describe Cross as one of the most amazing swiss army knife tools for the command line.
[01:26] Viktor Petersson
That is a tool that I use religiously myself and I love it.
[01:30] Viktor Petersson
So, yeah, thank you for creating such a great tooling.
[01:35] Viktor Petersson
So I want to talk a lot about Curl, but before we do that, I kind of want to talk about your early days because I think there's a lot of similarity with people who have a similar track record as yours that have been amazing engineers over the years.
[01:50] Viktor Petersson
And your engineering background really started in the Amiga world.
[01:54] Viktor Petersson
Right.
[01:54] Viktor Petersson
And then the demo scene.
[01:55] Viktor Petersson
So maybe, Phil, people about your background, like how you ended up on this.
[02:00] Daniel Stenberg
Track really well, I started with the Commodore 64.
[02:03] Daniel Stenberg
Oh, the C 64.
[02:04] Daniel Stenberg
Oh, right before them, yeah.
[02:06] Daniel Stenberg
So, yeah, the Commodore 64 was really the computer that got me interested and sort of fascinated by programming and computers in general because, well, I had.
[02:21] Daniel Stenberg
I had a friend there in my school, so I sort of got the taste for it and we gathered it at his place and, you know, entered programs from those early computer magazines, you know, with those data things.
[02:35] Daniel Stenberg
You had to type it in from a magazine.
[02:37] Daniel Stenberg
Took forever.
[02:38] Daniel Stenberg
And then it was wrong in the end, but you didn't quite have any linting then.
[02:44] Daniel Stenberg
Well, some of them had some checksum, so you knew that it was wrong, but some of them didn't.
[02:49] Daniel Stenberg
It was just ended up just one of those numbers was wrong somewhere in all of that.
[02:54] Daniel Stenberg
Well, so anyway, that got me sort of into it.
[02:57] Daniel Stenberg
And then me and my little brother, we bought Commodore 64 in 1985 and that.
[03:06] Daniel Stenberg
And then I actually, I was interested in programming pretty much from the beginning, not that I could, but, you know, I.
[03:12] Daniel Stenberg
Back then, they shipped with manual somehow basic was built in.
[03:16] Daniel Stenberg
There were some basic manuals how to do that so you could start making some, you know, guess the number programs or really silly basic things.
[03:24] Daniel Stenberg
But yeah, that got me into that.
[03:27] Daniel Stenberg
And very soon, well, my friend angel who had the computer before me, he and I started, well, look at, there's this thing called demos.
[03:39] Daniel Stenberg
People are doing how, you know, flying things, music and colors and stuff, and how do you do that, actually?
[03:45] Daniel Stenberg
Oh, right, there's something called assembly.
[03:47] Daniel Stenberg
You have to write assembler to do that.
[03:49] Daniel Stenberg
What's that?
[03:50] Daniel Stenberg
And then we just got into that.
[03:53] Daniel Stenberg
And then we got into that demo scene on the Commodore 64, and we made a lot of demos, created a demo group, and worked on that crazy amount of time for several years, actually.
[04:06] Viktor Petersson
Yeah, I mean, I remember SFL sweet Dreamhack back in the days when Dreamhack was actually mostly demo scene in the early days, and they were filling up arenas with this 64K demos and, I mean, it's amazing.
[04:21] Viktor Petersson
And the amount of super high caliber engineers coming out of that scene is just fantastic.
[04:29] Viktor Petersson
Right?
[04:30] Daniel Stenberg
Yeah, yeah.
[04:31] Daniel Stenberg
It was a really good school and a community and everything, so you pushed yourself to sort of try to show off, but you also learned tricks and how to do that, and it was a really good way to get into computers.
[04:43] Daniel Stenberg
I really sort of attribute a lot of what I know and my interest in to those early days when I learned exactly how to, how everything like that worked, how to write assembly.
[04:54] Daniel Stenberg
You know, you get a different sense of what memory is on how computers work when you actually write assembly.
[04:59] Daniel Stenberg
Exactly.
[04:59] Daniel Stenberg
Instruction by instruction and assembly on those early day computers and eight bit things, they were.
[05:05] Daniel Stenberg
I mean, it wasn't easy, maybe, but comparison to modern computers, they were easy.
[05:10] Daniel Stenberg
So learning assembly one of those more stupid devices is actually a pretty good way to learn assembly, because things were easier.
[05:17] Daniel Stenberg
You could, you know, you could actually count how many cycles a program would take because you knew how many cycles each instruction would take and so on.
[05:26] Viktor Petersson
Yeah.
[05:26] Viktor Petersson
And I had even Upton on the podcast a few episodes ago, and we talked about, I guess, the lack of people.
[05:34] Viktor Petersson
I mean, that was the original of the raspberry PI, right?
[05:36] Viktor Petersson
Is that he found that there were very few people that actually understood that level or that low level of engineering that the C 64 and the like, symbols, computers in the same cohort really fostered.
[05:50] Viktor Petersson
And so I think it's.
[05:52] Viktor Petersson
I'm glad to see that there are new tools that kind of addresses that because we had an era.
[05:56] Viktor Petersson
Well, everything was high level and nobody really understood what actually happened under hood.
[06:01] Daniel Stenberg
Right, right.
[06:03] Viktor Petersson
So.
[06:04] Viktor Petersson
And then obviously that led into the BBS era, which I guess you ran a BBS as well in those days, right?
[06:11] Daniel Stenberg
Yes, I did.
[06:15] Daniel Stenberg
Or did together with my brother.
[06:16] Daniel Stenberg
And we wrote our own BBS software there too, because why not?
[06:19] Daniel Stenberg
So, yeah, it was fun.
[06:23] Daniel Stenberg
It was a fun era of early communication and message boards and stuff.
[06:28] Daniel Stenberg
And a little bit like what we would later learn, the Internet could be like communicating and discussing things with people in a greater sense than just the little you and your closest friends.
[06:44] Daniel Stenberg
So, yeah, that was great fun.
[06:46] Daniel Stenberg
And then because I switched from the Commodore 64 and then I started to working on the Amiga and Amiga suddenly was not as fun to do demos on because, I don't know, when I did demos on the Commodore 64, it felt like a small little sandbox.
[07:02] Daniel Stenberg
Everything had some sort of borders.
[07:03] Daniel Stenberg
It was hard because it was small and tiny.
[07:05] Daniel Stenberg
You had to sort of squeeze in things to maximize.
[07:08] Daniel Stenberg
And then it.
[07:09] Daniel Stenberg
It felt like when going to the Amiga, everything was completely.
[07:12] Daniel Stenberg
Well, it felt like that, well, everything is possible on this based, you know, sixty eight k, eight megahertz.
[07:20] Daniel Stenberg
This is what a monster.
[07:22] Daniel Stenberg
So it felt like, okay, and completely different assembly.
[07:24] Daniel Stenberg
It was 68k instead of the 6502.
[07:27] Daniel Stenberg
So it wasn't really that fun to do demos.
[07:30] Daniel Stenberg
So me and my friend, then we started let's do a text editor, because we thought that existing text editors were not as good as they could be.
[07:37] Daniel Stenberg
So why not make text editor?
[07:39] Daniel Stenberg
And at the same point in time, basically I started working at IBM.
[07:45] Daniel Stenberg
And at IBM I got into contact with AIX, the IBM Unix version, on Rs 6000 machines.
[07:55] Daniel Stenberg
And on those we ran emacs.
[07:58] Daniel Stenberg
And that sort of opened up my eyes for, wait a minute, emacs where everything is sort of programmable in lispenness.
[08:05] Daniel Stenberg
I didn't really like Lisp, but I figured, well, this is sort of.
[08:08] Daniel Stenberg
I got a lot of inspiration for our text editor.
[08:10] Daniel Stenberg
We called Freqsad from Emacs at work, then worked on that on Amiga at home.
[08:17] Daniel Stenberg
And then eventually I transitioned into working on Unix directly instead of doing on.
[08:25] Daniel Stenberg
I just dropped the Amiga thing and went into working on Unix machines.
[08:32] Viktor Petersson
And I think that has probably come in very handy now as the array of supported devices for Curl is insane.
[08:40] Viktor Petersson
Almost.
[08:41] Viktor Petersson
The breath is insane.
[08:44] Daniel Stenberg
Yes, it is.
[08:46] Daniel Stenberg
It's super crazy, actually.
[08:48] Viktor Petersson
What's the strangest architecture you've had to port to curl, I guess Libcurl, more so than curl I would imagine.
[08:56] Daniel Stenberg
Actually.
[08:58] Daniel Stenberg
it's not that, well, there are, they're really not that strange when it comes to Libcurl because Libcurl is very low level.
[09:06] Daniel Stenberg
It basically only runs on top of a TCP IP stack.
[09:09] Daniel Stenberg
And the POSIX style API that was made, I don't know when in this, I don't exactly, I don't know my history there, but it was founded long before I started this.
[09:21] Viktor Petersson
70 something.
[09:22] Daniel Stenberg
Yeah, exactly.
[09:23] Daniel Stenberg
So mostly all operating systems offer a very POSiX style, like almost at least for doing networking.
[09:32] Daniel Stenberg
So usually it's very easy.
[09:36] Daniel Stenberg
So usually there's just some quirks here and there include files and exceptions and tiny things.
[09:44] Daniel Stenberg
So usually I haven't.
[09:46] Daniel Stenberg
I used to say that because I truly think so, that windows is actually the most quirky operating system to work with because that's the single operating system that is the most different to all the others and yet has a lot of users.
[10:00] Daniel Stenberg
So it's still a relevant one.
[10:01] Daniel Stenberg
So we still have to make it work.
[10:02] Daniel Stenberg
But that's actually the one I think I struggle the most with, possibly also because I'm not really a windows guy, so I don't really know all that sort of.
[10:11] Daniel Stenberg
For me it's always an uphill battle to work on the things there.
[10:16] Daniel Stenberg
So otherwise almost everything else is more streamlined around whole six API and how to do things.
[10:25] Viktor Petersson
Fair enough, fair enough.
[10:27] Viktor Petersson
So let's talk a bit about obviously building and maintaining curl because that's obviously, it's a beast of a project in the sense of not only complexity, but also like community.
[10:37] Viktor Petersson
Because you have obviously maintained this for why is it 15 years or whatever it is, you have maintained it now.
[10:44] Daniel Stenberg
Which is not trivial, for 26 years at least.
[10:48] Viktor Petersson
Oh wow.
[10:49] Viktor Petersson
Yeah.
[10:49] Viktor Petersson
Okay, so I'm fully off of my research here.
[10:53] Viktor Petersson
Building and maintaining a healthy community is in the open source world, obviously.
[10:59] Viktor Petersson
I guess GitHub made it easier and harder simultaneously as we moved away from mailing lists and whatnot.
[11:05] Viktor Petersson
Right.
[11:06] Viktor Petersson
What have you found?
[11:07] Viktor Petersson
Like dealing and maintaining a healthy community?
[11:11] Viktor Petersson
I'm curious about your insights on that because that's.
[11:13] Viktor Petersson
I would, I think curl is regarded as a very healthy ecosystem compared to what many other projects.
[11:20] Daniel Stenberg
Well, for example, I think, yeah, I worked really hard to make sure that we reduce friction and make it as easy as possible for anyone and everyone to participate.
[11:32] Daniel Stenberg
That's one of the reasons I still argue in favor of GitHub, even though there are reasons to be against it.
[11:40] Daniel Stenberg
But the fact that so many people are already on the platform, they already know how to work on the platform and how to do things on the platform, like how to make a fork and make a pull request.
[11:54] Daniel Stenberg
If you just go with that concept, you lower the bar quite a lot for so many users.
[12:02] Daniel Stenberg
And I want it to be like that.
[12:04] Daniel Stenberg
I want it to be easy and possible for anyone to fix whatever problem you find.
[12:08] Daniel Stenberg
If you find a typo in the documentation, I want it to be simple for someone to just fix that typo and send it to me.
[12:14] Daniel Stenberg
And I don't want it to be any obstacles or bureaucracy or anything in the way to do that or for me to accept those changes.
[12:21] Daniel Stenberg
So that's the goal here, to make sure that everything is streamlined for those who want to participate.
[12:28] Daniel Stenberg
And then of course make it possible for people to do changes again, not just that single type at once.
[12:34] Daniel Stenberg
Right.
[12:34] Daniel Stenberg
But when you've dipped your toe in the water, sort of make it possible for them to, hey, grab the next issue or help answer a question or join in the team.
[12:43] Daniel Stenberg
But also I should call it sort of, we don't have any, there's no steps in the ladder.
[12:52] Daniel Stenberg
It's not like you're joining different levels and then in the end you get to 100 or anything, you're just, you decide how much you want to be there and you can participate a lot if you want to, or just a tiny teeny bit if you want to.
[13:06] Daniel Stenberg
That's up to you.
[13:07] Daniel Stenberg
And of course I want to make sure that anyone can participate to the level they want to.
[13:12] Daniel Stenberg
And if they want to do a lot, I want to help them do that and join in, because we always have a lot of things to do.
[13:18] Daniel Stenberg
So of course we always welcome contributors as any open source project.
[13:22] Viktor Petersson
How many active contributors do you have?
[13:24] Viktor Petersson
I guess active is a subjective definition, but however you would define active.
[13:29] Daniel Stenberg
Exactly.
[13:29] Daniel Stenberg
So that's.
[13:31] Daniel Stenberg
I often then struggle with that.
[13:33] Daniel Stenberg
People talk about communities, right?
[13:35] Daniel Stenberg
How big is a community or something?
[13:36] Daniel Stenberg
Because it's nothing.
[13:38] Daniel Stenberg
There's no clear boundary anywhere.
[13:40] Daniel Stenberg
When are you in?
[13:40] Daniel Stenberg
When are you out?
[13:41] Daniel Stenberg
So there's no, you don't step in or out.
[13:43] Daniel Stenberg
You're just, everyone is in and out at the same time.
[13:47] Daniel Stenberg
So I don't really know.
[13:48] Daniel Stenberg
But if we count, for example, number of commit authors per month, I think we're around 25 on average month.
[13:58] Viktor Petersson
I mean, that's a very healthy ecosystem.
[14:01] Daniel Stenberg
Yeah, I'd say so.
[14:02] Daniel Stenberg
And it's not the same 25 every month either.
[14:04] Daniel Stenberg
So we have actually a pretty steady stream of new committers.
[14:09] Daniel Stenberg
I think we're at around ten per month that are new authors.
[14:14] Daniel Stenberg
So it's quite a lot of people coming in and of course a lot of them just do it once and never show up again.
[14:20] Daniel Stenberg
But at least it tells me that it's possible.
[14:24] Daniel Stenberg
So I know that the door is open, you can enter if you want to, and then if you don't want to stay or if you're happy with that single change.
[14:32] Daniel Stenberg
I can't do much about that.
[14:34] Viktor Petersson
Sure.
[14:35] Viktor Petersson
Yeah, absolutely.
[14:38] Viktor Petersson
Let's talk a bit about the community, because contribution is one thing, but then obviously, at least from my experience, an equally big burden, if not bigger burden, is the actual maintenance of issues and replying to feedback or issues in general.
[14:54] Viktor Petersson
On GitHub, how do you see that?
[14:57] Viktor Petersson
Have you maintained that in a healthy way?
[15:00] Viktor Petersson
I guess because it's extremely difficult to do without a lot of patience in the long run.
[15:10] Viktor Petersson
I guess it's a polite way to put it.
[15:13] Daniel Stenberg
That is certainly true, yeah.
[15:14] Daniel Stenberg
So it's one of these sort of patience testing and character building exercises to year after year, just.
[15:25] Daniel Stenberg
And of course it's that way that people usually don't say anything when things are going well and everything is fine and dandy.
[15:32] Daniel Stenberg
They just take the code, go, and I never hear from them and they never tell me anything.
[15:36] Daniel Stenberg
That's good.
[15:37] Daniel Stenberg
But the moment something is not working the way the person thinks it should, then they come.
[15:42] Daniel Stenberg
So basically it means.
[15:45] Daniel Stenberg
Sorry.
[15:45] Daniel Stenberg
Yeah, curl, 26 years ago, 26 years of people complaining on things that don't work the way they think they should.
[15:53] Daniel Stenberg
So yeah, it is an exercise in being patient and trying to ignore these slurs or the sort of, I often try to view them as, you know, cultural or language differences.
[16:10] Daniel Stenberg
So, yeah, maybe that insult wasn't intended, it was just a bad way of using the english language.
[16:18] Daniel Stenberg
But of course it's.
[16:18] Daniel Stenberg
Sometimes you just have to bite your tongue and wait a few days until you respond because it's just someone who hasn't understood how to behave in public.
[16:27] Viktor Petersson
Absolutely.
[16:28] Viktor Petersson
And I mean, I guess in particular, in the open source world, there are two levels of, I guess entitlement might be the right word for it, but there is the open source entitlement of, I need this feature, build this for me because I want it.
[16:42] Viktor Petersson
Right.
[16:43] Viktor Petersson
Not like they want to contribute, but rather you go and build it because I want it for my job.
[16:48] Daniel Stenberg
Exactly.
[16:48] Daniel Stenberg
And really?
[16:49] Daniel Stenberg
Yeah, you gave me this now and it doesn't have, you know, it gave me 99.95% of everything.
[16:55] Daniel Stenberg
But this last little thing doesn't work.
[16:56] Daniel Stenberg
Go fix it now, because my company depends on this and we have a problem.
[17:01] Daniel Stenberg
Please ship it tomorrow at the latest.
[17:03] Viktor Petersson
We've already proven to our customers, so please go do it.
[17:06] Daniel Stenberg
Exactly.
[17:07] Daniel Stenberg
Otherwise we will be sorry.
[17:08] Daniel Stenberg
So, yeah, please spend your spare time now and fix our problems.
[17:12] Daniel Stenberg
Yes, there's some amount of that.
[17:16] Viktor Petersson
And how do you.
[17:17] Viktor Petersson
I mean, I guess that's, I guess as a test of patience again, really, it's just doing that in a way that, because I guess you have to bite your tongue quite a bit in these.
[17:29] Daniel Stenberg
Yes, and sometimes I fail at biting my tongue.
[17:33] Daniel Stenberg
And also since five years ago now I work on curl full time, so I sell support then to business and whoever wants to pay for support.
[17:43] Daniel Stenberg
And so then nowadays I have a better answer also.
[17:48] Daniel Stenberg
Okay, if your commercial user is actually depending on this, you can actually pay someone.
[17:55] Daniel Stenberg
Well, I don't have to say it's me, but to fix this issue, we can probably have it fixed by tomorrow.
[18:00] Daniel Stenberg
But if you're just sitting there unwining and your company is suffering, maybe just asking volunteers to spend spare time is not the way to do it.
[18:10] Viktor Petersson
Yeah, and I want to dive into that because I think that's a whole much bigger question around open source and funding in general.
[18:15] Viktor Petersson
So I want to save that.
[18:16] Viktor Petersson
But a pin in that particular conversation a little bit.
[18:18] Viktor Petersson
But I think that's interesting for the community.
[18:20] Viktor Petersson
The other thing that I find, you've been posting these for a while, I think on Twitter and whatever, on social media around these strange support requests you were receiving for users to please uninstall my curl.
[18:31] Viktor Petersson
Everything from cars running curl.
[18:33] Viktor Petersson
And they found your email address.
[18:35] Viktor Petersson
Talk to me about the craziest example you've had of people reaching out to you.
[18:39] Daniel Stenberg
Yeah.
[18:39] Daniel Stenberg
So since curl runs in, well, I estimate I've used the number for several years now.
[18:46] Daniel Stenberg
So I say 20 billion installations, which I think is nowadays a little bit.
[18:53] Daniel Stenberg
I think there are more, but it doesn't matter.
[18:55] Daniel Stenberg
It runs everywhere in.
[18:57] Daniel Stenberg
And the license says that you have to ship it, you have to mention the license somewhere in documentation or in products.
[19:02] Daniel Stenberg
And of course that means that in a lot of products you can't even figure out that it actually runs curl.
[19:07] Daniel Stenberg
But in a lot of products at least they put the license in some kind of about window or, you know, third party license things.
[19:15] Daniel Stenberg
So somewhere you can find the curl license.
[19:18] Daniel Stenberg
And in the ker license there's my email address, which is actually rare among software licenses.
[19:25] Viktor Petersson
Yes.
[19:26] Daniel Stenberg
And that is important only because if you then go to that weird page with a thousand software licenses, you can scroll for 45 minutes, and then suddenly you find an email address among all of those.
[19:37] Daniel Stenberg
And that's my email address.
[19:42] Daniel Stenberg
So that at least that's my leading theory on how they come to email me when person has a problem with a gps in their car.
[19:51] Daniel Stenberg
I can't figure it out.
[19:53] Daniel Stenberg
How do I do this?
[19:54] Daniel Stenberg
Probably they try everything and they end up on that screen eventually.
[19:58] Daniel Stenberg
And then they find my emailer.
[20:00] Daniel Stenberg
I'm going to email that guy and ask, gps problem.
[20:04] Daniel Stenberg
So out of the blue, I get a question about GPS in a Toyota Corolla.
[20:08] Daniel Stenberg
From often they also.
[20:12] Daniel Stenberg
Then, of course, they don't tell the whole picture.
[20:15] Daniel Stenberg
They just tell me something about, hey, fix my problem here and tell me a model number or something.
[20:21] Daniel Stenberg
I have no idea what they're talking about.
[20:23] Daniel Stenberg
And please go ahead and blah, blah.
[20:25] Daniel Stenberg
Usually that end is more amusing to me than that person because that person is probably most upset or angry even.
[20:32] Daniel Stenberg
That's.
[20:34] Daniel Stenberg
And when I try then to excuse myself and say, well, you know, I have no idea what you're talking about, I only.
[20:40] Daniel Stenberg
It never goes well because that's not the answer they want.
[20:43] Daniel Stenberg
They want me to fix their problems.
[20:45] Viktor Petersson
Yeah.
[20:46] Daniel Stenberg
Yeah.
[20:47] Daniel Stenberg
So one, in my, from my view, one of my more amusing cases was this woman who emailed me about her Instagram account was hacked, she claimed.
[20:59] Daniel Stenberg
So why do you email me about your Instagram account?
[21:02] Daniel Stenberg
I have no idea what are you talking about.
[21:04] Daniel Stenberg
You can.
[21:04] Daniel Stenberg
You should contact Facebook at the time, this was five, six years ago.
[21:10] Daniel Stenberg
But then she got back to me and said, well, your name is instagram.
[21:14] Daniel Stenberg
Exactly like that.
[21:15] Daniel Stenberg
Right?
[21:16] Daniel Stenberg
In the.
[21:16] Daniel Stenberg
In the about window, it says, you know, curl down, hdmi.
[21:20] Daniel Stenberg
Oh, right.
[21:22] Daniel Stenberg
I had no idea.
[21:23] Daniel Stenberg
Fun, you know?
[21:24] Viktor Petersson
Cool.
[21:24] Daniel Stenberg
That's like a billion installations.
[21:26] Daniel Stenberg
Suddenly, I thought it was really fun.
[21:28] Daniel Stenberg
She did not think that was very fun at all.
[21:31] Daniel Stenberg
So.
[21:32] Daniel Stenberg
But she insisted.
[21:33] Daniel Stenberg
No, no, I should just talk to my friends at Instagram.
[21:35] Daniel Stenberg
They should help her to fix her account.
[21:38] Daniel Stenberg
And, you know, back and forth.
[21:39] Daniel Stenberg
I tried.
[21:40] Daniel Stenberg
No, no, I have no idea.
[21:41] Daniel Stenberg
I never talked to them, never met them.
[21:42] Daniel Stenberg
They never told me even that they used this.
[21:44] Daniel Stenberg
I had no idea until you told me, you know, I'm just an open source guy, blah, blah.
[21:50] Daniel Stenberg
And then she got silent.
[21:51] Daniel Stenberg
And then I think about a week later or two, she emailed me again.
[21:55] Daniel Stenberg
Oh, you've been lying to me.
[21:57] Daniel Stenberg
Because look at this, your name is also in Spotify.
[22:01] Daniel Stenberg
And then she sent me another screenshot with my name in Spotify on the same phone, right.
[22:06] Daniel Stenberg
That cannot be a coincidence.
[22:08] Daniel Stenberg
My name in both Instagram and Spotify, the same phone.
[22:13] Daniel Stenberg
That's the only evidence you need that?
[22:17] Daniel Stenberg
Of course.
[22:18] Daniel Stenberg
What more do you need?
[22:20] Daniel Stenberg
So now unhack my phone immediately before I tell these companies about you.
[22:26] Daniel Stenberg
Then you just give up, right?
[22:28] Viktor Petersson
What do you do?
[22:29] Viktor Petersson
There is no coming back from that, right?
[22:30] Viktor Petersson
No, but it is amusing, obviously, for us, who's living in this world for a long time, and for us, it's so obvious.
[22:37] Viktor Petersson
But for the average user, have no idea what open source is.
[22:40] Viktor Petersson
Nor curl.
[22:40] Daniel Stenberg
Right, right.
[22:42] Daniel Stenberg
No, no.
[22:42] Daniel Stenberg
I've had the fullest sort of sympathies for them because it's a really complicated world.
[22:47] Daniel Stenberg
And for them to understand this, I understand that it's really hard for them to even accept it or buy it when I say something, but.
[22:56] Daniel Stenberg
So nowadays, I usually never even reply when they email me about these weird things because it's so hard to even.
[23:03] Daniel Stenberg
I don't know what to do.
[23:05] Daniel Stenberg
They don't believe me or they don't trust me or they.
[23:08] Daniel Stenberg
Anyway, I can't give them the answer they want anyway.
[23:11] Viktor Petersson
There's no upside.
[23:13] Daniel Stenberg
I collect them on my site now and I have a collection of my funniest emails nowadays.
[23:18] Viktor Petersson
Actually, that's where I've seen it.
[23:20] Viktor Petersson
Yeah, that's.
[23:21] Viktor Petersson
That must be it.
[23:22] Viktor Petersson
What?
[23:22] Viktor Petersson
I mean, what's the amount of emails you get per day for that?
[23:25] Viktor Petersson
I mean, is that crazy or are they.
[23:28] Daniel Stenberg
Yeah, no, it's not crazy.
[23:30] Daniel Stenberg
So actually, it's not even one a day.
[23:34] Daniel Stenberg
So it's more like one strange email.
[23:38] Daniel Stenberg
Well, most of them are not fun at all.
[23:42] Daniel Stenberg
Most of them are just confused and then I just don't care about them.
[23:45] Daniel Stenberg
Some of them are slightly amusing or scary, but there's more like a few per month maybe.
[23:51] Daniel Stenberg
So it's really not a load of any sort.
[23:54] Viktor Petersson
All right, that's fair.
[23:55] Viktor Petersson
All right, let's go back to curl for a bit.
[23:58] Viktor Petersson
And I was really curious about a few things about this, and one of them is the future roadmap I had.
[24:04] Viktor Petersson
And in terms in particular, let's focus on, well, the standards moving forward.
[24:10] Viktor Petersson
So I was chatting with some friends before I hopped on this, and one of the people asked me, like, how do you assess which standards you want to adopt in curl?
[24:18] Viktor Petersson
Is that driven by user demand or is it driven by you?
[24:23] Viktor Petersson
Seeing the future of, like, this is really interesting.
[24:25] Viktor Petersson
I think this has weight, or how.
[24:27] Daniel Stenberg
Do you see that it's driven by all of that and the rolling of a dice, basically.
[24:33] Daniel Stenberg
So it depends.
[24:36] Daniel Stenberg
So yeah, I try to follow, for example, since curl is used for Internet transfers on the Internet, and a lot of curl use is like mimicking what a browser can do.
[24:52] Daniel Stenberg
So instead of doing it with a browser, you can automate it with curl.
[24:56] Daniel Stenberg
So that's one reason to make sure that almost everything you can do with a browser, I want it to be possible to do with curl.
[25:03] Daniel Stenberg
Right.
[25:03] Daniel Stenberg
So if the browser suddenly adopts something new, crazy fun something, then usually we also go that route because then we know that it's going to be the new thing by a lot of users on the Internet or the web.
[25:20] Daniel Stenberg
So typically things that are adopted by all the browsers, we also do some of those things.
[25:27] Daniel Stenberg
You can figure that out pretty early on that, you know, and all the browsers are on the train, they're going in that direction.
[25:33] Daniel Stenberg
Of course we are going to implement that as well.
[25:35] Daniel Stenberg
Like the HTTP versions, right?
[25:37] Daniel Stenberg
All the big ones are going to adopt the new HTTP version, so it's not a bad bet that we are going to do that as well.
[25:45] Viktor Petersson
And I guess you're constraining that to ones that are official standards.
[25:51] Viktor Petersson
So, I mean, chrome is kind of playing a bit rough and dirty here and invent standards themselves a bit.
[25:56] Viktor Petersson
So I guess.
[25:57] Daniel Stenberg
Right.
[25:57] Daniel Stenberg
So I don't want to go sort of on a tangent on doing silly things either.
[26:03] Daniel Stenberg
So, no, I want them to be real standards and with a sort of with a goal or sort of with a future that we think that people will use.
[26:18] Daniel Stenberg
But of course that's hard to know.
[26:20] Daniel Stenberg
And also I kind of enjoy being sort of early on the train as well, so that we can help out to, like, I've been early on HTTP two, I've been fairly early on HP three, so that we get a tool to start also testing out the versions fairly early, perhaps even during the protocol development, so we can get some stuff early on and try it out and see does this actually work in reality?
[26:45] Daniel Stenberg
So that's kind of fun, even if it also means that sometimes it's a lot of effort that we don't have to backpedal and do something differently because standards change and so on.
[26:54] Viktor Petersson
Yeah, I can imagine.
[26:56] Daniel Stenberg
So it really matters on a personal interest and who wants this.
[27:01] Daniel Stenberg
And if companies show up and say, hey, we want to do this and someone pays for that development, that's also of course a strong motivator to go push for that because some things, if there's no company supporting stuff and it's a huge effort, then maybe we just, yeah, we might want it, but maybe it's too big an effort for us to just do it ourselves.
[27:23] Daniel Stenberg
So we just wait and sell and see.
[27:25] Viktor Petersson
Yeah, because you're also building tech debt in adopting something potentially.
[27:31] Viktor Petersson
Right?
[27:31] Daniel Stenberg
Exactly.
[27:32] Daniel Stenberg
And it's really horrible to adopt something and then later realize that everything, everyone is going to just abandon that anyway.
[27:40] Daniel Stenberg
So why did we do all that effort and support it forever after that?
[27:44] Daniel Stenberg
So no, we also want to make sure that we don't do too much of silly things that we have to just carry with us for all eternity.
[27:53] Viktor Petersson
And that brings me to another question, which is about backward compatibility.
[27:56] Viktor Petersson
You guys have been very good at that historically, but I guess at some point in the future protocols will be dropped, I would imagine, because either they're not used or is there philosophical stance that nothing ever will be dropped.
[28:11] Viktor Petersson
How do you see that?
[28:13] Daniel Stenberg
My philosophical stance is more like if no one notices, then when we drop stuff then it's okay.
[28:22] Daniel Stenberg
It's not a behavior break.
[28:24] Daniel Stenberg
If no behavior is actually broken.
[28:27] Daniel Stenberg
So if no one is actually using it then we can actually remove it.
[28:32] Viktor Petersson
But if you have no telemetry to tell you that.
[28:35] Daniel Stenberg
Exactly.
[28:36] Daniel Stenberg
So that's a sort of.
[28:37] Daniel Stenberg
Yeah, that's a weird answer because I actually don't know.
[28:40] Daniel Stenberg
There's going, whatever we do, there's going to be two people somewhere in that exact, there are using whatever we have done ever.
[28:48] Daniel Stenberg
So we are really careful about removing support for anything.
[28:53] Daniel Stenberg
So we don't remove support for entire protocols.
[28:56] Daniel Stenberg
We can remove support for some stuff, but for example if we have things that you can enable in the tool or in the library ask for this to be used, then we didn't guarantee for it to be used.
[29:09] Daniel Stenberg
Right.
[29:09] Daniel Stenberg
So we can not use it because you can still ask for it.
[29:12] Daniel Stenberg
It'll just never happen and things like that.
[29:15] Daniel Stenberg
So it is possible.
[29:16] Daniel Stenberg
And we also have dropped support for a lot of different third party dependencies and offer new third party dependencies instead, which so from the outside is still the same, but internally we stopped supporting some TL's libraries and stuff like that because they were, they die off.
[29:36] Viktor Petersson
Okay.
[29:37] Viktor Petersson
And then do you have a protocol for, I guess deprecation, notifications and stuff like that in the CLI or how do you communicate these?
[29:47] Daniel Stenberg
Yeah.
[29:48] Daniel Stenberg
Yes.
[29:49] Daniel Stenberg
So we have a procedure in the project how we do when we remove things from the project.
[29:54] Daniel Stenberg
So we have a pretty long time so that we warn and alert about when we want to do changes.
[30:01] Daniel Stenberg
So at the minimum, six months ahead, we sort of document exactly what we want to do.
[30:06] Daniel Stenberg
What the outcome is.
[30:07] Daniel Stenberg
And if you have a problem with this, you can always yell about it and we can sort of bring up the discussion and either postpone it or just cancel the precision completely or whatever, because everything is always up for discussion.
[30:20] Daniel Stenberg
So we can always change our minds as long as anyone wants to do.
[30:25] Viktor Petersson
And it's also open source, so you could always fork it and just keep it the way it is if you so desire.
[30:29] Viktor Petersson
Right?
[30:29] Daniel Stenberg
Yeah.
[30:30] Daniel Stenberg
And there's always a matter of sure if you show up and you want to be a contributor and help keep the code in shape and everything.
[30:36] Daniel Stenberg
So of course that changes the equation.
[30:38] Daniel Stenberg
Right.
[30:39] Daniel Stenberg
So then of course we can support whatever, if there's someone there who is actually using it, have a use case and make sure that we have test cases and everything is good, then I, then we don't remove it.
[30:49] Viktor Petersson
But do you still sign off?
[30:51] Daniel Stenberg
I usually don't do that.
[30:52] Viktor Petersson
Yeah, exactly.
[30:53] Viktor Petersson
Do you still sign off every PR coming in?
[30:57] Daniel Stenberg
No, I don't.
[30:58] Daniel Stenberg
So I review almost every PR, I think.
[31:06] Daniel Stenberg
But we are several committers and so there are a few bunch of other people who are actually merging quite a few changes.
[31:15] Daniel Stenberg
So I think I'm at 56% of all commits authored.
[31:20] Daniel Stenberg
Okay.
[31:20] Daniel Stenberg
But it's, my share is sort of shrinking over time because we have a lot of other good people who are doing a lot of development.
[31:29] Viktor Petersson
But you are the only, I guess, paid maintainer of curl.
[31:32] Viktor Petersson
There are no other paid maintainers to work full time on it.
[31:35] Viktor Petersson
More.
[31:35] Daniel Stenberg
I'm the only full time paid maintainer, yes.
[31:38] Daniel Stenberg
So I've actually off and on, I hire a few of the others, depending on what kind of assignments I have and what kind of money I have to spend on them.
[31:49] Daniel Stenberg
So I actually pay a few of the others on and off.
[31:53] Viktor Petersson
Okay.
[31:54] Viktor Petersson
Okay.
[31:57] Viktor Petersson
What was the biggest pain in the ass protocol to maintain, or what is, or was, I guessed.
[32:10] Daniel Stenberg
Curl is HTTP and HTTPs.
[32:13] Daniel Stenberg
They are the two big protocols that people use for curl.
[32:17] Daniel Stenberg
And with curl they're also super big and super complicated protocols.
[32:23] Daniel Stenberg
And since those two go hand in hand, right, because it's mostly most used and big complicated protocols, that means that we have most features with them and most of edge cases and most users doing things in crazy ways because there are such big protocols used in so many different ways, I think a fair amount of everything we do is around HTTP and HTTPs.
[32:49] Daniel Stenberg
So even though they are the most used and most tested and most well maintained, they're also the ones that are causing us the most problems because there are so much, they're just very complicated.
[33:03] Daniel Stenberg
They started out easy.
[33:04] Daniel Stenberg
Well, yeah, they were probably easy back in the early nineties, but they have developed into beasts really.
[33:13] Daniel Stenberg
And now with so many different protocol versions too, and different combinations of those and enter proxies and proxies of different versions and then all those different headers and things you can do with the content with different versions in different ways.
[33:30] Daniel Stenberg
Yeah.
[33:30] Daniel Stenberg
It's a never ending sort of challenge to keep all of that together.
[33:36] Viktor Petersson
I'm curious, obviously in the last five years, Cloudflare has eaten up so much of the traffic and acts as an intermediary for so much traffic.
[33:48] Viktor Petersson
They do interfere with headers, so they do add their own headers and they do modify how packets flow, I guess.
[33:57] Viktor Petersson
Have you seen any, I guess, positive or negative change as a client with curl since that change has happened over the last few years?
[34:08] Daniel Stenberg
I think in general, the entire trend with everything, everyone going behind cdns, I think in general that makes things easier for me as a client because it reduces to sort of the plethora of different implementations and different servers.
[34:26] Daniel Stenberg
So we're going into a future with fewer server versions, so less diversity really among server implementations and crazy things that are happening in the server side that we have to adopt to as a client.
[34:43] Daniel Stenberg
So I think in some ways it's easier, but in most ways it doesn't really matter to us.
[34:49] Daniel Stenberg
It's the same thing because they appear as servers for us.
[34:53] Daniel Stenberg
Right.
[34:53] Daniel Stenberg
So we have to work with any server, and if that happens to be a CDN, it's just a server as another server to us.
[35:01] Viktor Petersson
Yeah, I was just thinking if they sanitize the data in some way, that makes it easier for curl to ask.
[35:07] Viktor Petersson
I mean, I guess they would have to swallow up those edge cases on their end rather.
[35:12] Daniel Stenberg
Yeah, I guess so.
[35:13] Daniel Stenberg
But yeah, but I guess, you know, if they take 25% of the Internet, so sure they make that 25%, perhaps a little bit more cleaned up, but we still have all the other 75% served by others.
[35:24] Daniel Stenberg
And if there's a server out there that is sending a crazy header somewhere and that's used in production, you can be sure that we will see that at some point and then we have to deal with it, even though Cloudflare or the other CDNs will hide them for their particular clients.
[35:40] Viktor Petersson
Fair enough, fair enough.
[35:42] Viktor Petersson
What's the craziest use case you've seen of Curl so far, where you're like, wait, what?
[35:50] Daniel Stenberg
One of my favorite ones that I actually learned about, I think, was about a year ago when some we shouldn't names but they made their niche printer manufacturer.
[36:01] Daniel Stenberg
They actually used Curl as an internal IPC in their printer.
[36:05] Daniel Stenberg
So they actually did curl communications between the different processes in the printer.
[36:12] Viktor Petersson
That's an interesting use case.
[36:14] Daniel Stenberg
I thought it was crazy.
[36:15] Daniel Stenberg
Completely non ideal.
[36:18] Daniel Stenberg
But they did it.
[36:21] Viktor Petersson
It feels a bit like if you got a hammer, everything looks like a nail kind of situation.
[36:25] Daniel Stenberg
Yeah.
[36:26] Daniel Stenberg
And they contacted me because when you use libcurl, you basically set up so that it'll automatically keep x number of connections alive after you've used them.
[36:35] Daniel Stenberg
So that when you want to connect to that hostname again, it'll have the previous one still alive.
[36:39] Daniel Stenberg
So the next request will be much faster.
[36:41] Daniel Stenberg
Right, right.
[36:42] Daniel Stenberg
And they had like, they had that maximum number of connections to, I believe, five or six or whatever, and they had, I think, seven or eight nodes within that printer.
[36:51] Viktor Petersson
Oh, right.
[36:51] Daniel Stenberg
So basically they communicated with tiny amount too many, so they would close down connections all the time.
[36:57] Daniel Stenberg
So they had to close them and create new ones all the time.
[37:00] Daniel Stenberg
So within that, even within that silly little printer, they have to sort of create and close down connections all the time.
[37:06] Daniel Stenberg
So it's totally ineffective and really slow.
[37:11] Daniel Stenberg
So it was a bad idea to begin with and then use it in a bad way.
[37:14] Daniel Stenberg
That made it even worse.
[37:18] Viktor Petersson
Any other crazy use case that you can spring to mind of that you've seen?
[37:24] Daniel Stenberg
Actually, not that many, because I think a general trend is that everything is talking network these days.
[37:30] Daniel Stenberg
Right.
[37:31] Daniel Stenberg
So.
[37:31] Daniel Stenberg
And with everything is even talking even more networks tomorrow.
[37:34] Daniel Stenberg
So everything is potentially going to use curl sooner or later because everything is going to be networked in some way or another.
[37:42] Viktor Petersson
Yeah, that's a fair point.
[37:43] Daniel Stenberg
So therefore there's not a single product that I can't imagine having curl eventually.
[37:50] Viktor Petersson
Yeah, fair point.
[37:52] Viktor Petersson
One interesting, I guess spin out of curl.
[37:55] Viktor Petersson
I guess not spin out is not the right word, is w curl, which came out, I think it was a debian project, right?
[38:01] Daniel Stenberg
Yes, it's the alias actually.
[38:02] Viktor Petersson
Yeah.
[38:03] Viktor Petersson
And it's funny because I only use wget for downloading files, but I use curl for everything else and for the simple reason that I never forget if it's capital o or lowercase o for output file.
[38:14] Viktor Petersson
And that's the sole reason why I use wget.
[38:19] Daniel Stenberg
We get told that quite a lot, quite often.
[38:21] Daniel Stenberg
So, and I think this particular project, that wcurl is just a shell script, right?
[38:27] Daniel Stenberg
It's a shell script wrapping curl.
[38:29] Daniel Stenberg
But Samuel, who created it, he, I think he read a lot of feedback from our recent curl user survey where as usual, a lot of people pointed out exactly that.
[38:43] Daniel Stenberg
Remembering exactly which option you should use to just get that URL down to a file is complicated.
[38:49] Daniel Stenberg
And that's why people in many cases still use wget.
[38:52] Daniel Stenberg
So by providing this wCarl script, the idea being then that, well, this could then be a reason to maybe not install wget if this is the only reason.
[39:02] Viktor Petersson
Right, right.
[39:04] Viktor Petersson
And I mean, one of the things, I mean this has come back to like the old school Linux world and I, and the Unix philosophy, I guess with the whole thing you do, one thing you do well and it's, and what I like about Curl is how well it works with the piping.
[39:17] Viktor Petersson
Right.
[39:17] Viktor Petersson
So one of the most common use cases I use is piping curl to JQ for instance.
[39:22] Viktor Petersson
Right, right.
[39:23] Daniel Stenberg
I, yeah.
[39:24] Viktor Petersson
And I mean that's, it's such a good example of a tool that does one thing, very sharp focus and nothing else.
[39:32] Daniel Stenberg
Right, right.
[39:33] Daniel Stenberg
And I always wanted to be like that.
[39:34] Daniel Stenberg
Right.
[39:35] Daniel Stenberg
A good member in the Unix family, you pipe output from one tool into the other tool.
[39:39] Daniel Stenberg
So of course curl would pipe everything into whatever you wanted to do.
[39:43] Daniel Stenberg
And for me it was always sort of, that's how we define curl.
[39:47] Daniel Stenberg
It shouldn't ever really understand the data.
[39:50] Daniel Stenberg
It just gets the data for you or uploads the data for you, but it doesn't understand the data.
[39:54] Daniel Stenberg
If you want something to understand the data, you pipe that data into that thing that understands it.
[39:59] Daniel Stenberg
Like Eaq for JSON.
[40:01] Daniel Stenberg
Right?
[40:01] Viktor Petersson
Yeah.
[40:01] Daniel Stenberg
Curl doesn't understand JSON, has no idea that it is JSON.
[40:04] Daniel Stenberg
So you pipe the thing into the thing that knows about JSON and it can show the JSON for you.
[40:09] Viktor Petersson
Yeah.
[40:09] Viktor Petersson
And there's no world where there will be a feature creep or Curl would build into, I don't know, say JSON support parsing.
[40:15] Daniel Stenberg
We have a lot of people asking for that, but I can imagine I'm trying to stay up exactly for that reason.
[40:23] Daniel Stenberg
I think there's always the potential for feature creep because there's always this, we're getting bombarded not only with ideas, but patches and things people want to put in there.
[40:38] Daniel Stenberg
Yeah.
[40:38] Daniel Stenberg
We could go in any direction at any point, but I think it's important to remember what Curl is not, or rather where's the boundary, what can we consider and what's definitely not considered?
[40:49] Daniel Stenberg
And I think sort of dealing with the data, I think it's a pretty good and clear line.
[40:55] Daniel Stenberg
Right?
[40:55] Daniel Stenberg
No no.
[40:56] Daniel Stenberg
That's outside of the curl project.
[40:57] Daniel Stenberg
Understanding the data, that's not our business.
[40:59] Daniel Stenberg
So I try to keep that as a sort of, yes, we're on this side of the fence, that's the other side.
[41:06] Viktor Petersson
Yeah, I completely agree with I think that principle because if you add Jason, we know it.
[41:12] Viktor Petersson
Somebody's going to ask for xml and before they add that.
[41:14] Daniel Stenberg
Exactly.
[41:16] Daniel Stenberg
And that said, of course it's, sometimes it's hard to stick to that boundary.
[41:20] Daniel Stenberg
And of course in some way, sometimes the boundaries shifted a little bit because everything is always a discussion.
[41:28] Daniel Stenberg
And I also, I'm also sort of always vary that I cannot always just get stuck in a mindset that we set like 26 years ago.
[41:38] Daniel Stenberg
Right.
[41:39] Daniel Stenberg
Because things change.
[41:40] Daniel Stenberg
It's not necessarily that we did the right decisions in the past.
[41:45] Daniel Stenberg
Maybe we should reevaluate and do things a little bit different because maybe things are, but.
[41:49] Daniel Stenberg
So I always want to at least exercise that thought.
[41:54] Daniel Stenberg
But there are some boundaries I think we should really stick to.
[41:58] Daniel Stenberg
And for example, I always try to emphasize that curl is also for just uploads and downloads, transfer oriented.
[42:05] Daniel Stenberg
So if you come to me and say hey, I want to support protocol, blah, that is not about uploads or downloads, then nah, that's not for me.
[42:14] Daniel Stenberg
And I also want the protocols to be oriented around URL's.
[42:18] Daniel Stenberg
So it should be ideally a scheme for that particular protocol for curl to use it.
[42:26] Viktor Petersson
I guess you have feature creeps a little bit there because if I'm not mistaken there's even support for shfs and similar things that are like.
[42:37] Viktor Petersson
Yeah, I guess so.
[42:38] Daniel Stenberg
But it's, yeah, there's this, I mean feature creep.
[42:42] Daniel Stenberg
Yes.
[42:44] Daniel Stenberg
So there's a lot of features.
[42:45] Daniel Stenberg
So yeah it's, and it's hard to turn down features because there's always a niche for adding things.
[42:53] Daniel Stenberg
Yeah, yeah, you support everything but you forgot to add this little tiny detail.
[42:57] Daniel Stenberg
Yeah, okay, well support for that and then another tiny detail that we don't support.
[43:02] Daniel Stenberg
We add support for that on and on and on.
[43:05] Daniel Stenberg
Then you end up with 263 command line options.
[43:09] Viktor Petersson
Yeah, I completely understand that.
[43:11] Viktor Petersson
All right, let's switch topic a bit to security because if there is something that should be pretty painstakingly obvious right now in particular in light of the XZ vulnerability, is that Libcurl is probably one of the most prime suspects for injection if you want to backdoor any system on the planet.
[43:34] Viktor Petersson
So let's talk that what are the mitigation strategies in place right now to make sure that doesn't happen for supply chains attack and whatnot?
[43:44] Daniel Stenberg
Yeah, well I think we do just about everything we can do.
[43:50] Daniel Stenberg
So first of all, the Xe attack was awesomely sort of performed by the attackers.
[43:59] Daniel Stenberg
But they also had the most excellent project to attack in several ways.
[44:05] Daniel Stenberg
Right?
[44:05] Viktor Petersson
Yes.
[44:06] Daniel Stenberg
And one of the ways being that they had huge binary blobs in the test suite that was perfect for smuggle encrypted attacks.
[44:14] Daniel Stenberg
So that's one of the things, right?
[44:16] Daniel Stenberg
We don't have anything that is no uninspectable blobs in the git repository.
[44:24] Daniel Stenberg
And of course, and then we do everything I think that we should.
[44:28] Daniel Stenberg
Everything is tested a lot and we review everything.
[44:34] Daniel Stenberg
Well, I review almost everything.
[44:37] Daniel Stenberg
I can actually confess that I do a lot of merges that only I review.
[44:41] Daniel Stenberg
So I am suddenly sort of the weak link here.
[44:46] Daniel Stenberg
But anyway, so that's what we do.
[44:48] Daniel Stenberg
And then we try to then make sure that we never merge anything that breaks any tests.
[44:52] Daniel Stenberg
And so if the tests are fine and verify everything shouldn't be possible to put any backdoors in.
[44:57] Daniel Stenberg
Well ideally it shouldn't.
[44:59] Daniel Stenberg
And then we do.
[45:00] Daniel Stenberg
Eventually we do, since a short while back we do entirely reproducible torball builds.
[45:08] Daniel Stenberg
So it should be possible for anyone to just verify it and build.
[45:13] Daniel Stenberg
Exactly binary identical release.
[45:16] Viktor Petersson
Yeah, that's all for a attack vector.
[45:18] Viktor Petersson
Right.
[45:18] Viktor Petersson
But let's talk about that, because that's obviously a big push we're seeing with deterministic builds.
[45:23] Viktor Petersson
So walk me through that.
[45:24] Viktor Petersson
How was that process?
[45:25] Viktor Petersson
How do you find that?
[45:26] Viktor Petersson
Because obviously that's a big daunting task to do for many projects.
[45:30] Daniel Stenberg
Yeah, but it's not that hard for us.
[45:33] Daniel Stenberg
Release for us is just terrible.
[45:35] Daniel Stenberg
So we're only releasing source code at least.
[45:39] Daniel Stenberg
Well it's not entirely true, but we're focusing on those releases now.
[45:44] Daniel Stenberg
At least that's the primary release.
[45:47] Daniel Stenberg
That's terrible.
[45:48] Daniel Stenberg
And when we do a terrible, we actually do the releases in a similar style as XZ because we use water tools.
[45:56] Daniel Stenberg
So we generate a configure and stuff.
[45:57] Daniel Stenberg
And the generated configure is not in git.
[46:01] Daniel Stenberg
So of course in the XZ attack they then injected code between what's in git and what ended up in the turbo.
[46:10] Daniel Stenberg
So that's why the reproducible build is important, because then you can verify that there's nothing ended up in the tarbol that wasn't in git or wasn't generated with a yemenite established tool.
[46:22] Daniel Stenberg
So basically we just then make sure that when we build that turbo, we do that in a reproducible way.
[46:30] Daniel Stenberg
So nowadays I build a tarball with a docker image of a specific hash, basically with the exact tools and make sure that the torbo is built with the right timestamps, blah, blah, so that if you just rerun the same command line that I did, you get an identical copy of the release turbo.
[46:52] Daniel Stenberg
So it's actually pretty straightforward once we got all those tiny details just done correctly.
[46:57] Viktor Petersson
Okay, that's fair enough.
[46:59] Viktor Petersson
That's fair enough.
[47:00] Daniel Stenberg
So then the big sort of.
[47:04] Daniel Stenberg
I wouldn't say that it's a big, but the risk is really then that we would just merge someone's back door, you know, someone trying to just deliberately deliver a patch that says, hey, this patch is doing x and it looks good and we merge it, but in reality it actually does y.
[47:22] Daniel Stenberg
And then down the line someone can exploit that and use that backdoor.
[47:27] Daniel Stenberg
But I have never even seen an attempt do that.
[47:30] Daniel Stenberg
Maybe I've just missed it and we have it already.
[47:32] Daniel Stenberg
But I claim that it's really difficult to deliberately plant a backdoor like that does anything substantial.
[47:44] Daniel Stenberg
I think the actual biggest risk for curl, as in many other projects, is just the accidental vulnerability thing that we actually did something stupid a while ago that you can exploit.
[47:56] Daniel Stenberg
And then by exploiting a buffer, some kind of crash, some kind of thing, and that's what you can exploit and do something nasty.
[48:05] Daniel Stenberg
And that kind of security vulnerabilities we of course find and fix every now and then.
[48:11] Viktor Petersson
I mean that's more in the domain of regular vulnerabilities.
[48:14] Viktor Petersson
More so than supply chain attacks, I guess.
[48:16] Daniel Stenberg
Yeah.
[48:17] Daniel Stenberg
And looking back at the history of those, you can see that most of those mistakes were mine, so I know they weren't planted.
[48:24] Viktor Petersson
Yeah, that's fair.
[48:26] Viktor Petersson
So one thing that, I mean, obviously you all guys are doing really well.
[48:30] Viktor Petersson
I mean, I looked at the openSSF scorecard for Curl and you have a golden status for openSF scorecard, which is a pretty impressive score actually, because not a whole lot of projects actually make it that far.
[48:42] Viktor Petersson
Right?
[48:43] Daniel Stenberg
No, right.
[48:44] Daniel Stenberg
And I really made an effort to make sure that we sort of qualify for all those criteria and so.
[48:49] Viktor Petersson
Yes, but you're not actually, I don't think you ever mention that anywhere else that there is an opensSF scorecard that you actually aced, which I think is a lost marketing opportunity because I think that should be for, that should be the front for Readme of the off the readme file on GitHub, honestly.
[49:04] Daniel Stenberg
Right.
[49:04] Daniel Stenberg
Yeah, I think I have, there's a link somewhere.
[49:06] Daniel Stenberg
Yeah, maybe I should stress that harder.
[49:09] Daniel Stenberg
Yeah, I think.
[49:10] Viktor Petersson
Yeah, no, that's impressive.
[49:13] Viktor Petersson
Very few projects actually qualify that gets that far.
[49:17] Daniel Stenberg
It's actually pretty good that the best practice.
[49:21] Daniel Stenberg
So openssF has that best practice site that actually has a lot of questions to fill in.
[49:27] Daniel Stenberg
If you sort of follow a lot of different best practices.
[49:32] Daniel Stenberg
I think it's actually really good.
[49:33] Daniel Stenberg
Sort of just a checklist if you can say yes to all of those, you know, that you're doing things at least not bad.
[49:40] Daniel Stenberg
So that's what I've tried to sort of why I went for the gold too, because I want to make sure that we do everything as good as we possibly can in pretty much every aspect when it comes to running an open source project.
[49:53] Viktor Petersson
And also I would say it's a critical piece of infrastructure as well that so many people depend on that.
[49:59] Viktor Petersson
I mean I'm glad you see you guys are focusing on that because that is so important, right?
[50:05] Daniel Stenberg
Yeah.
[50:05] Daniel Stenberg
And in the same style also that sort of.
[50:07] Daniel Stenberg
Yes, as long as no one, you know, it's a success that no one is yelling about it.
[50:13] Daniel Stenberg
Right.
[50:13] Daniel Stenberg
So if as long as no one actually finds their heart bleeding curl, it's good.
[50:17] Daniel Stenberg
Right.
[50:17] Daniel Stenberg
So it's one of those silent successes too.
[50:20] Daniel Stenberg
So everything is good as long as no one finds anything alarming.
[50:23] Daniel Stenberg
So we should just keep it that way.
[50:25] Daniel Stenberg
And of course it's an ongoing effort because it never ends.
[50:29] Viktor Petersson
Oh yeah.
[50:30] Viktor Petersson
You're never done with security.
[50:31] Viktor Petersson
Of course.
[50:31] Viktor Petersson
Yeah.
[50:32] Viktor Petersson
Let's talk s bombs because that's something that obviously aligns with openness of core cards like tangentially I guess.
[50:40] Viktor Petersson
Are there any plans for publishing s bombs for curl?
[50:45] Daniel Stenberg
I think we're just following what everyone else is doing.
[50:47] Daniel Stenberg
And that's also why I talked about our releases are only turbo so we don't actually have any third parties in the tarbella.
[50:58] Daniel Stenberg
We actually don't have any bill of material in that way.
[51:02] Daniel Stenberg
I guess that's because we just ship the code.
[51:04] Daniel Stenberg
So someone else is building stuff.
[51:07] Daniel Stenberg
So we just push the responsibility to the others who are actually building everything and they're responsible.
[51:13] Daniel Stenberg
So basically all the distros that are shipping curl and everything, they build it themselves.
[51:18] Daniel Stenberg
So they get it from us, they build it and they include third party dependencies and everything.
[51:22] Daniel Stenberg
So they are the ones who are actually get to do that.
[51:27] Viktor Petersson
But I guess you have dependency tree inside of curl.
[51:30] Viktor Petersson
I would imagine you are depending on some other third party piece of.
[51:34] Daniel Stenberg
Not strictly, we only depend on them when you build curl to use them.
[51:40] Daniel Stenberg
And that's why we don't have the dependency when we ship curl.
[51:43] Daniel Stenberg
Because then you have to build it.
[51:45] Viktor Petersson
That's fair enough.
[51:46] Viktor Petersson
But it's useless in isolation, I guess, without building it.
[51:52] Daniel Stenberg
Right, exactly.
[51:53] Daniel Stenberg
Yeah.
[51:53] Daniel Stenberg
But that's also one way that we sort of duck for a lot of issues.
[51:58] Daniel Stenberg
And so we, since we don't ship the binaries, handling the binary thing there is not, so that we avoid a lot of issues and problems by doing it this way.
[52:10] Daniel Stenberg
We do ship a few binaries anyway.
[52:13] Daniel Stenberg
That sort of breaks what I'm saying.
[52:15] Daniel Stenberg
So we do offer binaries for windows, for example.
[52:20] Viktor Petersson
Right.
[52:21] Daniel Stenberg
So and then in that case we have a pretty, we don't have any really s bombs because pretty much, I think, I don't know really why, but we have a huge detailed log about everything and exactly that we ship and include in that.
[52:36] Daniel Stenberg
So all of that is transparent and available.
[52:40] Daniel Stenberg
I think we're pretty much, we're well covered in that aspect too.
[52:45] Daniel Stenberg
And I think if we ever land on, we should do this to provide s pumps in this format more universally then I'm sure that we will do that as well.
[52:54] Viktor Petersson
That's fair enough.
[52:54] Viktor Petersson
That's fair enough.
[52:56] Viktor Petersson
Let's talk CV's because you posted a blog post last year.
[53:00] Viktor Petersson
I think it was about the useless or everything that is wrong with CV's, which I think was a kind of entertaining read about a CV filed against Curl, which is kind of I guess a theoretical attack in some sense.
[53:15] Viktor Petersson
But let's talk a bit about that.
[53:17] Viktor Petersson
Do you want to recap the article a bit about this CV and your thoughts on that?
[53:21] Daniel Stenberg
Yes, so I actually, so I had this struggle against the CV in many, I've had a lot of weird CV's and security related things over the last few years, but I believe in that case it was a integer overflow in a delay argument to curl.
[53:42] Daniel Stenberg
So if you ask curl to retry on a failed transfer because it has that command line option, basically if the server returns internal error or overloaded or whatever, you can ask her to try again later.
[54:02] Daniel Stenberg
Sure.
[54:02] Daniel Stenberg
And then it'll try 3 seconds later or 12 seconds later.
[54:06] Daniel Stenberg
Then we have another option that says wait this amount of time until you'd retry again.
[54:14] Daniel Stenberg
One of those days we just fixed the little buffer overflow.
[54:17] Daniel Stenberg
So when you set that retry counter to you specify it in seconds and internally we multiply that by 1000 to get the timer into milliseconds and we didn't have any check for that.
[54:30] Daniel Stenberg
So if you set that retry delay to something enormously big, and we will multiply that by 1000.
[54:38] Daniel Stenberg
Sure.
[54:39] Daniel Stenberg
It'll sort of.
[54:41] Daniel Stenberg
Yeah, it will overflow the integer or the long or whatever I don't remember the variable type, but it was a 64 bit on Linux.
[54:48] Daniel Stenberg
So yes, then you get an integral overflow.
[54:51] Daniel Stenberg
So if you then ask curl to retry like once in every 68 million years, and then instead it would retry once every probably 0 second or 60 milliseconds or whatever it turned out it would wrap and become a very small number instead of insanely large.
[55:11] Daniel Stenberg
I consider that just a bug because first of all, no one would ever enter that huge number unless you actually wanted to trigger this.
[55:21] Daniel Stenberg
Okay, and that's fair, someone could do that.
[55:23] Daniel Stenberg
But what's the worst that could happen?
[55:27] Daniel Stenberg
It wouldn't wait 68 million years.
[55:28] Daniel Stenberg
It would actually do the retry immediately after it failed the first one.
[55:33] Daniel Stenberg
And that is exactly how curl behaves.
[55:35] Daniel Stenberg
If you just type multiple URL's after each other on the command line, it would be one, two, three, exactly as it always does.
[55:41] Daniel Stenberg
So yeah, okay, worst case, it doesn't wait forever, it'll just do the next request immediately.
[55:47] Daniel Stenberg
And someone then found out that I used the word integral in a commit message because it was.
[55:55] Daniel Stenberg
And someone then registered.
[55:57] Daniel Stenberg
And CV is just a bug id basically.
[56:01] Daniel Stenberg
So you can just ask for that from mitre or whoever is responsible for that.
[56:06] Daniel Stenberg
And someone then requested a CVE for this bug.
[56:09] Daniel Stenberg
And one day that suddenly just became public because obviously no one told us about it.
[56:16] Daniel Stenberg
So just one day this CVE becomes public.
[56:19] Daniel Stenberg
Integral overflowing curl and rated severity 9.8, I think.
[56:27] Daniel Stenberg
Because that's an integral overflow.
[56:29] Daniel Stenberg
What's the worst that can happen with an integral overflow?
[56:32] Daniel Stenberg
Probably really serious stuff can happen, right?
[56:34] Daniel Stenberg
If it had been in some place that actually matters.
[56:40] Daniel Stenberg
And I of course was just what a CV on.
[56:43] Daniel Stenberg
Because usually we manage all the CV's ourselves, of course, because people report to us, so we know about it, we do the fixes, we talk about it, we announce the details, we write about it, so on.
[56:54] Daniel Stenberg
But in this case, of course it just showed up out of the blue one day.
[57:00] Daniel Stenberg
And then of course it became this huge discussion, is this a security problem?
[57:04] Daniel Stenberg
And I'm a pragmatic guy, I hate this guy.
[57:09] Daniel Stenberg
Sure, it's an integral overflow.
[57:11] Daniel Stenberg
Integral overflows written in c.
[57:12] Daniel Stenberg
They're undefined according to the C standard.
[57:16] Daniel Stenberg
And then the most nihilistic people, they say undefined, then anything can happen.
[57:23] Daniel Stenberg
So yeah, that's true.
[57:26] Daniel Stenberg
By the sort of literal meaning of the words it's undefined, it means that anything can happen.
[57:31] Daniel Stenberg
That's actually true.
[57:32] Daniel Stenberg
So in theory, instead of wrapping everything to 32 milliseconds, instead of 68 million years it could actually do something seriously super crazy and you know, your computer might burn.
[57:46] Daniel Stenberg
But I think that's a really silly argument to have because you can try it through how many compilers you want added and see what do compilers actually do with it.
[57:57] Daniel Stenberg
And well they can wrap that integral in many different ways and some could actually in some ways do something somewhat strange, but in no way did that ever become a security problem.
[58:10] Daniel Stenberg
Anyway, so that was my argument.
[58:12] Daniel Stenberg
So first I wanted to mitre to just reject the CVE because it was stupid.
[58:16] Daniel Stenberg
It wasn't a security problem at all.
[58:18] Daniel Stenberg
And they refuse to do that because yes, it's a security problem, they say, based on what, I don't know, because they won't talk to me.
[58:25] Daniel Stenberg
They just reply and say it's a security problem.
[58:30] Daniel Stenberg
And then of course the score you see when you just google for the CVE is usually you end up on the NVD site, the national vulnerability database, and they set scores on CVE's.
[58:46] Daniel Stenberg
That's just their business.
[58:49] Daniel Stenberg
So the next thing I did was that I contacted NVD and said hey, how on earth did you end up with a 9.8 for this when it's not even a security problem to begin with?
[59:01] Daniel Stenberg
And NVD, they don't remove anything because they say if Mitre added we will host it.
[59:07] Daniel Stenberg
So they won't reject it, they will just.
[59:10] Daniel Stenberg
They can, if I yell at them enough they can reevaluate the score apparently because they did in this case.
[59:17] Daniel Stenberg
So they reevaluated.
[59:19] Daniel Stenberg
So from 9.8 they ended up with 3.3, I think.
[59:22] Daniel Stenberg
Okay, just yelling.
[59:26] Viktor Petersson
Significant drop.
[59:28] Daniel Stenberg
Exactly.
[59:29] Daniel Stenberg
And by that I figure, okay, sure, 3.3, you can have it like that because 3.3, I don't, I mean, sure.
[59:37] Daniel Stenberg
Then I think for me that sort of just sort of removed the issue from my table really.
[59:43] Daniel Stenberg
So okay, you can have it, 3.3, fine, if you want to.
[59:46] Daniel Stenberg
In my view it's still a bad and invalid CVE, and I call it that.
[59:50] Daniel Stenberg
On the curl webpage they say it's a 3.3.
[59:53] Viktor Petersson
Sure, fair enough.
[59:56] Viktor Petersson
All right.
[59:57] Viktor Petersson
The last thing I want to talk about, which I think you're in a very good position to speak about, is the future funding of open source because that's obviously a lot of the supply chain attacks in open source.
[01:00:09] Viktor Petersson
A lot of them stem from the fact that these are projects maintained by one or maybe a handful of people at most, but used everywhere.
[01:00:18] Viktor Petersson
Curl is a great example of that where it has its fingers into almost everything that runs Linux or any embedded system more or less now.
[01:00:30] Viktor Petersson
The funding is a hard part, right?
[01:00:32] Viktor Petersson
You managed to do it by consulting, but it took you 20 some years to get there, right, which is 20 some years more than most projects.
[01:00:41] Viktor Petersson
So how do you see the future of open source funding looking like with your experience in this domain?
[01:00:51] Daniel Stenberg
I don't have any answers.
[01:00:52] Daniel Stenberg
I don't have any magic bullets there either.
[01:00:54] Daniel Stenberg
So no, it's a challenge, of course, because I think just the market economy just makes it easy for anyone who wants to just get open source, use it for as long as you want for free.
[01:01:10] Daniel Stenberg
Never contribute anything back because you don't have to and you can run a successful business without contributing anything back at all.
[01:01:20] Daniel Stenberg
I think that's the ultimate challenge because you can, companies can get away with it, so they will do that.
[01:01:26] Daniel Stenberg
And it's really hard to, as a, as producers to suddenly say, hey, wait a minute, you should pay me.
[01:01:31] Daniel Stenberg
I've given everything away, but now I want you to pay because they don't have to and it's hard for them to do.
[01:01:37] Daniel Stenberg
Of course, I think in reality and for companies products to be sustainable in the long run, it benefits companies to help the projects that they depend on, right?
[01:01:50] Daniel Stenberg
So that they can continue doing their products in the future so that all their dependencies also strive to, you know, continue and are secure and good and everything.
[01:01:58] Daniel Stenberg
So it is good in a lot of companies own view as well.
[01:02:04] Daniel Stenberg
But I think it's often overlooked by them and by the fact that they can avoid it.
[01:02:10] Daniel Stenberg
They often do that just out of short sightedness.
[01:02:14] Daniel Stenberg
And of course then there's the challenge in the other end.
[01:02:18] Daniel Stenberg
So it's hard for some, in a lot of projects it's hard for people to even, just how do you even start getting money for anything?
[01:02:28] Daniel Stenberg
If it's a small project, surely it's not a full time thing, but who's going to pay for it?
[01:02:34] Daniel Stenberg
And how, and how do you go.
[01:02:35] Viktor Petersson
From a side project to a full time project?
[01:02:38] Daniel Stenberg
Right, exactly.
[01:02:39] Daniel Stenberg
That was my challenge for so long time.
[01:02:42] Daniel Stenberg
How do you do that, take that step?
[01:02:43] Daniel Stenberg
It's really difficult.
[01:02:45] Daniel Stenberg
So yes, there are numerous challenges on how to do that.
[01:02:48] Daniel Stenberg
And at the same time, of course, if it's just your spare time thing, of course no one can actually require you to have everything top notch all the time.
[01:02:55] Daniel Stenberg
So it's only natural that you slip and you have bugs or security problems or whatever in your, I mean it's your right to have that.
[01:03:01] Daniel Stenberg
It's your spare time project you do what you want.
[01:03:05] Daniel Stenberg
It's not for anyone else to require you to do anything on your spare time.
[01:03:09] Viktor Petersson
Do you have any opinions around?
[01:03:10] Viktor Petersson
So GitHub sponsors, for instance, they've been trying to gain some momentum.
[01:03:14] Viktor Petersson
I mean, we've used that screenly for a while for our open source project.
[01:03:17] Viktor Petersson
Some of that works.
[01:03:18] Viktor Petersson
We have some.
[01:03:20] Viktor Petersson
Has that worked with curl?
[01:03:21] Viktor Petersson
Have you seen some success around that?
[01:03:26] Daniel Stenberg
Usually all the ways when you open up for sponsorship, it's good with sponsors.
[01:03:32] Daniel Stenberg
So that allows people that it contributes in a easy way when possible.
[01:03:38] Daniel Stenberg
Usually sponsors never cover enough money to actually drive serious development, though, because usually sponsorships are mostly individuals.
[01:03:47] Daniel Stenberg
So sponsorships tend up to be in the smaller ranges.
[01:03:50] Daniel Stenberg
So you need a huge amount of people actually shipping money for that to actually end up employing someone full time in a western world.
[01:04:00] Daniel Stenberg
So it's really hard.
[01:04:02] Daniel Stenberg
You need companies involved to actually up the amounts and then you have to do something else than just ordinary sponsorships.
[01:04:10] Daniel Stenberg
That's at least the usual way things go.
[01:04:14] Viktor Petersson
Yeah, because I guess that's the problem, right.
[01:04:16] Viktor Petersson
If you are a good enough software engineer that you can write a great piece of software that people actually are using, your going rate on the market to join a company will be six figures in most western countries.
[01:04:31] Viktor Petersson
Six figures a lot for an open source project.
[01:04:34] Viktor Petersson
So that's basically your alternative option, right?
[01:04:37] Daniel Stenberg
Yes, exactly.
[01:04:39] Daniel Stenberg
Yeah.
[01:04:39] Daniel Stenberg
So it's certainly a challenge.
[01:04:42] Viktor Petersson
So I mean, I'm hoping that we have some progress that one of the things that we've at screen that we use open source a lot and one of the things we've been toying with internally is to have kind of a pool internally that we allocate each year to open source projects with a bias towards smaller projects.
[01:05:03] Viktor Petersson
Because I think the big projects like, I mean, I guess Curl is a big project by now in relative terms, and Django is and all postgres and all the other big top projects that we use.
[01:05:13] Viktor Petersson
But for every one of those, there are plenty of smaller projects that maybe just be one guy.
[01:05:18] Viktor Petersson
And my philosophy is the buyer should be on those guys because those are the guys who need the most, right?
[01:05:25] Daniel Stenberg
Most probably, yes.
[01:05:28] Daniel Stenberg
Yeah.
[01:05:28] Daniel Stenberg
So, yeah, exactly.
[01:05:29] Daniel Stenberg
That's, that's one good way to do it.
[01:05:32] Daniel Stenberg
And I think also it could possibly also be with angle to, I don't know, over maybe not overlooked projects.
[01:05:40] Daniel Stenberg
But there's also, I find a, I find it a challenge to be a component in a software tree.
[01:05:48] Daniel Stenberg
Right.
[01:05:49] Daniel Stenberg
So I think it's a different case.
[01:05:52] Daniel Stenberg
At least I sense that when I talk to other open source maintainers who do accept sponsorships.
[01:05:58] Daniel Stenberg
It's a different case when you, for example, if you do more like more directed end user products, perhaps with more usability, so that you reach more, and then you get sponsorships directly from end users.
[01:06:11] Daniel Stenberg
But when you're doing a component in someone else's project, then the project using your stuff is the one who's going to get that visibility among users, not you.
[01:06:21] Daniel Stenberg
So there's a visibility challenge in that case.
[01:06:26] Viktor Petersson
And I mean.
[01:06:27] Viktor Petersson
Yeah, and I think that has been very evident in the NPM world, right.
[01:06:30] Viktor Petersson
Where you have had a lot of supply chains attack with domain squatting and squatting attacks and whatnot.
[01:06:35] Viktor Petersson
Right.
[01:06:35] Viktor Petersson
And you just.
[01:06:38] Daniel Stenberg
Because a little component.
[01:06:39] Daniel Stenberg
Right.
[01:06:39] Daniel Stenberg
Used by everyone, but no one actually remembers that little component or even knew about it.
[01:06:43] Viktor Petersson
Right, exactly.
[01:06:44] Viktor Petersson
And that's why I'm very bullish at S bombs, particularly when you're exploding s bombs that will bring light to that world.
[01:06:51] Viktor Petersson
Right.
[01:06:52] Daniel Stenberg
More so, hopefully.
[01:06:55] Daniel Stenberg
Yeah, it really should.
[01:06:57] Daniel Stenberg
At least I think that it will.
[01:06:59] Daniel Stenberg
I mean, I think it'll take time, but I think at least that's sort of a necessary step towards visibility and knowledge and just making everyone aware exactly what the sort of the myriad of tiny projects that we're all building everything on top of.
[01:07:15] Viktor Petersson
Yeah, it's like that XKCD cartoon, right, where you have all these projects and they have like the small, like.
[01:07:21] Viktor Petersson
Oh, well, I think in that particular example, it's libsl or whatever it is.
[01:07:25] Viktor Petersson
Lib opens cell or whatever it is.
[01:07:27] Daniel Stenberg
That it actually doesn't say the project.
[01:07:30] Viktor Petersson
All right, fair enough.
[01:07:31] Daniel Stenberg
Yeah, 23, 47.
[01:07:35] Daniel Stenberg
Fair enough.
[01:07:37] Viktor Petersson
But it depends.
[01:07:38] Viktor Petersson
But it's illustrated as well, right?
[01:07:40] Viktor Petersson
It is.
[01:07:41] Viktor Petersson
It's starting on the show of giants at the end of the day.
[01:07:44] Daniel Stenberg
Exactly.
[01:07:44] Daniel Stenberg
And there are so many of those tiny little pillars, too.
[01:07:47] Daniel Stenberg
So there's not only one little pillar somewhere.
[01:07:49] Daniel Stenberg
There are a bunch of those tiny little pillars.
[01:07:52] Viktor Petersson
Exactly, exactly.
[01:07:54] Viktor Petersson
Well, I unfortunately don't think we're going to solve the problem of open source funding on this call, but this has been a lot of fun for me and I really thankful for the work you're doing on curl.
[01:08:07] Viktor Petersson
I've been a fan for a long time, so I was very happy to get you on the call.
[01:08:10] Viktor Petersson
So anything you want to shout out before we wrap up the call today?
[01:08:16] Daniel Stenberg
No, I don't think so.
[01:08:17] Daniel Stenberg
Join the curl project.
[01:08:18] Daniel Stenberg
Help us do things.
[01:08:20] Viktor Petersson
Amazing.
[01:08:22] Viktor Petersson
I believe you.
[01:08:23] Viktor Petersson
Good stuff.
[01:08:24] Viktor Petersson
Perfect.
[01:08:24] Viktor Petersson
Thank you so much, Daniel, and talk to you soon.
[01:08:27] Viktor Petersson
Cheers.
[01:08:28] Viktor Petersson
Bye.

Found an error or typo? File PR against this file or the transcript.