The challenge of maintaining curl [LWN.net]

Benefits for LWN subscribers

The primary benefit from subscribing to LWN
is helping to keep us publishing, but, beyond that, subscribers get
immediate access to all site content and access to a number of extra
site features. Please sign up today!

Keynote sessions at Open Source Summit events tend not to allow much time for
detailed talks, and the 2025 Open
Source Summit Europe did not diverge from that pattern. Even so,
Daniel Stenberg, the maintainer of the curl
project, managed to cram a lot into the 15 minutes given to him.
Like the maintainers of many other projects, Stenberg is feeling some
stress, and the problems appear to be getting worse over time.

Curl, he began, is “a small project with a big impact“. It began in
1996 with all of 100 lines of code; it has since grown to 180,000
lines that have been contributed by 1,400 authors. In any given month,
there are 20-25 developers who are actively contributing to curl. The
project has exactly one full-time employee — that being Stenberg himself.

The program is widely used, having been deployed in at least one-billion
devices. Just about anything that occasionally connects to the net, he
said, uses curl to do it. But using curl is different from supporting its
development. As an example, he put up a slide listing the 47 car brands
that use curl in their products; he followed it with a slide listing the
brands that contribute to curl. The second slide, needless to say, was
empty. (A version of both slides can be seen on this page).

Companies tend to assume that somebody else is paying for the development
of open-source software, so they do not have to contribute. He emphasized
that he has released curl under a free license, so there is no legal
problem with what these companies are doing. But, he suggested, these
companies might want to think a bit more about the future of the software
they depend on.

Open-source software is the best choice, he said, but maintaining it is a
tough job. Most projects out there have a single maintainer, and that
person is often doing the work in their spare time, without funding.
Maintenance involves a lot of tasks, including taking care of security,
reviewing patches, writing documentation, keeping the web site going,
administering the mailing list, and a long list of other tasks.
Occasionally, if a little time is left over, it might also be possible to
do a bit of feature development. That is a lot for one person to
keep up with.

Companies have a certain tendency to make things worse. He put up an
excerpt of a message from Apple support, referring a customer to the curl
project for help with their (Apple) device. He has received demands from
companies for
information on the project’s development and security practices, often with
tight deadlines for a response. He typically replies by sending back a
support contract; that usually results in never hearing from the company
again, he said. More recently, he has been getting demands from European
companies seeking information on the curl project’s Cyber Resilience Act
compliance practices.

Some communications are rather less humorous than that; one email
came with a subject reading “I will slaughter you“. He gets emails
from people who found his address in the license notices shipped with their
automobiles asking for support. But he also gets nice thank-you emails at
times.

Problematic email takes other forms as well. There is an increasing crowd
of people who ask a large language model to “find a problem in curl,
make it sound terrible“, then send the result, which is never correct,
to the project, thinking that they are somehow helping. Dealing with these
useless problem reports takes an increasing amount of time.

Recently, the curl project, like many operators of web sites, has been
contending with distributed denial-of-service attacks by scrapers run by AI
companies. He put up a link to LWN’s article
on this problem for those who are unfamiliar with it. The curl site
consumes a massive amount of bandwidth every month, but only 0.01% of that
is source downloads. Most of the rest is bot traffic. That, too, adds to
the difficulty of maintaining the project.

He concluded the brief talk with one last email; it was from an 11-year-old
child who had found curl useful in some project they were working on. It
included an expression of gratitude that, Stenberg said, was truly
heartwarming.

[Thanks to the Linux Foundation, LWN’s travel sponsor, for supporting our
travel to this event.]

Keep your files stored safely and securely with the SanDisk 2TB Extreme Portable SSD. With over 69,505 ratings and an impressive 4.6 out of 5 stars, this product has been purchased over 8K+ times in the past month. At only $129.99, this Amazon’s Choice product is a must-have for secure file storage.

Help keep private content private with the included password protection featuring 256-bit AES hardware encryption. Order now for just $129.99 on Amazon!

Help Power Techcratic’s Future – Scan To Support

If Techcratic’s content and insights have helped you, consider giving back by supporting the platform with crypto. Every contribution makes a difference, whether it’s for high-quality content, server maintenance, or future updates. Techcratic is constantly evolving, and your support helps drive that progress.

As a solo operator who wears all the hats, creating content, managing the tech, and running the site, your support allows me to stay focused on delivering valuable resources. Your support keeps everything running smoothly and enables me to continue creating the content you love. I’m deeply grateful for your support, it truly means the world to me! Thank you!