The state of curl 2024 by Daniel Stenberg from curl up 2024

Daniel talks about the state of the project.

1. 2024
the state of curl

2. Growth and size
Quality and testing
Commits
Newcomers and oldies
Releases
Activity
Users' view
Money
Less Good
My role
Future
@bagder

3. @bagder
26 years

4. @bagder
Growth and size

5. @bagder
At 167K LOC and climbing
20K more than last year

6. @bagder@bagder@bagder

7. @bagder @bagder@bagder

8. @bagder @bagder@bagder

9. @bagder @bagder@bagder

10. @bagder
28 transfer protocols
no change since last year

11. @bagder @bagder

12. 28 transfer protocols
TCP
UDP
TLSSSH
QUIC
HTTP
HTTPS
TFTP
FTP
IMAP
SMTP
POP3
GOPHER
TELNET
DICT
RTSP
RTMP
SMB
LDAP
SFTP
SCP
FTPS
IMAPS
SMTPS
POP3S
RTMPS
SMBS
LDAPS
@bagder
MQTT
GOPHERS
WS
WSS FILE
file
system

13. @bagder
36 third party dependencies
–1 +1 since last year

14. @bagder@bagder@bagder

15. @bagder
operating systems

16. 101 operating systems
@bagder
Syllable OS TPFTizenSymbian Tru64SunOS tvOS
ucLinux
Genode Hurd
iOSIntegrityIllumos
HP-UXHardenedBSDHaiku
z/OS
Nintendo
Switch
NonStop OSNetWare
MorphOS MPE/iX MS-DOS
NCR MP-RAS NetBSD
RISC OSRedox
ReactOS
Sailfish OS SCO Unix Serenity SINIX-Z
Qubes OS
UnixWare WebOSvxWorksVMS
Windows
UNICOS
Windows CE
Wii System
Software
AmigaOS Blackberry 10BeOSAndroid
Blackberry
Tablet OS
AIX
Cell OS
Aros
IRIX
RTEMS
Mbed Micrium
macOSMac OS 9Linux Lua RTOS
eCOS
FreeRTOSFreeBSD
FreeDOS
Fuchsia
DragonFly
BSD
ROS
Cisco IOS
OpenBSD
OS/2 OS/400
Ultrix
ipadOS
NuttX
Solaris
Xbox
System
Chrome OS
MINIX
Garmin OS
QNX
PlayStation
Portable
Plan 9OS21
OpenStep
Orbis OS
z/TPF
z/VM z/VSE
Operating systems known to have run curl
Atari FreeMiNT
DR DOS
Sortix
Zephyr
watchOS
Xenix
DG/UX
ArcaOS
Wii U
SkyOS
Wear OS
MeegoMaemo Moblin
NextStep
CheriBSD

17. @bagder
CPU architectures

18. 28 CPU architectures
@bagder
Nios
ARMARCAlpha
Itanium
m88k
m68k
OpenRISC
RISC-VPowerPC
POWER
AVR32
MicroBlaze
s390 SPARC
x86VAXTilera
SH4
MIPS
CPU architectures known to have run curl
HP-PAETRAX LoongArch
CompactRISC
Elbrus
Xtensa z/arch
C-SKY

19. @bagder
2 planets
no change since last year

20. 2 planets
@bagder
Planets known to have run curl

21. @bagder
12 TLS backends
-2 since last year

22. @bagder @bagder@bagder

23. @bagder
259 command line options
+9 since last year

24. @bagder @bagder@bagder

25. @bagder
305 curl_easy_setopt options
+3 since last year

26. @bagder @bagder@bagder

27. @bagder
94 API calls
+3 since last year

28. @bagder @bagder@bagder

29. @bagder
Quality and testing

30. @bagder
C!
Efficient and portable!
Some security problems could be avoided using something
else
Lots of “reach” would also be avoided
Mitigations: readable code, reviews, tests, fuzzing, static
code analyzing

31. @bagder
OSS-Fuzz
Flatlined the last several years – nothing new is reported
We need more entry points to get more out of fuzzers

32. @bagder
1834 test cases
+178 (10.7%) since last year

33. @bagder @bagder@bagder

34. @bagder @bagder@bagder

35. @bagder
10,051 bugfixes
+1184 (+13.3%) since last year

36. @bagder @bagder@bagder

37. @bagder
136 CI jobs *
+15 (+12.4%) since last year

38. @bagder @bagder@bagder

39. @bagder @bagder@bagder

40. @bagder @bagder

41. @bagder
Commits, frequency and whom

42. @bagder @bagder@bagder

43. @bagder @bagder@bagder

44. @bagder @bagder@bagder

45. @bagder @bagder@bagder

46. @bagder @bagder@bagder

47. @bagder @bagder@bagder

48. @bagder @bagder@bagder

49. @bagder
Newcomers and oldies

50. @bagder
3,151 contributors
+310 (+10.9%) since last year

51. @bagder @bagder@bagder

52. @bagder
1263 authors
+129 (+11.3%) since last year

53. Top-20 curl authors
last twelve months
855Daniel Stenberg
222Stefan Eissing
209Viktor Szakats
148Dan Fandrich
73Jay Satiro
20Patrick Monnerat
14Emanuele Torre
11Evgeny Grin (Karlson2k)
11Nicholas Nethercote
8Marcel Raad
7 Michał Antoniak
6 Christian Schmitz
6 Karthikdasari0423
6 Loïc Yhuel
6 dependabot[bot]
5 Graham Campbell
5 Philip Heiduck
5 Richard Levitte
4 Daniel Gustafsson
4 Jacob Hoffman-Andrews
@bagder

54. Retention
Out of the all-time top-20 authors
13 authored commits within the last 12 months
17 authored commits within the last 24 months
@bagder

55. The curl committers last 12 months
1359Daniel Stenberg
217 Viktor Szakats
139Dan Fandrich
109Jay Satiro
6Marcel Raad
3Daniel Gustafsson
3Marc Hoersken
2Michael Kaufmann
2Stefan Eissing
@bagder

56. @bagder @bagder@bagder

57. @bagder @bagder@bagder

58. @bagder @bagder@bagder

59. @bagder @bagder@bagder

60. @bagder @bagder@bagder

61. @bagder @bagder@bagder

62. surviving authors right now
628 individual authors
89 single-line authors
99 have more than 100 lines
14 have more than 1,000 lines
3 have more than 10,000 lines
right now - will of course change
@bagder
1 Daniel Stenberg: 80555 (42.07%)
2 Stefan Eissing: 32296 (16.87%)
3 Yang Tse: 10345 (5.40%)
4 Patrick Monnerat: 8862 (4.63%)
5 Steve Holme: 8491 (4.43%)
6 Jay Satiro: 3737 (1.95%)
7 Viktor Szakats: 2819 (1.47%)
8 Nikos Mavrogiannopoulos: 1993 (1.04%)
9 Dan Fandrich: 1665 (0.87%)
10 Pavel Raiskup: 1239 (0.65%)
11 Jan Venekamp: 1086 (0.57%)
12 Nick Zitzmann: 1056 (0.55%)
13 Stephen Farrell: 1023 (0.53%)
14 Marc Hoersken: 1015 (0.53%)
15 Marcel Raad: 957 (0.50%)
16 Evgeny Grin (Karlson2k): 952 (0.50%)
17 Bill Nagel: 897 (0.47%)
18 Max Mehl: 886 (0.46%)
19 Gilles Vollant: 774 (0.40%)
20 Michael Kolechkin: 752 (0.39%)

63. @bagder
Maintainers

64. The 18 in the GitHub curl org
Björn Stenberg
Dan Fandrich
Daniel Gustafsson
Daniel Stenberg
Gisle Vanem
Jakub Zakrzewski

@bagder
James Fuller
Jay Satiro
Kamil Dudka
Marc Hörsken
Marcel Raad
Max Dymond

Michael Kaufmann
Nick Zitzmann
Sergei Nikulov
Stefan Eissing
Tatsuhiro Tsujikawa
Viktor Szakats

65. Adding and removing
Idle members (create alumni team without rights?)
What is “idle” ?
New eager contributors?
Vague requirements
Vague responsibilities
@bagder

66. bus factor
@bagder

67. @bagder
Releases

68. @bagder @bagder@bagder

69. @bagder @bagder@bagder

70. @bagder @bagder@bagder

71. @bagder
Activity

72. @bagder @bagder@bagder

73. @bagder @bagder@bagder

74. @bagder @bagder@bagder

75. @bagder @bagder@bagder

76. @bagder @bagder@bagder

77. @bagder
Security
(separate session)

78. @bagder
The users’ view

79. Annual user survey
What is used, what is ignored
What is good, what is bad
What should be added, what should be removed
How are we doing
Will run mid-May 2024
What should we ask users this year?
@bagder

80. curl.se web traffic May 2024
Fastly makes our lives easier - since 2017
454 TB the last 12 months (up from 358 TB)
720 M requests/day on average
Fast web site, close to most users
No ads, no logs, no cookies, no tracking, very little stats
Did I mention Fastly is good?
@bagder

81. Google trends 5-year span, worldwide
@bagder
Includes wget and OpenSSL to provide references with similar projects
Wget OpenSSL curl
Snapshot from April 22 2024

82. GitHub
34,100 GitHub Stars
6,150 forks
15,000 git clones/day (one every 6 seconds)
@bagder

83. @bagder
Twenty billion installations

84. @bagder
curl runs in all your devices

85. @bagder
Money

86. @bagder
Finances and sponsors
curl is not a legal entity
Open Collective holds our funds
Daniel is employed by wolfSSL
wolfSSL offers commercial curl services
@bagder

87. @bagder
Main sponsors
@bagder

88. @bagder
Gold sponsor
@bagder

89. @bagder
Balance April 22, 2024
$158,609.10 USD

90. @bagder
Top financial contributors

91. Expenses
curl.se hosting
curl up – travel and lodging
Stickers – getting and shipping merchandise
Development (how?)
More?
@bagder

92. Sponsored
curl.se CDN (Fastly)
CI services (Teamviewer, GitHub)
Anycast DNS (kirei)
Bug-bounty (Internet Bug Bounty)
@bagder

93. curl up 2024 expenses
we failed borrowing a venue
venue fee, food, travel + lodging expenses
in the 6-7,000 USD range
@bagder

94. @bagder
Other news in and around the project

95. @bagder
Removals
NSS
gskit
NTLM_WB

96. @bagder
EXPERIMENTAL
Graduated: HTTP/3 with ngtcp2
Added: ECH
Maturing: Hyper, rustls, WebSocket, other h3 backends

97. @bagder
documentation improvements
curldown everwhere
spellchecked and proselinted
now in present tense

98. @bagder
audits
Trail of Bits performed a security audit of curl's
HTTP/3 components, published in February

Trail of Bits performed a security audit of curl
source code and internals, published in
December 2022.

99. @bagder
curl core team
Was never formalized before
Same as the security team for now

100. @bagder
everything curl
now under the curl org on GitHub
110,000 words
now self-hosted
https://github.com/curl/everything-curl/issues

101. @bagder
The curl-distros mailing list
Any discussion and subject that helps curl distributors
coordinate, cooperate and enhance curl packaging for end
users are welcome on this list!

102. @bagder
CNA
curl now manages its own CVE Ids
OSS CNA Users Group
(more in a separate session)

103. @bagder
parse, manipulate and output URLs and parts of
URLs
@bagder

104. @bagder
Less good

105. @bagder
Less good
❌ Flaky CI
❌ Slow CI
❌ Vulnerabilities
❌ Regressions
❌ Test gaps
❌ Could use more people who stick around
@bagder

106. @bagder
My (Daniel’s) role

107. @bagder
What I think I do for curl
I help keeping the vision – what curl and
libcurl should do
I do curl development and fix problems –
for fun and profit
I support users and developers
experiencing problems or bugs
I review code and suggestions
I’m guiding the architecture of existing
and future features
I document how things work and should
work
I inform project members and the
outside world about news and things we
work on
I aim to master the protocols curl works
with
I admin and host the web site, mailing list
and random services
I often serve as a public face for the
project. It is sometimes said to be “mine”
(it isn’t)
I talk about the project publicly

108. curl for
business
curl for fun
Me, curl and wolfSSL
@bagder

109. BDFL
Benevolent Dictator For Life
I am a dictator of sorts
I want to make decisions and act on them based on consensus
When possible
For life?
@bagder

110. Future
@bagder

111. Everything will be networked
If it isn’t powered now, it will be soon
If it is powered, it will be networked
If it is networked, it needs Internet access
If it needs Internet access, curl can help
@bagder@bagder

112. @bagder
more everywhere
@bagder
stuff
time

113. @bagder
is curl sustainable?

114. @bagder
We are not done yet