The state of curl 2022
•
0 gefällt mir•46 views
For curl up 2022, Daniel summarizes the past year, what the curl project did, what it does and maybe what it will do next.
Empfohlen
Empfohlen
Weitere ähnliche Inhalte
Ähnlich wie The state of curl 2022
Ähnlich wie The state of curl 2022 (20)
Mehr von Daniel Stenberg
Mehr von Daniel Stenberg (20)
Kürzlich hochgeladen
Kürzlich hochgeladen (20)
The state of curl 2022
- 1. The state of curl 2022
- 2. Growth and size Quality and testing Commits Newcomers and oldies Releases Activity Vulnerabilities Users' view Money The last 12 months Less Good My role Future @bagder
- 4. @bagder At 145K LOC and climbing no change since last year
- 6. @bagder 26 transfer protocols no change since last year
- 8. @bagder 36 third party dependencies –1 +1 since last year
- 10. third party world map June 2022 I/O layer URL parser libidn2 winidn HTTP TLS OpenSSL gskit mbedTLS wolfSSL Schannel Secure Transport GnuTLS NSS boringssl libressl AmiSSL SFTP SCP LDAP WinLDAP OpenLDAP RTMP librtmp Name resolver c-ares compression libz brotli cookies libpsl IMAP SMTP POP3 HTTP/2 nghttp2 authentication winsspi Heimdal MIT kerberos HTTP/3 quiche ngtcp2 HTTP/1 SSH wolfSSH libssh2 libssh @bagder BearSSL nghttp3 zstd FTP Hyper FTPS IMAPS POP3S SMBS SMTPS GOPHERS HTTPS LDAPS RTMPS libgsasl rustls msh3
- 11. @bagder 86 operating systems no change since last year
- 12. operating systems @bagder Syllable OS TPF Tizen Symbian Tru64 SunOS tvOS ucLinux Genode Hurd iOS Integrity Illumos HP-UX HardenedBSD Haiku z/OS Nintendo Switch NonStop OS NetWare MorphOS MPE/iX MS-DOS NCR MP-RAS NetBSD RISC OS Redox ReactOS Sailfish OS SCO Unix Serenity SINIX-Z Qubes OS UnixWare WebOS vxWorks VMS Windows UNICOS Windows CE Wii System Software AmigaOS Blackberry 10 BeOS Android Blackberry Tablet OS AIX Cell OS Aros IRIX LineageOS Mbed Micrium macOS Mac OS 9 Linux Lua RTOS eCOS FreeRTOS FreeBSD FreeDOS Fuchsia DragonFly BSD Cygwin Cisco IOS OpenBSD OS/2 OS/400 Ultrix ipadOS NuttX Solaris Xbox System ChromeOS MINIX Garmin OS QNX PlayStation Portable Plan 9 OS21 OpenStep Orbis OS z/TPF z/VM z/VSE Operating systems known to have run curl Atari FreeMiNT
- 13. @bagder 22 CPU architectures no change since last year
- 14. CPU architectures @bagder x86 MIPS ARM PowerPC SPARC POWER m68k s390 HP-PA SH4 Nios RISC-V OpenRISC ARC Cell Itanium VAX MicroBlaze Alpha Xtensa x86-64 AVR32 CPU architectures known to have run curl
- 15. @bagder 2 planets no change since last year
- 16. Planets @bagder Earth Mars Planets known to have run curl
- 17. @bagder 13 TLS backends -1 since last year
- 19. @bagder 248 command line options +6 since last year
- 21. @bagder 295 curl_easy_setopt options +7 since last year
- 24. @bagder C! Efficient and portable! Some security problems could be avoided using something else Lots of “reach” would also be avoided Mitigations: readable code, reviews, tests, fuzzing, static code analyzing
- 25. @bagder OSS-Fuzz Flatlined the last few years – nothing new is reported CI-Fuzz runs a little fuzzing on every commit / PR We need more entry points to get more out of fuzzers
- 26. @bagder 1509 test cases +85 (5.9%) since last year
- 28. @bagder 7857 bug-fixes +1024 (+15.0%) since last year
- 30. @bagder 107 CI jobs * +13 (+13.8%) since last year
- 33. @bagder @bagder
- 34. @bagder Commits, frequency and whom
- 42. @bagder Top-20 curl commit authors last twelve months 840 Daniel Stenberg 64 Jay Satiro 51 Daniel Gustafsson 35 Marc Hoersken 29 Tatsuhiro Tsujikawa 27 Marcel Raad 20 Patrick Monnerat 19 Michał Antoniak 16 Josh Soref 14 Viktor Szakats 13 Fabian Keil 12 Gergely Nagy 11 Philip H 9 Harry Sintonen 8 Dan Fandrich 8 Henrik Holst 7 Gisle Vanem 6 Jacob Hoffman-Andrews 6 Jan Venekamp 6 Kevin Adler @bagder
- 44. @bagder 2639 contributors +256 (+10.7%) since last year
- 46. @bagder 1034 authors +134 (+14.9%) since last year
- 50. @bagder Releases
- 53. @bagder Activity
- 61. @bagder 34,660 USD bug-bounty in total +25,660 (+385%) USD since last year
- 63. @bagder Lessons recent vulnerabilities C mistake mitigations might have had an effect Flaws linger in the code a very long time until detected Fuzzing is king Fixing the flaws is usually straight-forward Raised bounties thanks to Internet Bug Bounty
- 65. @bagder Annual user survey What is used, what is ignored What is good, what is bad What should be added, what should be removed How are we doing
- 66. @bagder User survey 2022 Just ran, not analyzed yet 😢
- 67. @bagder curl.se web traffic June 2022 Fastly makes our lives easier 278 TB the last 12 months (up from 146 TB) 103.8 M requests/day on average (up from 11.4 M) Fast web site, close to most users No logs, no tracking, very little stats Did I mention Fastly is good?
- 68. @bagder Google trends 5-year span, worldwide Includes wget and OpenSSL to provide references with similar projects Wget OpenSSL curl Snapshot from May 26 2022
- 71. @bagder Everyone uses curl Apps: Youtube, Google Photos, Skype, Spotify, ... OS: iOS, Android, macOS, Windows, Linux, ChromeOS, AOSP, ... Cars: 22 top brands. Mercedes, BMW, Toyota, Nissan, Volkswagen, … Game consoles: PS5, PS4, Nintendo Switch, ... Games: Fortnite, Red Dead Redemption 2, Spider Man, … The Mars 2020 Helicopter project Estimate: 10+ billion installations
- 72. @bagder Money
- 73. @bagder Finances and sponsors curl is not a legal entity Open Collective holds our funds Daniel is employed by wolfSSL wolfSSL offers commercial curl services @bagder
- 76. Silver sponsors June 2022 @bagder @bagder
- 77. @bagder Balance May 26, 2022 $123,459.06 USD (+40,863 since last curl up)
- 78. @bagder Expenses curl.se hosting curl up – travel and lodging Stickers – getting and shipping merchandise Bug bounties More?
- 79. @bagder Done the last 12 months
- 80. @bagder 1024 bug-fixes 29 changes 18 CVEs
- 82. @bagder News in libcurl msh3 as a new h3 backend percent-escaping for multipart form field and file names curl_url_strerror() localhost is “fixed” cookies over localhost considered secure dropped metalink support dropped mesalink support Increased hyper support
- 83. @bagder Command line tool --no-clobber --remove-on-error --json More --write-out magic: %header{} %{header_json}
- 84. @bagder Test suite unix socket support for http server numerous more “testable features”
- 85. @bagder Other news in and around the project
- 86. @bagder Daniel - a GitHub star Recognition Channel for previews and communication
- 87. @bagder Travis CI No longer free to use for us Added Zuul and Circle CI Distributed old Travis jobs to other services Then Zuul turned bad - in a different way
- 88. @bagder everything curl At 92,000 words +19,000 words since last curl up
- 89. @bagder Less good Flaky tests/CI still Slow CI tests sometimes Vulnerabilities are still reported yes but... Still regressions, but less frequently? happens Could use more people who stick around always @bagder
- 91. @bagder What I do here I help keeping the vision – what curl and libcurl should do I do curl development and fix problems – for fun and for customers I support users and developers experiencing problems or bugs. I review code and suggestions I’m guiding the architecture of existing and future features I document how things work and should work I inform project members and “the outside world” about news and things we work on I aim to master the protocols curl works with I admin and host the web site, mailing list and random services I often serve as a “public face” for the project. It is sometimes said to be “mine” (it isn’t) I talk about and “market” the project in many places and ways
- 92. curl for business curl for fun Me, curl and wolfSSL @bagder
- 93. Future @bagder
- 94. Everything will be networked If it isn’t powered now, it will be soon If it is powered, it will be networked If it is networked, it needs Internet access If it needs Internet access, curl can help @bagder @bagder
- 97. @bagder TODO? I have a personal list of things I want to work on I hope to do more curl work for hire What do you want to see?
- 98. @bagder Talk to us! I’m @bagder on Twitter We’re in #curl on libera.chat IRC File bug reports: https://github.com/curl/curl/issues Submit pull-requests: https://github.com/curl/curl/pulls Security problems: https://hackerone.com/curl Mailing lists: curl-users for command line tool questions and support curl-library for libcurl users, development, debugging, architecture, new stuff. https://curl.se/mail/