For Inside Security episode number 17 I had the honor of getting Daniel Stenberg on the podcast! He is possibly more known as bagder, but definately even more known for being the creator of curl. We had a really good timing talking about the origins of curl, how it started and the route it followed. In the end we do the classic “overrated/underated” and Daniel faced some tricky decicions .. check it out!
The youtube interview with Daniel Stenberg:
Here is a full transcript of the interview if you rather read it:
Mikael:
Here we go inside security episode number 17. This is actually the first episode, and I’m not live streaming on Twitch, so unfortunately we won’t have the amazing Twitch chat interacting with interesting questions. But I do think we will still have a really interesting episode coming up. So the guest of today is the creator of something that you’re almost guaranteed to interact with or use on a daily basis without even thinking about it. And it’s so cool to have you here, the creator of CURL. Welcome. [inaudible]. It’s so good to have you here. I’ve been wanting to have you on for quite some time, so I finally asked them and then you said yes, which is awesome. So I figured just to sort of set the, the ground and the baseline straight. So I think that a lot of people actually don’t really know what Curl is, or perhaps they only use Curl to just fetch data from a url and that’s it. So being the creator of curl, if you had to describe it in like one or two sentences, what would that be? And then also sort of touch upon in which devices is CURL typically being used in
Daniel Stenberg:
Not even my family members fully understand what it is and what I do, but <laugh>. So, so what I, what I try to sort of, when I start with it, of course I work with software engineering stuff, you know, I’m a software, blah, blah. So I write code and people usually have some idea about that. And then I go into, well, so Curl is command line tool, LibCurl is that library, and it’s an, it, I, I usually try to call it as an internet transfer engine component module, something that does internet transfers for others. So it’s usually that something wants to do internet transfers. And of course, typically you don’t know, why would you want internet transfers for, so people don’t actually understand that you’re, you know, your car actually has to download maps to get the maps to your car or your, your fridge can’t show the recipe on this, on the, you know, on the door without getting that.
So people haven’t really thought about that, but I’m trying to then to say that Curl is that little engine that helps the alert applications to, to do that internet transfer, send data or get data, and that is what Curl tries to be focused on that particular thing. Internet transfers using one of those protocols he supports specified as url. Actually, that’s what, that’s part of the name, right? “C URL”. so that, that is how I try to phrase it, is typically people don’t really understand anyway, so sort of yeah, <laugh> there’s something with internet and software.
Mikael:
I heard internet
Daniel Stenberg:
<Laugh>. Exactly. Yeah. I I’ve used internet
Mikael:
<Laugh>. Yeah, I Know internet.
So can you help me with my printer? No,
Daniel Stenberg:
<Laugh>.
Okay. So, but then of course, so Lib Curl is that library that was, we’ve been working on for quite a while. I actually, I think we released the first, the Curl We, we ship curl under the name Curl in, in, in spring 1998. And we sort of remodeled it and made a library in, in the, in the summer of 2000. So it’s been well, a little over 21 years we have had this library. And since we’ve shipped the library, it’s been adopted and, and deployed in lots of places. I mentioned cars. So pretty much all, all brands of modern cars have curl in them. You know, it’s so curly is now in all servers. It’s shipped by default in Windows, in Mac, in all Linux servers. It’s used by a lot of apps in, in phones. It’s used in in phone operating systems. It’s basically used in all operating systems you can imagine, or, or even iOS, Android, Chrome os and, and yeah, everything. And more and more in all sorts of devices like watches and TVs, streaming devices. Yeah. So it’s literally everywhere, all over the place. There’s actually very few internet connected devices then that don’t have curl in them. So we estimate that there’s somewhere around 10 billion installations of Curl Worldwide, or well give or take is really hard estimate, but in, in that vicinity. So it’s an insane amount of curl everywhere.
Mikael:
Yeah, it’s, it’s, that’s everywhere. So imagine like playing with the idea that curl just sort of broke, like the internet would break, right?
Daniel Stenberg:
Yeah. That would <laugh> be really bad. <Laugh>,
Mikael:
Yes. Yeah. I mean that, that, that might be sort of a way to understand it quite good as well. I think if curl broke, like everything would just break.
Daniel Stenberg:
Yes. But, but unfortunately, but, but fortunately it is, it is usually used in, in constrained use cases in many different places. So usually even if it would break in one particular device, it’s not necessarily that it’s going to break in another device using it for, it’s like a different purpose. Mm-Hmm. <affirmative>. So, so at least it’s, they’re usually I should call it, you know, separated installs, sometimes separated, build, separated version separated. So yeah, I would say that the risk that they all would break at some point at, you know, in unison, that wouldn’t, that won’t happen. Of course. It can break anyway.
Yeah. So a, a question I, I rarely get to ask someone who’s, who’s created something. How many planets has Curl been used on
<laugh>? Two? Two
Mikael:
So far,
Daniel Stenberg:
Right? Number of planets Two. Yes, exactly. Two so far. That’s pretty, but, and, and I actually don’t know about the moon, but that’s not a planet either, so, yeah. But I, I’ve, I, I know for a fact and it’s been confirmed that they’ve used it on the helicopter Mars Landing project, so I know it’s been used on Mars and on Earth. So yes, it’s a pretty cool achievement actually.
Mikael:
<Laugh>, that’s really cool. <Laugh> and that, that’s something that quite few people get to say, right?
Daniel Stenberg:
Yes. Yes. Exactly.
Mikael:
So, okay, so you created Curl, well, you started with it in 98, right? But how did you get into computers at all to start with?
Daniel Stenberg:
Well, I, I’m an old guy. I started long before that, so I, I got it into Commodore 64 in the eighties. So I at the first, well, the one, one of those early waves of home home computers, and I’ve sort of got stuck with it immediately, sort of fascinated by that, you know, you can control the computer to do what you want if you just learn how to, so I, I was fascinated by programming and, and doing things pretty much from the beginning. And then I sort of stuck with me and know, got into spending a lot of my spare time hours on, on programming early on, and then it’d just been like that since then. <Laugh> never stopped.
Mikael:
That’s, that’s really cool. So do you think it’s sort of it touches on your creative mind or it just to actually create something? Or, or Yes,
Daniel Stenberg:
It is an act of creating something and, and sort of yeah, it’s a little like, like building with Lego when you were a kid pre, pretty much, you have all the pieces, you can make it whatever you want, as long as you just put your mind into it and, and making sure you sort of stick to it and make sure that it happens. So I think it’s, it’s that par at least part of it is that sort of creativity to make, make something, and then also it’s, it’s the next level then, so that when you’ve created something that actually see that someone else appreciates it as well, and they sort of tell you, maybe you should do it this way too and do that, and you get that sort of loop and they Yeah. Well, the positive circle sort of, so they say something like, get more users, and that sort of inspires you to keep on going.
Mikael:
Yeah, I can imagine that.
Daniel Stenberg:
So the, the feedback is also very important, the positive feedback, because if nobody ever would use it, nobody ever would like it, then maybe I would’ve grown bored and just, you know, I’ll do something else instead.
Mikael:
Yeah. That has to be one of most positive things doing open source projects, right?
Daniel Stenberg:
Yes, yes, it certainly is. So, and that sort of helps keep, keep the motivation up and actually motivates me to keep going and keep fixing things, keep adding things.
Mikael:
So how, how did you, how did you create Curl from scratch? Like what was your background to it? Like why, why even start making something?
Daniel Stenberg:
Well, I, I I had, I worked on another project at the time in, actually back in 1996. I wrote an I R C bot together with some friends. So we had a bot that’s the early EFnet days on irc. And then, then we had yeah, there were actually pretty wilding crazy days on irc a lot of attack bots and a lot of takeovers of channels and stuff like that. So we were actually writing a bot to help us protect our chat channels. Yeah. But anyway, so one of these days it struck me, well, wait a minute. So wait, were an international bunch on that IRC channel talked, I think we were, I talked a lot of AMIGA in those days because it was sort of in my AMIGA days. Anyway, so we were, you know, international crowd before the Euro as well.
So there were a lot of currencies. So, and, and sometimes we were talking about things and, you know, the price of things and you, how much is the computer of this in your country? So you would, but, you know, currency translation. So it struck me, I should offer that my bot should offer the currency translation. Yeah, of course. How much is 100 US dollars today in Swedish crowns or vice versa, or whatever currency. So sure, easy pc, I just need to get the currency rates from somewhere, you know? And how could you do that? Yeah. Well, they were provided by, I could of course, figure that was 1996. So there were sites that provided currency rates, you know, just a listing currency, this rate converted to dollars or whatever mm-hmm. <Affirmative>. So to, to make sure that my bot could do this, I needed to download that rate, that list the rates, maybe twice a day, once a day.
So I just needed a little tool to do that HTTP download. So how do you do that? And back in that I, I’ve searched … Google wasn’t around. I bet it was AltaVista. I don’t actually remember how I searched for it. So, yeah, so that was years before Google came so, and I found a tool called HTTP Get. Okay. That was, you did an HTTP Get. So, yeah, and I got that tool, and I started with that tool that, and that tool actually was released for the first time in November, 1996. So I sort of found it just weeks or days after it was released the first time. And that was written by a guy from Brazil, and it was just, I think it was about 300 lines of code, very simple, easy piece thing. And of course, doing single HTTP get is very easy.
So and then I got that, and then I, it sort of did what I wanted to, I don’t remember exactly what it was, but I found some bugs and I sent back a patch to the guy, and we started sort of communicating. I extended it a little bit more. I got some of my other bot friends involved, and we started poking on it, and it just took, I, I think it took me a few weeks until the, the Rafael, I think his name is first name who wrote it. He said, well, maybe you can just take it over and, you know, do what you want with it. So I became a maintainer just maybe a month after I started using it. Mm-Hmm. So I started developing that HTTP Get tool to do more things that we wanted to do, you know, added support for proxy and whatever.
It was all, all for that purpose of currency rates. So, and while doing that, I also, one day I realized, wow, you can get currency rates from Gopher. And I found this UN site, I believe it was, that had hundreds of rates. Cool. I want my currency service to have hundreds of rates. That must be much better currency. Of course, most of those currencies, you know, were never used by any one in that chat channel. But anyway, sort of, you know, I could do it. So, oh, oh, gopher, by the way, my, my tool didn’t support Gopher <laugh>. I had to add support for Gopher, so I did that. Gopher, gopher is, is, is not that sort of different than HTTP 1.0 at least. So I did, that was pretty easy. And it just took, I, I don’t remember the timing here exactly, but it just took a little while until I found even more current rates and this time on ftp.
So, ah, okay. Right. But then I just had need to add FTP support as well, <laugh> FTP being quite different than the other protocols. But anyway, <laugh>, I did that. And, and after I’ve done that, actually somewhere in that, in the middle of that, I actually realized, well, wait a minute. This tool is called HTTP Get, but now it does another protocol, several other protocols. It’s sort of nonsensical name. I need to change it. So actually it’s changed the name to URL GET. And then, so worked with that and then had those three protocols, and then one day someone needed FTP upload support as well. I don’t remember exactly why mm-hmm. But we added FTP upload support that in the early 1998, and then suddenly URL GET was also a stupid name because it wasn’t get anymore. You could even, you could do it both ways. Yeah. But then I had to rename the, the tool again. So then I renamed it to CURL in an early 1998. So then I, I shipped it as CURL, I kept, I actually bounced the version number from before, so it actually became Curl 4.0 in, in March, 1998.
Mikael:
Okay.
Daniel Stenberg:
And then it spoke those three protocols, and then it did uploads with ftp and sort of at that point it was about 2000 lines of code. And then I had 24 command line options. I, I know that because I’ve gone back and checked actually, course because, because it’s sort of been such an insane journey since then. So I sort of just for my own sort of pleasure, go back and see what did we actually start with, because we started then, well then in, in early 1998, and we had 2,400 lines of code that has now grown to about 170,000 lines of code in the actual products. And the number of command line options has, has done recent from 24 up to 243. So we’re roughly 10 times the number of options since that day in, in, in 1998.
Mikael:
So do you, do you, do you know all of them by heart?
Daniel Stenberg:
[Inaudible]? No, I don’t. Well, but, but I think if I, if I read it, I have a, I, I think I know most what they do actually and how they work, but I certainly couldn’t remember all of them. A lot of them are, yeah, I mean, there’s quite a few, and a lot of ’em are very niche too. So many of them, you basically only use for specific use case, right. That most users probably never even encounter. So yeah.
Mikael:
What’s the most obscure command line perimeter, like the one that’s been, was rarely used? Do you Know?
Daniel Stenberg:
I can know it, right? Because there’s no statistics or any, we don’t know what people are using, but I would imagine that there are, there’s stuff basically, you know, technologies that are running out of life, you know? Mm-Hmm. For example, we introduced an option for, for a particular way to negotiate HTTP/2 in the beginning, in, in 2012, I believe. Mm-Hmm. <affirmative>. And that was a technology that was basically deserted after a few years. So that’s called NPN and so there’s an option to enable disabled use of NPN, but basically that’s totally useless today because there’s probably no service around anymore that supports it even says, yeah, it’s just an option. It’s there. We haven’t removed it pointless for most people, but it’s there. And do you,
Mikael:
Do you ever remove options or do we just keep them all
Daniel Stenberg:
I keep them all
Mikael:
<Laugh>,
Daniel Stenberg:
So yes. I don’t, I actually don’t remove,
Mikael:
Yeah.
Daniel Stenberg:
Yeah. It’s, it’s sort of, okay. That’s actually not entirely true <laugh>, but <laugh>, that’s the story I go with. Yeah. No. So I, I actually, I, I, I, I do my very best to never remove them. I should put it like that. Okay. Because it, I actually removed one last year.
Mikael:
Oh, right.
Daniel Stenberg:
Because of basically of security reasons, I didn’t actually remove it. The option is still there, but it’s basically refuses to work if you use it
Mikael:
<Laugh> Okay.
Daniel Stenberg:
So otherwise we make a really big effort to make sure that we, whatever we introduce, we keep supporting well indefinitely, really. So that, so that you can rely on, at whatever point you upgrade CURL, you should know that it will continue working exactly as it did before. And the same goes with Lib curl. So we make a, an immense effort and to make sure that it just will continue working like it did before even when you upgrade.
Mikael:
Yeah. So if you upgrade you, you are not breaking anything.
Daniel Stenberg:
No, exactly. And so you should always be able to upgrade without any negative consequences.
Mikael:
Yeah.
Daniel Stenberg:
Positive, ideally, but <laugh>.
Mikael:
So, I mean, going, going from there with CURL, was this an overnight success at some point, or was it some tipping point where like usage sort of dramatically increased or has come gradually
Daniel Stenberg:
No, it, it’s really, really gradually mm-hmm. <Affirmative>. So there was never any point in time when suddenly, you know, felt, whoa, I, I made it. It was really, really slow. Okay. And only, only ever gradually growing. I have this excellent fun moment when I go back and look at how, how I sort of posted a news item on, on the website in November, 1998. That is well, a little bit half year after I, I wrote Curl the first time. And this says with sort of happy that we had 300 downloads during that month, <laugh>. And I thought, I, I thought I was great, you know, 300 users sort of in, in a single month. So I, I view that as a cool thing and as a good thing, and sort of, I think that sort of also shows the expectations I had in the beginning because Yeah, how would I know?
I mean, how would I know what people want or, or, or, or going to use. So I had no idea what to expect, or I didn’t relate, anticipate it either. So it just went on and on. And also, to be fair we, we made Curl in a pretty good time. So we, of course, we had no idea where the internet was going or the, you know, the web or everything so that we would, but we created Curl, I think, pretty good in a time that sort of followed the wave of websites and internet use in, in society in general. So it’s sort of, we of course followed along. So when everything, you know, expanded and blew up, we also got more users and, and sort of got used more.
Mikael:
Absolutely.
Daniel Stenberg:
So I have this slide in my car presentation as that in 1996, there were 250,000 websites, and today there’s 2 billion. So it’s actually grown by 8,000 times since 1996 when we started. So it has grown significantly more than currently itself has
Mikael:
<Laugh>. Yeah. So they yeah. The places where CURL can be used are quite more <laugh>,
Daniel Stenberg:
<Laugh>. Oh, oh, indeed. Yes. Yes. And at the same time, in the other end too, I mean, that’s website. So at the same time, I mean, in, in the world today, basically everything is networked, right? So whatever we use today, even if it’s not networked today, you can assume that someone is going to make that same product next year and it’s going to be networked, or you know, it’s going to be, have a battery power and Bluetooth or wifi or whatever. So I think we’re only going in forward into future with even more networking. Yeah. And more networking is potential for more curl.
Mikael:
Absolutely. I mean, the, the general consensus seems to be if my product can talk, it should <laugh>,
Daniel Stenberg:
So Yes, exactly. And if it doesn’t talk, we should make sure that it talks because it’s going to be sales pitch, right? Yeah. So whatever you have, if you can make a talk , it’ll be a sales pitch, and then we can sell it for a little bit more money tomorrow. Yeah. And then, and beat our competition
Mikael:
<Laugh>. But I mean, this this increase in usage and of course devices and everything that can be used, it’s, it has its own flip side, right? Cause I’ve seen your Twitter posts with this sort of, and I’m doing air quotes here for the podcast feedback you get. Some are nice, some are just insane ramblings and stuff like Yeah. What’s the what’s the most common thing you get and what’s sort of the most worst stuff you got?
Daniel Stenberg:
Yeah. Okay. So, so first just to, to make, to explain why that happens is because in the, yeah, good. The, the, the current license is a MIT license thing. We actually, for some silly reason and modified it slightly in the, in the early days. So it’s actually not exactly an MIT license. It’s sort of, yeah. Yeah. A few words in it are actually modified, which makes it sort of not match MIT <laugh>. So it’s actually listed often as its own license, but it’s, it’s pretty much an MIT with a few words twisted. So, okay. But that license little thing, just, you know, 40 lines, 30 lines of, of, you know, this English mumbo jumbo legalese, and it says copyright Daniel Stenberg, my email address and so on. And a lot of places they just copy that thing into their, about window or, you know, open source license window or whatever it is, window.
And that usually then contains my email address there. Mm-Hmm. And that is pasted in everywhere. So a lot of cars, for example, you can go to some, you know, obscure window on your car and see open social licenses. And then if you scroll for half an hour, you will get to my email address, <laugh>, you know, they usually insanely long and without any way to search or anything. But for reasons, people then find my email address in all sorts of weirdo products. And I think in many cases my email address is one of the few email addresses around in that product, because people, I don’t think they typically have their own email addresses in those products. I, I’m not, I’m not entirely sure because it’s, it would make sense, right? Right. But so, so there’s, this user is upset because he can’t figure out how to do something in his car.
And, you know, he has tried every sort of, of support channel that he, he or she knows about, and then he scrolls around in different menus in car, and he finds my email address. So, so he has a problem with the, I have this great email somewhere when someone had a problem with his GPS and so yes. Then he emails me and asks me detailed questions about how to configure the GPS in his car, because you know, your address in, in my car, I have a problem with my car. I email you and I have this trick situation, what do I do with this email? Yeah. <laugh> and I’ve, I’ve tried to sort of email back and say, I, sorry, I don’t know what you’re talking about. Car, I, I sort of, and often these manufacturers that you put my code in their products, they haven’t told me about it.
Right? Yeah. So I don’t, I didn’t, I didn’t know that my code was actually in that car or in that watch or in that whatever they’re asking about. So for me, it’s usually a surprise sort of, oh, wait a minute, you’re using that kind of product and you found my you’re asking me why are you asking me about this? I have no idea. So usually it is as we are very far away apart from each other. And if I try to say, you know, I actually don’t know anyone at that company I don’t even know what kind of product you’re talking about. They, they don’t really believe me. Yeah. They, so that, yeah, yeah, yeah. You are saying that, go ahead, talk to your buddies now and ask them to help me help with my gps. So so I usually actually rarely respond to those emails nowadays because I feel that the distance between me and, and the user asking me questions, it’s just too distance. So they don’t believe me, or they, or they don’t understand, or, and I don’t understand the other, so I, I get
Mikael:
It sort of makes sense. I mean, if, if we are stepping away from being technical for a while, and like if, if someone wants to reach someone, like they look for an email address and the first one they find in their product should, in their sense, probably like reach out to someone at that company or the web website or something. So
Daniel Stenberg:
Yeah. I, I agree. So from their point of view, it’s makes sense. Yeah. But I also think it’s actually emphasize the problem is also because they probably also tried the easy solutions, right? So when they find my address, they’re probably not, I’m probably not the first sort of go-to, so I’m probably number 14, you know, they have all disappointments all the way, and then here I come and they’re fed up.
I don’t know, <laugh>. So they’re probably, you know, fed up already. Yeah. No, no, no. Fix this for me. Now you’re silly person in the other end <laugh>. So I, I, I feel a little bit of that sometimes, so that Yeah, yeah. Sort of. Yeah, I’m, I’m, I’m option number eight here. So this, yeah, I can imagine stuff isn’t working. I have no idea what they’re talking about. <Laugh> you know, that, that can often isn’t just confusing for me. Mm-Hmm. <affirmative> often they’re just talking about things I have no idea. And, and sometimes it becomes more of a, from my point of view, more of humor because it’s sort of, sort of it’s ironic or, or I don’t know, sad that they’re actually asking me. Yeah, I understand that it’s not sad from their point of view, but from my point of view, yeah. And I have this excellent thing that I, it’s actually a, a number of years ago now that a woman emailed me and asked me to fix her Instagram account, <laugh>.
It was one of those moments, what are you talking about? Why are you asking me about this <laugh>? Yeah. So and, and then he, she says well I had a hacker friend of mine helped me and he found your address, look. And then he sent, she sent me a screenshot of, of this about window in Instagram that says, curl license, blah, blah, blah. And I, all right, Instagram use says curl Cool. I had no idea. So I tried to explain it well that this is, because, you know, Instagram is the company they’re using Curl and this component in their software. And, and she basically said, yeah, yeah, yeah, yeah. Fix this for me now. Yeah, of course. Let’s talk with your guys at your friends at the Instagram so they can help me fix my account. I said, no, no, no. I don’t know anyone there. And, you know, <laugh>. And then I thought, find a back and forth number of times. And then I thought that I finally had convinced her sort of, I don’t know anyone, I haven’t hacked anything. Yeah. I just write this code. And then sort of she came back again. Aha, you’ve been lying all this time. And then she sent me another screenshot. Look, your name is in Spotify as well,
Mikael:
<Laugh>.
Daniel Stenberg:
So, you know, it can’t be a coincidence. Your name in two, my two apps separately from each other. So certainly you had, you are the one who has actually hacked my phone. Yeah. So now go fix this, or I will tell these companies that you are a hacker and you don’t want that <laugh>.
Yeah. Cause you were in a hacking ring, right?
Yeah, exactly. So, so she is threatened to tell Facebook and, and Spotify that I run this hacking ring, so that at that point I pretty much gave up. So
Mikael:
Yeah. <Laugh>. Well, it sounds like you actually gave it a good try anyway. So
Daniel Stenberg:
In that case, I actually did, I, I did a real, real effort to, to
Mikael:
Sort of for nothing
Daniel Stenberg:
Claim that, I mean, something is or for nothing in the end. Yes. Yeah. And then of course I have a, I mean, it goes from that confused to I’m using things and, and usually they are, they’re in the, that sort of category of just mm-hmm. I’m using confusing thing. And then of course I got this set of death threats like a year ago or so from another also deeply confused person who found my email address in some sort of connection to what he claims wasn’t an attack or a hack of his systems. And he blamed me for having he having lost his home and work and family and everything. And then it turned out very dark and and ugly immediately.
Mikael:
And you, you wrote a blog post about this, right?
Daniel Stenberg:
Yes, I did, but it sort of hit me pretty hard ex exactly at that moment. Anyway, when he sort of, he wrote that in an email and, and I didn’t take it serious at first because I thought, what are we talking about? Mm-Hmm. <affirmative>. And then he actually replied to my email sort of immediately and insisted that he was sincere and he was going to make it reality which, which sort of just confirmed that he, he wasn’t, he hadn’t sent, sent this by accident. But then sort of the more I communicated with this person, it more and more, so it hit me first and I got sort of concerned. It was a bit, sort of came a little bit too close, a little bit too hard mm-hmm. <Affirmative>, but then I communicated a little bit more, and then he ended up more and more appeared more and more confused and, you know, deranged pretty much so. Oh, okay. So, and then I think then it got a little less serious for me because it seemed like, you know, he had confused everything. So it’s a very strange sort of feeling for reality. So then I’m more, yeah, he is probably, you know, sick or, or, or he has a problem that is way beyond me somehow mm-hmm. <Affirmative>. So it made me feel a bit, a little bit more safe about it. And that same person actually then emailed me, I think about half year later and apologized.
Mikael:
Okay. That’s least something positive from that.
Daniel Stenberg:
Yeah. That was sort of a positive, and I think it was a strung of him to do that. Yeah. and so I, it was great and it felt sort of a little bit of a relief, but it also, it also showed that, that his sort of excuse or explanation why he had pinpointed me in that was also deeply confused and sort of really, that was how you found me, sort of. Yeah. He had confused me with other persons called Daniel. And yeah, it was a really
Mikael:
Okay.
Daniel Stenberg:
Crazy explanation that I didn’t really understand either. So <laugh> like, I chose to not sort of focus on that, but say focus on, yeah. He apologized, he sort of, he, I think he also had some sort of disorder that made him sort of
Mikael:
Yeah.
Daniel Stenberg:
Made him have difficulties to sometimes separate, you know, things from that maybe wasn’t totally real from what he
Mikael:
<Laugh>. Yeah. Sounds like it could be some underlying reasons.
Daniel Stenberg:
Exactly. Exactly. Yeah. So, so yeah. But still that was an outlier. I, I actually very rarely get that kind of nastiness. I usually get those level of, you know, confused emails.
Mikael:
But that’s good. I mean, as long as the positives outweigh the, the negatives, right?
Daniel Stenberg:
It’s Oh, absolutely. I, I actually usually just think that all those emails I get, they’re, they’re fun and not help me get a sense of what people find me my address in. I mean, you know, I, oh really? Your, my, my product is in this product or in this device. I had no idea. So it helps with that. And I, no, I think it usually just good fun.
Mikael:
Do you track it some somehow or somewhere like where it’s being used? Or is it just too much?
Daniel Stenberg:
It’s, it’s just too much. I’ve, I used to try to track it mm-hmm. But it became far too spotty, so just, yeah, I know a bunch of places, but, you know, at the same time, I don’t know so many others. I have this collection, you know, on my blog just when I try to collect different snapshots of curl credits and different products, because that’s just fun. But that’s, you know, just a little, that’s just for fun. It’s, it’s not by any means complete or or covering of anything that’s just random.
Mikael:
Yeah. So. Alright. So that’s I mean, that’s the negatives of the negative feedbacks or the experiences with this. Right. What about positive stuff? Like has this, like, has this history with CURL helped you in some way with like job application experiences or other perks or, or something?
Daniel Stenberg:
Oh, absolutely. So so, well, more or less my entire life is CURL , or has been CURL or turned even more over, over the years. So, so CURL was my spare time project for a very long time. And then I pretty much got my job working for Mozilla with Firefox in 2014. It was actually pretty fun to go there and have my interviewing with Mozilla pretty much sit around all day and talk about CURL and Http client code. Nice. Because already back then people knew about CURL that I had sort of, I, I was the founder and maintainer of, so nobody doubted my ability to understand, or, or the protocol side or development side. So we, I was a fjun sort of experience to just, so I think I was in a good position for that interview and, and get that job at Mozilla.
So, and then at Mozilla, I worked with Firefox, HTTP and Networking Stack pretty much, but I had permission to do part of my work hours and spent on Curl. Not that curl was used by Firefox or Mozilla by any means, but just because for the, for the goodness of it. Mm-Hmm. <affirmative>. And then when I finally, so that already then of course Curl was a good way for me to get that job because I really wanted to get opportunity to try to work for, for a company like Mozilla. Yeah. and I was fun, good. And, and then I, in 20, late 2018, I quit there and then I sort decided to try to make something real and start working with Curl full-time. So then of course, in, in, then in early 2019, I started working curl full-time. So, and I now work with this company called Wolf SSL, and we sell curl support to companies, basically. So, so
Mikael:
I was just about to add how, how you monetize from that. So how do you actually work full-time? So it’s by Wolf SSL.
Daniel Stenberg:
Yeah, so, so I work, so, so I get a paycheck from Wolf SSL, and, and we at Wolf SSL we sell support for CURL to customers, and we have different so then of levels of support and premise incident based or contract development or feature editions or, you know, backtracking or whatever companies need help with in regards to Curl it’s built around this support. So usually companies end up buying, paying for support, done for, for a period of time and for a number of incidents
Mikael:
Because that’s I mean that’s, that’s a really interesting thing cuz I was thinking about opensource products mostly be being for free, right. And in almost every single case. So like, do you think that opensource developers should get backed more by companies like voluntarily, I mean, or is the part of being an open source developer that you don’t have to rely on companies? Or is it on a good level as it is
Daniel Stenberg:
<Laugh>? Yeah, it’s, it’s really hard because I think there’s a little bit of everything here because opensource is such a wide concept that yeah, we have everything of what you just said sort of that exists and there are some projects that clearly should be more supported. There’s also this freedom from companies that I’ve always experienced with CURL, that we’re not relying or are reliant on any particular, you know, major company. We can do exactly as we want and that’s the freedom. But at the same time, we need someone to pay something to someone to be able to, to run everything, you know, infrastructure and actually get features done. And so, so someone has to pay at some point. So there’s a little bit of that. And, and at the same time, I mean, anyone giving away code for free as, as an open source licensed, we know that companies are in their right to just take the code and build something and run with it.
Yeah. It’s not that they’re actually doing anything illegal because then we shouldn’t release it like this. Exactly. So it’s, so, it’s a little bit of everything, but ideally, of course we want to, I mean I released Curl Opensource from the beginning and I still do it because I, from the beginning, I just wanted to be, to make sure that I was also part of opensource and I wanted CURL to, you know, be able to get ported into different devices and get, and I wanted to get help from everyone so that it would actually improve and become what it eventually became. But because I had no sort of I didn’t, I never thought that I would be able to do that myself, and I still don’t think that I would have been able to do that myself. So, I mean, there’s been a lot of people that I have helped out to make CURL what it is today and I, and still helps out.
So I think open source is part of the explanation to what has made CURL what it is and what it sort of still is. So I want it to be open source, but of course I still also want to get paid. So I, I still also struggle with this. So a little bit of ups and downs. So what do I do? What can I do to make sure that companies pay me? But I also don’t want to sacrifice CURL, I want to release CURL opensource. So I have that duality. And it’s it’s, I think a lot of open source projects have that struggle. You want to have it open source because of all the goodness that you get from open source, but you also need an food on the table and, and your family happy. So you need to make that work somehow.
Mikael:
Yeah. So probably like, like you do a sell services around your open source product.
Daniel Stenberg:
That’s certainly one way. I mean, it doesn’t really scale the same way as you as if you would’ve sold your software then I I, with a kind of billionaire. Right. If you sell ..
$1 Per device
Right, exactly. So it doesn’t scale it like that at all. But I don’t need it to scale like that. I, for me, for me, it’s good enough if my, if I, if I’m happy and I can work what I, what I think is fun and I get a good paycheck out of it, then that that’s good enough for me. And it seems to work and we’re actually slowly growing the business. So seems to, seems to do Okay.
Mikael:
Is it, is it your business Wolf SSL?
Daniel Stenberg:
No, it’s not. But but sort of, yeah, they’re very, we are very good friends. It’s a small company, so, and, and Wolf SSL has other opensource libraries that we also support. So it’s currently is pretty much one than out of a set of maybe 10 different libraries that we support. They’re all up the source and we sort of provide them under the same umbrella. And and really there’s nothing that prevents us from, if, if we grow big enough, if we grow up the Curl business big enough, we might spin off a separate company at some point in time that would become just curl support. Okay. But right now it actually works pretty good to have support and sales and everything sort of together with the other libraries because it makes it really sort of very low overhead. So I basically do all the support right now because we don’t have more business than that, so. Okay. It works pretty good. Yeah. So I do a portion of my day pretty much divided devoted to support and then portion of my day I do whatever I want. And that is usually then fixing bugs, feature development, you know, managing and reviewing code, managing whatever I want to do around Curl.
Mikael:
Nice. So something that I just came to think about, cause you get donations to curl right? From various companies like AWS and such.
Daniel Stenberg:
Yes.
Mikael:
Would you ever turn down like a massive donation and like, because that company would then say, with a main contributor to, to CURL, we, we are financing like 95% of it, or would you be okay, like fine with that?
Daniel Stenberg:
Well I am fine with sort of, I’m fine with changing the optics and saying things about companies, you know, oh, if someone donates a lot of money, I’m fine with calling them out for that sort of, and thanking them for being main sponsors or gold sponsors or whatever sponsor they want <laugh> us to say they are. Yeah. So I’m fine with that, but I w sort of, we are also in a fortunate position when it comes to Curl that we’re not, we’re not that dependent on any donations right now with sponsors, so I wouldn’t Oh, okay. I wouldn’t, I wouldn’t accept anything to sort of try to control the project or, or, you know, demand a certain, certain direction or, or that we would do anything, you know sort of give up our soul or give up our policies or, or concepts for, for money that we’re, we’re far away from that. Yeah. We’re actually in a pretty good financial situation, so that’s, no, then we turn them down.
Mikael:
That that’s really nice. What what about, I, I like to sort of get help new people get into the business, into, well, my area is security of course, but if we’re talking about like programming and coding and stuff, like, do you have any sort of advice or tips and tricks to aspiring coders and let’s, let’s say they’re into open source. Like, do you have any sort of lessons learned or things that you, you knew beforehand? And so for, for like, let’s say youth or, or, or aspiring coders?
Daniel Stenberg:
I think first I think that it is easy to think a lot of things about open source projects that you just observe from, from a distance. And you you might think that, you know, that they’re, they’re advanced or, or too complicated for you, or maybe that they have, you know, raised a bar and it’s too hard for me to get into, I don’t know this, but all first, I think almost every opensource project out there they’re willing to accept, contribute, tions from anyone, right? So they’re all actually willing to accept help and contributions. So th that’s the first thing, whatever project it is, and however old we’re mature, I, I mean, I get that questions quite a lot about CURL. I mean, we are, we’re old by now. Yeah. But there are so much left to do. Right. It’s not that we’re done we’re, you may not have found a bug recently, but you know, there, there are heaps of them.
You, if you just scratch the surface, there’s lots of things to fix. And, and that is sort of, it is not unique for us. Right. All projects have like that because all projects keep evolving. So we fix bags, we add things, we add new bags, and we fix bags, and it’s a constant thing. And it’s like that everywhere. So there’s first that, that you can be sure that everyone actually wants projects or, or help with their projects. And, and then I think it’s just a matter of, of getting to know the project a little bit. And I think usually you can, if you are, if you are new to, to open source, I think it’s a good idea to maybe work on or look into a project that you, maybe you use yourself or you think is fun or you look interesting.
I mean, that you have a particular interest in. Not just maybe you have a glitch, you have found yourself, you are getting annoyed by this little thing that happens every time I do web. And then maybe just hang around the project, you know, watch the code, see what happens on their issues or mailing lists or forums or whatever. Get to feel a little bit about the yeah, their culture. See who’s doing what, what are they saying? I mean, most, I would say opensource projects or just not that many people involved. They’re all friendly usually, and they’re all trying to do their best to make sure that things are, are progressing forward. So usually just by being friendly and, you know, open with what you want and what you’re are set out to do, you can go very, very far mm-hmm. <Affirmative>. but then of course there are exceptions, but you can avoid the exceptions, right? If they, they’re, if they’re unfriendly they, they, they don’t seem to want you there, go somewhere else. Because I mean, the world is drowning in open source projects. There’s no, there’s no lack of open source projects and most of them will be friendly and accepting to whatever.
Mikael:
That’s really good. That’s, that’s some good, some good takeaways I think.
Daniel Stenberg:
Yeah, I think so. I think there should be very little that sort of should stop you from, from doing good open source in other than in mostly in your own mind. Right? And, and a lot of people don’t think that, well, I’m not good enough. I don’t know enough or, or my code isn’t sort of beautiful enough for me to be show it to the world like that. But that is so not true. Right. So you just have to get over that feeling because we all have that feeling. Yeah. so just, no, it’s not like that. Just if you fix the problem, it doesn’t matter if it’s, I mean, if it’s, if the code is ugly, it’s okay, but because someone will tell you, or, or, or get, you will get that feedback when you submit your pool request or what, however you do it. Mm-Hmm. <affirmative>. And then you of course you iterate, you work on it, you improve. I mean, nobody is perfect from the beginning and we’re all beginners at start, so of course everything and everyone is doing bad things all the time. Right. So we just have to iterate and fix it again and continue. So I think yeah, getting into it, dive in and, and get get coding.
Mikael:
Sounds good. I yeah, it’s always a bit of a sort of imposter syndrome where you’re afraid to like, you know, I can be good enough for if I submit this, they’re gonna see that I don’t know what I’m doing, really, but you might be, you might be good actually. Yes.
Daniel Stenberg:
Just do it. And, and I think that imposter syndrome thing, that’s something that sort of plagues all of us, many of us all the time. We just have to sort of try to push through it. Yeah. I think that’s a, it’s a very wide phenomena, so, so you, you just have to sort of, I think at some point ignore it and, and pretend it’s not there, and actually just reach out and do it anyway. Oh, of course. It’s easy for me to say because I’m not, maybe not there right now myself, but it’s still like that. It’s still true.
Mikael:
Yeah. Right. So we reached the the part of this show, which I call overrated, underrated. And this is the part where you are not prepared for anything that’s coming. And I’m gonna just throw out, it’s like three or four questions or topics or subjects. And like, you tell me if you, like, you individually think that they are overrated or underrated. Right. And you can elaborate more or less if, if you want to, but it’s, it’s up to you. So one of the easy ones that are not easy ones, but one of the most common ones, sorry, that I like to ask is certifications like are certs overrated or underrated and I mean personal, personal certs, like,
Daniel Stenberg:
Oh, that’s a good question. I, I don’t think <laugh> if, if I would be sort of a model here, I would say that I don’t, I don’t have a single certificate for anything. So I think, I think they they don’t have to be very useful or, I mean, you can get away or get around without them in many cases, but I also think I, I understand why they exist. So I think in certain areas or ever maybe for certain types of things, I think they fulfill a purpose. So I’m not sure, I’m not sure exactly how, how, how they rated in general, but I, for me, usually I, I think of them as overrated.
Mikael:
Yeah. I I like to say the same thing. I also think they’re overrated, but I think they’re useful in sort of getting past HR at the various companies.
Daniel Stenberg:
Exactly. Sort of like you check boxes, like. At least that you need to, a little bit like people use regular education for it these days. You need to have this past, otherwise we won’t talk to you sort of. Yeah. But, but, but, but no, no, no. Sort of, so like that
Mikael:
Yeah. So you almost answered the next one by yourself. But this is so higher education, like universities and stuff, are they overrated or underrated?
Daniel Stenberg:
No, I, I really cannot say that they’re overrated. So <laugh>, so then I’ll go have to underrated it. So the, even if I myself don’t have any higher education. So again, <laugh>.
Mikael:
So what, why, why underrated then?
Daniel Stenberg:
Well, well basically because I think in comparison to certificates, I think that’s much hard, harder obstacle to avoid or I mean to, to work around if you don’t have it. That’s, that’s why I say it. I, I mean, I myself don’t have it because I managed, I managed very well without it. But I think it’s harder today and harder for every regular person to get where you want without a higher education. So I think that’s why I think that you should still go for that.
Mikael:
Yeah, I agree. I also feel that it sort of differs where in the world you live, I think certain countries has way higher expectations on your higher education than perhaps perhaps in Sweden where you can get a get away with having experience instead.
Daniel Stenberg:
That is true. I think that’s very true because I think it’s some hierarchical cultures. I think it’s even more of a requirement than in Sweden we have sometimes a little bit more flat. So you, you can do things if you have just a strong will and just set yourself out to do it. You can manage without it, but it’s certainly harder, I think. Yeah.
Mikael:
I, I also like to think of higher education cause I don’t have it either. So I’m not, I don’t know what, what I’m talking about here, but <laugh>, but I like to think of it as you also have that personal trait of delayed gratification. Like you can see that if I do this for three years and down the line, I will get a better job. And I think that delayed gratification is a, like a character trait for success, I think.
Daniel Stenberg:
Right.
Mikael:
So, you know, that it, everything doesn’t come instantly, but if I do this, if I work on this for, for a long time, I would actually get better at this. And in the end I will actually have a better job or meet someone or, or, or something. I think it’s a really good character trait to have.
Daniel Stenberg:
Oh, it is. It is. Yes.
Mikael:
Yeah. And also I, I believe the higher education like universities teach you sort of critical thinking and presenting to at least some form of group or, or, or public like that as well, which I think is good. So it’s not only the knowledge I, I’d say in, in like school and stuff, it’s things like these
Daniel Stenberg:
No, exactly. There, there’s a lot like that. And also if we’re talking about our specific sort of, if we’re talking about software engineering it mm-hmm. <Affirmative>, I also think that it’s an area that has exploded Yeah. Over the last 20 years. So maybe when I was young it was a much more narrow area and it’s easier to get into without having that higher education. Now it’s has become a much more wider rich universe. So it’s maybe it’s harder for you to get into that on your own to actually get somewhere.
Mikael:
Yeah. Agreed. Right. Next one is, and I’ll explain it, but physical conferences as opposed to virtual conferences. So are they overrated or underrated
Daniel Stenberg:
Tough? That’s a tough question actually. Yeah, that’s really tough. And I think during this pandemic we’ve had a, a lot of chances and opportunities to think about this because I think without done saying over or under just yet, <laugh>, so I mean, pre pandemic of course had a lot of, with basically online conferences never happened. And it was more of an illusion. And people will say that it couldn’t be done. So during the pandemic, everything, every physical one turned into an online one because they didn’t want to disappear. And then you, we could all experience how it is to have an online, it’s not at all the same thing. It’s much harder to attend and much sort of harder to keep focus and you know, you just drop out and do something else and then you forgot about the conference and then you had lunch and then you sort of never came back. And as a presenter, it’s the same thing, right? Doing a presentation. I’ve done a lot of presentations in general, I’ve done a lot of presentation to physical conferences, but I’ve also done like, I don’t know, maybe 20, 25 during the pandemic and a presentation online is even more difficult than in, in a physical. Like, it’s like literally talking to all,
Mikael:
No feedback. Right.
Daniel Stenberg:
No feedback at all. You know, if I would try to be funny, did even one person sort of get that or have they all left as has they all fallen asleep or they all bored? You know, no feedback at all. And so, and also it’s, it’s harder to keep, it’s harder to do the same pace and presentation even to, to do that in, in front of a screen as in, in front of a live audience. So I think, and then of course all the networking that could come from a physical, you actually sort of bump into someone you’re standing a line to get your food or coffee or something that, that is of course, completely gone online. They some try to replicate it in some, you know, lame ways, <laugh>, but it’s really never the same thing anyway. Yeah. Because sort of bumping into someone online, it’s not the same thing.
It’s sort of actually bumping into someone. So now it’s really, really hard to, to do I think a good, but then on the other hand, there’s, there’s a lot of upsides with doing online, right? So because you don’t have to go anywhere, you can just attend and it’s there and drop out and you didn’t lose any work hours just because you happen to attend a really lousy talk and you can just, you know, switch to do some work instead and then switch back and you, so, so, and, and you can go everywhere across the globe and, and you can get a lot more attendees. And so yeah, there’s a lot of benefits with that. Mm-Hmm.
Mikael:
<Affirmative>,
Daniel Stenberg:
But I, I can certainly feel now sort of, since we’ve in, in, in Sweden, we pretty much, there’s not a lot of signs of the pandemic left because all the restrictions are gone. Yes. And boom, everyone is starting to have conferences and physical meetups again, and you become really feel that everyone who has been doing physical conferences, who did them online now are desperate to go back to do them physically. So this period of online conferences, that’s soon is going to be a past tense and Sure. Someone is going to talk about hybrid versions because yeah, sure. You some, some of them will allow you to attend some sessions online, but it’s not going to be online conferences. They’re going to be physical one with some online, you know, presence, but it’s going to be crappier <laugh> experience to go to do them online. So I, I don’t know. Yeah. I, I think, I think so therefore, I, I have a really hard time here to decide if, if they’re underrated or, or, or overrated. Mm.
Mikael:
I totally, these are trick this, there’s no hard questions. The tricky questions.
Daniel Stenberg:
The, the, so yes, I, I think this one is, I, I think I have the hardest answer. So yeah, I would say that they’re so, I don’t know. I will say that they’re overrated.
Mikael:
<Laugh>. Yeah. Yeah. Cuz you can attend to much, well, well, many more conferences if they’re virtual, right.
Daniel Stenberg:
Yes. Yeah. And I, I, I have to admit that I, I struggle now. It’s because, you know, immediately now I start, I’m start getting, I’m starting to get invitations to do presentations on different conferences and I have to admit that Yeah, right. There’s a conference in this city, in this country on this date. Do you want to come and say something?
Mikael:
It’s traveling.
Daniel Stenberg:
I have travel. It’s going to take me like three days to get there and talk for a minute. Can I do we don’t mind. <Laugh>
Mikael:
<Laugh>. Yeah. It, it, it’s, it’s a really tricky question because yeah. I mean, most people probably say, oh, physical is better at this. And then once you start to discuss around it, you’re like, well maybe virtual is quite nice.
Daniel Stenberg:
Exactly. So yeah, there’s, there’s really, yeah, it’s really hard because there’s, there’s goodness and badness in, in both ways here.
Mikael:
Cool. So we decided for, for overrated physical.
Daniel Stenberg:
Yeah. I had to pick one. So I think, I think I go with overrated. Awesome. You know, I’m a working from home person. I’ve been working from home since 2014. I like it too.
Mikael:
<Laugh> Yeah. In the comfort of your own home, so Yeah, exactly. I get it. <Laugh>
Daniel Stenberg:
No pants,
Mikael:
<Laugh>. Exactly. That’s the good part about just having the upper part of your body. Right,
Daniel Stenberg:
Exactly.
Mikael:
So we, we reached the the last the last question of the overrated, underrated, and the last question of this show actually. And the question is if this is overrated or underrated and it’s demo parties.
Daniel Stenberg:
Okay. I, I would say that they’re the, these days, I would call them overrated <laugh>. I’m, I’m, I I was a part of the demo scene in, in Sweden in the sort of late eighties, early nineties, back on the Commore 64 days. And then it was I, I appreciate them that I appreciated them greatly, but it was a completely different time and era. You know, they, we didn’t have internet, we didn’t have networking even. We just had, you know, floppy disks.
Mikael:
<Laugh> Yeah. There’s no need for copy parties now right,
Daniel Stenberg:
<Laugh>. Exactly. So, but, but I also think it’s pre, I actually don’t, I’m not sure. I think the, they’re actually overrated. There’s somewhat of a different universe than one that I’m in, so I’m more of an observer. Yeah. So I don’t, I don’t really have an opinion if, if, if people are happy with them and they find sort of enjoyment and, and they think that it’s fun to do, let them do it. I’m sure they, they will have a good time and, and that might come something good out of it. Mm-Hmm. <affirmative>, I, I won’t attend any <laugh>. Yeah. I’m pretty sure.
Mikael:
So, so back in like early nineties and which were your favorite parties? Was it Birdie or something else?
Daniel Stenberg:
No, but back in then it was more the, the, we organized, they were just more of a sort of single events, parties. I was, I was part of the demo group called Horizon back then, and we did, we organized a few of them a few times there. And then I pretty much stopped doing Commodore 64 in maybe around 91 or so. And then I, I also stopped attending demo parties or copy parties as we call them.
Mikael:
They, they served their purpose, but back in the day. Right.
Daniel Stenberg:
Yeah, exactly. So, well, more that I left that universe more than that they actually, I mean, they’re still ongoing Right. Different than that back then, but still.
Mikael:
Yeah. I think there’s a time and place for everything in everyone’s life. Right. So
Daniel Stenberg:
No, absolutely. Absolutely. We’re all sort of, you, you are in one kind of world at one point in your, in your life. You don’t have to stick there forever. But maybe that little thing still sticks anyway, even if you are not there anymore,
Mikael:
Most likely. Right. That’s actually all the topics and stuff that I had in mind to talk about. Did I did I forget something that you wanna bring up or did we sort of touch on all
Daniel Stenberg:
About that? I have I, we’ve touched a lot of things. I don’t know if I have anything else to say. <Laugh>.
Mikael:
So how do you, how do you get in contact with, with Wolf SSL if you, if you want to?
Daniel Stenberg:
Well, yeah, you go to the website, of course, and you check out the, the support deals, but you can also just Google Curl support or whatever, and you will find it because it’s not, it’s going to be easy or you just contact me or whatever. We’re, we’re sort of casual and no bureaucracy or, or high bars to get past. So actually you can get in contact with me, whatever it is that is related to CURL and I’ll can sort of help you out or point you to the right place to do next step.
Mikael:
Awesome. All right. Thank you so much for, for coming. And and it’s not gonna be included in the show, but sorry for the the initial technical difficulties, <laugh>, which not a single listener will see, but you know of it. And yeah. <Laugh>, thanks for the patience.
No worries at all. It was just fun. Yeah.
Daniel Stenberg:
Awesome. Okay, well we’ll speak more another time.
Mikael:
Absolutely.
Daniel Stenberg:
Take care.
