I feel the urge to make #curl faster and safer. And I feel like blogging about design choices, which I have no expectation of anyone having an interest in.

Also I should invent a test case for a combination a clanker said was not working. Hmmm..

Happy Thursday, everyone!

The UK government's AI Security Institute confirms: AI models do anything to fulfill an assigned task, including breaking rules, cheating and lying about it.

Given that they are the results of distilling exabytes of human behaviour, I wonder where they picked that up…

We should treat chatbots as statistical mirrors of ourselves, distorted in places by enforced training, sure. But whatever behaviour we expose is part of them as well.

https://www.theregister.com/ai-and-ml/2026/07/21/ais-cheatin-heart-will-make-you-weep/5275784

‚Torvalds added, in the case of AI-discovered bugs, you need to keep in mind that just "because you found it with AI, 100 other people also found it with AI."‘

There is nothing secret about a bug found by a model. If the software is a target, you can be sure that the bad guys are running continously prompts against it. Without token restrictions.

As a maintainer, this is all hard to manage. But this is happening everywhere. It‘s not your job to save the world from stupidity, vanity and greed.

Spin to Win:

- a billions dollar startup get its source code leaked
- everyone sees hilarious stupid things, ridiculing the startup
- the IPO is in danger

- a Mythical New Product is announced that is ultra-super-good, but too dangerous. Only orgs that have an interest in the startup doing well get access.
- the media goes crazy with doomerisms. „Will this be the end of <something people are emotionally attached to>?“
- everyone forgets about the leaked, shoddy stuff

Works every time.😌

Do not travel to the USofA, part XXXIV:

- doing everything right is not enough
- white skin does not protect you
- detention may mean a cell shared with 70 people, fighting over food, without medical supplies
- your signature will get forged if you refuse
- judge orders for release on bail are ignored

https://www.theguardian.com/us-news/2026/feb/09/irish-man-seamus-culleton-ice-detention

There are good things in the world:

Security training on the topic of "do not click links or open attachments" is obsolete now.

The AI in your inbox will open all attachments and click on all links. Problem solved.💁🏻‍♂️

Still my favorite meme.😌

There are many nice people here on the fediverse. Some are smart, some are kind, some are funny, some are just there for the ride.

Many thanks to the admins and mods, for enabling this.🤗

/cc @ordnung @leah @rixx

“one-acre solar farm produces as much energy as 100 acres of corn-based ethanol.”

The countries throttling renewables now (US, but also Germany) are just accelerating their decline. The laws of physics can not be lobbied.

https://www.newyorker.com/news/annals-of-a-warming-planet/46-billion-years-on-the-sun-is-having-a-moment

@pluralistic on the Apple tax https://pluralistic.net/2025/05/01/its-not-the-crime/#its-the-coverup

„AI can't do your job“, by @pluralistic

https://pluralistic.net/2025/03/18/asbestos-in-the-walls/

@pluralistic on the current things: US intellectual property rights have negative value for countries hit by US trade wars.

https://pluralistic.net/2025/03/03/friedmanite/

Tech of the Ancients

I have this incredible kitchen scale for over 20 years now. It has a swipeable screen and does not need recharging.

You put sth on it, then touch the screen with your finger and swipe right and can measure whatever you put in next.

I do not fully understand the math behind it and how it uses the gravitational fields and atom bonds. But it works reliably and it's always on. Truly magic.

It does not show news and weather, though.💁🏻‍♂️

#ancienttech

Honored to be part of the first Sovereign Tech Fellowship program. This will support a good chunk of my work on curl and Apache during this year.

It's great to see a government realising the need to support the infrastructure so many rely on, business as well as individuals.

https://www.sovereign.tech/news/meet-the-sovereign-tech-fellows

Yesterdays link to the Let‘s Encrypt blog dragged in some people who seem to think that CAs are unnecessary or even evil.

LE is s very small group who set out to improve the terrible CA situation and the fucking middle box corruptions.

They did that successfully with a budget that a medium sized city spends on its department for car license plates.

So, my advice: don‘t yell at people who made the world somewhat better or you‘ll soon run out of ones who try.💁🏻‍♂️

Timeline on Let's Encrypt disabling OCSP.

If you use Apache ACME, and have set "MDMustStaple on", you have to switch it off in your config for LE certificates. Otherwise renewals will fail from March 2025 onwards.

https://letsencrypt.org/2024/12/05/ending-ocsp/

Roy Fielding weighs in on the handling of the HTTP/2 Rapid Reset attack vector: https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0068.html

@bagder ...using a single connection to a local, plain vanilla Apache httpd.

But who cares for raw power?💁🏻‍♂️😌

Many PRs were merged today. A successful curl Friday.

On @bagder 's god-like machine, curl master now shows nice numbers on our scorecard.

50x1OOMB https: GETs in parallel with HTTP/2: 2477 MB/s

Mood: happy