curl

<p>I pushed an update to <a href="/tags/dostodon/" rel="tag">#DOStodon</a> (the <a href="/tags/mastodon/" rel="tag">#Mastodon</a> client for MS-DOS):</p><p>- Updated <a href="/tags/curl/" rel="tag">#curl</a> to 8.13.0<br>- Updated <a href="/tags/mbedtls/" rel="tag">#mbedTLS</a> to 3.6.3<br>- Fixed <a href="/tags/win32/" rel="tag">#win32</a> version (works on <a href="/tags/winxp/" rel="tag">#WinXP</a> or newer), DLLs were missing</p><p>Grab it at <a href="https://github.com/SuperIlu/DOStodon" rel="nofollow"><span class="invisible">https://</span>github.com/SuperIlu/DOStodon</a></p><p>Screenshot is showing the win32 version running on Win10.</p><p><a href="/tags/javascript/" rel="tag">#Javascript</a> <a href="/tags/retrocomputing/" rel="tag">#RetroComputing</a> <a href="/tags/msdos/" rel="tag">#MSDOS</a> <a href="/tags/creativecoding/" rel="tag">#CreativeCoding</a> <a href="/tags/mastodonclient/" rel="tag">#MastodonClient</a> <a href="/tags/freedos/" rel="tag">#FreeDOS</a> <a href="/tags/djgpp/" rel="tag">#DJGPP</a> <a href="/tags/dojs/" rel="tag">#DOjS</a></p>

<p><a href="/tags/curl/" rel="tag">#curl</a> 8.12.0</p><p><a href="https://daniel.haxx.se/blog/2025/02/05/curl-8-12-0/" rel="nofollow" class="ellipsis" title="daniel.haxx.se/blog/2025/02/05/curl-8-12-0/"><span class="invisible">https://</span><span class="ellipsis">daniel.haxx.se/blog/2025/02/05</span><span class="invisible">/curl-8-12-0/</span></a></p>

<p>We got this &quot;HIGH security problem&quot; reported for <a href="/tags/curl/" rel="tag">#curl</a> earlier today:</p><p>&quot;The -o / --output parameter in cURL does not restrict or sanitize file paths. When passed relative traversal sequences (e.g., ../../), cURL writes files outside the current working directory, allowing arbitrary file overwrite. In automated or privileged environments (CI/CD, root containers), this leads to Remote Code Execution (RCE), privilege escalation, and supply chain risk.&quot;</p><p>Never a dull moment.</p>

<p>Educational moment on the <a href="/tags/curl/" rel="tag">#curl</a> wikipedia page 😎</p>

<p>An Open Source sustainability story in two slides. (for a coming talk of mine)</p><p>Slide 1: car brands using <a href="/tags/curl/" rel="tag">#curl</a><br>Slide 2: car brands sponsoring or paying for <a href="/tags/curl/" rel="tag">#curl</a> support</p>

<img src="https://neodb.social/media/emoji/snac.daltux.net/debian.png" class="emoji" alt=":debian:" title=":debian:"> 📰 Apareceram notícias sobre o pacote <a href="https://packages.debian.org/sid/curl" rel="nofollow">curl</a>, ao atualizá-lo hoje no <a href="/tags/debian/" rel="tag">#Debian</a> <a href="/tags/sid/" rel="tag">#sid</a> (unstable) e que achei interessantes compartilhar. É o anúncio de alterações importantes, aparentemente entrando em efeito agora e iniciadas alguns meses atrás pelos mantenedores, em suma:<br><br>- O utilitário curl, a partir da versão 8.8.0-2, passa a suportar <a href="https://pt.wikipedia.org/wiki/HTTP/3" rel="nofollow">HTTP/3</a>, com os parâmetros --http3 ou --http3-only. Para conseguir isso, o programa agora passa a utilizar <a href="https://www.gnutls.org/" rel="nofollow">GnuTLS</a> no lugar de <a href="https://packages.debian.org/sid/openssl" rel="nofollow">OpenSSL</a>. Ainda fornecerão uma variação de libcurl que continua usando OpenSSL.<br><br>- Incluíram o comando wcurl (<a href="https://manpages.debian.org/unstable/curl/wcurl.1" rel="nofollow">veja seu manual</a>) que facilita baixar um arquivo sem precisar lembrar os parâmetros do curl. Pode ser chamado no lugar dos usos mais simples de wget.<br><br>O conteúdo completo da mensagem está em <a href="https://metadata.ftp-master.debian.org/changelogs/main/c/curl/curl_8.12.0+git20250209.89ed161+ds-1_curl.NEWS" rel="nofollow" class="ellipsis" title="metadata.ftp-master.debian.org/changelogs/main/c/curl/curl_8.12.0+git20250209.89ed161+ds-1_curl.NEWS"><span class="invisible">https://</span><span class="ellipsis">metadata.ftp-master.debian.org</span><span class="invisible">/changelogs/main/c/curl/curl_8.12.0+git20250209.89ed161+ds-1_curl.NEWS</span></a><br><br><a href="/tags/curl/" rel="tag">#curl</a> <a href="/tags/http3/" rel="tag">#http3</a> <a href="/tags/gnutls/" rel="tag">#gnutls</a> <a href="/tags/openssl/" rel="tag">#openssl</a> <a href="/tags/gnu/" rel="tag">#gnu</a> <a href="/tags/softwarelivre/" rel="tag">#softwareLivre</a><br>

<p>Oh, nice. Just found a <a href="/tags/curl/" rel="tag">#curl</a> to <a href="/tags/golang/" rel="tag">#golang</a> http request converter: <a href="https://mholt.github.io/curl-to-go/" rel="nofollow"><span class="invisible">https://</span>mholt.github.io/curl-to-go/</a></p>

<p>I pushed an update to <a href="/tags/dostodon/" rel="tag">#DOStodon</a> (the <a href="/tags/mastodon/" rel="tag">#Mastodon</a> client for MS-DOS):</p><p>- Updated <a href="/tags/curl/" rel="tag">#curl</a> to 8.14.1<br>- Updated <a href="/tags/mbedtls/" rel="tag">#mbedTLS</a> to 3.6.4<br>- Enabled HTTP 3xx redirections</p><p>Grab it at <a href="https://github.com/SuperIlu/DOStodon" rel="nofollow"><span class="invisible">https://</span>github.com/SuperIlu/DOStodon</a></p><p>Screenshot is showing both, the DOS ( <span class="h-card"><a href="https://corteximplant.com/@DOSBox_Staging" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>DOSBox_Staging</span></a></span> ) and the the win32 version (Win10).</p><p><a href="/tags/javascript/" rel="tag">#Javascript</a> <a href="/tags/retrocomputing/" rel="tag">#RetroComputing</a> <a href="/tags/msdos/" rel="tag">#MSDOS</a> <a href="/tags/creativecoding/" rel="tag">#CreativeCoding</a> <a href="/tags/mastodonclient/" rel="tag">#MastodonClient</a> <a href="/tags/freedos/" rel="tag">#FreeDOS</a> <a href="/tags/djgpp/" rel="tag">#DJGPP</a> <a href="/tags/dojs/" rel="tag">#DOjS</a></p>

<p>a detail you probably didn&#x27;t know: nowhere in any <a href="/tags/curl/" rel="tag">#curl</a> documentation do we use the word &quot;very&quot;. It is a banned word enforced by a CI check. This rule encourages us to rewrite and instead use more appropriate words. Makes us write better English.</p>

<p>Good morning Fedi friends and happy Saturday! 🌈​<br><br>File under: I&#x27;m such a clown sometimes. I did something extremely foolish yesterday (installation-wise) that bricked my whole YunoHost with Sharkey instance. This is not the fault of YunoHost or Sharkey, it&#x27;s just me being the biggest airhead.<br><br>So this morning I nuked that VPS (Hetzner makes it so easy to start and stop) and, armed with a stopwatch, I wanted to see how long it would take me to order a new server, log in, install YunoHost and set up a main URL and a subdomain to log in.<br><br>I had this unique challenge that we&#x27;re going hiking in the mountains so my time is very limited this morning.<br><br>How long did it take me? A grand total of 14 minutes.<br><br>The perks of being a fool is that you repeat the steps so many times that you go from being terrified (what do I have to do now?) to just sailing through the steps.<br><br>Time went like this:<br><br>1m30s: logged onto Hetzner, ordered a new server (Debian v12)<br><br>4m50s in: logged in, increased security, ran apt update and apt upgrade<br><br>5m in: installed YunoHost (thanks <a href="/tags/curl/" rel="tag">#curl</a>)<br><br>7m30s in: with YunoHost successfully installed, I got into their beautiful graphical interface to continue the post install<br><br>9m30s in: post installation complete<br><br>11m 20s in: began tweaking DNS records for the main domain and the logging in subdomain, installed certificates, etc.<br><br>14m23s = all done, tripled checked that everything is working in incognito mode (it is) 🥳​<br><br>Wishing you all a great day. Time to go hiking for me and my fam 🗻​<br><br><a href="/tags/mysocalledsudolife/" rel="tag">#MySoCalledSudoLife</a> <a href="/tags/selfhosting/" rel="tag">#selfhosting</a></p>

<p><a href="/tags/lispygopherclimate/" rel="tag">#lispyGopherClimate</a> <a href="/tags/lisp/" rel="tag">#lisp</a> <a href="/tags/technology/" rel="tag">#technology</a> <a href="/tags/podcast/" rel="tag">#podcast</a> <a href="/tags/archive/" rel="tag">#archive</a>, <a href="/tags/climate/" rel="tag">#climate</a> <a href="/tags/haiku/" rel="tag">#haiku</a> by <span class="h-card"><a href="https://climatejustice.social/@kentpitman" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>kentpitman</span></a></span> <br><a href="https://communitymedia.video/w/c3GdAXe7BQTbK3VrcXCm7E" rel="nofollow" class="ellipsis" title="communitymedia.video/w/c3GdAXe7BQTbK3VrcXCm7E"><span class="invisible">https://</span><span class="ellipsis">communitymedia.video/w/c3GdAXe</span><span class="invisible">7BQTbK3VrcXCm7E</span></a><br>&amp; <span class="h-card"><a href="https://fe.disroot.org/users/ramin_hal9001" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>ramin_hal9001</span></a></span> <br>On the <a href="/tags/climate/" rel="tag">#climate</a> I would like to talk about the company that found <a href="/tags/curl/" rel="tag">#curl</a> and <a href="/tags/openssl/" rel="tag">#openssl</a>&#x27;s <a href="/tags/deeplearning/" rel="tag">#deeplearning</a> many (10ish) 0-day vulns &quot;using <a href="/tags/ai/" rel="tag">#ai</a> &quot;. (<a href="/tags/llm/" rel="tag">#llm</a> s were involved).</p><p>This obviously relates to my <a href="/tags/lisp/" rel="tag">#lisp</a> <a href="/tags/symbolic/" rel="tag">#symbolic</a> <a href="/tags/dl/" rel="tag">#DL</a> <a href="https://screwlisp.small-web.org/conditions/symbolic-d-l/" rel="nofollow" class="ellipsis" title="screwlisp.small-web.org/conditions/symbolic-d-l/"><span class="invisible">https://</span><span class="ellipsis">screwlisp.small-web.org/condit</span><span class="invisible">ions/symbolic-d-l/</span></a> (ffnn equiv). Thanks to everyone involved with that so far.</p><p>I implemented that using <a href="/tags/commonlisp/" rel="tag">#commonLisp</a> <a href="/tags/condition/" rel="tag">#condition</a> handling viz KMP.</p>

<p>curl libcurl</p><p>Just in case you have forgotten how to curl a file from a server here&#x27;s a extensive howto with screenshots </p><p>`-L` redirect<br><a href="https://everything.curl.dev/http/browserlike.html?highlight=-L#redirects" rel="nofollow" class="ellipsis" title="everything.curl.dev/http/browserlike.html?highlight=-L#redirects"><span class="invisible">https://</span><span class="ellipsis">everything.curl.dev/http/brows</span><span class="invisible">erlike.html?highlight=-L#redirects</span></a></p><p>`-o` filename<br><a href="https://everything.curl.dev/usingcurl/downloads/url-named.html#download-to-a-file-named-by-the-url" rel="nofollow" class="ellipsis" title="everything.curl.dev/usingcurl/downloads/url-named.html#download-to-a-file-named-by-the-url"><span class="invisible">https://</span><span class="ellipsis">everything.curl.dev/usingcurl/</span><span class="invisible">downloads/url-named.html#download-to-a-file-named-by-the-url</span></a></p><p>`-C -` resume<br><a href="https://everything.curl.dev/usingcurl/downloads/resume.html#resuming-and-ranges" rel="nofollow" class="ellipsis" title="everything.curl.dev/usingcurl/downloads/resume.html#resuming-and-ranges"><span class="invisible">https://</span><span class="ellipsis">everything.curl.dev/usingcurl/</span><span class="invisible">downloads/resume.html#resuming-and-ranges</span></a></p><p>`curl --verbose -C - -L -o lp_someband_some_name_disc1side2.flac archive.org/download/lp_someband_somename-v/disc1/lp_someband_somename_disc1side2.flac`</p><p><a href="/tags/curl/" rel="tag">#curl</a> <a href="/tags/get/" rel="tag">#get</a> <a href="/tags/programming/" rel="tag">#programming</a> <a href="/tags/technology/" rel="tag">#technology</a> <a href="/tags/fetch/" rel="tag">#fetch</a> <a href="/tags/networking/" rel="tag">#networking</a> <a href="/tags/https/" rel="tag">#https</a> <a href="/tags/http/" rel="tag">#http</a> <a href="/tags/ftp/" rel="tag">#ftp</a> <a href="/tags/opensource/" rel="tag">#OpenSource</a> <a href="/tags/posix/" rel="tag">#POSIX</a> <a href="/tags/bsd/" rel="tag">#BSD</a> <a href="/tags/freebsd/" rel="tag">#freeBSD</a> <a href="/tags/ghostbsd/" rel="tag">#ghostBSD</a> <a href="/tags/openbsd/" rel="tag">#openBSD</a> <a href="/tags/linux/" rel="tag">#Linux</a> <a href="/tags/win64/" rel="tag">#win64</a> <a href="/tags/mac/" rel="tag">#mac</a></p>