The challenge of maintaining curl

Curl, he began, is "a small project with a big impact". It began in 1996 with all of 100 lines of code; it has since grown to 180,000 lines that have been contributed by 1,400 authors. In any given month, there are 20-25 developers who are actively contributing to curl. The project has exactly one full-time employee — that being Stenberg himself.

The program is widely used, having been deployed in at least one-billion devices. Just about anything that occasionally connects to the net, he said, uses curl to do it. But using curl is different from supporting its development. As an example, he put up a slide listing the 47 car brands that use curl in their products; he followed it with a slide listing the brands that contribute to curl. The second slide, needless to say, was empty. (A version of both slides can be seen on this page).

Companies tend to assume that somebody else is paying for the development of open-source software, so they do not have to contribute. He emphasized that he has released curl under a free license, so there is no legal problem with what these companies are doing. But, he suggested, these companies might want to think a bit more about the future of the software they depend on.

Open-source software is the best choice, he said, but maintaining it is a tough job. Most projects out there have a single maintainer, and that person is often doing the work in their spare time, without funding. Maintenance involves a lot of tasks, including taking care of security, reviewing patches, writing documentation, keeping the web site going, administering the mailing list, and a long list of other tasks. Occasionally, if a little time is left over, it might also be possible to do a bit of feature development. That is a lot for one person to keep up with.

Companies have a certain tendency to make things worse. He put up an excerpt of a message from Apple support, referring a customer to the curl project for help with their (Apple) device. He has received demands from companies for information on the project's development and security practices, often with tight deadlines for a response. He typically replies by sending back a support contract; that usually results in never hearing from the company again, he said. More recently, he has been getting demands from European companies seeking information on the curl project's Cyber Resilience Act compliance practices.

Some communications are rather less humorous than that; one email came with a subject reading "I will slaughter you". He gets emails from people who found his address in the license notices shipped with their automobiles asking for support. But he also gets nice thank-you emails at times.

Problematic email takes other forms as well. There is an increasing crowd of people who ask a large language model to "find a problem in curl, make it sound terrible", then send the result, which is never correct, to the project, thinking that they are somehow helping. Dealing with these useless problem reports takes an increasing amount of time.

Recently, the curl project, like many operators of web sites, has been contending with distributed denial-of-service attacks by scrapers run by AI companies. He put up a link to LWN's article on this problem for those who are unfamiliar with it. The curl site consumes a massive amount of bandwidth every month, but only 0.01% of that is source downloads. Most of the rest is bot traffic. That, too, adds to the difficulty of maintaining the project.

He concluded the brief talk with one last email; it was from an 11-year-old child who had found curl useful in some project they were working on. It included an expression of gratitude that, Stenberg said, was truly heartwarming.

[Thanks to the Linux Foundation, LWN's travel sponsor, for supporting our travel to this event.]