Fedora considers curl-minimal [LWN.net]

By Jake Edge
March 9, 2022

The curl utility is a command-line program (and associated library) for interacting with various network protocols; it is commonly used to do things like transferring data from a remote server over HTTP or HTTPS using a URL. But curl also supports a lot more protocols, some of which are probably rarely used, obsolete, deprecated, or all three. As a recent discussion on the Fedora devel mailing list shows, though, it is hard to find agreement that support for only some of those protocols should be installed by default, while others might be left in an optional package for those who need them.

A proposal to install a minimal version of curl by default starting with Fedora 37 was posted to the list on February 22. As is usual for feature proposals, it was posted on behalf of the feature owners, Zbigniew Jędrzejewski-Szmek and Kamil Dudka, by Fedora program manager Ben Cotton. The idea is to make the curl-minimal package (and it companion libcurl-minimal) the default for installation on Fedora systems, while allowing users to switch to the full curl package (and libcurl) if they need it. The minimal variants "are compiled with various semi-obsolete protocols and infrequently-used features disabled: DICT, GOPHER, IMAP, LDAP, LDAPS, MQTT, NTLM, POP3, RTSP, SMB, SMTP, SFTP, SCP, TELNET, TFTP, brotli compression, IDN2 names", while both packages support HTTP, HTTPS, and FTP.

There are two benefits for Fedora described in the proposal. The infrequently used protocols are not as well tested as the others and "are a source of security bugs". Most people are not using them anyway, so removing them reduces the attack surface for the default installation. In addition, the minimal packages are smaller, saving 8MB, which is a reduction of 12%.

The problem with having "extra" protocols available for curl is that they might be invoked unexpectedly. Even if a program is using a URL with an http scheme (i.e. protocol), the (possibly malicious) server could redirect to a different URL with a different protocol entirely, which would then invoke that code in curl if it is present. In addition, if user input is used for the URL, it could refer to an unexpected protocol, which curl will happily try to satisfy. Thus protocols that are installed, but not actually needed, increase the potential attack surface of the distribution.

IDN

Removing support for internationalized domain name (IDN) handling could be a problem even for those who only need the three protocols available in curl-minimal, Björn Persson said. IDN domain names are internationalized names in Unicode that have been encoded into ASCII using Punycode. That is so that they can be used in the Domain Name System (DNS), which in practice can only handle a subset of ASCII in domain names. The lack of support for IDN "makes libcurl-minimal suited only for programs that only communicate with a predefined set of servers in ASCII-only domains".

Jędrzejewski-Szmek wondered how many domains actually use IDN, noting that he had added support for it to systemd, but "realized that I have _never_ once used an idn domain outside of testing". He also pointed out that this change would not affect other programs, like web browsers, where IDN use might be more prevalent. Others in the thread thought that IDN support was a must, at least for certain regions of the world. Dudka said he was not necessarily opposed to adding IDN support to curl-minimal, but that it had been removed from the universal base image (UBI) for the ubi9 container images "and nobody has complained about it so far". It is not clear how much exposure ubi9 images have actually gotten at this point, however.

The question of the prevalence of IDN domains was at least partly answered by Jędrzejewski-Szmek himself; there are more in use than he expected. He would be in favor of adding IDN support to curl-minimal "_if_ there are people who'd actually use this for real". Persson noted that there are multiple programs that have incomplete support for IDN, including OpenSSH, Nmap, and the BIND utilities, but that is a "problem that you're about to make worse". Having a default curl without such support will "end up hampering the adoption of international domains even more". Dudka said that since there is a demand for it, he had created a pull request to add IDN in libcurl-minimal.

Security benefit

Chris Adams thought that the security benefit of not shipping the other protocols was a "poor argument". If those protocols are still going to be available, "they need to be maintained to the same level". Beyond that, most of the security problems reported for curl seem to be in the protocols that would be retained:

Looking at the curl RPM changelog on F35, most CVE entries seem to be TLS and/or HTTP(S) related, with a couple of TELNET and one MQTT. Looking back to 2020, there were more TLS and a couple of FTP (which is staying in the minimal build).
If TELNET/etc. is a problem and not being maintained upstream, then just drop TELNET. Don't shuffle it off to the side and ignore security issues in a package still in the repos.

But Demi Marie Obenour disagreed; the purpose of the change is not to reduce the maintenance burden, but to reduce the impact of vulnerabilities in the less-used parts of curl. "Right now, a vulnerability in an obscure protocol impacts most users. With this change, it will only impact users that have installed the full version of curl." But Adams said that using security concerns as a justification for the change was not reasonable. If the code is prone to security problems, Fedora should not be shipping it at all. In a followup message, Obenour said that the change is about the attack surface: "Secure enough to ship ≠ secure enough to enable by default."

Peter Robinson asked about removing FTP as well, "with most browsers obsoleting the protocol due to lack of security". Dudka thought that was premature, but suggested that the day was coming: "it may happen that FTP will be unavailable by default in a year or two".

Richard W.M. Jones thought a different approach was in order. While the minimal variants are smaller, that is "a non-goal for almost everyone". Beyond that, the security benefit "will be immediately negated once everyone unbreaks their Fedora by installing curl-full". He suggested that libcurl-using Fedora packages should use the CURLOPT_PROTOCOLS option to only allow the protocols they expect. In a message back in October, he said that instead of creating a single minimal version of curl, a more fine-grained approach could be pursued:

[...] my impression is that at a code level they [the protocols] are quite modular, so maybe upstream would be interested in turning them into real loadable modules. Then we could package each protocol ("curl-http.so") as a separate RPM which is really best of all worlds.

Dudka was in favor of using CURLOPT_PROTOCOLS for Fedora packages that use curl, "but it cannot be a replacement for libcurl-minimal because there is no algorithmic way to decide whether all users of libcurl disable a problematic protocol on all reachable code paths". The switch to minimal is not just for container images, where the installation footprint needs to be as small as possible, as Jones had suggested, because there are other (unspecified) Fedora installations where the size is also important. Dudka also reiterated the attack-surface reduction as a benefit for those who do not need any of the extras.

Jones mentioned the modularization of curl again, but said "I think this whole business of minimizing Fedora is getting way out of hand". Dudka said that it had been added as a wishlist item for curl, "but I do not remember anybody working on it". Neal Gompa agreed with Jones that defaulting to a curl-minimal, instead of taking a modular approach, would cause more problems than it would solve, at least for many Fedora users:

This is a very big hammer that basically tells people that we're crippling curl by default for users and it has very large network effects across the entire distribution. It's quite one thing to use curl-minimal for containers where people expect tools to be broken in the endless pursuit of smaller base images, but when real people need to use real systems in complex configurations, having a reduced functionality curl by default is just going to lead to support nightmares and complaints about random breakages in applications on Fedora.

FESCo

After the mailing list discussion died down, inconclusively, the Fedora Engineering Steering Committee (FESCo) took up the proposal at its March 8 meeting (minutes, IRC log at the point it was discussed). After some discussion, much of it about the upgrade path for users who do want the full curl, the proposal was unanimously rejected as it stands, with an invitation to bring it back with some changes. It turns out that switching from the default curl-minimal to curl would not be done with the expected "dnf install" command or similar, but would need to use the less well-known "dnf swap" command. That was deemed confusing and surprising to users, so part of any re-submission will be changing the way the split into two packages was made.

In addition, some of the arguments for and against the benefit with respect to security concerns for the "extra" protocols were aired, but not resolved there either. It is not clear whether simply changing the packaging approach will be enough to get the feature over the line or not. To some, the overall benefit is low, while user confusion is clearly a possible outcome. The need for the feature to be the default distribution-wide seems unclear, as well; having container images and the like default to curl-minimal, while leaving other Fedora editions with the full curl package by default, might be a kind of middle ground.

Curl is used in lots of different ways within scripts and programs of various kinds, including in dnf itself. Since the curl upstream has not taken the modular approach, at least yet, any kind of attack-surface reduction for curl in Fedora is going to require this kind of "big hammer", where many of the protocols are shunted aside. It does seem like it leaves open the possibility of having to squeeze a few more protocols or features into curl-minimal, as with IDN support, if it is realized they are actually widely needed. For now, at least, curl-minimal will not become the default for Fedora 37, however.

to post comments

Fedora considers curl-minimal

Posted Mar 10, 2022 3:02 UTC (Thu) by flussence (guest, #85566) [Link] (2 responses)

This sounds reasonable, but only if it's very clearly marked as a "trial version", and not just a repeat of what RedHat/Fedora previously did to perl (and perl's upstream support channels) by shipping something with half the expected functionality missing.

In particular, shipping without brotli and IDN is going to break browsers' debug options to "copy request as curl command".

Fedora considers curl-minimal

Posted Mar 10, 2022 4:56 UTC (Thu) by josh (subscriber, #17465) [Link] (1 responses)

Yeah, leaving those two out seems like an odd choice, since both are used with https.

Fedora considers curl-minimal

Posted Mar 11, 2022 2:09 UTC (Fri) by jalla (guest, #101175) [Link]

MS still ships with native FTPS support, feels a bit silly to leave that one out. The rest have proper clients (like scp) that should likely be preferred instead.

Fedora considers curl-minimal

Posted Mar 10, 2022 4:32 UTC (Thu) by NYKevin (subscriber, #129325) [Link]

Fun fact: At least within the scope of HTML5, which is basically all modern websites these days, the de facto URL spec is https://url.spec.whatwg.org/, and there's nothing in there which says you can just omit the IDNA step if you don't feel like doing it (aside from some security notes about RTL text and homoglyph attacks, which basically amount to "browsers should protect users from spoofed domain names in an implementation-defined manner"). As far as the modern web is concerned, IDN support is simply mandatory.

Fedora considers curl-minimal

Posted Mar 10, 2022 7:27 UTC (Thu) by Lionel_Debroux (subscriber, #30014) [Link] (1 responses)

Disabling support for e.g. DICT and GOPHER might not inconvenience many persons indeed, and SCP needs to be phased out in favor of SFTP. Maybe IMAP, POP3 and SMTP are best left to MTAs and MUAs, too.
I'm less convinced about disabling SFTP (and TFTP, to a lesser extent) by default, requiring users to explicitly install full libcurl. libcurl's a nice, unified API for downloading and uploading files through FTP(S), HTTP(S) and SFTP protocols. I've already done that in a professional setup, and I'm definitely not the only one.

Fedora considers curl-minimal

Posted Mar 11, 2022 18:51 UTC (Fri) by HenrikH (subscriber, #31152) [Link]

Add to this that curl is much easier to script for SFTP upload/download since one does not have to mess around with expect scripts and what not.

Fedora considers curl-minimal

Posted Mar 10, 2022 8:40 UTC (Thu) by jd (guest, #26381) [Link] (5 responses)

Correct me if I'm wrong, but the real problem seems to be that the protocols are compiled in, as opposed to being something external that is dynamically loaded.

If they're dynamically loaded, then you would only have one version of any given binary, users can decide exactly what protocols they want to install and protocols that are known to be in an uncertain state can be labeled as such.

This moves responsibility from the distros to the curl maintainer, which means we don't have different distros running in different directions and nobody really knowing what they're installing.

Of course, that's a lot more work than just compiling the code twice, but it only has to be done the one time whereas protocol selection and recompiling would have to be done every time there's a code change. Not that this happens much with curl.

Fedora considers curl-minimal

Posted Mar 10, 2022 8:48 UTC (Thu) by rwmj (subscriber, #5474) [Link]

This is exactly right. If curl was modular upstream then we could have an interesting discussion about which of the modules to include in base Fedora. But nothing would be broken - if a package was expecting to use, say, telnet it could depend on libcurl-telnet so installing the package would install the extra curl module.

As you say it requires work upstream. No one has stepped up to do that.

FWIW we already went through this process with fio (Jens Axboe's Flexible I/O tester) which used to link all of its backends together, but now uses modules ("engines"), and we then changed the packaging in Fedora to use it: https://src.fedoraproject.org/rpms/fio/blob/rawhide/f/fio...

Fedora considers curl-minimal

Posted Mar 10, 2022 8:52 UTC (Thu) by SLi (subscriber, #53131) [Link] (3 responses)

It doesn't seem to even be what's compiled in but what's enabled by default. Perhaps there could be a configuration file in which you can enable protocols you need one by one (and disable ones enabled by default)?

Fedora considers curl-minimal

Posted Mar 10, 2022 9:03 UTC (Thu) by rwmj (subscriber, #5474) [Link] (2 responses)

You cannot determine this list globally. There's already a mechanism in libcurl to limit protocols that can be used (CURLOPT_PROTOCOLS). It has to be invoked by the programs linking to it since they are the only thing that know what protocols they're expecting to use.

Fedora considers curl-minimal

Posted Mar 10, 2022 11:35 UTC (Thu) by SLi (subscriber, #53131) [Link] (1 responses)

How is determining it globally worse than having the option to have either curl-minimal or curl-full installed? To me, it seems it would provide the best of both worlds, and you could also provide an API for interested clients to say "I want to enable support for Gopher".

Fedora considers curl-minimal

Posted Mar 10, 2022 11:52 UTC (Thu) by rwmj (subscriber, #5474) [Link]

It's not how curl works now and curl already has an API for limiting protocols. I would suggest discussing any plans with upstream curl.

Fedora considers curl-minimal

Posted Mar 10, 2022 8:42 UTC (Thu) by rwmj (subscriber, #5474) [Link] (5 responses)

It seems clear to me that the driver for this is some pointless competition where everyone tries to claim the crown of having the smallest base container. But container layers get cached - you only download them once - disks are cheap and networks are getting better. This isn't something we need.

Fedora considers curl-minimal

Posted Mar 10, 2022 8:53 UTC (Thu) by SLi (subscriber, #53131) [Link] (4 responses)

I'm curious, why does it seem to be about size instead of the attack surface as explicitly stated?

Fedora considers curl-minimal

Posted Mar 10, 2022 9:01 UTC (Thu) by rwmj (subscriber, #5474) [Link] (3 responses)

If we are really serious about attack surface we should audit Fedora programs that use libcurl and make sure they are using CURLOPT_PROTOCOLS (https://curl.se/libcurl/c/CURLOPT_PROTOCOLS.html), because that is the only way to ensure that unwanted/exploitable curl modules are not invoked by redirects.

Fedora considers curl-minimal

Posted Mar 10, 2022 14:43 UTC (Thu) by smoogen (subscriber, #97) [Link]

The problem with auditing is the same as saying upstream should make curl modular. Someone has to step up and do the work and no one has (mainly because you then have to interact with N upstreams who may not see it as something they want to do either.) This seems to be the inevitable 'ok so no one has that energy, what can we do?' compromise.

Fedora considers curl-minimal

Posted Mar 14, 2022 14:43 UTC (Mon) by Paf (subscriber, #91811) [Link] (1 responses)

We could do that if we’re “serious about security”, or, being equally serious about security, we could do this. And then if someone ever installs something that isn’t packaged by Fedora, they would *also* benefit from this change if it doesn’t use that option correctly.

Yes, if we handle our footguns *correctly*, there’s no issue. There’s ongoing overhead and risk from their existence, but obviously, handled correctly, they’re fine. If they’re completely unnecessary - like most, though not all, of these protocols clearly are - we could also *stop shipping them by default*.

Fedora considers curl-minimal

Posted Mar 14, 2022 14:55 UTC (Mon) by rwmj (subscriber, #5474) [Link]

More likely if someone installs something not in Fedora and they have curl-minimal they'll be wondering why the package they just installed doesn't work.

Fedora considers curl-minimal

Posted Mar 10, 2022 9:49 UTC (Thu) by jengelh (subscriber, #33263) [Link]

There is a limit to practicality. Some considerations:

* Providing both curl and curl-mini variants may reduce the container by 100KB, but now you have added at least 500KB to your mirrors.
* Some software has so many build dependencies that, indeed, it may make sense to build a -mini variant and then another standard variant. openSUSE does that to a few select packages to cut down on overall project build time and/or reducing build cycle lengths. libcurl is not among those, because it is not nearly as dependency-heavy as e.g. systemd.
* xkcd.com/1172
* The overhead of ELF is so damn high these days. ~14 KB for an "int main(){}" built with standard compilers and options plus strip. Splitting libcurl into multiple component libraries hence raises the disk usage for at least one case. Your RPM/DEB database would have to process more entries perhaps (because now libcurl4 and libcurl-gopher4). ld-linux.so would have to deal with more libraries, load times getting worse. You really don't want to end up like samba-libs either, do you!?
* I predict that most people will probably end up with the full curl installed for one reason or another, and the security argument gets weak.
* The "url" implementation of many a browser has probably a lot more fat than curl. If only firefox and chromium would use libcurl instead of handstrung solutions, that might, overall, be a better outcome. Don't try to make the small smaller, make the large smaller.

Bootstrap problem

Posted Mar 10, 2022 10:46 UTC (Thu) by james (guest, #1325) [Link] (2 responses)

Are non-transparent proxies with NTLM authentication really that dead? A system behind one of them is not going to be able to dnf install anything if it can't authenticate (dnf uses libcurl).

Bootstrap problem

Posted Mar 10, 2022 15:55 UTC (Thu) by zdzichu (subscriber, #17118) [Link]

I had such setup on one of the past workplaces. We used locally running "cntlm" proxy.

Bootstrap problem

Posted Jun 9, 2022 10:25 UTC (Thu) by paulj (subscriber, #341) [Link]

They are not dead. There are large companies with such setups.

Fedora considers curl-minimal

Posted Mar 11, 2022 8:17 UTC (Fri) by taladar (subscriber, #68407) [Link] (1 responses)

It seems very strange to remove many protocols in active use as well as IDN "for security reasons" and yet leave the underspecified, unencrypted mess that is FTP in there.

Fedora considers curl-minimal

Posted Mar 19, 2022 1:23 UTC (Sat) by cypherpunks2 (guest, #152408) [Link]

The security argument is that the protocol implementations may have security vulnerabilities, not that the protocols themselves are not secure by design. FTP is insecure in that it is unencrypted and poorly authenticated, but it is not (necessarily) insecure in that it's easy to find an RCE in the code.

Fedora considers curl-minimal

Posted Mar 11, 2022 8:33 UTC (Fri) by andika (guest, #47219) [Link] (6 responses)

I'm confused

https://lwn.net/ml/fedora-devel/CA+voJeWtucz4WFZN6kLU2PKC... said initially:
The "minimal" variants provide only a subset of protocols (HTTP, HTTPS, FTP).

then later said:
`curl-minimal`+`libcurl-minimal` are compiled with various
semi-obsolete protocols and infrequently-used features disabled:
DICT, GOPHER, IMAP, LDAP, LDAPS, MQTT, NTLM, POP3, RTSP, SMB, SMTP,
SFTP, SCP, TELNET, TFTP, brotli compression, IDN2 names.

does he really mean to say:
`curl-minimal`+`libcurl-minimal` are compiled **without** various
semi-obsolete protocols and infrequently-used features disabled:
DICT, GOPHER, IMAP, LDAP, LDAPS, MQTT, NTLM, POP3, RTSP, SMB, SMTP,
SFTP, SCP, TELNET, TFTP, brotli compression, IDN2 names.

Fedora considers curl-minimal

Posted Mar 11, 2022 13:15 UTC (Fri) by jake (editor, #205) [Link]

> `curl-minimal`+`libcurl-minimal` are compiled with various
> semi-obsolete protocols and infrequently-used features disabled:

the wording is a little confusing, as the 'disabled' at the end is somehow easy to miss (or at least i did too at first), but the minimal versions have various protocols and features *disabled*, thus not present in those builds.

jake

Fedora considers curl-minimal

Posted Mar 11, 2022 13:19 UTC (Fri) by tao (subscriber, #17563) [Link] (4 responses)

No. "with [...] disabled"

"with" refers to the enumeration of items, "disabled" applies to that selection.

Think of it in programming terms:

"with" item in [dict, gopher, ...]; do
"disable" item
done

Fedora considers curl-minimal

Posted Mar 12, 2022 7:44 UTC (Sat) by rolandog (guest, #151303) [Link] (3 responses)

I love that spoken language grammar is easier to understand to us in terms of programming language syntax.

Fedora considers curl-minimal

Posted Mar 13, 2022 12:03 UTC (Sun) by rahulsundaram (subscriber, #21946) [Link] (2 responses)

> I love that spoken language grammar is easier to understand to us in terms of programming language syntax.

Spoken language has a lot more amguity that humans can parse based on context, programming languages do less of that or pay a price for it.

Fedora considers curl-minimal

Posted Mar 15, 2022 3:34 UTC (Tue) by NYKevin (subscriber, #129325) [Link] (1 responses)

> programming languages do less of that or pay a price for it.

See for example Inform 7, which is specifically intended to look like English (and is therefore extremely prone to all sorts of weird parsing issues, but OTOH it has support for fairly complex English predicates, meaning you can do logic programming without gouging your eyes out).

Fedora considers curl-minimal

Posted Mar 15, 2022 8:11 UTC (Tue) by Wol (subscriber, #4433) [Link]

Interesting you mention "Inform 7" - especially as it was written by a Graham Nelson.

Because one of the names of the Pick data access language was "English", another was "Inform". And it may have (although I don't think so) been written by Don Nelson, one of the architects of Pick.

(It was called English, because it is similar to English, and likewise it allows pretty complex query logic. "Without gouging your eyes out" as you so eloquently put it - and as I'm now finding with my SQL programming at work ...)

Cheers,
Wol

Fedora considers curl-minimal

Posted Mar 11, 2022 14:11 UTC (Fri) by bagder (guest, #38414) [Link] (2 responses)

> Even if a program is using a URL with an http scheme (i.e. protocol), the (possibly malicious) server could redirect to a different URL with a different protocol entirely, which would then invoke that code in curl if it is present

That was true until curl 7.65.2, released on Jul 17 2019. Since then there's a separate option for setting which protocols curl accepts redirects to, which defaults to HTTP, HTTPS, FTP and FTPS.

/ Daniel

Fedora considers curl-minimal

Posted Mar 14, 2022 14:47 UTC (Mon) by Paf (subscriber, #91811) [Link] (1 responses)

An option which no doubt is rigorously set by all users at all times. “Options” for doing the secure thing are borderline meaningless in most situations unless they’re shipped on by default.

Fedora considers curl-minimal

Posted Mar 14, 2022 22:10 UTC (Mon) by bagder (guest, #38414) [Link]

Let me repeat myself:

"which defaults to HTTP, HTTPS, FTP and FTPS"

Fedora considers curl-minimal

Posted Mar 12, 2022 4:24 UTC (Sat) by PengZheng (subscriber, #108006) [Link] (2 responses)

CURL is mainly used by developers (or not?).
It really makes no sense to reduce developers' power.

Fedora considers curl-minimal

Posted Mar 14, 2022 14:45 UTC (Mon) by Paf (subscriber, #91811) [Link] (1 responses)

That’s not true at all. Curl is a regular - if horrifying - component of scripts.

And this isn’t “reducing developers power”. There’s literally going to be a “with ancient unused protocols fully intact” version *also packaged by Fedora*. For our theoretical developer, ‘fixing’ curl so it can support Gopher again is one brief command away.

Fedora considers curl-minimal

Posted Mar 15, 2022 8:07 UTC (Tue) by PengZheng (subscriber, #108006) [Link]

It's no surprise to me that the biggest user of curl is backend developer (page 4 of https://daniel.haxx.se/media/curl-user-poll-2021-analysis...). It will be a big surprise to most users (and programs using libcurl) that the "swiss army knife" has only 4 built-in protocols.

A safe default setting should be enough solving the mentioned problem.

Fedora considers curl-minimal

Posted Mar 14, 2022 15:00 UTC (Mon) by Paf (subscriber, #91811) [Link] (3 responses)

It’s just incredible to me that people seem to be arguing in favor of never deprecating *anything* by default in an internet facing program. Sure, the selected list seems too broad, possibly much too broad, but the idea that “respecting developer power” should trump anything else…. Or the repeated - in the comments here - detailed arguments about binary size, which the article and thread make clear is a non-concern…. It’s fun to have every protocol ever, sure, but if you want that it’s one package install away. One of the absolute best ways to reduce burden and improve security is *removing stuff*. Code that doesn’t exist has no bugs.

As for the Fedora thread, the idea that everyone is going to “unbreak Fedora by installing full curl”…. No, if the protocol list is reasonable (I agree this removal is too broad), 99+% of users (including developers) will *never notice there was a change*.

How many of you can honestly say you’ve needed curl to support something other than HTTP, HTTPS, FTP, SFTP, NTLM, brotli, and (I guess?) TFTP in the last decade? (IDN gets a pass for reasons cited in the article.) Not for fun - actually needed.

Fedora considers curl-minimal

Posted Mar 14, 2022 18:45 UTC (Mon) by bagder (guest, #38414) [Link] (2 responses)

The curl project asks its users about these things in its annual survey. While that then is self-reported it certainly isn't an unquestionable truth, but probably the best what-features-in-curl-is-used numbers you can get.

The 2021 survey analysis is linked to from here: https://daniel.haxx.se/blog/2021/07/05/curl-user-survey-2...

Fedora considers curl-minimal

Posted Mar 15, 2022 12:29 UTC (Tue) by Paf (subscriber, #91811) [Link] (1 responses)

Given curls use in scripts and other tools used in installers, etc, I feel comfortable saying the user survey is massively *unrepresentative* of use.

Those interested enough in curl to take the survey are vastly more likely to use weird protocols.

In essence we see it has two lives:
A basic system component which is worked in to the fabric of other things, in which role it uses HTTP, HTTPS, and FTP to get stuff from the internet
A Swiss army utility protocol fiddler/translator for developers and admins

It doesn’t seem crazy these would be separate packages, given the risks posed to the (much larger) first group, and the minor burden introduced for the second group who know how to deal with it.

Fedora considers curl-minimal

Posted Mar 15, 2022 15:11 UTC (Tue) by amacater (subscriber, #790) [Link]

Curl is the "Oh dear, if that's the recommended way to get components for [Kubernetes/Open Stack/any other popular program], it's bound to be a world of hurt putting it all together" moment for me.

Maybe I've been insulated by living with distributions for too long but it's also very much a "don't trust anything that asks you to curl/wget stuff from random 'Net addresses" syndrome, I'm afraid.

IDNs

Posted Mar 20, 2022 5:29 UTC (Sun) by mirabilos (subscriber, #84359) [Link] (2 responses)

Instead of having tools automatically support IDNs, with the exception of GUI tools that directly take typed user input (and even there, different solutions might be better), I’d rather have a CLI tool to punyencode things which you can then call like: curl http://$(punyencode "$domain")/path/file

IDNs

Posted Mar 20, 2022 8:04 UTC (Sun) by zdzichu (subscriber, #17118) [Link] (1 responses)

So instead of curl being linked with libidn, you will have punyencode linked with it. libidn is still on your system. In the big picture, you have not shrinked your system image (which is the point of curl-minimal exercise).

IDNs

Posted Mar 20, 2022 10:33 UTC (Sun) by mirabilos (subscriber, #84359) [Link]

You are missing two things.

One, the attack surface of IDNs will be gone from cURL, which I believe is the actual point of this exercise.
Two, the presence or absence of IDN support can be done independent of cURL or other tools, and even be added to only a subset of system images.