Curl 8.5.0 With Daniel Stenberg  ## Metadata - Author: [[Daniel Stenberg]] - Full Title: Curl 8.5.0 With Daniel Stenberg - Category: #articles - Document Note: --- tags: [#ElectionDay, #Voting, #ChristianEthics] - #ElectionDay - #Voting - #ChristianEthics Author: Chapter 5 Cast Source: YouTube Video – "Chapter 5: Election Day!" Reference: https://www.youtube.com/watch?v=NgF7rqjx0BE date created: 2025-08-22 23:59 --- # Title: Chapter 5: Election Day! (Transcript Analysis) ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Diversity, Equity, Inclusion, Belonging Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary: This video transcript uses humor (including goats dressed as Lord Copperbottom) to explore **Christian approaches to voting**. The narrative emphasizes four guiding principles: 1. Reject fear-driven choices. 2. Value all people equally as made in God’s image. 3. Discern truth from lies in political messaging. 4. Avoid domination while still engaging in politics as an act of neighborly love. The dialogue concludes with the recognition that **no perfect candidate exists**, so Christians must weigh imperfect options while striving to vote for justice, truth, and love. --- ## 📖 Main Content: The video blends satire and theology to teach ethical voting habits. It encourages viewers to avoid being manipulated by ads, fear, or misinformation, and instead focus on biblical principles of love and justice. Humor keeps the content engaging, while serious points (imperfect choices, responsibility to neighbors) ground the lesson. --- ### 🗒️ Notes [0:10](https://www.youtube.com/watch?v=NgF7rqjx0BE&t=10) Election Day excitement - Compared to Christmas: relief from ads, debates, flyers. - Goat dressed as “Lord Copperbottom” adds absurd humor. [0:31](https://www.youtube.com/watch?v=NgF7rqjx0BE&t=31) Guiding principles for Christian voters - Reject fear as a motivator. - Do not dehumanize groups—everyone is made in God’s image. [0:50](https://www.youtube.com/watch?v=NgF7rqjx0BE&t=50) Reject lies and misinformation - Ads, debates, and political messages often contain falsehoods. - Discernment and truth-seeking required before voting. [1:11](https://www.youtube.com/watch?v=NgF7rqjx0BE&t=71) Politics and power - Christians should not use politics to dominate others. - Voting is framed as **loving neighbors** by seeking their good. [1:57](https://www.youtube.com/watch?v=NgF7rqjx0BE&t=117) No perfect candidate - Until Christ’s return, all candidates are imperfect. - Voters must choose between flawed but potential good options. [2:28](https://www.youtube.com/watch?v=NgF7rqjx0BE&t=148) Voting ethic summarized - Reject fear, hate, and lies. - Vote for the good of everyone, showing love and justice. --- ## 📖 References: - Genesis 1:27 – All humans made in God’s image. - Micah 6:8 – Act justly, love mercy, walk humbly with God. - 1 Timothy 2:1-2 – Pray for leaders and those in authority. --- ## 🗣️ Paraphrase: 1. Original: *“We won’t think of any group of people as less human or less deserving of God’s love.”* Paraphrase: Every community and person deserves full dignity and divine love; voters must reflect this in political choices. 2. Original: *“There is no perfect candidate who gets everything right until Jesus comes back.”* Paraphrase: All political choices involve imperfection, so believers must carefully weigh flawed alternatives while awaiting ultimate restoration. --- ## 📰 Newsletter: 🗳️ **Faith, Humor, and Voting Wisely** This week’s spotlight is on a lighthearted yet powerful video about Election Day. Between goats in costumes and lively dialogue, the story challenges us to reject fear, lies, and hate while casting votes rooted in love and justice. The reminder that **no candidate is perfect** rings true for every election season. Check out [Chapter 5: Election Day!](https://www.youtube.com/watch?v=NgF7rqjx0BE) for a mix of satire and spiritual grounding that could inspire your own approach to voting this year. --- ## ✅ Action Items: - Relate this content to **open source governance parallels**: no perfect leader, but transparency and truth matter. - Use this as an analogy in **WordPress contributor mentorship**: discern truth, reject fear, embrace inclusion. - For OSPO career goals, highlight the **importance of principled decision-making** in governance structures. - Educationally, develop training that frames contribution and voting as **acts of service for community good**. --- ## 🧪 Hypotheses: - Humor increases retention of ethical-political lessons. - Explicit rejection of fear and lies reduces polarization among faith-based voters. - Community framing (neighbor-love) makes civic duty more meaningful to participants. ### 📊 Methodology: - Run surveys testing comprehension of voters exposed to humorous vs. serious election guides. - Compare civic engagement levels in communities taught using neighbor-focused ethics. ### ❓ Questions: - How does satire improve (or distract from) moral instruction? - Can faith-based messages transcend partisan divides? - What parallels exist between voting ethics and open source governance? ### 🔮 Future Research: - Study effectiveness of religious humor in civic education. - Analyze role of storytelling in reducing fear-driven voting. - Compare Christian ethical frameworks across denominations on political participation. ### 💡 Implications: - Could inform how churches, nonprofits, and educators approach election season. - May encourage communities to balance serious reflection with levity. - In open source, reinforces need for principled, transparent decision-making. --- ## 🧠 Learning Styles Assessment: - **Visual**: Present (goat, costumes, humor). Could add infographics for voting principles. - **Aural**: Strong—dialogue format with voices. Could supplement with podcasts. - **Verbal**: Engaging, narrative-rich. Well-suited for linguistic learners. - **Kinesthetic**: Weak—no interactive elements. Suggest role-playing election scenarios. - **Logical**: Moderate—principles outlined, but could include flowcharts of decision-making. - **Social**: Strong—dialogue encourages group reflection. - **Solitary**: Limited—no journaling prompts. Suggest reflection questions. - **Naturalistic**: Absent—add environmental metaphors (e.g., community as ecosystem). --- ## 📊 Accessibility Assessment: - Video transcript available ✔ - Humor may not translate well via screen readers (goat joke). Recommend descriptive captions. - Ensure high-contrast visuals for accessibility. - Suggest audio description for key visual humor. --- ## 🌍 DEIB Diversity, Equity, Inclusion and Belonging Assessment: - **Cultural Relevance**: US-centric election framing; could broaden to global voting contexts. - **Inclusive Language**: Strong—human dignity emphasized. - **Neurodiversity Support**: Dialogue format accessible, but could simplify structure for clarity. - **Representation**: Limited—characters not visibly diverse. Suggest broader character variety. - **Psychological Safety**: High—encourages rejecting hate and fear. --- ## ✅ Logical Validity: - **Strengths**: - Strong causal reasoning (fear, lies → harmful voting outcomes). - Deductive reasoning (all made in God’s image → all votes should respect dignity). - Balanced perspective: acknowledges imperfect candidates. - **Weaknesses**: - Possible oversimplification: “reject lies” doesn’t address nuance of misinformation. - No direct exploration of policy complexities (could be seen a - Summary: Curl 8.5.0 was recently released by Daniel Stenberg, the project leader. This release had a total of 78 contributors and 40 authors who wrote commits that were merged into the release. The release included security advisories for two vulnerabilities, one medium severity and one low severity. The medium severity vulnerability involved a flaw in how curl handles the public suffix list, potentially allowing for the creation of a super cookie. The low severity vulnerability was related to a bug in how curl handles the HSTS feature. The release also included improvements, bug fixes, and changes such as support for native CA stores and the official support for HTTP/3. - URL: https://www.youtube.com/watch?v=fWiYbDpFeS4 yes hello and welcome to curl 85.0 this is December 6 2023 uh I just did the release uh a little over an hour ago and uh this is of course I am Daniel Stenberg I do I lead the project I'm the I work for wolfssl we do curl support all that's my social stuff you can find my site this photograph is actually where I sit right now it's here in my home office in Sweden so today I wanted to go through the regular setup that I do on um you know the release videos going to start with some numbers and a little bit of the security specific things that we did in this release I want to mention the two changes we have h a few of my favorite bug fixes I think I have 16 this time to talk about there are many more of course in the change log two things that we are going to remove in the future I just want to emphasize highlight talk about it and uh let you say what you want about them and then I have a number of things that we are we might merge soon possibly for the next release uh yes this is release 200 153 counted from the very beginning uh of course it was not even named um curl from the beginning but still in for this release we had a pretty big participation as most releases we have 78 contributors and we had 40 authors who actually um wrote commits that we merged into get in this release so the total number of people of course keep uh growing and um it's cool so keep keep submitting your issues and pull requests and whatever this was an ordinary quote unquote release cycle so we did it in 8 weeks 56 days and that sort of adds up to 9,392 days since the first curl release quite a long time uh you see just 600 days left until the 10,000 days since Carl was released again we started this project before it was named Carl um so let's start out with the security advisories for this time we have two uh to talk about one medium one severity medium one severity low uh they're they're not alarming in any way but I wanted to talk to you about them and tell them a little bit uh tell you a little bit of the details here and again you should not really read about them on nvd or trust what nvd says about them because you know by now that they will say whatever they want and it's not necessarily at all the same view as others like us have uh on those issues so let me start with the civility medium one reported by Harry cintan again I think he's approaching 20 CVS by now this is a way basically it's a flaw and curl in how it handles the public suffix list and the public suffix list uh in case you don't know or you don't remember it is the list of domains that are domains that are treated and presumed to be public suffixes and one of the most sort of commonly known and used ones is the co do UK which basic basically means that that's a public suffix it's supposed to be treated as treated differently for cookies sorry you're not supposed to be able to set a cookie for that domain co.uk because you would then set it for a huge number of sites so Carl of course as any cookie engine on on the web today then checks that if you try to set a cookie for a PSL domain it refuses uh or it should in this case it fails to do that pre precaution uh check avoidance because of a flaw so that if you would ask to set the um the cookie using a mixed case or um not only lower case you would sort of circumvent the check that's why it's called a mixed case PSL bypass so by by if you're as a site then set the cookie for and you you say here's for this domain co.uk per perhaps with the UK then in uppercase as I mentioned here in the text uh C would accept that because it wouldn't detect it to be a PSL because of a flaw in the check in the code pretty stupid but this allows a server for example if uh to set the kind of a super cookie that would survive and get used on all of the all sites on that part particular domain including then a PSL so you could set it for a huge amount of sites and that's not how cookie is supposed to work and then you you would sort of create a kind of super cookie in a way that's um could be bad could be maybe not that terrible either but um still a security flaw we consider it C medium um and yeah yes let's leave it at that rewarded uh 2,500 usds I think with this reward we are now above 70k USD in reward money in total since we started the back bounding program kind of cool the second flaw is uh severity low reported Maximillion I don't know how to pronounce his last name archim moitz arim arovit I don't know I'm sorry for that but that's just me um so this is a bug that is um basically when when Carl you know hsts is the feature when Carl saves a domain and it knows that starting now it should never speak clear text HTP to this site it should only speak https directly so if you would go to http colon site again it would not use Clear text it would switch to HPS directly immediately and so by that avoid the sort of the clear text uh redirect bounce thing that you would otherwise get and in this case if you would use an HTS file Li as as a cache and you would have a very long file name like in a in a normal file system like 255 bytes or it's usually that's maximum and if you would have a fil l close to that limit Cur would actually accidentally flush the entire HST hsts cache and you sort of start over because of it would when it create a temporary file to save it h it would add a few bytes to the file name and therefore create a too long file name so it would fail the creation blah blah blah um anyway that stupid bug is now also fixed so so we we consider this a severity low because it's kind of a stretch that you would actually suffer from it but if you have a script and if you just happen to do this it could be it could be doing things wrong it was a silly flow of course but um yeah we have a few things added in this release well I count two changes and they are pretty basic and U let me tell you about them so the cockpit in curl is now extended with so we now support the this native CA bit you can ask lib curl and actually you and you can do it with a curl command line tool too to use a native CA store basically that in most cases that means your windows CA store it depends a little bit about the on the TLs packet in particular but if your TLS uh well if the right combination of support is there now you can ask um your curl build that is built to use G LS to also use the native CA store which in this case then means Windows CA store which is kind of convenient if you're if you want to make Carl actually work more similar to your windows native stuff um and and maybe not such a well this is a change because now we consider hb3 no longer experimental if you build with NG tcp2 back end so from now on we officially support and hb3 in in official bills it is still I mean it's yay but it's still going to be a little bit of a hurdle for people to actually use and deploy this because um the most widely popular TLS Library op SSL does not have the necessarily necessary apis for this so you can't build curl with regular open SSL with hp3 support so I know that is going to be a sort of a deal breaker to some but if you're able to use one of the libraries that support the quick apis you can build it and run it today NG gtcp 2 supports quick with a lot of different libraries so there's a there's a large sort of collection to pick from but not open SSL right now possibly uh going forward we might get openl support as well but it's it's not there and U it might take a while so with those two simple changes we can just sort of just move on and say that we have 188 bug fixes in this release and um yes some of them uh I want to talk to you about and uh sort of my quote unquote favorite ones basically a bunch of of things that we could talk about or and just sort of maybe be aware of maybe they are the most important ones to most most people but first uh it turns out that we introduced ipfs support in the C tool I think the previous release and it turned out that the the management of ipfs URLs was a little bit uh inferior so it's improved now it works better so it should work with more gateways and more ipfs URLs pretty much and a fun thing that we introduced actually I think we introduced it in 2018 to non- Windows curl tool users we started showing headers in bold in Terminals and if the ter terminal would support it um and starting in this release we can also support bold headers output in the curl tool in Windows so just uh five years later or something like that I think it's cool it it increases readability when you output things in the terminal fun thing it turns out that if you're using the progress bar with curl you know the D pound sign progress bar or-- progress bar uh it is you know a different progress bar and when you download stuff it turns out that if you had a terminal wider than 256 columns we would actually output it wrongly when I created the progress bar in the in memory buffer it would not fit the carriage return the final bite on the line so it would have just output the line uh in a broken way didn't really work um and now starting with this release when you do curl DV as in verbose or lib Cur with verbose option set you will curl will now uh show you the list of ips that is going to try to connect to it is useful for the bugging when you want to connect to a site that resolves to a number of IP addresses it will it will then show you what IP addresses it resol to and not only I mean in it already showed you which IP addresses uh IP address it tries to connect to which then could be many if it would iterate through many but if it if it works with the first IP address you wouldn't see the other ones now you can get the other ones as a sort of helpful debug thing which is good when you want to well debug issues uh similarly we also added more verbos output about the TLs handshake some algorithms and stuff uh when in the when opsl has negotiated a TLS sort of connection we fixed or we improved the uh do DNS over HPS handling really which means that in most cases when you do adns over htps it's a it's actually a https request right to get DNS information but in most cases you do two DNS requests one for the ipv4 address and address sis or and one for the IPv6 addresses that's an dnsa record or a quad a record so they're done they're done by two different H HTP requests and starting now we make a better we add we set the pipe white internal option which means that it h tries to a higher degree to use the same HTP the same connection for both requests rather than doing two connections for those two those two requests basically lowering the amount of connections necessary for this from two to one which is a sort of it uses few resources and just is could be more effective in some ways I fixed a few problems with the curent easy dup handle function in case of out of memory in the middle of the dup handle operation it was a kind of messy situation there again we fixed problems with the AWS sigv4 authentication mechanism which is a um no judgment from me but it's a really messy authentication mechanism that is really complicated to support and uh we of course found a few more edge cases I don't think we have found the last one but you know we're slowly gra slowly fixing things one by one so it becomes better day by day so now it's a little bit better again uh we this bug fix in this bug fix we remove http2 support from curl when you build it to use hyper which sounds weird right but it turns out that our my implementation or my adjustment for using H you you if you remember hyper is an alternative HTP back end for curl so you can build curl to use hyper instead of the Native HTP code it then replaces part curl with Hyper instead of curl code it's an experimental feature and it turns out that I had done it slightly wrongly so the hp2 support with Hyper was broken broken into the extent that it was better to just remove the support and we are going to work on remodel that and do it in a different way going forward so um we remot be2 support because it turns out I had misunderstood the API there might be some features missing from the API and turns out that in some cases it turned out to be really terribly slow and unusable pretty much and now by removing hpt2 support we at least avoid those really terrible pitfalls in in the in the tball release of curl we have now dropped support from for a lot of older Visual Studio project files that we used to generate in in the distribution and we added a new one uh well it's not the latest one it's a newer one I don't remember exactly what they have different you know they called 2018 or something but internally it's 14.20 and 14.30 and stuff like that I don't remember the exact details we dropped a few we added a new one we're probably going to drop them all going forward because nowadays you can regenerate these with from cmake so we probably don't need to generate them ourselves anymore but um in this release we do we fixed the thing when again this is you know the the op native CA I mentioned as a change for GS we bug fixed the feature for open SSL so that it also Imports the intermediate Casa that Windows might have stored uh because it's sort of that's what's sort of users are going to expect and it increases is the usability of this and probably going to make users happier in general and we've bug fixed this little thing so that when you use ocsp stapling called verify status actually in TLS lingo uh it it shouldn't be it shouldn't be attempted when we reuse session ID to do a shortcut handshake really because it's not supposed to so we're not supposed to do that but and if we did we would get a failure so now we don't do that anymore okay and the last four bug fixes to mention for this time you know we have a lot of different protocol combinations and you can ask for different protocol versions for different layers really so I had previously not done it like this but if you ask for a specific IP resolve option that means you're asking for IPv6 or ipv4 that's typically the your local connection so I didn't think it would apply to the so socks proxy as well but now it does because it's seemed most reasonable so if you're asking for a IPv6 connection or an ipv4 connection specifically you're now asking for socks 5 to resolve or use that IP family as well maybe not a bug fix but a small little Improvement is that we introduced a sort of the the perfect hash approach to find this URL scheme when you enter a URL you know searching among all the known schemes we now no longer Loop to find the the scheme we have the the sort of perfect hash mechanism so we just calculate the hash and it will automatically just match a single scheme so it'll just find schemes a little bit faster probably no one will ever notice because you don't do that too often normally but who knows a little fun thing we now basically the AL pan is a way Al pan is a TLS extension to select what protocol to talk behind TLS right application layer protocol negotiation is the term for the alpn and it actually it was introduced for http two so you could say to the server I I want to speak HTP 2 or htp1 you pick the one that you can support and the server then responds and say Hey I want to go with this version going forward which is cool and when when that was introduced HP 1.1 and hp2 was the only one they were the the first ones and the only ones for a brief period of time and then later they also registered HTP 1.0 alpn code but it turns out then that early servers that support alpn they don't know the HTTP 1.0 alpn they only one they only know the 1.1 so even if you want to speak 1.0 you still have to use the 1.1 alpn so that's what curl does now for sort of compatibility with the real world out there uh it's a little bit weird but it turns out that there are servers that work better this way what do you do this is what we do I went through and made sure that all curl command line sorry uh all lib curl Man pages that's all the Man pages for lib Cur functions and lib curl options there about 480 of them all of their examples the example Snippets in their Man pages they all now compile without well they compile Warning free so they they actually you know they use the right symbols they don't use Undeclared variables and they actually don't declare unnecessary variables either so um I think it's a it's a big win because it makes the examples better now they're proven to actually compile I hav to run them because they're usually incomplete so but at least they compile so we I found a lot of mistakes so they they're certainly much better now and now they're also tested in the CI and everything so when we we update Man pages and create new Man pages and everything they we will spot if someone creates or you know fails to create an example that actually is a lib curl proper kind of cool so I want to highlight two things that we are going going to remove in the future Pro tiny things it's not going to impact a lot of people I think first we're going to remove the support for the ntlm WB option and this is a really Niche feature it's an it's a support for ntlm authentication but a particular flavor of it us using an external tool a wind helper tool called I don't remember off the top of my head but anyway it's a very Niche uh feature be basically no one is using it it was quirky it a quirky implementation it use even uses fork in xac um we don't have a very good test coverage so there are a lot of reasons why we don't want this anymore and I don't think anyone uses it anymore so it's not going to hurt anyone either and I'm giving you heads up time so if your user of this let us know if you're um sort of if you're going to hurt by this move let us know and we'll take it into consideration I'm not sure what to do about it but we we want to know at least and then of course I mentioned this before also next year then by the summer time we're going to remove this space separated no proxy pattern support uh basically just in a way to make sure that we support the no proxy style of specifying proxy patterns the same way as most other tools and libraries do yes so wow that everything is weird here and that's yeah something is going on okay next release is um likely to become 8. 6.0 we are uh of course we have a bunch of things queued up that we wanted want to do in that release uh and uh some of those things that we are planning to get into next release first support for E encrypted client hello previously know known as ESN encrypted server name I identification I yeah so encrypted CLI hello is a way to encrypt more data in in the TS handshake in particular the Sni field hide the destination of your TLS connection sort of the destination host name or the destination service we are planning to implement this this is just a millisecond version of the option without the underscore Ms extension it should be a very simple little thing just give you the user a higher resolution timer another curl um timing information that we haven't really exposed to users so if you want if you for example if you're using a lib col transfer and you're limiting for example number of parallel connections Carl could cue your transfer for a while until there's a connection available for you to run the transfer so this is a Time information about how long did your transfer sit in the queue before it started uh we have a new error code coming called curl to curl e to large basically if a value Set uh is too large or or if something grow grew too large to be acceptable and therefore causing an error uh I mean this error situation already exists but this is a way to give you a better error code to understand better what actually happened we are probably going to move or introduce Trace info and verbose info for the do desso HPS communication slightly differently to sort of using the trace config way we introduced a few versions ago maybe a new uh return code for the right function call back so a few things that we have those things are mostly already in the as a they exist as pull requests on on GitHub so we can go there already and start checking them out so next release is plan for January 31 next year 2024 unless we consider some of the bugs that we clearly have in this version already maybe some of them are too annoying to to wait until the end of January and then in in that case we will do an earlier patch release but I hope we can avoid that during our release cycle you can of course always go to this URL and check out the pending release notes we we keep that up to date during the Cycles so we update that every now and then so you can go and see there dep pending release notes for the coming release what are we planning to do going forward uh yes so we have this release cycle as I mentioned before it is a release Wednesday that's today we have 10 days to sort of figure things out um wait maybe we have need to do a patch release maybe not we just make sure that everything works we get read reports we start to fix bugs and then 10 days later it's a Saturday we add a we go into the feature window period three full weeks when we actually allow everyone to not everyone we allow features to get much changes into the G repository and after those three weeks that's another Saturday then of course um we enter the feature freeze period where we no longer introduce features we just fix bugs until the release Wednesday and then we ship the release and then we start over again and in this particular cycle of course December 6 is today December 16 is when we go into the Fe we open the feature window on January 6th we close the feature window again and then we can do the next release on January 31 that's the ideal cycle uh here I of course always want to emphasize that I do curl support uh full-time all day every day so if you have a problem you want help with your commercial use of curl get in touch and we can help you already today if you find issues bugs typos problems do submit them on GitHub on this URL or if you have a security problem go to hacker one.com curl instead and um tell us about it and we will work on that feature sorry the problem there like we did with those two CVS we announced in this release um we keep that of course private and secret until the day we release all the details as always and I want to mention of course the the uh cool official curl sponsors of curl uh in December 2023 they are this cool team have a bunch of um main sponsors and a bunch of silver sponsors and the screen looks all weird but maybe it's it's acting up for me but um I don't know what to do about it let's see if it what happens yeah let's forget about that um and just say that the this was is curl 8.5.0 and um December 6 I suggest you go to the curl. site and read the full change log if you want to find out about more the extensive change log and all the datas and everything and uh then until next release um goodbye, Curl 8.5.0 With Daniel Stenberg, Daniel Stenberg, 01hh5kvy7vgsm9sz7mqxqwkcz0.