Some tools you use so often that you stop seeing them, like a light switch: nobody stops to wonder who made it or when. That’s what happens to me with curl. I type it several times a day to test an API, check some headers or download something, and in PHP I must have written curl_init() and curl_setopt() more times than I’d like to admit. Well, today, November 11, Daniel Stenberg looks back on the 30 years since it all started.
A hundred lines of C
On November 11, 1996, Rafael Sagula published httpget 0.1, a little over 100 lines of C for downloading things over HTTP. Daniel was working at a railway systems company at the time and had an IRC bot (Dancer) with a currency-conversion service that needed to fetch exchange rates from a website. He found httpget, added name resolving and sent the patches to Rafael. The usual story: you fix what you need and send it back.
Then came Gopher and FTP, and since calling it httpget no longer made sense, it became urlget. In early 1998 it got its final name, and on March 20 curl 4.0 was released: 3,300 lines, 24 options and three protocols. That’s why the project has two birthdays: httpget in November 1996 and curl in March 1998.
For some context, in 1996 an average Swedish home connection ran at about 30 kbps (today it’s around 200 Mbps), there were about 36 million Internet users and some 250,000 websites. A world where downloading something automatically was almost a luxury.
From tool to library
The big leap came in August 2000 with libcurl, the library that lets other programs do what the command-line tool does. And this is where PHP comes in, adopting it very early as its transfer engine. Half the PHP web that talked to other services (payment gateways, APIs, webhooks…) did so, and still does, through libcurl.
From there, curl ended up everywhere. Stenberg estimates libcurl runs in about 30 billion installations: phones, cars, TVs, consoles, routers… and NASA confirmed it was used in the Mars landing mission. Not bad for something that started out checking the dollar exchange rate on an IRC channel.
What I like most
Beyond the numbers, there are two things I take away from the story.
The first is that curl has never been rewritten. Thirty years keeping API and ABI compatibility, in an industry that rewrites everything every few years because “this time we’ll get it right”. Code you wrote against libcurl twenty years ago still works, and that, boring as it sounds, is exactly what makes people trust a tool enough to build on it.
The second is that curl belongs to nobody. It isn’t a company or a foundation: Daniel calls himself its “benevolent dictator” and admits there’s no succession plan, although everything is documented so the project can carry on without him. It’s the textbook case of those pieces of infrastructure held up by a single person (with help, of course) that we all depend on without knowing it. And that person also has to spend more and more time sifting through security reports that aren’t: in VulnCheck’s tracking of AI-discovered bugs, 19 of the 34 published reports about curl weren’t vulnerabilities.
Rafael Sagula, who wrote those first hundred lines, passed away in 2016. Daniel is still at the helm and says he never had an end goal for curl, and hopes to keep at it for a few more decades. Thirty years on, the tool I use without thinking is still there, compatible and unobtrusive, which is the best thing you can say about a piece of infrastructure.
