Daniel Stenberg, lead developer of curl, writes about maintaining the project, security reports, and internet protocols.
HN links it for his posts on AI-generated bug reports. Commenters cite his skeptical view of AI vulnerability finding and say reviewing plausible-sounding LLM output is hard.
> we've had say superhuman competitive programming performance for awhile
Fair. Question though, is this when compared to competitive programmers, or developers in general?
> extremely strong performance (super-p90-engineer) on say language-to-language porting
I'd need to see the methodology here and could easily be wrong, but I suspect this is largely down to "faster" and "willing to do a lot more of it without complaining"
> RE-bench (ML research engineering benchmark from METR) is already clearly above human perf
This pretty much has to be "relative to devs who don't specialize in that area", because if it wasn't the frontier labs wouldn't be paying a fortune to hire ML researchers.
> Mythos clearly has superior cyber capabilities
Based on Daniel Stenberg's experience with it [0], it seems like it's at best roughly on par with human experts. It's advantage is cost/speed.
> Also, why do you discount speed and cost so much?
Because in all the domains LLMs are applicable to, getting something cheaper/faster at the expense of quality isn't new or particularly interesting.
> Every model iteration is a significant bump up in performance according to a lot of complementary and principled measurements. What's been the thing that hasn't been true?
That they were good enough. To reuse the baby analogy, if every week your friend told you that their infant child was now heavier than an elephant (while acknowledging that the baby was lighter than one the previous week),…
sudo makes sense as a name, but it is worth noting that it hurts the original projects.
Famously, the curl project receives tonnes of issues and support requests from people who run `curl` in PowerShell, not knowing it is an alias meant for convenience instead of the actual curl command[1].
Sudo for windows is already relatively old and doesn't seem to have been adopted much, but my prediction is that adoption would mean people would complain on forums that commands they found on the internet don't work. "Why wouldnt it? I have sudo?". Then people will have to explain to them that "No you do not have sudo, you have the windows version of sudo, which is not real sudo" and it will confuse.
When it comes to tools, I strongly believe naming things similarly to concepts the user already knows is a disservice to the user. This isn't UX for your mom and pop, it is a tool to perform a job, and learners get confused when suddenly the same thing isn't actually the same thing at all. It is mislearning, and I would argue almost anyone who does mentoring has seen this in action.
[1]: https://daniel.haxx.se/blog/2016/08/19/removing-the-powershell-curl-alias/
Here's my "reply-guy" comment of the day: if you are posting about where you buy your wall decoration and you get negative feedback, well, maybe it's not worth to tell strangers where you buy wall decoration.
But sometimes somebody puts a lot of effort on creating things for other people to enjoy. It can be a youtube video, a tutorial, a technical opinion. Or curl[^1].
Feedback provided on such an effort often takes a minuscule fraction of the work the creator put in, and they can be really nasty.
I just think that providing opinions should require some effort. An affordable amount of effort, but not too low. Maybe if I do something worth of notice someday, I'll invite feedback by creating a public Minecraft server and asking people to log in there and post their comments on the book at coordinates 1000, -58, 1000.
[^1]: https://daniel.haxx.se/blog/2024/04/22/curl-is-just-the-hobby/
Such an amazingly useful tool -- just a couple hours ago I was using it to setup and launch an entire website from the command-line after having just learned that Dreamhost has a REST API for setting up DNS (which works in tandem with AWS's s3api CLI tool) -- and so actively yet quietly updating for nearly 20 years now...
Daniel Stenberg (curl's creator) posted a talk he gave at Google's Stockholm offices a few months ago...I'm sure he's told the origin story many times before but it was the first I've heard of its truly humble and hacker-DIY origins (he needed a convenient way to access currency rates while chatting in IRC):
http://daniel.haxx.se/blog/2015/09/17/blabbed-about-curl-at-google/
The talk is worth watching just to hear not about what it's like to maintain a "hobby project" for a billion users, but for a nostalgic tour of Internet protocols at the time of curl's birth.
Of course, Amazon loves the US and is concerned about her safety, that's why they have been found to sell to sanctioned individuals [0].
Also, outside marketing, there is no reason to presume GPT-5.5 to be any less capable in this aspect. Yes, Glasswing lead to a lot of findings, but for one, as curl has proven, these were often oversold [1] and B, Glasswing was heavily subsidised [2], alongside being exclusive, so naturally the entities that had access were going to heavily use it while they had this access, thus inflating findings. A lot of Glasswing also happened prior to GPT-5.5 being accessible, again tilting the numbers towards Mythos being more capable, simply by being a few weeks earlier.
[0] https://ofac.treasury.gov/media/44311/download
[1] https://daniel.haxx.se/blog/2026/05/11/mythos-finds-a-curl-vulnerability/
[2] https://www.anthropic.com/glasswing
> cURL (still single person AFAIK)
That person is Daniel Stenberg. He's been the main driver[0] (esp since its been called "curl"), and is still the majority committer, but the project has ~1000[1][2] commit authors (disclosure, I'm one). I'm in no way trying to diminish Daniel's work. It is excellent. Curl has however taken on a life of its own to an extent, with a few other heavy lifters and lots of occasional contributers. I actually think this speaks well to Daniels leadership; he seems to have a loose grip that guides the project and keeps things on the rails with minimal perturbation. He's still a heavy lifter, but not entirely Atlas[3].
[0] https://curl.se/docs/governance.html
[1] https://curl.se/docs/thanks.html
[2] https://daniel.haxx.se/blog/2022/01/30/1000-commit-authors/
[3] https://en.wikipedia.org/wiki/Atlas_(mythology)