Mackenzie Jackson: Welcome back to another episode of The Secure Disclosure. I'm super excited to be here with yourself, Daniel. Thank you so much for agreeing to join me on the show. I was saying I was expecting a rejection, but you kindly agreed, so here I am. Anything can happen. But you're the creator of curl. It's one of those projects where it's so fundamental and built into everything now that you kind of forget that it's these people behind it. It came from somewhere. It was an idea that you had, but I wanted to start maybe by talking about how that project started and how it got to I think 30 billion applications using it or whatever the insane number is.
Daniel Stenberg: Yeah, it's somewhere in that ballpark, right? I just wanted to download data over HTTP and I didn't know how to do that. I just looked around. This was in late '96, right? Soon 30 years ago. And I found a tiny little tool called HTTP Get that basically did what I wanted: download currency rates over HTTP since I did a currency exchange service for my IRC bot at the time.
Mackenzie Jackson: Yeah, yeah. And then so that...
Daniel Stenberg: It was a really tiny tool, 100 lines of code or something. And it did basically what I wanted. It had some flaws, and I thought we could improve it a little bit. So, I patched it around and sent back some improvements to the author of that tool, Rafael. And that's how it started. And then I started to download stuff over HTTP. It was a little bit of a revelation to me how you actually, "Oh, it's that easy to actually download stuff over HTTP." Early days. And I figured out some other ways we should tweak the tool to make it more convenient to use from the command line. Rafael, he didn't really want my contributions anymore. He figured he was done with it, I guess. So, he basically asked me, "Oh, if you want to do something more, you can continue the work." So, I became the maintainer of the HTTP Get tool. I think I did the first release in December '96. And already from that point on, we made it online, asked people to try it out and use it for whatever your HTTP downloads, whatever you want to download. And people started submitting bug reports and contributing some improvements. I found more protocols which had also other currency rates actually. So, because I still did this for my currency exchange service for the bot, right? So, I just, "Oh, a new protocol that had more currency rates." So, I added a few more. And over time, it just grew. We added more stuff. We changed the name because it didn't do HTTP only anymore. And then we changed it again when it didn't do just downloads anymore. So, it became uploads and downloads. And it was for URLs. And the clients of that became curl, client for URLs, or cURL, or whatever. And it became curl in '98. So, it just sort of, you know, just on and on. Started as that little toy tool, and I just wanted to scratch my little itch. And we just continued and people chimed in, and it was fun, and it just moved on.
Mackenzie Jackson: Well, it's crazy how big it becomes. I'm always curious in this, because I interviewed another very prolific open-source maintainer. He runs a lot of JavaScript projects like debug and talk and all that. I asked him, "How does he feel about it?" And he was like, "It's kind of weird because at no point did he make a decision that he was going to build something big and that the whole world was going to rely on it."
Daniel Stenberg: Yes, but it is exactly the same for me, and it really never changed. So, I get that question quite a lot: how the project changes. But the project really doesn't change, right? It's me and a bunch of other people that all want to make this happen, and it's the same thing. It was the same thing in '97. Sure, the surroundings change, right? We change hosting, we get new tools, we get better tools, we get, everything gradually changes, but it's the same kind of spirit. People come back and complain when things aren't working. They do that today as well, right? They did it in '97, and they do it today. And at some point, a lot more people are using it, but within this little development corner of the universe, it's pretty much the same thing. So, there was never any moment in time when we suddenly realized, "Let's make it big." It never just happened. It was this gradual growth and move, and over time. And of course, everything was a little bit silly and stupid and immature to begin with, as all projects start out somewhere, right? But along the way, we started to fix things and do things more correctly and more responsibly, and you know.
Mackenzie Jackson: Yeah.
Daniel Stenberg: Add test cases and actually verify things and do the proper engineering. So, over time, we just, you know, we grow up and do things better, but.
Mackenzie Jackson: Are there ever any moments where you like, I don't want to say regret doing this, but just kind of want to move away from it? And especially in the world of open source, like mental health and maintainer health. You talked briefly about other people complaining and all of that. And people often forget that so much of open source, it is passion projects, it's hobbies, it's all of that. And it moves to a point where I'm always curious with these gigantic behemoths, is there a point where you kind of like, "I don't want to do this anymore. I just..."
Daniel Stenberg: There have been moments, of course, when, yeah, things are, when you question why do I do this? It's not that I'm getting rich out of it. So, why, why actually do I spend all my waking hours on this? So, sure, there have been those moments, but I think on the contrary, there are so many more of the good moments that I'm enjoying myself. And I think it's a great community to be in, you know. I get to hang out with cool people and do what I think is fun. So, I think it's much more of that. I think I'm enjoying myself the majority of the time. Of course, humans are complicated, and there's always this, sure, some are just rude and annoying and or offensive in different ways. And I think I've had the luxury that I haven't had that to such a large extent that it was never the problem. So, I've had my share of death threats or whatever, and it's been bad and horrible, but they're such a fringe. They are occurrences that I'm sure bad in the moment, and yes, but then I overcome that, and I think it's just fun. And then, of course, it's a personality thing, right? How do you handle load and pressure and expectations? But I think I've been pretty good at just, you know, not taking it so personally. Imagining that I'm not the project, the project and I, we're not the same, right? So, it's not actually my responsibility to do all that. It's an open-source project. If you so badly want something fixed, you can actually do it, right? You can complain to me that I should do it, right? But I also don't take that so personally. I don't take that as a requirement that I need to. I think they're mostly just rude. You can do it yourself if you really need to do it that way, or pay me to do it. And until you do that, I'm fine with just, we can fix it. And also, there's just, I think I have this kind of awareness that, you know, over time we can fix everything. If we just, we move on. We just, the grind of time, basically. We can fix everything if you just keep at it, and that's what we're doing. So, I think I managed, I think I have a good approach to it just personally. And it suits my personality, I guess. I'm just thick-skinned enough to not let it get to me personally, and I think it's fun and just.
Mackenzie Jackson: Yeah. I think that's great to hear. It's also a little sad that you have to be thick-skinned, you know? And I think that it is.
Daniel Stenberg: I agree.
Mackenzie Jackson: And something that really had a moment for me was the XZ Utils breach, the Drytan, where an open-source maintainer was essentially socially engineered through threats, through pressure, through that, where they just end up going, "You know, enough is enough. I can't deal with this. This is awful." And I think that that actually opened up, you can look at it as a security flaw, or you can look at it as, "Why are we in this position where the internet is being held up by people's goodwill, you know, and ability to be thick-skinned and all of that?"
Daniel Stenberg: Yes. Yeah, yeah, I agree. But then again, even in other areas, there's always this certain amount of people that are just annoying in any context, right? And they're probably offensive. Just bring a lot of people into a room, and there's going to be a few of them. You know that kind of speak about. And they're everywhere, right? So, of course, they're in open source as well. So, they will show up, and they will be like that. So, yes, that's unfortunate, but it's also just, yeah, that's life and that's humans. So, that's, that's, yeah, that's one of the challenges or the tricky parts of doing open source or doing engineering in general, right? That you have to actually manage people or learn how to handle them or communicate with everyone. Yeah. So, yeah.
Mackenzie Jackson: Yeah, absolutely. I want to get into a topic. It is one of the reasons I really wanted to speak to you today, because you recently, you're a big personality or big persona in the open-source world. So, when you write something, people listen and people debate.
Daniel Stenberg: Yeah, amazingly, I do.
Mackenzie Jackson: [laughter] And you wrote a blog explaining your decision recently to shut down the curl bug bounty program. So, I wanted to kind of, for those that haven't heard about this, I have spoken about it before, but what was behind that decision to no longer go through the vulnerability program of curl?
Daniel Stenberg: Yeah, so I think the progression has been that we started our proper bug bounty in 2019, and then I should also mention that it is sponsored, right? So, the money part isn't actually our money. So, we actually have the IBB, the Internet Bug Bounty effort to actually pay the money. But anyway, I've always thought about it as a success because it's a great way to actually encourage people to scrutinize the code, look at it, find the problems and report them, and as a thank you, we award them with money. So, I think that has worked out really well over time, and I have always thought of it as a good way to be able to, when you are able to pay people, you're also able to attract the really good ones. The ones who are actually doing this as a profession at work. Yeah. They actually can then spend the time and investigate my stuff, right? Yeah. And point out my flaws. That's a good thing. But over time, it has just sort of, the precondition has then been that you invest your time and effort, and as a sort of, I review this and I do this assessment on my end, but the contract has been broken now because on the reporter end, there's so little work now. I mean, people are now just resorting to asking the AI for doing that. Basically, ask whatever stupid AI is possible to find a security problem in curl and write up a report, and they submit it. In many cases, without they don't understand the answer. They haven't verified it. They don't. So, it's just a huge report, looks correct, and they send it over to us. And this development has then sort of over time, during 2025, has escalated quite clearly so that the amount of valid reports has fallen drastically, and the amount of really long ones, detailed, genuinely real-looking, have also skyrocketed. So, we spend a lot more time assessing, dismissing false ones, and in the end, we get even less. And so, the output in the end became sort of not really sustainable for us. We spend too much time on this.
Mackenzie Jackson: Yeah.
Daniel Stenberg: With too little gain in the end. So, we had to do something about it. What do we do about it? We have to make something has to change because we have a small security team to deal with this. I'm the only one doing this full time. The other ones are volunteers here. So, we can't just overload everyone with hours of work per day for so little benefit in the end. So, what do we do? We can't, we can't continue this. We have to change something. And then one theory is that we get this a lot by the incentive of money. So, they do this because they think they can actually get money out of it. So, what if we remove the money from this equation? We say, "We're not going to pay anyone anymore." So, at least, yeah. They won't be tricked into thinking they can do this for money.
Mackenzie Jackson: Mhm.
Daniel Stenberg: So, yeah, the hope, the plan, the idea being that we should lower the volume of crap that we get. So, that's why we did it. And then also, as a combination, I wanted to switch away from HackerOne as a platform over to GitHub as a more of a distinct way to show that we shut that down. We're over here now. The money stays, we dropped the money. We dropped that, we dropped the GitHub. And that turned out not to work very well. So, we're back on HackerOne now, but we have sort of shut off the money still.
Mackenzie Jackson: Yeah.
Daniel Stenberg: But anyway, so that's what we did. That's what we do.
Mackenzie Jackson: And does it work?
Daniel Stenberg: I think early numbers say that it looks like it's working. It might be too early to tell. I don't know if I figure it'll take a while until we know for sure if it's just a temporary bump, or if it's actually...
Mackenzie Jackson: Yeah, a true difference.
Daniel Stenberg: We certainly see them still coming. So, they're not gone.
Mackenzie Jackson: Right.
Daniel Stenberg: But they might be fewer of them.
Mackenzie Jackson: What was really interesting in your report, the blog that you made, something that stood out for me, I can't quote you word for word. You said something along the lines of like, "More convincing crap is worse than unconvincing crap." And it's kind of this area of LLMs, where what I understood from that is that because we can create such a convincing report using AI, it's harder to immediately get rid of what might have been easier. Like you might have been able to see the crap earlier on. And so, now you have to go through the whole process that could be real.
Daniel Stenberg: Exactly, right. Because in previous times, you could still do crap reports, right? Because people could always do that. Back again to that percentage of users, they were always like that. They were always those sort of luck seekers. "I'm going to send this." But previously, they were more obviously bad and crap. And you know, you didn't spend your time to do that. Then you got a really crap report in the end, and I could dismiss it immediately. Crap. So, anyway, I didn't waste much on that. But now, they generate. So, first they're very big, a lot, and they're. So, they look real, and it might take a while to actually, you know, dig through the layers and figure out what they're actually talking about. Is it real? Is it not? And is it reproducible? And blah, blah, blah. And you. So, yeah, it can take a lot of time to just go through that. And I actually find that also when I talk to my teammates and we've received it, I also think it feels more sort of, I mean, we get more, I think, a mental toll more because it's more deceiving and more dishonest or sort of, you know. It's like this bad faith from the other end. I think that also adds to sort of the sentiment here that they're, "What are you doing?" It's sort of, it's like an attack, a personal thing, right?
Mackenzie Jackson: Yeah.
Daniel Stenberg: And that's also part of this. It feels like they're not helping here. They're actually actively unhelping us. And that part is really.
Mackenzie Jackson: I'd like, I don't think there's indications that this is intentionally malicious, but it could be as kind of like a DDoS attack.
Daniel Stenberg: It is on the vulnerability.
Mackenzie Jackson: Yeah, it works as a DDoS attack, right? Because I mean, the vulnerability reports, they're also sort of the most high priority you can have in your project, right? You pretty much put everything else on hold. "Here's a security report, go read it." And then you spend an hour on it and you figure out it's just all made up.
Daniel Stenberg: Yeah.
Mackenzie Jackson: So, what, why did I spend an hour on this when I could have, you know, done something productive? I could have written code, I could have had fun.
Daniel Stenberg: Yeah, or maybe.
Mackenzie Jackson: That's like unproductive and...
Daniel Stenberg: Exactly. That would have been much more fun or better. And then, you know, then you sort of wall and you dismiss it, and you curse, and then you get another one and another one and another one. And it's, I agree. I don't think they're meant maliciously and sort of intended. They don't.
Mackenzie Jackson: Yeah.
Daniel Stenberg: Do this, they don't think, "I'm going to do a DDoS attack on the project and sending a lot of crap." That's not the way they think. I think in a lot of cases they're mostly misled into thinking that they can actually do this. I mean, that the tools are actually telling them the truth, and they think in many cases they actually think they help us.
Mackenzie Jackson: Yeah, "I found a problem. I'm reporting it." Yeah. And then, because the other side of that too is that these reports are so convincing, they probably convinced the people that are generating them that...
Daniel Stenberg: Yeah, correct, right? So, then you also now you have to have an argument with someone.
Mackenzie Jackson: Yeah, yeah.
Daniel Stenberg: And the fun part about that is, and of course, so I get that, you know, 400 lines of detail, and then I'm not quite understanding it. So, I ask a question, and you know, these reports are never actually submitted by an AI, right? There's a user there who has submitted this, and the user doesn't actually understand what they reported, right? So, my question to the person, what does he do? He asks the AI, of course. Of course. So, my conversation then becomes just indirectly with the AI, with just a person in between as a proxy there. And you can tell that pretty quickly.
Mackenzie Jackson: Yeah.
Daniel Stenberg: So, of course, I've learned this also over time. I wasn't that good at it from the start, but now I know, you know, when the follow-up question or when you get an apology, you know, "You're right. You're absolutely right. I'm sorry," or whatever. Like no human ever writes, but the AI is always doing. And then, you know, it's too polite, and then, you know, and then you get a list of bullet points again, and you know, emojis.
Mackenzie Jackson: [laughter]
Daniel Stenberg: And you know, this was not a human there.
Mackenzie Jackson: Yeah, it is, it is interesting. This is kind of like it's on a much smaller scale, but I'm involved in some conferences, and I review calls for papers for people to talk on that. And I'm struggling with an area that every single talk is not entirely made by AI, but all of them are kind of formatted in an AI. And because it's kind of like if you have a big research paper, you might be like, "Can you please condense it down to a 300-word abstract," right?
Daniel Stenberg: Right. And then you get that AI feel.
Mackenzie Jackson: Yeah, you get the AI feel. So, every one that I read, pretty much every one that I read, has an AI feel to it. And now it's really hard to know, like what is good? In fact, I've kind of almost just gone to the method of just almost ignoring what the talk is about and just looking at who submitted it, you know? Like and judging it that way.
Daniel Stenberg: Right. And I also sort of, I'm going through this similar transition, and I'm now going through that, you know, back in the day we wanted everyone to submit as much detail as possible so that we can sort of assess this. And now I'm going the other way.
Mackenzie Jackson: Yeah.
Daniel Stenberg: So, don't tell me a lot about it, you know, keep it as short as possible. Just use five sentences ideally, and explain the problem. And if I need more, I'll ask you for more.
Mackenzie Jackson: Yeah.
Daniel Stenberg: Because that's way better for me to get an early feel for this.
Mackenzie Jackson: Yeah.
Daniel Stenberg: And if it's AI, I can stop already there. So, it's much better now to go the other way than just keep it short to start with.
Mackenzie Jackson: Isn't it funny how it's kind of flipped everything on its head? Because the other, the other part that I always find amusing is that literally like four years ago, we were still training people that if there's a spelling mistake in an email, it's, you know, it's more likely that it's phishing. And I get an email with a spelling mistake in it, I'm like, "Wait, I trust it way more now," because I'm like, "Oh, this was, there's a human..."
Daniel Stenberg: Exactly. So, it's like, "Wait a minute, here's a full paragraph and no typo." That's [laughter] suspicious.
Mackenzie Jackson: No one writes like that.
Daniel Stenberg: And overly friendly, too, because no one is that friendly. In particular, in the security reports, that's a sign too. It's very friendly. People are never that friendly in the first.
Mackenzie Jackson: This is you're one data point in this in terms of curl that sort of you're not the only one. Many other companies that are also doing, perhaps maybe not shutting it down, but limiting who can submit them, how much credit on HackerOne you need, those types of things. I think it was, there's another company, I think Node said that less than 5% of the reports that they get are valid.
Daniel Stenberg: Yeah.
Mackenzie Jackson: Now and areas like that. So, where do we go from here? I've, like, like what, where does bug bounty go? It was such a big thing. And in the way that I described bug bounty, it was a way to get immediate scale for your security, right? You had one security guy in your team that was looking at it. Now you can have 200.
Daniel Stenberg: Right. Now you're sort of opening up to anyone who wants to, yeah.
Mackenzie Jackson: So, you get scale from it. But so it's such an important part of it. I can't imagine a world without it. But is that where we're heading? I don't like.
Daniel Stenberg: Uh, yeah, right now I think it's a little bit sort of shaky, and we don't really know where to go next. And I think there, I think one of the good parts of this, of course, is that we're all trying different things. Because, yeah, maybe if someone figures out the best way, we can go with that way, all of us. But right now, I think we're all trying different things. What's the best way forward? In our case, we removed the bounty part of it, right? That's not ideal either.
Mackenzie Jackson: No, yeah.
Daniel Stenberg: But we all have to do something just to survive. And I mean, we need since this contract about nowadays, you don't have to spend any time to just submit it and then back to call for papers or.
Mackenzie Jackson: Yeah, submitting anything.
Daniel Stenberg: It's the same in all of those areas where people can submit something. And nowadays they don't have to spend any effort. It's just, you know, do that in a few seconds. And the other end, then we can't just have our floodgates open because we drown. We have to have some new ways of making sure that, okay, you didn't spend a lot of time. Maybe you should have some other means of proving that you're actually genuine or a proper person or, I don't know. We need some kind of sand in the machine to sort of make it harder to just submit a lot of it.
Mackenzie Jackson: Yeah.
Daniel Stenberg: Without any sort of quality assurances. So, I don't know exactly how it's going to, what we need or how, but we need some ways, some new ways to introduce that mechanism so that not everyone can just submit a lot.
Mackenzie Jackson: Yeah, and definitely be, and because we're also at risk of isolating out the younger generations or the emerging generations of pen testers and hackers and bug bounty people, because if we say, "Okay, you can only submit a report if you've got prestige on HackerOne now."
Daniel Stenberg: Yeah. Now, where does entry go, and then does everyone go into the few programs, and.
Mackenzie Jackson: I agree. I agree. That is also unfortunate, right? So, you still want to have that ability. And we've seen that a lot of times because in our program in HackerOne, we see that a lot of our sort of good, accurate reports have come from first-timers, right? So, we can't just say that just because you're submitting something first time, you're a newbie or we shouldn't accept it. That would be weird because then we would dismiss a lot of quality reporting, too. Yeah. So, it's, it's really hard. So, all those sort of reputation programs.
Mackenzie Jackson: Mhm.
Daniel Stenberg: Yeah. They're a little bit tricky to do. It's not the ultimate solution, either. No.
Mackenzie Jackson: Yeah. Yeah. Yeah. Yeah. No, we, we haven't figured out the solution yet. But I also think that the platforms who are doing this, they could also, you could potentially think that if you're doing, you know, you're submitting AI slop in one project, they should be punished for the other projects.
Daniel Stenberg: Right.
Mackenzie Jackson: So, it could still be a little bit, you know, the anti-spam thing on Gmail, right? If everyone is marking your mail as spam, maybe it is spam, right? Even for the others. So, maybe we don't have to deal with those persons. Every one of every project wouldn't have to deal with every person who is sort of abusing it. Maybe. I don't know. I think we need to try out different things and how to root this out because it's similar to spam in that regard.
Mackenzie Jackson: Absolutely. Now, the response or at least the strategy that it seems to be some of the bug bounty platforms are going in and also other people is to kind of build out the AI on the other side of it.
Daniel Stenberg: Yeah. Yeah. Yeah. That's what he all told me. Yes.
Mackenzie Jackson: Yeah. Yeah. Yeah. Yeah. So, okay. So, I feel like, I feel like there's opinions behind you. Do you think that that could be a solution to have an AI validating it, or do you think that we're kind of, it's not the solution that we're going to solve it?
Daniel Stenberg: You know, basically the second I told the world about us closing this down, I've been contacted by like 22 different platforms. They're all offering this. So, [laughter] it's sort of the general, I have something to tell you after this, too. Yeah, yeah, so, so of course you should just fight AI with AI. But I think it's actually the problem is much harder than just, you know, first, it's not a question about identifying an AI, right? Because just because it's written by an AI doesn't mean that it's wrong or bad in a way. I want to have the report assessed. Is the report right or wrong? And it's really hard to actually do that automatically anyway. I guess it depends a little bit on what your project and product and how to do that, and what kind of requirements you can have on the reporter. But as we have it in curl, curl is a really complicated thing, and looking back at previous reports that we have confirmed, a lot of them have never actually contributed, you know, a proper reproducer or anything. They identified parts of the code that is wrong, and we can sort of backstep from that and create a scenario where this can happen, and that's why it's wrong. So, just saying that, "Hey, no reproducer, we just throw it out." That wouldn't be good either. I actually don't believe that just using AI to assess it is not going to, it's not going to work. So, potentially it could, of course, use us, it could be, I use it as a filter. Maybe we could use that as a sort of, sure, discard it 20 worst percent. Maybe that's a solution. So, I think we're going to have to try different ways and see what works and what doesn't. And maybe, maybe helping us with 20% is good. So, maybe that's part of it, maybe.
Mackenzie Jackson: Yeah, it is, it is interesting. I think I do think there's something there. It's all about how it's implemented and the risk of that, because now we're introducing the risk of discarding real reports because they can't be reproduced because the scenario is unique.
Daniel Stenberg: Right. And we have seen that happen, right? When projects dismissed reports just because they use an AI to assess it, and the AIs, they do mistakes. So, yes.
Mackenzie Jackson: Yeah, yeah, yeah, yeah, yeah. All right, so we still haven't figured it out yet, right?
Daniel Stenberg: No, we are not. We still have ways to go. It's still early days, I, I, and that's the.
Mackenzie Jackson: Yeah, I mean, it is exciting to kind of see it and what will happen because something will happen. The solution is not to get rid of bug bounty. I mean, you have to do something when your boat's sinking, right? You have to, you have to do something.
Daniel Stenberg: Absolutely.
Mackenzie Jackson: So, that doesn't mean that, you know, the.
Daniel Stenberg: It's not the end all of everything. It's just it's one step in the way to sort of just to keep the boat afloat, right? So, and then, of course, when we manage to do that, the next step is, yeah, what do we do now? Maybe we will reintroduce it. Maybe have some new rules or whatever, yeah.
Mackenzie Jackson: Yeah. Now, kind of a different topic, but like thinking of AI, you've been fundamental in kind of building out key components in how we operate the internet now, you know?
Daniel Stenberg: It happened. [laughter]
Mackenzie Jackson: It did. What's your kind of opinion about this as someone that kind of works in lower levels, you know, components of it, of the kind of vibe coding AI code generation kind of phenomenon that's taken over? I'm always curious to know kind of at your level, are you using AI coding assistants as well? Where do you think it is? Net good, net bad?
Daniel Stenberg: Well, I think, yeah, similar to doing security reporting, I think you can really, the AI tooling can really augment you and make you faster, more productive if you know what you're doing. So, I think even a developer in any capacity anywhere can actually get accelerated, basically become faster, more productive if you're using AI tools and you understand how to use it and dismiss the bad parts and get with the good parts.
Mackenzie Jackson: Yeah.
Daniel Stenberg: So, that's, that's, I think it's quite clear. I personally don't use it a lot when I write code. I use it quite a lot now to review code and analyze code. So, and I think it helps us do better code in general. So, I, so that's why I always try to sort of emphasize that when we get a lot of AI crap in security reporting, that's just, you know, augmenting the bad people to do bad stuff, but you can still use AI to do a lot of good things if you're just using the tool the right way, right? You use the right tools, and you understand what you're doing, then you can do really good things. And you can actually find a lot of good security vulnerabilities with AI as well.
Mackenzie Jackson: Yeah.
Daniel Stenberg: If you just do it right.
Mackenzie Jackson: I mean, absolutely. We, like, it's, it's a tool that can be used as stuff. There's a talk here at NDC, and there's a key sentence that stood out for me that was, a compound compounds confusion. And I kind of really liked that. It's like, because a lot of people talk about AI and how it builds security debt and all of that. But I think what it also does is just compounds like confusion of trying to understand what's real and what's not, and what does this do? Right? It works. How does it work? How does it work? All of this stuff. I joked that I like before vibe coding was a thing, I called myself a Stack Overflow coder because like half of my code was like, you know, and now I wasn't doing anything fundamental in production, right? But all my stuff worked. I often had no idea why it worked.
Daniel Stenberg: Yeah, yeah. And but it's similar, right? This is, this is just more automated Stack Overflow coding.
Mackenzie Jackson: [laughter]
Daniel Stenberg: So, yeah, you don't have to, you don't have to ask the sort of Google the question and then copy and paste. It'll, it'll do it for you. So, yeah, it's similar in that. And if you don't know it, it'll, you know, produce a lot of things. Might do things right, maybe not.
Mackenzie Jackson: I mean, something that I worry about a little bit is losing the foundation of like how things work and how things build. Yeah. And that in the sense that how we, how a younger generation is learning to code now is very different to, you know, how we used to. We're not kind of reading through the syntax of languages anymore to understand the key components of it. We're often just going.
Daniel Stenberg: Yeah, getting a lot of things done.
Mackenzie Jackson: Do you kind of worry that at some point we would kind of, that, that, that code might be unmaintainable just because no one understands what it does anymore and by extrapolation to other, other areas. A bit of a philosophical question, right?
Daniel Stenberg: Yes. I think if we would extrapolate sort of a lot of hype coding into the future, that could be the case. But, I'm, I'm not sure that's where we're going to end up. I think right now we're still, still early days, so we're still, you know, experimenting a lot of things, throwing a lot of things out there, trying out. And I think it'll take some time until we understand and learn how to do this. So, we, it will, we will mature into something a model of how to manage all this.
Mackenzie Jackson: Yeah.
Daniel Stenberg: So, I, I'm, I'm generally an optimist when it comes to this. So, I think we're going to just have to figure it out.
Mackenzie Jackson: And I think you can kind of rely on the fact that there's certain engineers and engineering brains out there that doesn't have a need to know how something works and pull it apart.
Daniel Stenberg: Right.
Mackenzie Jackson: And we can kind of, hopefully we can just rely on that. That there's enough of them that when the internet does crash, someone will be able to figure out why.
Daniel Stenberg: And really, isn't that mostly how things work already, right?
Mackenzie Jackson: Exactly.
Daniel Stenberg: We have so many things in life, and most of us, we have no idea how it actually works. We're, we're just, you know, we're just using everything, building new things on top of other things, and we don't actually know how the things underneath work.
Mackenzie Jackson: Yeah, it's kind of like I'm, I'm, I'm almost more impressed with all the technology because when I look, when I look at a GPU that has, you know, like the computational power of like 12 billion supercomputers for the '90s or whatever it is.
Daniel Stenberg: Yeah.
Mackenzie Jackson: I can't wrap my head around it, but I can look at a record and go, "Isn't it amazing? All the things in it make music." Like, it's just dumb enough for me to understand it.
Daniel Stenberg: Exactly. But, at least close enough to understand it. When modern things it's just, you know, it's just impossible.
Mackenzie Jackson: Idea how. Like, how does this AI make this music that's so good? Or so trash?
Daniel Stenberg: Right. And of course, then we have AIs that can help us explain the code anyways.
Mackenzie Jackson: Yeah. Yeah.
Daniel Stenberg: Whether or not it's hallucinated or not.
Mackenzie Jackson: Well, or maybe. You don't know. Well, there you are. I don't want to keep you much further, but it's been a fascinating conversation. I really appreciate you coming to spend the time talking to me here. And, yeah, can't wait to kind of see what happens and watch the evolution of curl and if we can start to see what a solution to the bug bounty is, and I don't think it's going to go away, but it is going to change.
Daniel Stenberg: It's going to change, yes. Yeah. Yeah. I think that's everything we need to adapt to how the reality changes and then sort of take it from there.
