Curl 8.4 Released For Addressing A Big Security Vulnerability

[moltonel]

That's a bit of an overstatement. Libcurl supports a number of backend variants... and one of those variants is binding to an existing Rust HTTP library. That's somewhat short of rewriting Curl itself in Rust.

"partial/gradual kinda-sort-of very slowly" is an overstatement ? I hope nobody understood what I said as "there's a curl rewrite happening". It's just a selection of optional components for the foreseeable future. We can revise that estimate in ten years

In the meantime, I recompiled my curl to use rustls instead of openssl just for the cracks. This is a non-event so far. libcurl is a bit smaller.

[Delgarde]

"partial/gradual kinda-sort-of very slowly" is an overstatement ? I hope nobody understood what I said as "there's a curl rewrite happening". It's just a selection of optional components for the foreseeable future. We can revise that estimate in ten years

It's an overstatement because nobody so far is writing any part of libcurl in Rust. At best, they're linking to some external libraries which are implemented in Rust.

[moltonel]

It's an overstatement because nobody so far is writing any part of libcurl in Rust. At best, they're linking to some external libraries which are implemented in Rust.

Remove external libs, and libcurl is largely an empty shell. Those libs are an integral part of libcurl's offering, and changes in what libs curl chooses are significant.

Base http classes and http/1 support is something that libcurl has so far implemented itself. Integrating hyper means transferring some of that core functionality to a Rust lib. Even if it remains an optional dependency, it's replacing (rewriting) a little bit of libcurl C code with Rust code.