Daniel Stenberg

The Profile

The Quiet Architect of How the Internet Moves

Right now, as you read this, curl is running. It's running on your phone, probably on your car's dashboard system, possibly on a satellite orbiting earth. It's baked into every Windows 10 and macOS installation. Spotify uses it. YouTube uses it. NASA's Curiosity rover used it. And one person has maintained it for over 25 years: Daniel Stenberg, a Swedish software engineer who describes himself as "the super-nerd" and means it as a compliment.

Today, Stenberg works at wolfSSL as Lead Developer and Maintainer, where he gets to do what he loves full-time - write C code, argue about network protocols on mailing lists, and shepherd the open-source project that quietly underpins modern digital civilization. He's also President of the European Open Source Academy, a role that adds institutional weight to his long-standing advocacy for open-source sustainability.

This is not someone who stumbled into relevance. Stenberg has been writing code continuously since he was 14, starting on a Commodore 64 in Huddinge, south of Stockholm. The tool he built in 1998 to download currency exchange rates evolved - through years of meticulous, obsessive engineering - into the foundational networking library that makes the modern web possible. curl supports over 40 protocols. The codebase spans 171,000 lines. And Stenberg can tell you the complexity score of every function in it.

In 2025 alone, he received three major awards: the IVA Gold Medal from the Royal Swedish Academy of Engineering Sciences, the Swedish Developer of the Year award, and the European Open Source Achievement Award. The recognition, long overdue by any reasonable measure, finally caught up to the scale of his contribution.

I'm the super-nerd. I'm not the social guy. I'm not the person who unites crowds or inspires teams to create miracles. I'm a software developer and I design and create code, and debate technical details, protocols and choices on mailing lists.

- Daniel Stenberg, on self-description

What makes Stenberg unusual isn't just that he built something used by billions. It's that he kept going. Most programmers who create widely-used tools hand them off, license them, or watch them get absorbed by a corporation. Stenberg kept the keys. He answers bug reports. He ships releases. He writes the changelog. Week after week, year after year, for over a quarter-century, he's done the unsexy, essential work of keeping critical infrastructure alive.

His weekly newsletter is a window into this: a running account of what he fixed, what he's simplifying, what new security analysis found, what the IETF is arguing about this week. There's no PR spin. No product positioning. Just an engineer reporting from the trenches of the internet's plumbing.

At a Glance

Full Name: Magnus Daniel Stenberg

Born: November 23, 1970

From: Huddinge, Sweden

Current Role: Lead Developer at wolfSSL; President, European Open Source Academy

Known For: Creating curl & libcurl

Languages: C (primary), shell scripting

Editor: GNU Emacs (since 1991)

OS: Debian Linux (unstable branch)

Handle: @bagder (misspelled "badger" - demoscene nickname)

Latest Updates

Feb 2026 Presented "AI: Augmenting humans in two directions" at FOSDEM 2026, Brussels
Oct 2025 Received IVA Gold Medal from Royal Swedish Academy of Engineering Sciences
Sep 2025 Named Swedish Developer of the Year
Jan 2025 Became President of European Open Source Academy; paused curl bug bounty amid AI report flood

Origin Story

From Commodore 64 to Spacecraft

The story of curl begins not with a grand vision but with a very 1990s problem: Daniel Stenberg wanted to auto-download currency exchange rates from a website into his IRC bot on a Commodore Amiga. The existing tools didn't quite work. So he built one. That's it. That's the founding myth.

Before curl, there was Stenberg's teenage years in Huddinge - a suburb south of Stockholm where he and his brother co-founded the demoscene group "Confusing Solution" in 1985, writing games and music editors in BASIC and 6510 assembly on a Commodore 64. The nickname "bagder" - a deliberately misspelled "badger" - dates to those years and has followed him across every platform he's ever used since.

At 20, he landed his first professional job at IBM, learning Unix, AIX, and C from the ground up on RS/6000 machines. He also discovered GNU Emacs - the text editor he still uses today, more than 30 years later. Two years at IBM, then Frontec Railway Systems writing embedded C for railroad safety systems. The kind of work where a bug isn't a bug, it's a derailment.

That background - low-level systems, embedded code, safety-critical software - informs how Stenberg thinks about curl. He's not cavalier with complexity. He tracks it obsessively, reducing a function that scored 100 on cyclomatic complexity down to 59 as an ongoing project. The whole codebase averages 15.9. He knows this number.

The first version was called httpget - then urlget - then curl. Version 4.0 shipped March 20, 1998. Over the following years, Stenberg added protocol after protocol: FTP, SFTP, SCP, LDAP, MQTT, QUIC, DNS over HTTPS, and dozens more. libcurl arrived in 2000, transforming a command-line tool into a library that applications could embed. That's when things got interesting.

When you embed something, it travels. libcurl traveled everywhere: into operating systems, into browsers, into car infotainment systems, into IoT firmware, into space probes. The 2001 Mars Pathfinder mission. The Curiosity rover. Various satellites. At some point, curl ceased to be Daniel Stenberg's project and became the internet's. He kept maintaining it anyway.

From 2013 to 2018, he worked inside Mozilla on Firefox's networking stack, contributing to the HTTP/2 and HTTP/3 standards that now define how the web works at scale. He left to join wolfSSL in 2019 - a move that finally let him work on curl full-time with a commercial backer while keeping the project fully open source.

I work on things I personally would like to have and use, and I hope they also end up useful to others.

- Daniel Stenberg

Career Arc

The Long Game

1985

Age 14: co-founds demoscene group "Confusing Solution" on Commodore 64 with his brother. Nickname "bagder" is born.

1991

First job at IBM: learns Unix, C, and GNU Emacs (which he still uses today). Writes code for RS/6000 systems.

1993

Joins Frontec Railway Systems: writes embedded C for safety-critical railroad software. Bugs have real-world consequences.

1996

Creates "httpget" to auto-download currency exchange rates for an Amiga IRC bot. The humble ancestor of curl.

1998

Releases curl 4.0 on March 20. The name sticks. The project begins its quiet march toward global ubiquity.

2000

Creates libcurl, turning a command-line tool into an embeddable library. Everything changes. curl starts traveling.

2001

Co-founds Rockbox, open-source firmware for digital audio players. Also takes over c-ares async DNS library maintenance.

2006

Takes over libssh2 maintenance. His portfolio of critical internet infrastructure keeps growing.

2013

Joins Mozilla's networking team. Spends 5 years working on Firefox HTTP protocols and contributing to HTTP/2 standards.

2017

Wins the Polhem Prize for technological innovation in the cURL utility. First major public recognition.

2019

Joins wolfSSL to work on curl full-time with commercial support. The project keeps its open-source soul.

2025

Triple award year: IVA Gold Medal, Swedish Developer of the Year, European Open Source Achievement Award. Becomes President of European Open Source Academy.

The Product

What curl Actually Is (And Why It's Everywhere)

Most people have used curl without knowing it. Every time an app fetches data from the internet on your phone, there's a reasonable chance libcurl is the library doing the actual work. Every time you open a Windows command prompt and type curl, you're using Daniel Stenberg's code. Every time macOS does a software update check - curl. Spotify's desktop client - curl. A Tesla pulling map data - almost certainly curl.

curl isn't complicated in concept: it moves data between a computer and a server using URLs. What makes it remarkable is the breadth of protocols it supports (40+), the reliability it has maintained across decades, and the fact that one person has been responsible for it the entire time. There is no curl foundation. No rotating maintainer committee. No corporate governance structure. Just Daniel Stenberg, his mailing lists, his GitHub issues, and his commitment to the project.

What curl supports

HTTP, HTTPS, FTP, FTPS, SFTP, SCP, MQTT, QUIC, DNS-over-HTTPS, LDAP, POP3, IMAP, SMTP, WebSocket, and 25+ more protocols. If data moves over a network, curl probably already handles it.

Where it runs

Every iPhone. Every Android. Every Windows 10+ PC. Every macOS. Spacecraft. Automobiles. Smart TVs. Routers. Satellites. Printers. IoT sensors. Wherever a processor meets a network, curl follows.

The numbers

20-40 billion installations. 250,000 downloads per month from curl.se. 32,000 git repository clones every day. 400,000-700,000 Docker image pulls per day. Numbers that most VC-backed companies spend hundreds of millions not achieving.

The irony of scale

curl is free. libcurl is free. The man who maintains the infrastructure that billions of dollars in annual economic activity flows through earns a regular developer salary. Open source has a sustainability problem. Stenberg keeps working anyway.

The AI Chapter

AI Slop, Bug Bounties, and the Double-Edged Algorithm

In early 2025, Stenberg paused curl's bug bounty program. Not because it wasn't working - because it was working too well, attracting a flood of AI-generated fake vulnerability reports. Researchers (and bots pretending to be researchers) were feeding curl's codebase into large language models and submitting whatever came back as security disclosures. The reports looked plausible. They were wrong. Reviewing them consumed enormous time and produced nothing.

He called it "AI slop" - a term that stuck. The bug bounty was meant to reward genuine security research. Instead, it became a mechanism for gaming the incentive structure with generated noise. The irony is sharp: the same technology that was flooding his inbox with garbage was also finding real bugs.

Stenberg has been running advanced AI-assisted security analyzers - tools like CodeQL and experimental LLM-based code analysis - that have identified over 50 genuine vulnerabilities in curl's codebase that human reviewers had missed. He's been fixing them. It's the other side of the AI coin: the same capability that generates fake reports at scale also scales genuine security analysis beyond what any human team could do manually.

At FOSDEM 2026, he talked about this directly: AI as an amplifier that works in both directions. It amplifies human capability - for analysis, for productivity, for security research. And it amplifies human mischief - for spam, for fake reports, for scams. The tool doesn't choose. The humans do.

For Stenberg, this isn't abstract. It's operational. He's navigating it in real-time, adjusting the bug bounty program, integrating useful AI analysis tools, and trying to maintain the signal quality of the security reporting channel that his project depends on. It's one of the more honest accounts of what AI actually looks like in production software maintenance.

AI acts as a force that augments us humans in two directions - the bad way or the good way.

- Daniel Stenberg, FOSDEM 2026

The Person

Conservative Radical

There is a productive tension at the center of Daniel Stenberg's identity. He is, by his own account, a conservative in technology choices. He writes C. He uses Emacs. He runs Debian unstable. He has used the same editor since 1991 and sees no reason to change. When he says he rarely tries new programming languages, he means it. He is not interested in rewriting curl in Rust just because the internet says he should.

And yet the project he maintains is at the cutting edge of network protocol development. He has contributed to the standards that define HTTP/2 and HTTP/3. He's actively implementing QUIC support. He's tracking and deploying AI security analysis tools. The conservatism isn't stagnation - it's discipline. He changes things when there's a good reason to change them, and he doesn't when there isn't.

He played football from age 7 to 17. He has no tablets in his house because he sees no compelling use case. He thinks Web3 is largely a scam. He answers emails. He shows up to mailing list debates about HTTP header parsing with the same intensity that other people bring to board meetings. He is, by any reasonable measure, exactly who he says he is.

I'm conservative when it comes to languages - I stick to the ones I've used for a long time and practically do not try out new ones.

Web3 is a silly term, and most of what has come out of that movement has been scammers and pyramid schemes.

I work on things, products, and stuff I personally would like to have and use, and I hope they also end up useful to others.

I'm the super-nerd. I'm not the social guy. I'm not the person who unites crowds. I'm a software developer and I debate technical details on mailing lists.

Track Record

What He's Actually Done

Created curl (1998) - now on an estimated 20-40 billion devices worldwide
curl ships pre-installed on every Windows 10+ and macOS system on the planet
curl has been deployed on spacecraft and Mars exploration missions
libcurl embedded in automobiles, smart TVs, IoT devices, routers, and major web services
Authored "HTTP/2 Explained" and "HTTP/3 Explained" - free educational resources used globally
Co-authored RFCs defining HTTP/3, HTTP/2, DNS-over-HTTPS, and HTTP/1.1 semantics
Co-founded Rockbox (2001), open-source firmware running on millions of digital audio players

IVA Gold Medal 2025 from the Royal Swedish Academy of Engineering Sciences
Swedish Developer of the Year 2025
European Open Source Achievement Award 2025
President, European Open Source Academy (2025-present)
Polhem Prize 2017 for technological innovation in cURL
Active IETF contributor across HTTP and QUIC working groups
25+ years of continuous open-source maintenance - one of the longest active streaks in software
Identified and fixed 50+ security vulnerabilities using AI-assisted code analysis

Details That Matter

Fun Facts & Field Notes

curl was born from a script that fetched currency exchange rates for a Commodore Amiga IRC bot. The smallest problems sometimes produce the largest tools.

His handle "@bagder" is a deliberately misspelled "badger" from his teenage demoscene days in the mid-1980s. He's used it on every platform for 40 years.

He has used GNU Emacs as his primary text editor since 1991 - over 33 years. His first job at IBM is where he learned it.

curl has been to space. Spacecraft and Mars missions have used it. A command-line HTTP tool from a Stockholm suburb made it to other planets.

He deliberately has no tablets in his home. Not a Luddite - he has specific reasons. He just hasn't found a compelling use case for a tablet.

Before curl, he wrote safety-critical embedded C for railroad systems at Frontec. The kind of code where bugs don't just crash programs - they crash trains.

He paused curl's bug bounty program because AI-generated fake vulnerability reports overwhelmed the real ones. He called it "AI slop" and the phrase stuck in the security community.

The most complex function in curl had a cyclomatic complexity score of 100. He reduced it to 59 as an ongoing project. He knows every function's score.

He played football (soccer) from age 7 to 17, when computers took over completely. There's no "balance" in his history - there's football, and then there's code.

DanielStenberg