Don’t trust, verify

Daniel Stenberg, creator of curl, argues that software security should be built on verification rather than trust, outlining the many ways a widely used project like curl could be compromised - from malicious insiders and breached credentials to hacked distribution sites and CI tool exploits. To counter these threats, the curl project employs an extensive set of practices including mandatory code reviews, strict coding standards, thousands of tests run across 200+ CI jobs, continuous fuzzing, a ban on binary blobs and Unicode tricks, and full transparency - all designed so that independent outsiders can verify every release matches the source repository and catch any tampering.