Buy commercial curl support. We
help you work out your issues, debug your libcurl applications, use the API,
port to new platforms, add new features and more. With a team lead by the
curl founder Daniel himself.
Re: HTTPS-RR and ECH
- Contemporary messages sorted: [ by date ] [ by thread ] [ by subject ] [ by author ] [ by messages with attachments ]
From: Daniel Stenberg via curl-library <curl-library_at_lists.haxx.se>
Date: Sun, 2 Aug 2026 23:08:45 +0200 (CEST)
On Sun, 2 Aug 2026, Michael wrote:
>> What if you build a browser using libcurl for the networking parts?
> unlikely. browser is a huge project, its hard to justify such a project and
> even harder to predict it will utilize CURL library.
There are to my knowledge at least two browsers already doing it. Perhaps
proving that with a large enough user base, even the unlikely use cases can
happen.
> even larger amount of users dont want to be tracked by cloudflare, when
> asked, that is why the ECH option is opt-out by default, to avoid users.
ECH prevents your family members and coworkers to figure out what you do. It
prevents your ISP and its employers to figure out which sites you visit.
Cloudflare and the other CDNs know just as much with and without ECH about the
traffic that reaches them.
ECH remains opt-in for the forseeable future because it will be refused and
break things in a certain amount of networks as this added encryption is scary
for those who want to monitor users.
>> We offer options for users to opt-in and out of features, both at
>> build-time and runtime to allow them to decide as much as possible.
> but opting in is not offered anymore?
Sorry, I'm lost. I don't understand what you're asking here. Is there a
feature that is not opt-in anymore that previously was?
>> Browser-like automation is a pretty signification chunk of curl use cases.
> ECH is not needed for automation, right?
You said curl doesn't need many features that browsers have, I gave you a
reason why it does at least to some extent. While ECH could be used to make
network traffic appear more similar to a browser, its primary purpose is to
increase privacy. Which of course even automated use cases might want.
Simply don't enable it if you don't want it. We're not doing to drop the code
just because one user thinks its unnecessary.
Date: Sun, 2 Aug 2026 23:08:45 +0200 (CEST)
On Sun, 2 Aug 2026, Michael wrote:
>> What if you build a browser using libcurl for the networking parts?
> unlikely. browser is a huge project, its hard to justify such a project and
> even harder to predict it will utilize CURL library.
There are to my knowledge at least two browsers already doing it. Perhaps
proving that with a large enough user base, even the unlikely use cases can
happen.
> even larger amount of users dont want to be tracked by cloudflare, when
> asked, that is why the ECH option is opt-out by default, to avoid users.
ECH prevents your family members and coworkers to figure out what you do. It
prevents your ISP and its employers to figure out which sites you visit.
Cloudflare and the other CDNs know just as much with and without ECH about the
traffic that reaches them.
ECH remains opt-in for the forseeable future because it will be refused and
break things in a certain amount of networks as this added encryption is scary
for those who want to monitor users.
>> We offer options for users to opt-in and out of features, both at
>> build-time and runtime to allow them to decide as much as possible.
> but opting in is not offered anymore?
Sorry, I'm lost. I don't understand what you're asking here. Is there a
feature that is not opt-in anymore that previously was?
>> Browser-like automation is a pretty signification chunk of curl use cases.
> ECH is not needed for automation, right?
You said curl doesn't need many features that browsers have, I gave you a
reason why it does at least to some extent. While ECH could be used to make
network traffic appear more similar to a browser, its primary purpose is to
increase privacy. Which of course even automated use cases might want.
Simply don't enable it if you don't want it. We're not doing to drop the code
just because one user thinks its unnecessary.
-- / daniel.haxx.se || https://rock-solid.curl.dev -- Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library Etiquette: https://curl.se/mail/etiquette.htmlReceived on 2026-08-02