One man, twenty-one unpaid years, and the contract that fixed it

In late 1996 a Swedish developer wanted a chat bot to quote currency rates, and needed something that could fetch a page over the internet to do it. He picked up an existing small tool called httpget, written by a Brazilian developer, and shipped his own version that December. By March 1998 it had grown enough that the name stopped fitting, and he renamed it curl. At that point it was about 2,200 lines of code, three protocols and 24 options.

That developer is Daniel Stenberg. He has personally packaged every curl release since 1998 — roughly twenty-eight years as the person whose name is on it.

Nobody chose to install it, and almost everybody has it

You do not buy curl and you almost certainly did not install it. It arrives inside other things. Apple has shipped it in macOS since version 10.1 in September 2001. Microsoft has shipped it in Windows since the 1803 update in April 2018, and in Windows 11 — it sits at C:\Windows\System32\curl.exe on a standard machine. It is in iOS and in several Android phone makers' builds. Stenberg has found it in more than 20 car brands, including eight of the world's ten largest. It was aboard the NASA Ingenuity helicopter that made the first powered flight on another planet in April 2021.

The number usually quoted is more than twenty billion installations. Treat that as what the project itself says it is: an estimate. The project's own wording is that it estimates more than twenty billion installations, that it "makes a good line to say", and that in reality it does not have numbers that exact. Stenberg calls twenty billion a low estimate. Earlier estimates on the same basis were around five billion in 2018 and ten billion in 2020. Nobody can count copies of software that ships inside other companies' products, and the project does not pretend otherwise. The honest version of the claim is: it is somewhere in the billions, and no one, including the people who wrote it, knows the real figure.

One licensing decision explains the spread. In January 2001 curl settled on a permissive MIT-style licence, after starting under stricter ones. That choice is why a company can put curl inside a commercial product without a legal conversation — and so they did, at scale.

For about twenty-one years, none of that paid him

From 1996 until February 2019, curl was spare-time work. Stenberg had jobs elsewhere the whole time. His own explanation is not romantic: he could not see how to turn it into a job without putting either the project or his own finances at risk. He has also noted the oddity that the people who were paid to work with curl were the ones asking the unpaid developers for help.

What that looks like in practice is worth stating plainly, because it is the part that does not appear in the marketing version of open source. In January 2022 a Fortune 500 company emailed him demanding answers about curl's security exposure within 24 hours. It had never paid him anything. Apple's own support has publicly pointed users at the curl maintainer. He keeps a public archive of the hostile mail the job attracts; one message in February 2021 was threatening enough that he reported it to the Swedish police. He kept shipping releases.

That is not here to make you feel sorry for him. It is here because it is the real cost structure of software your business depends on, and most buyers never see it.

What actually fixed it was a contract

In February 2019 Stenberg joined wolfSSL to work on curl full time. He is paid out of commercial curl support contracts — companies that depend on curl pay for support, and that revenue pays the maintainer's salary. In November 2024 the project added Rock-solid curl, long-term-support releases with each branch supported for five years, aimed squarely at companies that need a version that does not move.

Note what did not fix it. Donations to curl run to a few hundred thousand US dollars across the project's whole history, and the project is explicit that donations pay project expenses — the conference, the former bug bounty — not Daniel's salary. That distinction is reported wrong constantly. Charity kept the lights on for some things. A commercial contract paid the maintainer.

In his own framing: companies pay wolfSSL, wolfSSL pays him, and he gets food on the table. The vast majority of curl users pay nothing and never will. You only need a small number of companies that do.

Why this is the model we are arguing for

That is the whole shape of it, and it is the shape OSS Malaysia is built around. The software stays free to use, so any Malaysian business can adopt it without a licence negotiation. The businesses that come to genuinely depend on it pay someone for setup, support and a version that will still be there in five years. That money goes to the people maintaining it — and in our case, ideally to local builders rather than out of the country.

It is not a moral argument. curl proves it works at a scale nothing else in this industry can match, and it took about twenty-one years of the alternative to prove the alternative does not.