Seven years ago I wrote about how a hundred million cars were running curl and as I brought up this blog post in a discussion recently, I came to reflect over how the world might have changed since. Is curl perhaps used in more cars now?
Yes it is.
With the help of friendly people on Mastodon, and a little bit of Googling, the current set of car brands known to have cars running curl contains 47 names. Most of the world’s top brands:
Acura, Alfa Romeo, Audi, Baojun, Bentley, BMW, Buick, Cadillac, Chevrolet, Chrysler, Citroen, Dacia, Dodge, DS, Fiat, Ford, GMC, Holden, Honda, Hyundai, Infiniti, Jeep, Kia, Lamborghini, Lexus, Lincoln, Mazda, Mercedes, Mini, Nissan, Opel, Peugeot, Polestar, Porsche, RAM, Renault, Rolls Royce, Seat, Skoda, Smart, Subaru, Suzuki, Tesla, Toyota, Vauxhall, Volkswagen, Volvo
I think it is safe to claim that curl now runs in several hundred million cars.
How do we know?
This is based on curl or curl’s copyright being listed in documentation and/or shown on screen on the car’s infotainment system.
The manufacturers need to provide that information per the curl license. Even if some of course still don’t.
Some brands are missing
For brands missing in the list, we don’t know their status. There are many more car brands that we can suspect probably also run and use curl, but for which we have not found enough evidence for it. If you do, please let me know!
What curl are the running?
These are all using libcurl, not the command line tool. It is not uncommon for them to run fairly old versions.
What are they using curl for?
I can’t tell for sure as they don’t tell me. Presumably though, a modern care does a lot of Internet transfers for all sorts of purposes and curl is a reliable library for doing that. Download firmware images, music, maps or media. Upload statistics, messages, high-scores etc. Modern cars are full-blown computers plus mobile phones combined, of course they transfer data.
Brands, not companies
The list contains 47 brands right now. They are however manufactured by a smaller number of companies, as most car companies sell cars under multiple different brands. So maybe 15 car companies?
Additionally, many of these companies buy their software from a provider who bundles it up for them. Several of these companies probably get their software from the same suppliers. So maybe there is only 7 different ones?
I have still chosen to list and talk about the brands because those are the consumer facing names used in everyday conversations, and they are the names we mere mortals are most likely to recognize.
Not a single sponsor or customer
Ironically enough, while curl runs in practically almost every new modern car that comes out from factories, not a single of the companies producing the cars or the software they run, are sponsors of curl or customers of curl support. Not one.
An Open Source sustainability story in two slides
Yes they are allowed to
We give away curl for free for everyone to use at no cost and there is no obligation for anyone to pay anyone for this. These companies are perfectly in their rights to act like this.
You could possibly argue that companies should think about their own future and make sure that dependencies they rely on and would like to keep using, also survive so that they can keep depending on these components going forward as well. But obviously that is not how this works.
curl is liberally licensed under an MIT-like license.
What to do
I want curl to remain Open Source and I really like providing it in a way, under a liberal license, that makes it possible to get used everywhere. I mean, if we use the measurement of how widely used a software is, I think we can agree that curl is a top candidate.
I would like the economics and financials around the curl project to work out anyway, but maybe that is a utopia we can never reach. Maybe we eventually will have to change the license or something to entice or force a different behavior.
What do you think? curl or SQLite is used more in various hardware?
@George: it is impossible to say. Both run in many billions of devices.
It is important to discuss the financial situation of free and open-source projects because many FOSS developers are unsung heroes: they develop high-quality software components that provide fundamental functions for our digital world, yet often remain in the background. At Mercedes-Benz, we rely on Free and Open Source Software and recognize our responsibility. For several years, we have supported a variety of FOSS projects nominated by our employees via GitHub Sponsors, and we have received a lot of positive feedback for this. In the first round, we financially supported cURL, as shown on cURL’s GitHub Sponsors page and on ours. As in previous years, we will again support selected FOSS projects this year and are excited to see which projects our colleagues will nominate.
Hi Daniel,
I work for one of the car brands you mentioned (Mercedes-Benz) and these kinds of posts honestly hurt me a bit.
Our industry should give back way more to the open source we massively profit off!
I contacted the FOSPO if it would be possible to do a monthly sponsorship for the curl project!
After looking into it in the past we already sponsored the curl project, although with a very small monthly commitment.
I don’t think that the voice of a single software engineer has a large weight for the whole corporation, but we do have a budget for supporting FOSS projects, so I have a glimmer of hope that I might move things! 🙂
curl did qualify for funding from the »Sovereign Tech Fund« in 2022/23 iirc and there are several other funds available like the EU’s FOSSA which has been recently restarted, or NGI that try to address the needs of projects like curl.
For the lack of financial support, your current sponsorship model suggests (to me), the curl development process is well funded, just sayin. I am used to a anually, more drama based approach to funding.
I doubt that a c-suite of brand managers knows that their car-like product uses libcurl. The automotive industry is assembling outsourced components into car-like products for quite some time now and for various reasons, like intellectual property, which are often diametrical to security and other concepts like sustainability.
A lot of research, progress and production happens in outsourced conglomerates like i.e. Bosch or startups that are later bought and turned into a division or profit center in such groups. I’d expect very little awareness for curl from that industry of ~15 or less, a lot more development is going to happen in Asia (Japan, S. Korea and China) while the whole semiconductor decoupling process is happening.
Some funds, funding or sponsorship options may have a requirement to turn the current curl development process into some sort of non-profit or not-for-profit entity, that is a lot more administrative work and responsibility.
Employee based sponsorship or LTS branches like rock-solid-curl I would avoid. Makes funding or financial contributions overly complicated, product based or impossible for various organizations that are used to tax exempt donations to NPOs. A foundation model (Linux, OpenBSD, OpenSSL, Mastodon) could be an option.
Above all the OSI-layers, your (Daniel’s) employer is quote-competition-unquote on available funding or sponsorship that could turn into an conflict of interest. But that is probably just me being overly sensible, having no further insight into the curl development process that worked for quite some time…
@H. Stefan: I think perhaps “lack of annual drama” is not the best way to assess economic sustainability.
The only thing stopping me from becoming an open source developer is the lack of a reliable minimal source of income.
I’m stable enough to live without a job more or less forever with a minimalistic lifestyle and I would not need 5 digits, but it would be unjustifiable to drop my job to develop open source hoping to get donations maybe years later *if* the project happens to be successful.
What could help people like me to do more than occasional commits and bug reports? I get it: “do one hour a day”, but in such a little time I can barely get into the zone and it’s already bedtime.