{ "description": "Browse aymeric's, an independent, searchable archive of readable snapshots from followed feeds, preserved in Git with aggr.", "feed_url": "https://aggr.aymericbeaumet.com/sources/seriot.ch/feed.json", "home_page_url": "https://aggr.aymericbeaumet.com/sources/seriot.ch/", "items": [ { "authors": [ { "name": "seriot.ch via kytta" } ], "content_html": "

Nicolas Seriot

\n

Computation > How curl was accidentally Turing-complete for nine months

\n

29th October 2026

\n

From curl 8.12 through 8.16, config files could slice variable values and include other config files without an explicit depth cap. Together, these features let curl simulate any two-counter Minsky program. Under the usual idealization of unbounded strings and resources, this construction was Turing-complete.

\n

Curl 8.17.0 added a five-level include cap that breaks this reduction.

\n

Update 2026-10-30: Jonathan Tremesaygues wrote me: I couldn't help but implement “99 Bottles of Beer on the Wall” 99_bottles.tar.gz

\n

Minsky 2-Counter Reduction

\n

A counter value n is represented by n copies of x.

\n

Each instruction state uses one or more config files, with file names acting as labels, and expand-config selecting the next file.

\n

Syntax:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
MinskyCurl config
Register RVariable r (R is the number of x bytes)
INC(R)expand-variable = "r={{r}}x"
DEC(R)expand-variable = "r[1-]={{r}}"
JZ(R, _, _x)expand-variable = "t[0-0]={{r}}" expand-config = "state_{{t}}.conf"
JMP(S)expand-config = "S.conf"
HaltNo further expand-config
\n

With that, we can compile any two-counter program into curl config files.

\n

PoC: Adding 2 + 3

\n

Four files in curl_addition.zip compute 2 + 3.

\n

\"\"

\n

Build a local curl 8.12.0 binary if needed:

\n
mkdir -p /tmp/curl-tc-build\ncd /tmp/curl-tc-build\ncurl -fsSLO https://curl.se/download/curl-8.12.0.tar.gz\ntar -xzf curl-8.12.0.tar.gz\ncd curl-8.12.0\n./configure --without-ssl --disable-shared --disable-manual --disable-docs\nmake -j4\n
\n

Then, from the addition/ directory, run:

\n
/tmp/curl-tc-build/curl-8.12.0/src/curl -q -s -K main.conf\n
\n

Expected output:

\n
A=xxxxx B=\n
\n

Runtime Bounds

\n

The reduction assumes unbounded counters and unbounded steps. The real binary has neither:

\n\n

History and Version Support

\n\n

The pull request says the cap prevents a config file from including itself indefinitely. Its regression test does exactly that and expects an error. The public explanation does not discuss Turing completeness or why the cap is five.

\n

A Bash while loop can complement bounded curl by invoking a config once per step and carrying the counters and instruction label between invocations. The repetition then comes from Bash, so this is a composition rather than curl-alone Turing completeness.

\n

Security impact

\n

None.

\n", "date_modified": "2026-10-30T07:24:01+00:00", "date_published": "2026-10-30T07:24:01+00:00", "external_url": "https://seriot.ch/computation/curl.html", "id": "urn:aggr:item:9731107b0848ba5ad88591a5167bdc86a8f11a55", "image": "https://seriot.ch/resources/curl_config.png", "summary": "Comments", "tags": [ "news", "compsci" ], "title": "How curl was accidentally Turing-complete for nine months", "url": "https://aggr.aymericbeaumet.com/items/lobste-rs/2026-10-30-how-curl-was-accidentally-turing-complete-for-nine-months/" } ], "language": "en", "title": "seriot.ch", "version": "https://jsonfeed.org/version/1.1" }