If it was Gentoo emerge and Arch pacman, I'd be with you :-) When it's some of the more mature projects, I give them a little more credence.
Also, every script-based web framework under the sun includes libcurl, which means that Facebook, Twitter, and a number of other large sites that are known to actually contribute patches back, have been using it. Thus, I'd trust libcurl over my own implementation on top of first principles.
So... you think that somehow it might have more eyes on it? I have no doubt that people contribute patches, but looking at the github I can see that there are 4 main developers who make up 99% of all commits. This is the SAME problem OpenSSL had, and you can recall how secure that "widely used" library turned out.
More eyes doesn't mean people are actually looking at it. and while it is nice in theory to claim that more eyes means more chances to spot the issues... most of these appear to be just feature additions, not necessarily security reviews and enhancements.
I am not saying one should implement their own SSL, in fact I have stated otherwise above. But, you already HAVE an implementation in place on windows, which gets all the benefits of windows security updates, and more. You do not need to use yet another one, where you will likely just drop in the DLL and never update it (or worse, static link it). That and I happen to know that WinHTTP HAS BEEN security audited. I cannot say the same about libcurl (and the same cannot be said about OpenSSL, which is in the process of but has not been completely, security reviewed).
