5 ms·

Who on earth still uses ImageMagick? Security holes in it are old news. Like 15 year old news.

by trollian 10y ago

Bromskloss 10y ago
What replacement would you suggest?
- tobltobs 10y ago
  Libvips. It also doesn't choke on large files and doesn't fill your tmp dir with GBs large tempfiles.
- mappu 10y ago
  Most basic image manipulation can be performed using only the standard library packages, if your language includes such (PHP's bundled `libgd2` fork / Golang's `image` package / Qt QImage+QPixMap ). For Python `pillow` is popular.
  - harryf 10y ago
    Python / Pillow (formerly PIL) could offer a real path here although there's a gap to Imagemagick on things like SVG
  - mschuster91 10y ago
    I believe php uses imagick under the hood, and even if it does not, I'd rather rely on imagick than on PHP code when accepting exotic formats.
    - voltagex_ 10y ago
      From a security standpoint, wouldn't it be better to rely on PHP (first)? Are you more or less likely to get RCE from PHP or ImageMagick? I'd say PHP has had a lot more eyes on it, security wise.
      - cyphar 10y ago
        > From a security standpoint, wouldn't it be better to rely on PHP (first)? You're joking, right? Popping PHP boxes is script kiddie 101. You might argue that "bad developers make insecure software" but when you're given a toolbox with nothing but oddly shaped hammers it's very hard to make a house.
        lillesvin 10y ago
        That's rarely PHP failing but whatever framework/CMS is used. That's like saying C++ is inherently insecure because there exists a lot of software written in C++ with security holes.
        cyphar 10y ago
        Did you read the second sentence I wrote? Just because you can write safe code in a language that tries to make you footgun at every turn, doesn't mean that language is a good language. Pick a language that doesn't suffer from crippling security issues (which, sure, you can workaround -- but why use a language that requires workarounds to get security?).
        ndj7 10y ago
        We started Imageflow (https://www.imageflow.io https://www.imageflow.io ) in C to design the C ABI for interop with all the host languages, but we're swapping out components for Rust every time it's possible/practical.
      - tracker1 10y ago
        Or, when saving to file for imagemagic, have it be a random temp name, with the correct file extension, read in the result, and only serve it as the original name when downloaded, if it fits the use case.
    - 0x0 10y ago
      PHP does not use imagick, but a (forked) libgd2 by default (some distros patch php to use the distro libgd). Imagick is only available if you install a C PHP extension providing an imagick interface.
  - nkozyra 10y ago
    I don't think ImageMagick is targeted at "basic" image manipulation, though.
kristopolous 10y ago
True, and most people. Despite the issues, it's still really versatile tech.
Mandatum 10y ago
Unfortunately when it comes to file conversion/creation even, ImageMagick is the best of a bad bunch. Graphics formats are notoriously bad, check out the famous PSD rant on it: http://web.archive.org/web/20090426230545/http://code.google.com/p/xee/source/browse/trunk/XeePhotoshopLoader.m?spec=svn28&r=11 http://web.archive.org/web/20090426230545/http://code.google...
- voltagex_ 10y ago
  Alternate link: https://github.com/zepouet/Xee-xCode-4.5/blob/master/XeePhotoshopLoader.m#L108 https://github.com/zepouet/Xee-xCode-4.5/blob/master/XeePhot...
  - Bromskloss 10y ago
    Look! It's possible to highlight an entire block of code: https://github.com/zepouet/Xee-xCode-4.5/blob/master/XeePhotoshopLoader.m#L108-L136 https://github.com/zepouet/Xee-xCode-4.5/blob/master/XeePhot... Maybe we should even link to a specific version of the file, to make sure that nothing breaks when it is updated or moved: https://github.com/zepouet/Xee-xCode-4.5/blob/83394493f51991748b9b4706e6d37a8ed874bc05/XeePhotoshopLoader.m#L108-L136 https://github.com/zepouet/Xee-xCode-4.5/blob/83394493f51991...

Who on earth still uses ImageMagick? Security holes in it are old news. Like 15 year old news.

Bromskloss 10y ago

What replacement would you suggest?

tobltobs 10y ago
Libvips. It also doesn't choke on large files and doesn't fill your tmp dir with GBs large tempfiles.
mappu 10y ago
Most basic image manipulation can be performed using only the standard library packages, if your language includes such (PHP's bundled `libgd2` fork / Golang's `image` package / Qt QImage+QPixMap ). For Python `pillow` is popular.
- harryf 10y ago
  Python / Pillow (formerly PIL) could offer a real path here although there's a gap to Imagemagick on things like SVG
- mschuster91 10y ago
  I believe php uses imagick under the hood, and even if it does not, I'd rather rely on imagick than on PHP code when accepting exotic formats.
  - voltagex_ 10y ago
    From a security standpoint, wouldn't it be better to rely on PHP (first)? Are you more or less likely to get RCE from PHP or ImageMagick? I'd say PHP has had a lot more eyes on it, security wise.
    - cyphar 10y ago
      > From a security standpoint, wouldn't it be better to rely on PHP (first)? You're joking, right? Popping PHP boxes is script kiddie 101. You might argue that "bad developers make insecure software" but when you're given a toolbox with nothing but oddly shaped hammers it's very hard to make a house.
      - lillesvin 10y ago
        That's rarely PHP failing but whatever framework/CMS is used. That's like saying C++ is inherently insecure because there exists a lot of software written in C++ with security holes.
        cyphar 10y ago
        Did you read the second sentence I wrote? Just because you can write safe code in a language that tries to make you footgun at every turn, doesn't mean that language is a good language. Pick a language that doesn't suffer from crippling security issues (which, sure, you can workaround -- but why use a language that requires workarounds to get security?).
        ndj7 10y ago
        We started Imageflow (https://www.imageflow.io https://www.imageflow.io ) in C to design the C ABI for interop with all the host languages, but we're swapping out components for Rust every time it's possible/practical.
    - tracker1 10y ago
      Or, when saving to file for imagemagic, have it be a random temp name, with the correct file extension, read in the result, and only serve it as the original name when downloaded, if it fits the use case.
  - 0x0 10y ago
    PHP does not use imagick, but a (forked) libgd2 by default (some distros patch php to use the distro libgd). Imagick is only available if you install a C PHP extension providing an imagick interface.
- nkozyra 10y ago
  I don't think ImageMagick is targeted at "basic" image manipulation, though.

kristopolous 10y ago

True, and most people. Despite the issues, it's still really versatile tech.

Mandatum 10y ago

Unfortunately when it comes to file conversion/creation even, ImageMagick is the best of a bad bunch. Graphics formats are notoriously bad, check out the famous PSD rant on it: http://web.archive.org/web/20090426230545/http://code.google.com/p/xee/source/browse/trunk/XeePhotoshopLoader.m?spec=svn28&r=11 http://web.archive.org/web/20090426230545/http://code.google...

voltagex_ 10y ago
Alternate link: https://github.com/zepouet/Xee-xCode-4.5/blob/master/XeePhotoshopLoader.m#L108 https://github.com/zepouet/Xee-xCode-4.5/blob/master/XeePhot...
- Bromskloss 10y ago
  Look! It's possible to highlight an entire block of code: https://github.com/zepouet/Xee-xCode-4.5/blob/master/XeePhotoshopLoader.m#L108-L136 https://github.com/zepouet/Xee-xCode-4.5/blob/master/XeePhot... Maybe we should even link to a specific version of the file, to make sure that nothing breaks when it is updated or moved: https://github.com/zepouet/Xee-xCode-4.5/blob/83394493f51991748b9b4706e6d37a8ed874bc05/XeePhotoshopLoader.m#L108-L136 https://github.com/zepouet/Xee-xCode-4.5/blob/83394493f51991...