3 ms·
Yeah, the frequency with which they have to make security patches is telling a lot about the overall code quality. One might argue that it's because it's more
by WesolyKubeczek 6y ago
Yeah, the frequency with which they have to make security patches is telling a lot about the overall code quality.
One might argue that it's because it's more popular than other similar projects, but it doesn't happen as often with, say, Pillow. And I don't quite remember PIL/Pillow having holes as big as ImageMagick.
Also, try actually programming against it. Whatever language you choose, it's going to feel clunky and alien. It feels alien in C. It feels alien in Perl. Even in PHP, the match made in hell, it feels thoroughly un-idiomatic. I'm not even surprised they have to patch it up now and then.
- jefftk 6y agoParsing complex untrusted inputs in a language that isn't memory safe is the center of the unholy venn diagram. It's very hard to do a good job under those conditions. While "rewrite it in Rust" is a cliche, I think ImageMagick is a good candidate!
- iou 6y agoI think it's a thing! https://github.com/imazen/imageflow https://github.com/imazen/imageflow
- WesolyKubeczek 6y agoCan it easily sprout bindings to other languages, especially given Rust’s ABI stability guarantees which are as firm as melted icecream?
- detaro 6y agoIts README addresses that. TL;DR: it exposes a C-API and offers bindings based on that, like pretty much any language allowing bindings would.