5 ms·
True, and most websites will reencode images for compression anyway. But the point still stands this makes "hacked by clicking a link" a reality again for some
by Vt71fcAqt7 3y ago
True, and most websites will reencode images for compression anyway. But the point still stands this makes "hacked by clicking a link" a reality again for some people which should have ended along with flash and java applets. The current mainstream is that "you won't get hacked if you don't install." (not to say that this is the best security practise..) Since you don't install images most people will just assume they are safe. I hope this whole ordeal doesn't hurt JPEG-XL adoption.
- mnw21cam 3y agoAgreed. Security shouldn't depend on not visiting certain web sites, because if nothing else the ad networks are able to get your browser to load all sorts of content from all sorts of places that you wouldn't deliberately do.
- Filligree 3y agoI hope it does hurt JPEG-XL adoption. The reference implementation is C++, and it’s nearly guaranteed to have equally worrisome bugs in it — every image library has seen those over the years. We live in 2023. We can deal with slightly worse compression until someone rewrites it in a sane language.
- sambazi 3y ago> We live in 2023. We can deal with slightly worse compression until someone rewrites it in a sane language. not just sanity of implementation but also reliability and compatibility {h264,jpg,zip} for life!
- londons_explore 3y agoEspecially when there are various neural net compression methods on the horizon that look like they can probably reduce file sizes 10x or more for similar user enjoyment.
- hot_gril 3y agoYeah, I don't mess with webp, VP8, etc. I see near zero benefit to myself from that, with significant downsides. Like, Google Meet insists on using VP8/9. Why, cause it's "free?" The strain on my laptop and extra energy usage for it to CPU-en/decode video ain't free. Zoom just uses h.264 instead of being annoying about it.
- Vt71fcAqt7 3y agoI'm sure this is what you meant, right ;) https://github.com/Traneptora/jxlatte https://github.com/Traneptora/jxlatte
- Filligree 3y agoI'll take it. It's not like Java is slow nowadays.
- pixelesque 3y agoIt's not just compression ratios that new formats provide though: it's also higher bit depths (meaning less banding for things like gradients, i.e. in skies at sunset) and HDR support (values over 1.0 in 'linear' space, rather than being clamped).
- yjftsjthsd-h 3y agoI was under the impression that modern C++ is a "sane language" - it looks like "smart pointers" are a thing now?
- UncleMeat 3y agoSmart pointers aren't the beginning and end of things. C++ is riddled with places that can be converted into weird machines, even if you guarantee correct lifetimes of everything on the heap. Look at how much fun we can just have with the stack! std::string_view foo(std::string_view s) { return s; } auto s = foo("temporary"); // kaboom Modern C++ does not force you to initialize everything before it is read. Modern C++ happily lets you ignore bounds checks with vector operator[] or by using c style arrays or by doing pointer arithmetic. Modern C++ happily lets you overflow integers or silently truncate when widths change. And on and on and on. Turning every "new" into "make_shared" is nowhere close to enough to make C++ safe in the face of bugs.
- londons_explore 3y agoClicking a link in a web browser means that any image decoding happens in the browser renderer sandbox. That sandbox is pretty robust - the difficulty of finding an exploit somewhere in a browser renderer is much lower than the difficulty of finding a way out of the sandbox the renderer runs in.
- Vt71fcAqt7 3y agoYes, not exactly "clicking a link" but still at the same level ("add to contacts"). Also many apps have users with profile pictures. An attacker can send a link that will open in an app (eg. Instagram, facebook). Also within browsers could this still leak whatever is currently rendering on the page?