3 ms·

But the initial security issue was in libwebp, which is made by Google, and surely Google had already fuzzed it and run all the available static analyzers in th

But the initial security issue was in libwebp, which is made by Google, and surely Google had already fuzzed it and run all the available static analyzers in the world. Static analyzers are nice to have, but they can't warn of every issue out there.

astrange 2y ago
The initial security design failure was inventing lossless WebP, which is a completely different format from lossy WebP, which means the library has double the code for double the attack surface. I am skeptical inventing any kind of WebP was a good idea, but I know the inventor and he got mad at me last time I said that, so I won't.
- saagarjha 2y ago
  Maybe because going "I think WebP was a bad idea" when its implementation has the same bugs in it that every other image parser has is not a very useful comment to make.
  - acdha 2y ago
    I think there’s a stronger form of the argument: image formats are expensive to create and secure, and that should have factored into WebP adoption given its marginal benefits. The lesson I hope was learned is that nobody should be writing new parsers in an unsafe language. WebP is old enough that it was defensible at the time but everyone should have a “no new C/C++” policy for internet-facing code.
    - saagarjha 2y ago
      Yes, I think we’re going to see this moving forward. The tools are in place to make this possible.
  - astrange 2y ago
    No, it's a bad idea because they based it on a video codec and then released a much better video codec a year later but couldn't update it. It's not better enough than JPEG to be worth existing.
    - saagarjha 2y ago
      The same could be said for half the formats Apple ships: HEIF/HEVC, for example. Or even LZFSE: who asked for an algorithm that compresses worse, slower?
      - astrange 2y ago
        It could but HEVC is actually an open standard, whereas WebP is a proprietary codec they bought and then released with no community feedback. (That's why the next VPx codec was better.) Also HEIF actually has useful features, it supports HDR! AVIF is certainly better though. I only feel positively about AVIF and JPEGXL.

astrange 2y ago

The initial security design failure was inventing lossless WebP, which is a completely different format from lossy WebP, which means the library has double the code for double the attack surface. I am skeptical inventing any kind of WebP was a good idea, but I know the inventor and he got mad at me last time I said that, so I won't.

saagarjha 2y ago
Maybe because going "I think WebP was a bad idea" when its implementation has the same bugs in it that every other image parser has is not a very useful comment to make.
- acdha 2y ago
  I think there’s a stronger form of the argument: image formats are expensive to create and secure, and that should have factored into WebP adoption given its marginal benefits. The lesson I hope was learned is that nobody should be writing new parsers in an unsafe language. WebP is old enough that it was defensible at the time but everyone should have a “no new C/C++” policy for internet-facing code.
  - saagarjha 2y ago
    Yes, I think we’re going to see this moving forward. The tools are in place to make this possible.
- astrange 2y ago
  No, it's a bad idea because they based it on a video codec and then released a much better video codec a year later but couldn't update it. It's not better enough than JPEG to be worth existing.
  - saagarjha 2y ago
    The same could be said for half the formats Apple ships: HEIF/HEVC, for example. Or even LZFSE: who asked for an algorithm that compresses worse, slower?
    - astrange 2y ago
      It could but HEVC is actually an open standard, whereas WebP is a proprietary codec they bought and then released with no community feedback. (That's why the next VPx codec was better.) Also HEIF actually has useful features, it supports HDR! AVIF is certainly better though. I only feel positively about AVIF and JPEGXL.