4 ms·

I'm seeing the image on zen which is a firefox fork but not on firefox itself :/ even with `image.jxl.enabled` I don't see it on firefox

by numbers 8mo ago

capitainenemo 8mo ago
Checking the Firefox bugs on this, it seems they decided to replace the C++ libjxl with a rust version which is a WIP, to address security concerns with the implementation. All this started a few months ago. Maybe the zen fork is a bit older and still using the C++ one?
- capitainenemo 8mo ago
  ... update. after reading the comments in the rust migration security bug, I saw they mentioned "only building in nightly for now" I grabbed the nightly firefox, flipped the jxl switch, and it does indeed render fine, so I guess the rust implementation is functioning, just not enabled in stable. ... also, I see no evidence that it was ever enabled in the stable builds, even for the C++ version, so I'm guessing Zen just turned it on. Which... is fine, but maybe not very cautious.
  - awestroke 8mo ago
    zen browser is pretty much vibe coded
    - nar001 8mo ago
      Do you have any proof/more about this? I've never heard this claim and I'd like to know more
      - awestroke 8mo ago
        1. Zen Browser had remote debugging enabled by default and disabled the security prompt for it. Extreme incompetence or malice? https://github.com/zen-browser/desktop/pull/927 https://github.com/zen-browser/desktop/pull/927 2. Social trackers are selectively allowed, unsigned extensions are enabled by default, and Enhanced Tracking Protection isn't fully implemented. There's just a theme of incompetence, trying to cover it up and just in general being clueless about security.
- bpbp-mango 8mo ago
  good. image parsing has produced so many bad RCEs.
- rkangel 8mo ago
  Google Chrome is using a Rust implementation. The existence and sufficient maturity of it is the reason they were willing to merge support in the first place.
  - illiac786 8mo ago
    Hmmm, check the jxl-rs repository. I wouldn’t call it mature. Not to say it’s buggy, but most of its code is very fresh.
dietr1ch 8mo ago
Flipping `image.jxl.enabled` made it work for me after refreshing the page. I'm using Librewolf 146.0.1-1, but I guess it works just fine in firefox 146

I'm seeing the image on zen which is a firefox fork but not on firefox itself :/ even with `image.jxl.enabled` I don't see it on firefox

by numbers 8mo ago

I'm seeing the image on zen which is a firefox fork but not on firefox itself :/ even with `image.jxl.enabled` I don't see it on firefox

capitainenemo 8mo ago

Checking the Firefox bugs on this, it seems they decided to replace the C++ libjxl with a rust version which is a WIP, to address security concerns with the implementation. All this started a few months ago. Maybe the zen fork is a bit older and still using the C++ one?

capitainenemo 8mo ago
... update. after reading the comments in the rust migration security bug, I saw they mentioned "only building in nightly for now" I grabbed the nightly firefox, flipped the jxl switch, and it does indeed render fine, so I guess the rust implementation is functioning, just not enabled in stable. ... also, I see no evidence that it was ever enabled in the stable builds, even for the C++ version, so I'm guessing Zen just turned it on. Which... is fine, but maybe not very cautious.
- awestroke 8mo ago
  zen browser is pretty much vibe coded
  - nar001 8mo ago
    Do you have any proof/more about this? I've never heard this claim and I'd like to know more
    - awestroke 8mo ago
      1. Zen Browser had remote debugging enabled by default and disabled the security prompt for it. Extreme incompetence or malice? https://github.com/zen-browser/desktop/pull/927 https://github.com/zen-browser/desktop/pull/927 2. Social trackers are selectively allowed, unsigned extensions are enabled by default, and Enhanced Tracking Protection isn't fully implemented. There's just a theme of incompetence, trying to cover it up and just in general being clueless about security.
bpbp-mango 8mo ago
good. image parsing has produced so many bad RCEs.
rkangel 8mo ago
Google Chrome is using a Rust implementation. The existence and sufficient maturity of it is the reason they were willing to merge support in the first place.
- illiac786 8mo ago
  Hmmm, check the jxl-rs repository. I wouldn’t call it mature. Not to say it’s buggy, but most of its code is very fresh.

dietr1ch 8mo ago

Flipping `image.jxl.enabled` made it work for me after refreshing the page. I'm using Librewolf 146.0.1-1, but I guess it works just fine in firefox 146