34
what is the webp vulnerability?
(lemmy.ml)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 30 Sep 2023
34 points (87.0% liked)
Asklemmy
42432 readers
1226 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
A malformed (attacker crafted) webp file could cause Chrome (or other Chrome based browsers) to execute arbitrary code when rendering it. The file might be embedded in a web page you view. Other applications that use Skia for graphics are theoretically affected too.
oh i use firefox
It's a bug in the webp library; everything that can decode webp is affected.
The one s couple of weeks ago also affected Firefox: https://thehackernews.com/2023/09/mozilla-rushes-to-patch-webp-critical.html?m=1
The internet needs to switch to .svg
SVG is for vector graphics, i.e. anything that can be described with lines and shapes, like logos or most icons.
WebP on the other hand is for raster graphics. For example, cameras create raster graphics.
So, while SVG may be able to replace WebP for some use-cases, it makes no sense to generally switch to SVG.
A suitable, better replacement for WebP is JPEG XL.
In oelden days, I once made an entire (small) web site out of SVG. All the layout, everything; it was before responsive design, and before SVG had text wrap. It had animations and everything.
In a way, it was pretty cool; like PDF web pages. Everything was always perfectly and faithfully laid out. But the downside was that everything was always perfectly laid out ... for exactly one display dimensions.
I still have a soft spot in my heart for SVG. I wish it were more widely used, and that svgz was more well supported. But yeah, you're right: it's not the best choice for a lot of graphics.
Haven't heard of JPEG XL, will investigate further. ๐ค
Thanks! ๐
What does jpeg XL differ from normal jpeg? Wansn't webp introduced to replace jpeg?
JPEG XL is just a new standard from the Joint Photographic Experts Group. It doesn't have much to do with the original JPEG standard from 1992. For example, JPEG XL also supports lossless compression, which PNG was traditionally used for.
And yes, WebP was developed to supersede JPEG, however it was developed at Google without much input from the industry. As such, it never gained particularly widespread support.
JPEG XL is a newer standard compared to WebP, developed in a joint venture by more of the industry (including Google), and from what I've heard, it makes several significant improvements compared to WebP.
It is a very new standard, so it probably is still behind WebP in terms of adoption, but I'd expect that to flip pretty soon.
Personal opinion: I just think WebP is poop.
You can have images with huge resolutions that still look incredibly blurry.
Reminds me of the xkcd about standards
https://xkcd.com/927/
What's better? Avif or jepg xl?
Honestly, I have no idea. It sounds like AVIF also has wide industry support and is generally quite proficient.
But JPEG XL likely wouldn't have been created, if AVIF was perfect. Wikipedia says:
I'm guessing, AVIF was created, because it basically already existed. It's using the AV1 video codec to encode a single-frame video and that just happened to be better than the competition.
JPEG XL being more focused on those still images could obviously still outperform it. I guess, we'll have to see.
For right now, though, yeah, JPEG XL might still be too young and AVIF therefore the better choice.
Reminds me of the xkcd about standards
https://xkcd.com/927/
whats that