On GitHub if you rename your WebP file to "file.webp.png" it will upload just fine, and will use the correct Content-Type header when serving. It's really frustrating a simple \.(png|gif|jpe?g)$ check is preventing the uploading of these files. I found this is actually the case for a number of platforms.
Why is Adobe so bad at their job? GIMP added webp support about 5 years ago. Paint.NET added it 4 years ago.
> many websites still don't support uploading webp files.
4chan is the only such site I've heard of, and 4chan is notoriously bad at this sort of thing ever since they lost moot. It took them years to permit uploading of vp9/opus webms, for no good reason. 4chan's present administrators are incompetent, but 4chan is barely profitable (if at all) so that's not really unexpected.
But Adobe rakes in huge piles of cash, so what is Adobe's excuse?
Did they finally do that? I left permanently a couple years ago (after being there regularly since 2006) because the small "these kinds of threads are why I still hang around this place" threads got more and more infrequent and the regular users got more and more annoying and less fun. Most of the site just became a constant pool of angry racism, cynicism, and paranoia. I can handle seeing stupid racism, but the death of fun and the constant angry sarcasm just got old.
Anyway, I was constantly annoyed that I couldn't upload vp9 webms, and that apng was also not supported given how much better than gif it was. Webp would have been decent, too.
Because this code will be exposed on every single webpage you load, and historically these kind of parsers have had a number of security problems.
Something something memory safety, but this is the situation that currently exists.
"All the image parsers" would be a very bad idea. Years ago there was a bug in some Linux setups where all gstreamer codecs were exposed in Firefox, and it was a huge problem (similar: https://lwn.net/Articles/708196/ – although the one I remember is much older, around 2010 or so).
It's not really comparable to all the old terminfo entries from decades ago: the vendor controls those terminfo entries, not $random_websites. Maybe the ncurses terminfo parser actually does have some buffer overflow (there's an entire mini-programming language in there), but if it does it's not really a huge acute problem.
By that logic, Chrome shouldn't ever add any new features. WebP is also an additional attack surface.
Who cares if there's little adoption? Why not be feature complete? It's not like Google is some cash-strapped startup.
Heck, macOS ships with terminal definitions so you can log into a Mac using a Commodore B-128 as a serial terminal. That's certainly going to have less adoption than JPEG XL.
https://en.m.wikipedia.org/wiki/Commodore_CBM-II