News for hackers. Stuff that matters.

A comment on Blasting Past WebP - An analysis of the NSO BLASTPASS iMessage exploit. Parent comment

Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by astrange on Thursday March 27, 2025 @04:30PM (#43497821)
The initial security design failure was inventing lossless WebP, which is a completely different format from lossy WebP, which means the library has double the code for double the attack surface.

I am skeptical inventing any kind of WebP was a good idea, but I know the inventor and he got mad at me last time I said that, so I won't.

[ Parent | on HN ]
Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by saagarjha on Friday March 28, 2025 @03:43AM (#43502629)
Maybe because going "I think WebP was a bad idea" when its implementation has the same bugs in it that every other image parser has is not a very useful comment to make.
[ Parent | on HN ]
Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by acdha on Friday March 28, 2025 @10:23AM (#43505814)
I think there’s a stronger form of the argument: image formats are expensive to create and secure, and that should have factored into WebP adoption given its marginal benefits.

The lesson I hope was learned is that nobody should be writing new parsers in an unsafe language. WebP is old enough that it was defensible at the time but everyone should have a “no new C/C++” policy for internet-facing code.

[ Parent | on HN ]
Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by saagarjha on Friday March 28, 2025 @03:16PM (#43509007)
Yes, I think we’re going to see this moving forward. The tools are in place to make this possible.
[ Parent | on HN ]
Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by astrange on Friday March 28, 2025 @03:08PM (#43508935)
No, it's a bad idea because they based it on a video codec and then released a much better video codec a year later but couldn't update it.

It's not better enough than JPEG to be worth existing.

[ Parent | on HN ]
Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by saagarjha on Friday March 28, 2025 @03:14PM (#43508985)
The same could be said for half the formats Apple ships: HEIF/HEVC, for example. Or even LZFSE: who asked for an algorithm that compresses worse, slower?
[ Parent | on HN ]
Re:Blasting Past WebP - An analysis of the NSO BLASTPASS iMe... by astrange on Friday March 28, 2025 @03:55PM (#43509314)
It could but HEVC is actually an open standard, whereas WebP is a proprietary codec they bought and then released with no community feedback. (That's why the next VPx codec was better.)

Also HEIF actually has useful features, it supports HDR!

AVIF is certainly better though. I only feel positively about AVIF and JPEGXL.

[ Parent | on HN ]