Think about it. It was released (read: forcibly shoved down our throats) by Google and came out of nowhere when there were zero problems with the decades old and extremely well researched incumbent image/video formats that the web was already using (i.e. jpg, png, gif, mp4, etc). Google has confirmed ties to the US three-letter agencies through PRISM, as well as AFAIK all but confirmed ties to the Israeli government. BlastPass was reportedly apart of Israel’s Pegasus hacking suite for years before the vulnerability went public, and was actively exploited by Israel to track down political dissidents. It’s also the worst type of vulnerability there is, a buffer overflow resulting in arbitrary code execution, meaning once you exploit it you can do literally anything to the target device, from an image format, the type of file most people would never suspect to be capable of doing that (and indeed most developers never suspected that either, considering how everyone from Mozilla to Apple seemingly just took Google source code and incorporated it into their own software, no questions asked).
Maybe I’m just overly cynical, but I’m having a really hard time believing that such a critical vulnerability in such a widespread code base would be accidental, especially in the age of automated testing, fuzzing, and when the industry generally has a very good understanding of how to prevent memory vulnerabilities. The vulnerability was there since they very beginning of the standard and we’re to believe one of the largest software companies simply failed to spot it for years? I don’t think Hanlon’s Razor should apply to companies like Google because they have a long and shameless pattern of malice and have long exhausted their benefit of the doubt.
I have a sneaking suspicion that WebP was planned as a Trojan horse from the start to backdoor as much software as possible, and Google sold the exploit to the US and Israel govts. Why else would Google so relentlessly push an image format of all things unless there was some covert benefit to themselves? (An image format that’s not even patented/licensed mind you so they’re definitely not making money that way.)
What do you think?
It was released (read: forcibly shoved down our throats) by Google and came out of nowhere when there were zero problems with the decades old and extremely well researched incumbent image/video formats that the web was already using (i.e. jpg, png, gif, mp4, etc)
I don’t agree with this. There are many things wrong with those file formats. GIF, for example, is over 35 years old and has a 256 color pallete. Now, if it’s good enough for your purposes and it “ain’t broke” for that, fine, but compare these formats to JPEG-XL and it’s clear that they deserve to be surpassed. WebM/WebP, despite my many issues with it (WebP and AVIF are bullshit formats), they did serve a legitimate purpose, and quite frankly you can even say it was good for the environment due to lowering filesizes at an actually meaningful scale.
In fact, if I’m reading Mitre correctly, there are libjpeg vulns still being found since WebP was launched. I’m not saying this to equivocate the two from a security standpoint, hell no, but to critisize the common view I see online claiming the older formats are unbackable.
Quite possibly. And also that format should die. It’s bad and it should feel bad.
What do you suggest ? Jpeg-xl ? Avif ?
No.
Everything is possible. Malice or just incompetence? No way to know.
Google implemented WebP because they can control it without having to pay anyone else. Apple then bungled the client-side implementation.
I know almost nothing about BlastPass, but, looking at the first page of search hits, it seemed to have been an Apple implementation vulnerability rather than some vulnerability baked into the standard itself. In general, buffer overflows are implementation-specific.
This video from a security researcher says that pretty much every software that uses WebP was affected though, and once the issue was discovered, Google made commits in their own codebase to “fix” it. Which suggests it’s an issue with the upstream source code that Google provided to everyone else.
Oh. That’s what I get for making wild-assed guesses from the first page of search results ¯\_(ツ)_/¯
What do you think?
I think I prefer JPEG-XL
it is superior in all the ways. too bad it’s barely supported by anything
