How and why I made a zine
jvns.ca
How and why I made a zine
1–10 of 27 posts
Re: How and why I made a zine
#2Re: How and why I made a zine
#3 # imagemagick is the best thing in the world
Re: How and why I made a zine
#4Julia Evans' zines are the most entertaining way to learn about linux/unix internals I've encountered yet :)
Re: How and why I made a zine
#5Omg, It is not something about strace. I will go to my basement and lock myself up.
Re: How and why I made a zine
#6I find this extremly hard to read and I don´t get why you have to push feminism into this topic.
Re: How and why I made a zine
#7I find this extremly hard to read and I don´t get why you have to push feminism into this topic.
OMG ^_^ Did ya see those handscribbled pages though so cute!!!
Re: How and why I made a zine
#8# imagemagick is the best thing in the world Unfortunately, the number of vulnerabilities in ImageMagick has earned it another name, ImageTragick. https://imagetragick.com/ https://github.com/ImageTragick/PoCs
"It's riddled with features!"
Re: How and why I made a zine
#9# imagemagick is the best thing in the world Unfortunately, the number of vulnerabilities in ImageMagick has earned it another name, ImageTragick. https://imagetragick.com/ https://github.com/ImageTragick/PoCs
That's a big issue for imagemagick as an API/library (working on arbitrary data for a web service/application) not as a CLI tool to work on data you created yourself, which is the case here.
Re: How and why I made a zine
#10# imagemagick is the best thing in the world Unfortunately, the number of vulnerabilities in ImageMagick has earned it another name, ImageTragick. https://imagetragick.com/ https://github.com/ImageTragick/PoCs
TBH, I can't really blame ImageMagick devs too much for this. They're not making an image editing suite for web-facing services with access to sensitive user data. They're making an image editing suite for the Linux command line, which web devs happen to use on user-submitted images with absolutely no sanitization. The latter part of the sentence is the problem.
Adding to that, ImageMagick had it's first release in 1990! That's half a decade before the first release of Apache. It's no surprise some of the code in ImageMagick make it unfit for unfiltered use in web apps, when it was written before graphics-capable webservers, even graphics-capable browsers, were a thing.
What we really need is for someone to write a security-focused universal wrapper, that plugs straight into existing frameworks, so everyone can get the benefit of best-practices, and can report vulns and get them secured quickly.
So really, blaming ImageMagick is not that far from blaming Python for having vulnerabilities if you run a Django app taking unsanitized form input and doing subprocess.Popen() with it.
(That's not to say the "imagetragick" folks are wrong for alerting the community, using that moniker to increase awareness.)