Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ImageMagick: CLI for Image Editing

imagemagick.org

Post reply on HN
Print view View original

51–60 of 101 posts

Re: ImageMagick: CLI for Image Editing

#51

Post by jmull »

dkuder wrote: post #18

There are 634 CVE Records that match your search. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=imagemagick There have been a number of zero days. My entire interaction with Imagemagick has been removing it. Often with great difficulty because there is some odd dependency.

I guess this means you should not use imagemagick in any process where the files (or other input) aren't trusted.

So you could use it in some typical dev workflows (or other business workflows) that are purely internal and maybe in certain non-internal processes where the inputs are strictly limited to trusted ones. But not, e.g., in services/apps that could process untrusted inputs.

(Seems like there are a number of leaks too, but since it's process-oriented, those probably won't be that hard to live with. They might be hard to notice normally.)

?

Re: ImageMagick: CLI for Image Editing

#52

Post by coldpie »

herpderperator wrote: post #42
coldpie wrote: post #11

I always found it fascinating the grade-A executable names which imagemagick was able to claim in the global namespace: imagemagick /usr/bin/animate imagemagick /usr/bin/compare imagemagick /usr/bin/composite imagemagick /usr/bin/conjure imagemagick /usr/bin/convert imagemagick /usr/bin/display imagemagick /usr/bin/identify imagemagick /usr/bin/import imagemagick /usr/bin/mogrify imagemagick /usr/bin/montage imagemag…

This looks like useful output, what distro and command did you use to list this?

Arch Linux.

    $ pacman -Ql imagemagick | grep bin
    imagemagick /usr/bin/
    imagemagick /usr/bin/Magick++-config
    imagemagick /usr/bin/MagickCore-config
    imagemagick /usr/bin/MagickWand-config
    imagemagick /usr/bin/animate
    imagemagick /usr/bin/compare
    ....
You may also enjoy:

    $ pacman -Qo /usr/bin/{display,convert}
    /usr/bin/display is owned by imagemagick 7.1.0.16-1
    /usr/bin/convert is owned by imagemagick 7.1.0.16-1

Re: ImageMagick: CLI for Image Editing

#53

Post by technobabbler »

HeckFeck wrote: post #39
coldpie wrote: post #11

I always found it fascinating the grade-A executable names which imagemagick was able to claim in the global namespace: imagemagick /usr/bin/animate imagemagick /usr/bin/compare imagemagick /usr/bin/composite imagemagick /usr/bin/conjure imagemagick /usr/bin/convert imagemagick /usr/bin/display imagemagick /usr/bin/identify imagemagick /usr/bin/import imagemagick /usr/bin/mogrify imagemagick /usr/bin/montage imagemag…

If executable names were traded like internet domains, imagine what they'd be worth now.

I tried to convert those units but all I got was an imagemagick error

Re: ImageMagick: CLI for Image Editing

#54

Post by technobabbler »

wingmanjd wrote: post #3

At my $OLDJOB, I used ImageMagick to compare snapshots during some automated front-end testing on our public Drupal site. It would compare the running test to previously accepted images, highlighting pixel diffs in red. It would also generate a 4 frame animated gif with of the original, highlit changes, the running test version, and back to the highlit changes (so it could loop for better comparison). Imagemagick sav…

For the lazy geeks out there, the service diffy does this easily and for cheap: https://diffy.website/

Re: ImageMagick: CLI for Image Editing

#56

Post by bjackman »

chucky_z wrote: post #35
dkuder wrote: post #18

There are 634 CVE Records that match your search. https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=imagemagick There have been a number of zero days. My entire interaction with Imagemagick has been removing it. Often with great difficulty because there is some odd dependency.

Imagemagick is one of the few bits of software where the functionality is worth the risk. Simply find a way to remove any network access and use it. I used to run it in a docker container with (almost) all capabilities dropped but with a directory mapped into it to run.

Not sure if this is common knowledge (??) but I feel I should note here: in my job we absolutely do not consider containers to be a security boundary[1]. On the other hand I still tend to use them for isolation on my personal boxen, because they at least reduce the blast radius of bugs or shitty packaging.

[1] Random search result that appears to corroborate my claim: https://blog.aquasec.com/container-isolation

Re: ImageMagick: CLI for Image Editing

#58

Post by pavlov »

coldpie wrote: post #11

I always found it fascinating the grade-A executable names which imagemagick was able to claim in the global namespace: imagemagick /usr/bin/animate imagemagick /usr/bin/compare imagemagick /usr/bin/composite imagemagick /usr/bin/conjure imagemagick /usr/bin/convert imagemagick /usr/bin/display imagemagick /usr/bin/identify imagemagick /usr/bin/import imagemagick /usr/bin/mogrify imagemagick /usr/bin/montage imagemag…

No self-respecting Unix tool would use such long names, so that's why they were free. "compare" vs "cmp", etc.

Re: ImageMagick: CLI for Image Editing

#59

Post by Maursault »

Meph504 wrote: post #30
coldpie wrote: post #11

I always found it fascinating the grade-A executable names which imagemagick was able to claim in the global namespace: imagemagick /usr/bin/animate imagemagick /usr/bin/compare imagemagick /usr/bin/composite imagemagick /usr/bin/conjure imagemagick /usr/bin/convert imagemagick /usr/bin/display imagemagick /usr/bin/identify imagemagick /usr/bin/import imagemagick /usr/bin/mogrify imagemagick /usr/bin/montage imagemag…

Image magick has been around for a pretty long time, and was doing image processing on linux before most had considered it.

ImageMagick was developed by John Cristy at DuPont in 1987 and release in 1990. Your statement is not only false, even it it wasn't, mentioning Linux in relation to ImageMagick is a non-sequitor. Maybe you should try other things.

Re: ImageMagick: CLI for Image Editing

#60

Post by Gigachad »

pavlov wrote: post #58
coldpie wrote: post #11

I always found it fascinating the grade-A executable names which imagemagick was able to claim in the global namespace: imagemagick /usr/bin/animate imagemagick /usr/bin/compare imagemagick /usr/bin/composite imagemagick /usr/bin/conjure imagemagick /usr/bin/convert imagemagick /usr/bin/display imagemagick /usr/bin/identify imagemagick /usr/bin/import imagemagick /usr/bin/mogrify imagemagick /usr/bin/montage imagemag…

No self-respecting Unix tool would use such long names, so that's why they were free. "compare" vs "cmp", etc.

Image magick isn't something you use frequently and quickly like changing directories or moving a file. A longer more descriptive name is better here. Also easier to speak. Telling someone to write "compare" is easier than "C-M-P"
Post reply on HN