Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

This JPEG is also a webpage

lcamtuf.coredump.cx

Post reply on HN
Print view View original

21–30 of 236 posts

Re: This JPEG is also a webpage

#21

Post by aioprisan »

yathern wrote: post #15
aioprisan wrote: post #13

So in theory, can analytics platforms be compromised so that JPEG tracking pixels could turn into full-fledged sites interfering with the parent page at, say, a bank website? Firing off credentials in the background?

No, because if parsed as a JPEG, arbitrary code wont be run. If the jpeg was somehow parsed as JS, then possibly yes.

The image reference tag is for an image. As stated previously, if you look at the JPEG itself, it starts off with a JPEG comment, which embeds the entire html block, then starts a comment block for the remainder of the JPEG data. Browsers are very liberal in what they accept, so that initial 20-byte header is ignored, although you can see it if you inspect the page's elements.

Re: This JPEG is also a webpage

#22

Post by [deleted] »

aioprisan wrote: post #13

So in theory, can analytics platforms be compromised so that JPEG tracking pixels could turn into full-fledged sites interfering with the parent page at, say, a bank website? Firing off credentials in the background?

[deleted]

Re: This JPEG is also a webpage

#23

Post by brlewis »

tikhonj wrote: post #10
a1k0n wrote: post #7

That's a chipmunk, not a squirrel.

I'm not an expert on squirrels, but that could be a ground squirrel[1] of some sort. Some varieties of ground squirrel look a lot like chipmunks. [1]: https://en.wikipedia.org/wiki/Ground_squirrel

A quick search for "striped ground squirrel" turned up only one variety, the thirteen-lined ground squirrel. The animal in the photo has stripes like a chipmunk.

Re: This JPEG is also a webpage

#24

Post by united893 »

throwawayReply wrote: post #11

I appreciate the technical trickery in this version, but has it not been possible to do this since at least 1996[1] by having the server serve different files based on the "Accept" http header? [1] https://www.w3.org/Protocols/HTTP/1.0/spec.html#Accept

Great, now construct a jpeg image that's valid HTML and a valid uncorrupted picture as well.

Re: This JPEG is also a webpage

#25

Post by aioprisan »

throwawayReply wrote: post #11

I appreciate the technical trickery in this version, but has it not been possible to do this since at least 1996[1] by having the server serve different files based on the "Accept" http header? [1] https://www.w3.org/Protocols/HTTP/1.0/spec.html#Accept

That's for the initial resource itself, not subsequent asset requests. For instance, an asset request is a separate request on a different domain, such as one for a customer service analytics tag, which is requested without any accept resource type request filter.

Re: This JPEG is also a webpage

#26

Post by pauldino »

Hannan wrote: post #9
d33 wrote: post #2

...how is that possible?

He placed HTML inside a COM (comment) segment of the JPEG, which is perfectly legal. The ending of his HTML is " http://dev.exiv2.org/projects/exiv2/wiki/The_Metadata_in_JPE...

Actually the browser isn't ignoring the first bytes of the JPEG before the tag - it's there on the page, just hidden with CSS.

Re: This JPEG is also a webpage

#28

Post by Hannan »

pauldino wrote: post #26
Hannan wrote: post #9

Earlier quoted context omitted.

He placed HTML inside a COM (comment) segment of the JPEG, which is perfectly legal. The ending of his HTML is " http://dev.exiv2.org/projects/exiv2/wiki/The_Metadata_in_JPE...

Actually the browser isn't ignoring the first bytes of the JPEG before the tag - it's there on the page, just hidden with CSS.

That's true, I stand corrected.

Re: This JPEG is also a webpage

#29

Post by chriswarbo »

daeken wrote: post #4

I abused this concept to compress demo code in PNG files, with great success. http://demoseen.com/blog/2011-08-31_Superpacking_JS_Demos.ht... This is, at present, the most efficient way to pack demos on the web; a few characters of uncompressed bootstrap code, then the rest is deflated.

Seems like some bits are missing on that page, e.g. I see nothing between "What is the bootstrap? Well, it's what turns our PNG into code and runs it. Here's the one I use:" and "The 4968 here is really the size of the decompressed data in bytes times 4"

Re: This JPEG is also a webpage

#30

Post by rimantas »

danbruc wrote: post #27

A testament to one of the worst decisions in computing history - not to fail displaying a web page with an error message in case it is not a valid HTML document.

Or one of the best. Switch wen browsers to strict processong and you will hardly find working web page.
Post reply on HN