That's a big issue for imagemagick as an API/library (working on arbitrary data for a web service/application) not as a CLI tool to work on data you created yourself, which is the case here.
TBH, I can't really blame ImageMagick devs too much for this. They're not making an image editing suite for web-facing services with access to sensitive user data. They're making an image editing suite for the Linux command line, which web devs happen to use on user-submitted images with absolutely no sanitization. The latter part of the sentence is the problem.
Adding to that, ImageMagick had it's first release in 1990! That's half a decade before the first release of Apache. It's no surprise some of the code in ImageMagick make it unfit for unfiltered use in web apps, when it was written before graphics-capable webservers, even graphics-capable browsers, were a thing.
What we really need is for someone to write a security-focused universal wrapper, that plugs straight into existing frameworks, so everyone can get the benefit of best-practices, and can report vulns and get them secured quickly.
So really, blaming ImageMagick is not that far from blaming Python for having vulnerabilities if you run a Django app taking unsanitized form input and doing subprocess.Popen() with it.
(That's not to say the "imagetragick" folks are wrong for alerting the community, using that moniker to increase awareness.)
> TBH, I can't really blame ImageMagick devs too much for this. They're not making an image editing suite for web-facing services with access to sensitive user data. They're making an image editing suite for the Linux command line
On the other hand, CLI image display and edition doesn't mean it'll only face trusted content, it's not rare to download a file and display it or further manipulate it.
She brings back the child-like wonder and joy of early "tuts" of hackerdom. The old "asciiz" were tutorials written by people who both _enjoyed_ programming, and found it mischievous.
She may think that the problems associated with sexism in the workplace aren't solved yet, so feminism is relevant to her working life, whether she likes it or not. Or she may just find the subject interesting and enjoy writing about it.
Is there some reason you find the subject especially irritating? And did any of the other tangential things she mentions--Star Trek, deafness, Canada, etc.--provoke the same reaction?
Zines by techies have a long history! Tom Jennings [1], who founded FidoNet [2] and The Little Garden ISP, published one of the first Queercore anarcho-punk zines called Homocore [3]. He's written a retrospective and published an archive of his Homocore memory [4] of San Francisco during 1988-1991.
I imagine a lot of technical people are or could be into zines: they mix DIY and maker zeal with principles of distributed information sharing. They're the OG artisanal local blogs ;-p
You can make little zine booklets -- which I find especially satisfying -- from a single sheet of computer paper using the following instructions: http://staycalmcomic.com/how-to-zine
I like the way you phrased, "They're the OG artisanal local blogs," and I think of them the same way.
When I was in junior high and high school one of my best friends and I started producing a 'zine in Cleveland around the punk and hardcore music scenes. We interviewed bands, made crazy art work, she wrote some poetry, and it was a very fun, very satisfying collaboration. We used a mac at the time to do all of our layout and then went to Kinkos to assemble it.
Because of the relationships we developed we started producing concerts for the bands we liked. Basically, we were able to corral enough people to pay for a show we wanted to see by bands that weren't otherwise coming to Cleveland.
I was once at a tech-presentation where the presenter drew/wrote everything freehand like this on a tablet, almost similar to how one would use a blackboard. I really liked the way she presented compared to a static slide-deck, as she could adjust/add examples based on questions and feedback from the crowd.
From time to time I want to make a zine, but the distribution it is a problem. Startup idea time: I upload my PDF, the lists of address, and you print them and distributed them.
26 comments
[ 3.3 ms ] story [ 64.8 ms ] threadhttps://imagetragick.com/
https://github.com/ImageTragick/PoCs
Adding to that, ImageMagick had it's first release in 1990! That's half a decade before the first release of Apache. It's no surprise some of the code in ImageMagick make it unfit for unfiltered use in web apps, when it was written before graphics-capable webservers, even graphics-capable browsers, were a thing.
What we really need is for someone to write a security-focused universal wrapper, that plugs straight into existing frameworks, so everyone can get the benefit of best-practices, and can report vulns and get them secured quickly.
So really, blaming ImageMagick is not that far from blaming Python for having vulnerabilities if you run a Django app taking unsanitized form input and doing subprocess.Popen() with it.
(That's not to say the "imagetragick" folks are wrong for alerting the community, using that moniker to increase awareness.)
On the other hand, CLI image display and edition doesn't mean it'll only face trusted content, it's not rare to download a file and display it or further manipulate it.
Is there some reason you find the subject especially irritating? And did any of the other tangential things she mentions--Star Trek, deafness, Canada, etc.--provoke the same reaction?
[1] https://en.wikipedia.org/wiki/Tom_Jennings
[2] https://en.wikipedia.org/wiki/FidoNet
[3] https://en.wikipedia.org/wiki/Homocore_(zine)
[4] http://worldpowersystems.com/HOMOCORE/
http://www.phrack.org/
You can make little zine booklets -- which I find especially satisfying -- from a single sheet of computer paper using the following instructions: http://staycalmcomic.com/how-to-zine
When I was in junior high and high school one of my best friends and I started producing a 'zine in Cleveland around the punk and hardcore music scenes. We interviewed bands, made crazy art work, she wrote some poetry, and it was a very fun, very satisfying collaboration. We used a mac at the time to do all of our layout and then went to Kinkos to assemble it.
Because of the relationships we developed we started producing concerts for the bands we liked. Basically, we were able to corral enough people to pay for a show we wanted to see by bands that weren't otherwise coming to Cleveland.
Kathleen Hanna had a big hand in this movement [0] and if you want to see/listen then watch "The Punk Singer" ~ http://www.youtube.com/watch?v=zMbLzaVkn2s
[0] https://en.wikipedia.org/wiki/Kathleen_Hanna