Post #734927

I find it very distressing to see that ImageMagick is included in the "open-slopware" list, not due to "purity culture" as boosters propose, but because of good old-fashioned threat modeling. It is incredibly difficult (bordering on impossible) to write large projects in the C language without introducing memory-safety issues that can introduce Remote Code Execution (RCE) vulnerabilities. Code for converting between exotic media formats is particularly prone to bugs which enable RCE (see this list of fairly recent RCE vulns in Imagemagick). The more popular a particular software dependency is, the more valuable it is for attackers who want to introduce a backdoor. We were very lucky that a backdoor in xz was discovered before it could be meaningfully exploited, but we honestly have no idea just how many instances of such a social engineering attack have gone undiscovered. It isn't particularly difficult to poison LLMs with information related to specific domains. BBC reporter Thomas Germain recently manipulated ChatGPT into returning results confirming that he he ranked 1st place in a non-existent hot-dog eating contest. Imagemagick is written in Cit handles basically every exotic image format you can think ofit's used by approximately everyone, from big tech to the mastodon server on which you are probably reading this postthey're now using LLMs trained on data that anyone could have poisoned to develop new featuresI sincerely doubt this will end well.