High Efficiency Image File Format

Yeah, JPEG XL aims to provide better image quality at smaller file sizes while supporting features that traditional JPEG lacks.

That's why we started switching to PNG and HEIC because the Joint Photographic Experts Group is sort of like the United Nations Group.

and it perhaps deservedly takes forever to agree on these new standards, but now they have.

So, Kyle, some of the key advantages of JXL.

He made an app called HEVCut, and it basically is an app to go through and find, well, it does a few things, but the core thing is find large video files on your device, and especially things that are in older codecs like H.264. and convert them over into H-E-I-V?

H-E-I-F,

yeah.

The new Apple's new codec, which makes them much, much smaller.

Yes, it's two in one.

That's a good way to think of it, because it's one physical HEIF file.

but that he file contains two sets of pixels, your edited version and the reference image.

Okay.

That's obviously an altered photo from what's in the reference image.

Are those two images in Apple's reference image, are those two images connected in any way? Is there a path proven somewhere that says, yes, I brought up the greens and purples? But it's really this image?

Effectively, yes, if you share the HEIF file out of the Photos app.

So the Photos app's HEIF file contains your very pretty final version and the reference image, which can't be edited.

Imagine someone uploading a photo to your WordPress site.

If it came off an iPhone, it may be a HEIC or H-E-I-C file, and on many servers, WordPress passes that file through imagick and ImageMagick to a system library called libheif.

Our research team found a critical flaw in that library using Wordfence Argus, our own adversarial testing tool.

A specially crafted HEIC file can make it write attacker-chosen data into adjacent memory.

On a vulnerable server, that means reading sensitive files or executing arbitrary code.

Libheif's own maintainer scored it nine point eight out of ten on the CVSS scale.

So yeah, it's, it's been a, a- A real step up for me.

So I don't mind shooting in HEIF-

Mm-hmm

... uh, the file format that is baking the look in because it doesn't, you know, you can still adjust pretty, um, with, with a lot of control.

I use active storage, and I use it for avatars.

So yes, libvips is cool and all, but I only need to support JPEGs, PNGs, HEIF, whatever, like a handful of image formats, the common ones.

And supporting everything is really actually a security problem.

It's a whole bunch of bloat too, 'cause you install libvips, and it's got like 100-plus dependencies of Linux packages.