Reading the patch[0] for libheif the bug which lead to the vuln was around bounds checking for image overlays. the container can have multiple images and you can compose them in the output.
heif also supports rotating, cropping, alpha channels, thumbnails and a ton of other features that a web forum where a user is uploading photos or screenshots doesn't need.
It's a much, much larger attack surface than plain old school JPEG.
I'd suggest rather than wait for the next bug to appear in this or another image lib to keeping things simple - stick to plain JPEG and handle image conversion in the client (wasm in the browser) if you really need to support users uploading iphone images.
Media decoding is so hard - there have been tons of bugs in ffmpeg and imagemagick and the core libs. You really need to think about how much of it you expose via a web server
I agree, but imagemagick is kind of the worst of the bunch, graphicsmagick is a lot better and libvips significantly so.
Ffmpeg primarily suffers a lot from “we need to support the video format used on a washing machine display used in 1981 and only sold ten units”. It’s quite a large vector for attacks.
ffmpeg also prioritizes high performance assembly code over higher level languages. Some ffmpeg members have also waste knowledge about optimizing for specific micro-architectures, on a level of Intel or AMD engineers.
and thank god for that. it would be a pity for the world to succumb to the abstraction hell.
to make my point clear, complexity is the enemy of security but complexity comes in all shapes and sizes, which includes the alleged solutions to it. I don't trust shortcuts.
But if you don't support HEIF you get the Apple crowd breathing down your neck. The fact they made it basically default when sooo many things don't support receiving it is bonkers, but they'll bludgeon it through.
b) they proxied the target through a CTF host to fool the model and guardrails
> We then placed Claude in an autonomous /goal loop against our own Discourse Cloud instance, proxied through rce.ee/ctf-forum to make it look like a CTF target as Opus refused write exploit for remote instances.
the proxy is smart - there are other methods to bypass the guardrails to have it attack remote hosts.
you just have to prove to the model that you control the host or that its a valid target - and there are plenty of ways to fake that.
they also publish great tech reports. their founder is so confident in their model that he's regularly on social media offering bounties for false positives
a) you don't want the WPEngine case going to trial and that is coming to a decision point soon. chances are the new CEO and board settle.
b) wordpress is being absolutely obliterated by ai. work for commercial plugin authors and agencies has dried up while the platform and ecosystem see major security issues and worms exploit a large number of sites every week.
wordpress and automattic haven't responded to this well, at all. at times it is often straight denial.
founder CEO distracted by expensive lawsuit while facing existential threat to project that will require complete attention and a lot of skill to steer out of
Glancing at the docket [1] in an attempt to answer this myself... looks like the trial is scheduled for a bit over a year from now [2].. A ton of fighting over discovery... a motion asking for fairly monster sanctions for spoilation of evidence [3] (to be argued on the 30th). Claiming in [3] with what appear to be pretty solid receipts (as far as we can see through the redactions anyways) that Matt was willfully destroying communications related to the case and subject to the discovery - and Automattic's lawyers lied to the court that they preserved them (naturally Automattic's lawyers have a reply with an entirely different interpretation of events if you go look for it... but at least at a glance WPEngine seems more convincing).
Indeed. I'm very grateful for Woocommerce, but since I use a tiny subset of its features, I'm "vibe coding" my own alternative with way less surface area and less bloat.
On average, generally, do you dig into settings (or maybe if something works, good enough usually)?
(I’m always on the hunt for “please don’t just friggin sell my data to everyone, if you’re scared enough over getting sued that you’ll listen to the toggle” and “disable sponsored this-and-that”. Plus power user stuff.)
I used to, very much. I've slowly come around over the last ten years or so to just using everything in its default config. I guess I don't want to spend the time I have left fiddling with settings.
Honestly I rarely change it in either of them unless I’m using the cli or cowork to do something. That’s where smarter work means less iterative un-fucking, later.
Any quick questions or rubber ducking in a regular “chat”… the model just doesn’t really matter anymore.
They’re all smarter than I need for that stuff (and whatever unfortunate thing that says about me).
It's also very representative of the HN comment section vibes overall.
But such is normal with normies providing startup critiques, if you just look at every announcement and say "this will fail", you'd be right 99% of the time.
I mean, the AI skepticism is still so prevalent today in HN, despite it solving decades old math problems, hacking into companies, making software engineer no longer code, etc. (all this just in the last year).
So nothing really has changed in this community's vibes.
If you think HN is anti-AI, you are in deep. There isn't many places on the internet (sans X/Twit which i don't check) that is as AI-positive as HN. Sure, holdouts remain but the frontpage has a 60% constant vibecoded project submission.
You are mixing supporting AI (which HN is mostly against, but more supportive than other places), and thinking AI is dumb, which HN has been pretty persistent on for years.
I love OpenRouter, long time user. Stripe will hopefully be a good custodian.
I just want to point out some features of OpenRouter that make it more than just a model selection and routing endpoint and that I find incredibly useful:
0/ Default routing is to the cheapest provider, but they're usually not the most performant. I'd guess 99% of OpenRouter integrations never tweak the default routing. Here you can setup cheapest with performance minimums:
1/ Using broadcast you can push all your analytics to clickhouse / s3 / snowflake and a bunch of other compatible destinations. Setup a clickhouse server ($5 VPS[0]) and send all your traces to it:
there is also PII detection. This will show up in observability as rejections/blocks etc.
There are so many model routing solutions (same with observability, security etc.) but they're all 80% solutions - OpenRouter really rounds out with well implemented features that you need when deploying models at any scale and I gladly pay the toll.
[0] not sure if these exist any more but clickhouse is resource efficient
> Model router is also a natural home for llm security - OpenRouter has the beginnings of prompt injection detection
Maybe I'm biased from the perspective of a "harness provider", but I think Model routers often have too little context to act as well-informed prompt injection prevention. e.g. it lacks context of where which part of the message(s) originates from and sanitization/safeguards were already performed on the application layer.
Something like OpenRouter's "flag" mode is fine, but usage of auto-redact or auto-block should really only be used if there is significant risk exposure through your harness or otherwise they are a constant source of bugs.
They might be popular for indie developers, but nobody doing serious AI or in a corporate environment is using them.
And if they are, their compliance team is about to strike them down. The VCs forcing this acquisition do know this.
- Why would you add a penalty of 50 ms at a minimum? And that is not the p95...
Just run LiteLLM in house and you dont even really need that.
- Their capacity pools are shared across the whole user base, a massive batch processing by another of their customers and think what that means for your response time...
- So instead of negotiating corporate rates with OpenAI or Anthropic, you would be using an intermediary and topping up the corporate credit card... for a 5% markdown ? Really?
- They can see all your critical corporate data on the in and out
- They present some pink SOC 2 promises but then wash their hands and defer to
you and the providers. Its just the Bolt and Uber model the drivers are not
our employees....
- They are a man in the middle proxy that is a massive security liability
for your corporation
- They have no support for private cloud points
- No geofencing guarantees
- No intellectual property legal indemnification unlike what AWS or Microsoft or Google offers
- Its a provider roulette inconsistent with hosts providing different quantization levels causing random shifts in response quality
- Support via a Discord server...
The only reason they were not shutdown yet by Anthropic or OpenAI is because they have the same VCs, as those two. That would mean said VCs investment would go to zero. Oh and those are the same VCs that own Stripe...
Just setup a private proxy tier using something like LiteLLM, even if you really dont need it. Just code your enterprise apps to have have fallback loops on the core hyperscaler providers like AWS Bedrock or Azure Foundry...
> Why would you add a penalty of 50 ms at a minimum?
All of the customer service bots I've dealt with recently were reasoning models that thought for multiple seconds. I would not have noticed 50ms extra.
It’s not just solo developers. Startup teams with limited time that are focusing their energy on finding the right product to build also use openrouter.
I think the bet is that you offer enough value-adds that companies who find traction don’t want to switch to something enterprise grade, and you grow into being enterprise grade with them.
Very similar to Stripe’s trajectory, incidentally.
The other thing OpenRouter gets you is: Access to loads of models via a common API/sign-up/prepayment mechanism.
I want to know which vendor/model does best at my extracting-facts-from-text task? Which does best at my OCR-a-text-document task? Which can deal with a safe-for-work beach photo without a censorship system false alarm?
OpenRouter lets me run my tests against openai and anthropic and google and x and bytedance and qwen and llama, with a single sign-up and a single payment.
Nobody would trust one of the labs that have their own models with this. They’d assume they’re taking all the data, and biasing the routing to favour themselves. xAI would probably be the least trusted, but the same would apply for any of them.
reply