Hacker News Reader

Comment by Wingman4l7 | Hacker News Reader

Why the hell is this exploit being fully provided for use via a handy-dandy web interface? An image /cleanup/ tool is one thing... this is very irresponsible.

View on HN

I wonder if hiding the tool would help. Anyone interested could simply archive and hoard potentially interesting images until such tool emerges later. So in reality, it would change nothing, only slightly delay the images being extracted.

The only thing I can think of that would have made a real difference is to send a tool to fix the images to all image hosting platforms in advance. But which ones do you trust?

I think making this tool readily available right now is doing to result in a lot of people being doxxed who otherwise wouldn’t be.

Some people would just lose interest if there isn’t an easy tool immediately available, and also it would give potential victims or image hosts more time to fix or delete vulnerable pics.

Making such tool is trivial. Someone would have done it already, all you need is to point people's attention at the issue.

Just because making something that enables novice-computer-user bad actors is trivial, does not somehow justify it being ethical to do so.

What if we just... thought twice about making it this easy?

Since bad actors were likely going to provide such tool really soon anyway, providing it along with the announcement for potential victims to check their files wasn't probably a bad idea.

That was my first thought when I clicked on the website link in the Twitter thread -- expecting a disclosure/high-level info page in the fashion of the last decade of big-deal exploits with cute names -- and found only a tool the tweet author (not OP, but apparently working with him?) built that runs in-browser, requires no knowledge/setup, and appears to enable recovery of cropped-out image data at scale by even non-technical users. Jeez.

Edit: I find myself wryly weighing this against the ongoing unleashing of LLMs upon the world. Both have shades of clever people prioritizing being and demonstrating clever at the cost of... other stuff. On the bright side, it is distracting me from facepalming at the underlying Pixel bug.

The bug is so simplistic (yet also damaging) that you can't really do it high info. Google Markup doesn't truncate the file properly before writing new data to it (due to a mixture of bad coding and a bad Android API change in Android 10).

All the tool seems to do is just read out whatever comes after the end of the PNG and then supply the missing data to construct an image that can be rendered.

If you send me some extra information than you intend, nothing stops me from just looking at it.

Of course not -- but you still have to put in the effort to "just look at it". They set the bar on that effort extremely low, taking an exploit that required expertise to deploy, and put it in the hands of anyone who could operate a web form.

Google is irresponsible (current, not past tense, is and was always).

Everything after that is fair game.

Reply on news.ycombinator.com