7 ms·

For all the furore, I think the best outcome happened here. Both browsers used their weight to get a memory-safe implementation out, and now we can all benefit

For all the furore, I think the best outcome happened here. Both browsers used their weight to get a memory-safe implementation out, and now we can all benefit from a new file format with a significantly reduced attack surface.

culi 23d ago
Agreed. It's been hard to watch how much vitriol was pointed at Mozilla for their reasonable position. The C++ decoder was simply unsafe and they would not implement it until a memory-safe decoder was available. Imagine if the fanatics got what they wanted immediately and then major vulnerabilities were introduced and there was a huge backlash against JXL. It could have set things back way more
- eviks 22d ago
  > and then major vulnerabilities were introduced and there was a huge backlash against JXL. Has that ever stopped any of the previous unsafe stuff? Seems like this would be the same - we'd just see faster adoption of the better format without browser limits
  - Macha 22d ago
    Arguably killed WebSQL and Java applets, for some past examples. Currently it's why WebUSB is not getting picked up by Safari/Firefox.
    - Dylan16807 22d ago
      Java applets were massively harder to secure than an image decoder and died in a very different era. I don't remember security being an issue with WebSQL. The big complaint was about getting locked too tightly to SQLite's implementation details. I see the security issues with WebUSB as not wanting to step into a minefield, which is pretty different from adding one more C++ library.
  - account42 21d ago
    Notably, it did not stop webp and avif.
zamadatix 23d ago
Agreed. Much thanks to Mozilla for taking the wildly unpopular decision to shoot the early proposal down as well instead of supporting it just because it'd make people more mad at Chrome.
- bholley 23d ago
  Thanks all. I'm really happy with how it all turned out.
  - culi 23d ago
    (^CTO for Firefox at Mozilla)
- account42 21d ago
  Pursuing a different implementation didn't require rejecting the initial proposal, especially after already having an implementation. They didn't even agree to re-add support with a Rust implementation much later. This is a post hoc justification for Mozilla blindly following Google at the time.

culi 23d ago

Agreed. It's been hard to watch how much vitriol was pointed at Mozilla for their reasonable position. The C++ decoder was simply unsafe and they would not implement it until a memory-safe decoder was available. Imagine if the fanatics got what they wanted immediately and then major vulnerabilities were introduced and there was a huge backlash against JXL. It could have set things back way more

eviks 22d ago
> and then major vulnerabilities were introduced and there was a huge backlash against JXL. Has that ever stopped any of the previous unsafe stuff? Seems like this would be the same - we'd just see faster adoption of the better format without browser limits
- Macha 22d ago
  Arguably killed WebSQL and Java applets, for some past examples. Currently it's why WebUSB is not getting picked up by Safari/Firefox.
  - Dylan16807 22d ago
    Java applets were massively harder to secure than an image decoder and died in a very different era. I don't remember security being an issue with WebSQL. The big complaint was about getting locked too tightly to SQLite's implementation details. I see the security issues with WebUSB as not wanting to step into a minefield, which is pretty different from adding one more C++ library.
- account42 21d ago
  Notably, it did not stop webp and avif.

zamadatix 23d ago

Agreed. Much thanks to Mozilla for taking the wildly unpopular decision to shoot the early proposal down as well instead of supporting it just because it'd make people more mad at Chrome.

bholley 23d ago
Thanks all. I'm really happy with how it all turned out.
- culi 23d ago
  (^CTO for Firefox at Mozilla)
account42 21d ago
Pursuing a different implementation didn't require rejecting the initial proposal, especially after already having an implementation. They didn't even agree to re-add support with a Rust implementation much later. This is a post hoc justification for Mozilla blindly following Google at the time.