Slashdot Mirror

Seems quite complicated.

If Amazon doesn't convert the images, he could just upload a PNG file with a lot of information stored in ancillary chunks... the png specification even allows creating custom/developer chunks which should be ignored by any parser that doesn't understand them (for compatibility with future versions of the standard)

For example, just abuse the hell out of iTXt or zTXt chunks in the format : http://www.libpng.org/pub/png/...

For private chunks, see this bit : http://www.libpng.org/pub/png/...

Seems quite complicated.

If Amazon doesn't convert the images, he could just upload a PNG file with a lot of information stored in ancillary chunks... the png specification even allows creating custom/developer chunks which should be ignored by any parser that doesn't understand them (for compatibility with future versions of the standard)

For example, just abuse the hell out of iTXt or zTXt chunks in the format : http://www.libpng.org/pub/png/...

For private chunks, see this bit : http://www.libpng.org/pub/png/...

The algorithm wasn't new, but it was superior to LZW. Don't take it from me:

In the end, there were only two serious candidates for PNG’s compression engine: a particular LZ77
variant that was already in wide use and had survived at least one patent review, and a relative newcomer
known as Burrows-Wheeler block transform coding (BWT for short, covered by Peter Fenwick in Chapter
6). While there were a few concerns about BWT’s possible coverage by future patents, it did appear to be
clean (which still seems to be the case in 2001). But the main problem was that the early implementations
available at the time were quite memory-intensive and horrendously slow—roughly four to eight times the
memory and two orders of magnitude slower than the LZ77 alternative. Insofar as BWT’s compression was
no more than 30% better than the alternative (and often merely equivalent), and given its relative immaturity
at the time, it was ultimately rejected.

[...]

Thus the core of PNG’s compression scheme is a descendant of LZ77 known as deate. The specifics of
the format were defined by PKWARE for their PKZIP 1.93a archiver in October 1991, and Jean-loup Gailly
and Mark Adler wrote an open-source implementation that first appeared in Info-ZIP’s Zip and UnZip, and
subsequently in GNU gzip and the zlib library (http://www.zlib.org/). Deflate is comparable to
or faster than LZW in both encoding and decoding speed, generally compresses between 5% and 25% better
for “typical computer files” (though 100–400% better is not uncommon in truecolor images), and never
expands incompressible data by more than a fraction of a percent,3 but it has a larger memory footprint.
Deate’s compression efficiency tends to be worse than both Burrows-Wheeler and arithmetic schemes by
around 30%, but the most common implementations of both approaches also require an order of magnitude
more time and memory.

PNG is also about 14 or 15 years old, but IE still cannot handle its color correction chunks (gAMA, iCCP) properly:
http://www.libpng.org/pub/png/png-gammatest.html

Apparently Firefox 3.6 can't either, as I'm seeing the two-tone blocks under those sections as well.

Unless it's an OS rendering issue, but I don't think Firefox uses the OS for rendering PNGs.

PNG is also about 14 or 15 years old, but IE still cannot handle its color correction chunks (gAMA, iCCP) properly:
http://www.libpng.org/pub/png/png-gammatest.html

Only firefox renders that page correctly. All the other browsers fail in some way. Chrome doesn't even support color profiles at all.

IE9 's platform preview supposedly has full support for gamma, and v2 and v4 color profiles, but it has issues rendering that page. I'll report that page in their bugtracking system, so IE9 has fully accurate color rendering by release time.

PNG is also about 14 or 15 years old, but IE still cannot handle its color correction chunks (gAMA, iCCP) properly:
http://www.libpng.org/pub/png/png-gammatest.html

Pro-tip: if you need a pronunciation guide, then you desperately need to pick a better name.

Tell that to the authors of the PNG spec: "'PNG' is always spelled 'PNG' (or 'Portable Network Graphics') and always pronounced 'ping' in English." Yes, that's "ping" as in "Snooping as usual, I see".

PNG was adopted alongside GIF long before Mozilla was open sourced.

Adopted by whom? It was standardized by W3C (as a thing in and of itself) in 1996, yes, but browsers didn't start using it for HTML IMG elements right there and then. According to this, Netscape had limited support from 4.04 on, but it took Mozilla to support full alpha and gamma.

Even that isn't "adopting as a de facto standard", though - I'd only count it as happening when all mainstream browsers had full support. If I remember correctly, IE was the last to that party, with PNG full alpha support finally coming in IE7.

No, not even slightly true. The primary reason that PNG was created was to create a patent-free format. Then, since they were creating a format anyway, they decided to make other improvements. For more information, see "History of the Portable Network Graphics (PNG) Format" by Greg Roelofs, which was published by the Linux Gazette and later the Linux Journal. I know, this is Slashdot, I'm not allowed to cite sources :-).

I thought that was MNG?

Actually, IE 5.x on Mac OS X had full PNG alpha channel support, with compositing and everything. It was one of the browsers with which you could showcase pages like this one.

i used debian linux for ages and then one day i said fuck dependency hell, im getting a mac.

That seems downright retarded of you. You had a Debian bug, and rather than try one of the hundreds of other distros out there, you just go straight to a Mac? I haven't run into any problems like this on Ubuntu...

There is no technical reason why linux should have dependency hell.

True, it doesn't. It has package managers, and there is a technical reason for that.

Unlike OSX and windows where installing is either drag and drop or a double click, in linux you need to know

apt-get. Or one of the many GUI frontends, which end up being far quicker and easier than any Windows or Mac install I've ever seen.

I stopped using linux when after finally getting through the libc vs glibc mess, only to encounter the wonder that is libpng2 vs libpng3. fuck you libpng. every app used a different version and since they were two packages which had the EXACT SAME FUCKING FILES IN THE SAME FUCKING PLACE, you cant install both at the same time.

As mentioned elsewhere, these are the devel files. If you're compiling software on your own, then yes, you need to know how to deal with these. Worst case, you can head over to libpng.org and download the version needed for whatever you're compiling.

And yes, compiling custom software will require you to deal with strange stuff like how to force an app to use specific header files, even if they aren't where the app expects them.

in had to remoce libpng2 and all the apps the depend on it then install libpng3 install the app i wanted to use. When i was done I HAD TO FUCKING UNDO EVERYTHING and reinstall libpng to use my other apps.

Hmm. Could you remember which apps these were, which relied on development libraries?

More importantly, did you even try to get support before you threw your hands up and left?

Even with GUI wrappers, software installation and uninstallation in linux is a nightmare.

Not as much as software maintenance on OS X. Consider: I can do "apt-get update && apt-get dist-upgrade", or I can follow the GUI prompts when Ubuntu automatically finds updates for me. You have to spend a couple hours looking through every single app you have installed, comparing the version you have with the version online.

Its not hard to copy OSX, where a certain version of distro X is guaranteed to have certain base libraries (kde, gnome, etc) in a certain place. If you unzip gimp for example, no dependencies needed everything no in the base is in the package.

Great, thanks, now every single app will take 10 times as long to download and use 10 times as much disk space and RAM. We'd never have gotten out of the "stone ages" of an efficient OS if it wasn't for you! Thanks for thinking of something so new and non-obvious that every Linux developer has already thought of it (and rejected it) before you!

I am not making this up, by the way. VLC's Universal Binary for OS X is a solid 22.7 megs. The VLC deb file (Ubuntu, i386) is 1.1 megs, because the rest of it is in shared libraries -- most of which I'd already have.

Now, I realize a mere 21.6 megs of wasted bandwidth and disk space isn't worth crying over, but why would you waste it when you don't have to?

And anyway, what's stopping you? Roll your own distro the way you want it and see how far you get.

Don't have the time? Get someone else to. Organize. Maybe try a post to Slashdot that isn't immediately (and rightly) modded Flamebait.

Should we tell them?

All web browsing to non-secure sites is proxied. Javascript is removed. Flash is removed. Java is removed. All binary data is removed. Images are reformatted to .png format and the HTML adjusted to match. No more "Web 2.0"; those sites just stop working.

You also make indexed PNGs with variable transparency with tools such as pngquant and pngnq.

Also a half decade old program probably has worse compression then OptiPNG.

Ah, I see. And I tend to agree.

I was kind of dissapointed (though not too surprised) that MNG never took off. (see also the libmng site).

Looks like it's not TOTALLY dead, but isn't especially active, either.

SVG supposedly has a shot at replacing at least some of Macromedia flash, but that, too, remains to be seen.

They have. It's called JNG, and it's brought to you by the same people who made PNG and MNG.

From your blog: "Note: Large images are in PNG format, older versions of IE may have difficulty displaying them"

That's a bit smug, don't you think? After all, older versions of MOST browsers may have difficulty displaying PNG images, and the ones you posted don't use transparency, which is IE's main problem.

There is a list of MNG-supporting applications at
http://www.libpng.org/pub/mng/mngapps.html

Linux (Red Hat to be specific) reported AND HAD ALREADY fixed similar JPG/GIF/PNG flaws more than 2 years before microsoft ACKNOWLEDGED that they had similar flaws.

Like, oh, the libpng vulnerability fixed in August less than two years ago?

"On 4 August 2004 a new jumbo security patch was released to address several potential vulnerabilities in libpng, at least one of which is quite serious." link

And by "quite serious," they mean "remotely exploitable vulnerability, which could lead to arbitrary code execution on an affected system." link

Remind me how many *nix distros use libpng?

Sorry, I meant *good* PNG support. IE5 for the Mac displayed PNGs with alpha transparency. Without alpha transparency, you may as well be using a JPEG. So rather than being able to see NGs like everyone else, we could see them better than everyone else.
http://www.libpng.org/pub/png/pngstatus.html#brows ers

As for the support for third-party certification authorities, I never ran into that one but I can see it would be a problem for some organisations.

http://www.libpng.org/pub/png/pngapbr.html

Basically, IE4 and IE5 for Windows had various levels of bugs and flakiness (including crashes) in their PNG support.

I don't know what current market percentages are for these, but my understanding is that IE5 (at least) is still prevalent enough that major sites must plan for it. (Someone correct me if I'm wrong.)

Yeah, if only stupid Mozilla foundation wouldn't have gotten rid of native MNG format then we would have JNG (which is JPEG that supports an alpha channel) also.

Allegedly, the replacement format for JPEG is JNG, which is a subspec of MNG. MNG has a truckload of features including: animation (with sprites!), color correction, and (almost tangentially) lossy JPEG-like compression. The latter is available in a separate format called JNG too. Of course, on the one hand we need support for MNG in applications (consider for example how it was removed from Mozilla; there are high hopes for it to be reintroduced in SeaMonkey, though). And of course, there is my very personal perplexity ... by looking at the JNG spec, it looks like it's very similar to JPEG ... is it really outside of the bounds of that stupid patent? (Of course, everybody should be using JPEG2000 by now, which compresses much better with much less artefacts ... of course that's patented too ...)

Allegedly, the replacement format for JPEG is JNG, which is a subspec of MNG. MNG has a truckload of features including: animation (with sprites!), color correction, and (almost tangentially) lossy JPEG-like compression. The latter is available in a separate format called JNG too. Of course, on the one hand we need support for MNG in applications (consider for example how it was removed from Mozilla; there are high hopes for it to be reintroduced in SeaMonkey, though). And of course, there is my very personal perplexity ... by looking at the JNG spec, it looks like it's very similar to JPEG ... is it really outside of the bounds of that stupid patent? (Of course, everybody should be using JPEG2000 by now, which compresses much better with much less artefacts ... of course that's patented too ...)

Sure, because code taken straight out of linux and dumped into win32 land works just peachy. (Once you spend thousands of hours hacking away at it.)

Maybe the developers grandparent mentions were uninformed about what Linux is, remember most people think that Red Hat is Linux. I do not believe I am reaching here, but perhaps the Microsoft developers he was referring to meant open source code, not Linux.

Microsoft uses open source packages commonly found on Linux distributions. For example zlib is one, when a zlib vulnerability is discovered you will always find Microsoft's name as one of the vendors contacted.

http://ecoustics-cnet.com.com/Microsofts+borrowed+ code+may+pose+risk/2100-1001_3-860328.html

The zlib is licensed in a BSD-esque license. It's fine for Microsoft to use it legally. My question was strictly with regards to the GPL licensed software.

Microsoft using open source is not an isolated incident as shown below with a quick Google.

http://www.libpng.org/pub/png/pngapbr.html
Internet Explorer [Microsoft] (Mac PPC, Mac OS X) - version 5.0 and later; read-only; full alpha support (screenshots), though broken for tiled page- and table-background images smaller than 64x64 (switches to binary transparency for performance reasons [should be fixed in one of next two versions]; can work around bug by manually tiling image to be larger than 64 pixels in at least one dimension); full gamma support; full sRGB and ICC profile support; progressive display of interlaced images (replicating method); broken default handling on OS X for standalone PNGs (versions 5.1 and 5.2 save to disk rather than view due to QuickTime bogosity; see Matthew Rothenberg's Mac OS X Hint for simple fix); uses libpng and zlib; freeware. (Note that AOL 5.0 is apparently built on MSIE 4.5 or earlier, so it has no PNG support at all. No word on later versions.)

http://www.pcworld.com/news/article/0,aid,119666,0 0.asp
Microsoft also criticized Core Security Technologies of Boston for publishing a proof of concept for a hole in an MSN Messenger component called "libpng," which is used to display PNG (Portable Network Graphics) files

https://bugzilla.redhat.com/bugzilla/show_bug.cgi? id=159304
iDEFENSE has confirmed the existance of the vulnerability in version 5.1.2600.2180 of the Microsoft Telnet Client, the telnet client included in the Kerberos V5 Release 1.3.6 package and the client included in the SUNWtnetc package of Solaris 5.9.

Because Firefox renders PNG completely, it is prone to these sort of errors. However there is one browser that won't need a patch issued to be safe from this bug, which is Internet Explorer. While IE can render PNG a little, it hasn't implemented the full technology. By using IE, you ensure that you will be safe from any bugs that arise from new technologies, such as PNG.

Wow, that's some attempt at spin. Too bad it's completely wrong.

The fact that Microsoft doesn't support the PNG alpha channel, antialiasing, shadow masking, etc. is completely immaterial--IE still has to decompress the PNG, which means it is vulnerable to any zlib bugs.

By the way, the "new technology" known as PNG was approved by the W3C on October 1, 1996. The fact that Microsoft still doesn't properly support it does not mean it's some bleeding edge thing. Microsoft is just stuck in the stone age.

Yes, PNG is extensible.

I'd imagine this would be why IE can show images as they download, instead of waiting for the whole thing to download like other browsers...

Probably not. Many formats support interlacing (or progressively higher quality data with formats like JPEG). This basically means that the same (or similar) data is present, but in a different (predictable) order allowing useful images to be displayed without having access to the entire image file. IIRC, even early versions of Netscape supported this. I know may graphics viewers from the dialup BBS days did the same thing.

PNG has interlace support as well.

Interestingly enough, the vulnerability was due to the use of an open source PNG library:

http://www.libpng.org/pub/png/libpng.html

Note the issue mentioned with version 1.2.5.

http://libpng.org/pub/png/png.html

Portable Network Graphics (PNG) is a lossless compression format which is Freely (as in "free spech") usable by anyone for any purpose, even in commercial and/or proprietary applications.

MNG format includes JNG.
http://www.libpng.org/pub/mng/spec/jng.html

I have no idea if this spec infringes or not. It seems to allow significant variation in encoding though.

PNG supports 48-bit color and 16-bit grayscale. Also, while pure PNG doesn't support lossy compression, JNG is essentially JPEG compression in a MNG wrapper. (And yes, MNG can do still images as well, despite the name.)

PNG supports 48-bit color and 16-bit grayscale. Also, while pure PNG doesn't support lossy compression, JNG is essentially JPEG compression in a MNG wrapper. (And yes, MNG can do still images as well, despite the name.)

Yeah, it is a tad tough not to manage a project perfectly when you've got Donald "I never employed you but I can fire you" Trump breathing down your back.

Speaking of those apprecticeses (as Ellen calls them), I'd manage Audrey's projects anytime. To quote Greg Roelofs, "yowza!"

...the guys who wrote TFA at Techtree are from the JPEG. They might be jealous since PNG is Turbo-Studly(tm).

(Side note: Why doesn't Slashdot show character entities like ™ in "HTML Formatted" comments?

Perhaps one should take note that this overflow bug is not in MS code, but in the open-source LibPNG, which MS used.

And it's also included in most Linux distros.

If MS is to blame, it's for their lousy reaction speed. This vunerability has been known for months.

JPEG 2000 has one feature that might make it better in "archival" purposes - there is a lossless mode which still achieves higher compression ratios than PNG.

Yes, lossless JPEG 2000 is a reasonable option. I'm not sure any lossy video codec counts as 'archival' storage. Might as well just put published DVDs in a preservation vault. The wide release of movies of movies on DVD has done more for the preservation of movies themselves than anything else in history.

Still, for a digital archive of the film masters, until the patent issues with JPEG 2000 are resolved, I'd just put MNG and FLAC in an Ogg file.

And if you can spare the space, a directory with a wav file and a stack of uncompressed TIFF images is even better. Compression formats are complicated to reverse engineer.

SVG support.

Jpeg2000 support.

Seriously now. How the hell did they work that one in? Security flaws in Icon files.

Perhaps the same way as the widely-used and open source libpng library had a number of vulnerabilities last year? (ref 1, ref 2)

Or the same sort or way the Mozilla XBM vulnerability arose? (ref)

This isn't a new thing, and it's not unique to Microsoft, either.

PNG, being an indexed-color format, is not the end-all of graphics formats

No, it is not. It *can* do that, but PNG supports full 24-bit color, with 8 bit alpha. And possibly higher color depths if necessay (there's a byte or so in the header for bits-per-color).

And, in PNG, the G stands for Graphics; Portable Network Graphics. I know it's a stretch, but possibly Adobe meant the G in DNG to also stand for Graphics. I know it seems to have nothing to do with the file format at hand, but it's possible. I mean, they made PDF, which has nothing to do with Firearms even though the ATF's F stands for that. It's just an Adobe thing, I guess.

Viewers can support transparency control partially, or not at all.

I had forgotten that the MNG subset is even already defined in the MNG spec. This whole APNG thing looks very much like a reimplementation of MNG-VLC (Very Low Complexity):

MNG-VLC

A very-low-complexity subset of MNG that does not use stored objects, variable framing rates, location of images at positions other than (0,0), or other complex features.

Its possible, and its been done. Its called MPEG.

Anyway, this may be of interest to you.

The PNG format FAQ addresses the question of why the PNG format did not incorporate animation. They claim that support for animation would have overloaded the one format. Also, they claim that there would have been a problem of MIME types; would the type for the PNG format be video/png or image/png specifically? (The MIME type for Flash animation is application/x-shockwave-flash.) For the GIF format, it appears that the MIME type is image/gif. It could be said that it should be clear as to whether a file is for a still image or animation.

MNG includes the super duper cool JNG

JNG test-suite

Here's an example of the improved color gamut you can get by adding a few more colors. Try it out!

Before

and

After

Here's an example of the improved color gamut you can get by adding a few more colors. Try it out!

Before

and

After

Actually many of the GIFs were actually replaced with PNGs

GIFs and PNGs support transparency (something JPEGs can't do)

In any case many of had followed history and not only changed our GIFs, but also our JPEGs to PNG. PNG is a powerful open standard for image compression that is supported by our internet overlords.