Signal-Desktop
libwebp
Signal-Desktop | libwebp | |
---|---|---|
322 | 13 | |
14,040 | 1,913 | |
0.4% | 0.9% | |
9.9 | 8.8 | |
6 days ago | 7 days ago | |
TypeScript | C | |
GNU Affero General Public License v3.0 | BSD 3-clause "New" or "Revised" License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Signal-Desktop
-
Privacy is Priceless, but Signal is Expensive
2: https://github.com/signalapp/Signal-Desktop/issues/1862
-
Interview on Signal app?
For more Information on how to proceed kindly connect with the HR on Signal app. Download (Signal ) on your mobile device https://signal.org/download/ and connect now with the HR ON +13093936282
-
CVE-2023-4863: Heap buffer overflow in WebP (Chrome)
It does, see [0]. Fun fact: Signal desktop, which uses Electron under the hood, is running without sandbox on Linux [1][2].
[0] https://github.com/electron/electron/pull/39824
[1] https://github.com/signalapp/Signal-Desktop/issues/5195
[2] https://github.com/signalapp/Signal-Desktop/pull/4381
- No longer showing link previews?
-
super choppy video streams
There was a issue opened on GitHub a while back apparently but that was closed due to inactivity. What you might want to do is either open a new issue directly in GitHub (provide as much information as possible and include debug logs) or just send them a support ticket via the support form (and include debug logs).
- Signal Desktop for Windows takes 30+ min to send messages. Phone app still works.
-
Signal Android BETA has text formatting now
Desktop will have it https://github.com/signalapp/Signal-Desktop/commit/9bfbee464bc307a9133ccf43042987343722afe9
-
Signal Desktop messaging app having trouble with IPv6
Issues have been ongoing for the past couple weeks. It's not clear if this is the client or backend. Dual stack works again with v6.20.2, but IPv6-only with NAT64 still doesn't. Actively being worked on, and hopefully some good learnings. Issue link thread: https://github.com/signalapp/Signal-Desktop/issues/6439
-
IPv6 connectivity again with 6.20.1 Update
Alive again with 6.20.2 on Windows dual stack. Directly downloaded from https://signal.org/download/
-
Desktop Client takes minutes to send messages
Fix1, Fix2, Fix3, Fix4
libwebp
-
Google assigns a CVE for libwebp and gives it a 10.0 score
The thing that concerns me most is looking at the fix it is very difficult to see why this fix is correct. It also appears as there is lots of code without explicit bounds checks. It makes me worried because while the logic may be safe this makes the logic very complex. I wonder what the cost would be to add an explicit, local bounds check at every array access. This would serve as a backup that is much easier to verify. I suspect the cost would be relatively small. Small enough that I personally would be happy to pay it.
https://github.com/webmproject/libwebp/commit/902bc919033134...
This is also a great reminded that fuzzing isn't a solution to memory unsafe languages and libraries. If anything the massive amount of bugs found via fuzzing should scare us as it is likely only scratching the surface of the vulnerabilities that still lie in the code, a couple too many branches away from being likely to be found by fuzzing.
-
The WebP 0day
There's a follow-up fix, according to Debian[0]: https://github.com/webmproject/libwebp/commit/95ea5226c87044...
[0]: https://security-tracker.debian.org/tracker/CVE-2023-4863
-
CVE-2023-4863: Heap buffer overflow in WebP (Chrome)
The breakage [0] was introduced by the creator [1] of the project. If you want to audit 1674 commits over the past 12 years, it'd be easier to just audit the full project.
[0] https://github.com/webmproject/libwebp/commit/21735e06f7c1cb...
[1] https://github.com/webmproject/libwebp/commit/c3f41cb47e5f32...
- Convenient CPU feature detection and dispatch in the Magnum Engine
-
Whats going on with .webp and why are more and more internet images being converted to it?
If you like the command line, then you can use ffmpeg and ImageMagick, or use libwebp directly
-
What's up with people hating WebP?
The webp parser code is open source. Which means that even if Google decides to hide/obscure the code for webp, they'd legally not be allowed to prevent you from using older versions of the webp parser library. The only thing they could do is patent it, and then companies in the US (which has software patents, unfortunately) would have to pay royalties to decode it anyway; but here comes the next point
What are some alternatives?
signal-cli - signal-cli provides an unofficial commandline, JSON-RPC and dbus interface for the Signal messenger.
libjpeg-turbo - Main libjpeg-turbo repository
axolotl - A Signal compatible cross plattform client written in Go, Rust and Vuejs
Save-webP-as-extension - Firefox extension to overlay format and JPEG quality buttons on inline or stand-alone images for quickly saving a converted version of the image.
session-desktop - Session Desktop - Onion routing based messenger
BrowserBoxPro - :cyclone: BrowserBox is Web application virtualization via zero trust remote browser isolation and secure document gateway technology. Embed secure unrestricted webviews on any device in a regular webpage. Multiplayer embeddable browsers, open source! [Moved to: https://github.com/BrowserBox/BrowserBox]
AppImageLauncher - Helper application for Linux distributions serving as a kind of "entry point" for running and integrating AppImages
image - [mirror] Go supplementary image libraries
webclient - Angular webclient (with Linux, macOS and Windows desktop clients) for CTemplar's encrypted email service.
libavif - libavif - Library for encoding and decoding .avif files
telegram-bot-api - Telegram Bot API server
Electron - :electron: Build cross-platform desktop apps with JavaScript, HTML, and CSS