Re: EXIF support in PNG - MAJOR security issue

On Sun, Jan 15, 2017 at 3:45 PM, John Bowler <
[email protected]> wrote:

>
> When Glenn original suggested adding a specific comment about one very
> very specific security issue raised by EXIF in PNG (not by the proposal) I
> argued against that comment because it is misleading; I think your message
> proves my point.
>
> And I agree with John's assessment here.  I took it out of the eXIf
proposal.  But now I
think we need to make a more general statement to be added to the Security
Considerations
clause of the main PNG spec, which currently doesn't address privacy issues
at all.


>
> ISO-PNG is not a final format in these cases; it is an intermediate format
> in an image editing pipeline.
>

There's no big new privacy concern for PNG.  This issue has existed for
quite a long time
in the JPEG format and what's embedded in the files by cameras.  The only
new thing
here is that we are formalizing how to preserve that information when the
image is
converted to PNG format.

Glenn

------------------------------------------------------------------------------
Developer Access Program for Intel Xeon Phi Processors
Access to Intel Xeon Phi processor-based developer platforms.
With one year of Intel Parallel Studio XE.
Training and support from Colfax.
Order your platform today. http://sdm.link/xeonphi

_______________________________________________
png-mng-misc mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/png-mng-misc