Pixar’s USD format allows representation of dynamic 3D scenes. It lets designers create large numbers of objects that fit together into a scene. People on a team can work independently of each other, each designing certain parts. The project is on GitHub.
USD’s design solves the problem of not having to work with one monolithic file (as Pixar did for Toy Story), but sometimes a monolithic file is useful. At WWDC 2018, Apple and Pixar announced a new wrapper for USD, called USDZ. It’s a Zip archive with some special rules. iOS 12 will support it.
Sometimes my reaction to a story is “Wait, are they saying someone was that dumb? … No one could be that dumb! … Oh, gods, they were that dumb!” Naked Security’s account of the Zip Slip vulnerability is just such a story.
The article starts with a fair warning that the vulnerability is “so simple you’ll need to put a cushion on your desk before you read any further (in case of involuntary headdesk injury).” It explains that because of the coding mistake called “Zip Slip,” “attackers can create Zip archives that use path traversal to overwrite important files on affected systems, either destroying them or replacing them with malicious alternatives.” This is where I started to suspect.
The vulnerability isn’t in the Zip format as such, but in bad coding found in some of the zillion ad hoc pieces of software written to unpack Zip files. Have you figured it out yet? I’ll put the cut here to give you a chance to think…
Everybody recognizes that Adobe Flash is on the way out. It takes effort to convert existing websites, though, and some sites aren’t maintained, so it won’t disappear from the Web in the next few decades.
When it’s minor or abandoned sites, it doesn’t matter so much, but even the Library of Congress has the issue. Its National Jukebox currently requires a browser with Flash enabled to be useful. Turning on Flash for reliable sites such as the Library of Congress should be safe, at least as long as those sites don’t include third-party ads from dubious sources. Not everyone has that option, though. If you’re using iOS, you’re stuck.
I came across the National Jukebox while doing research for my book project Yesterday’s Songs Transformed, and it’s frustrating that I can’t currently use it without taking steps which I’d rather avoid. The good news is that this is a temporary situation and work is already underway to eliminate the Flash dependency. David Sager of the National Jukebox Team replied to my email inquiry:
When people who don’t understand file formats manipulate files in order to cover their tracks, they generally fail miserably. Slate magazine gives an entertaining case in point from the Trump scandals. The article says:
There are two types of people in this world: those who know how to convert PDFs into Word documents and those who are indicted for money laundering. Former Trump campaign chairman Paul Manafort is the second kind of person.
The PDF Association chimes in with additional technical details.
The Libtiff source code repository is now on Gitlab. The old CVS repository on maptools.org will be maintained for historical purposes but won’t get any updates. One reason for choosing Gitlab rather than Github is that there’s already a libtiff … Continue reading
Today is International Digital Preservation Day.
In honor of the day, I’m offering Files that Last: Digital Preservation for Everygeek on Smashwords at its lowest price ever. Today only, you can get it for $0.99 with the coupon code
AM26N. This is a one-day sale, so get it now if you don’t already have it!
There are new releases of VeraPDF and JHOVE today.
Libtiff 4.0.9 has been released. According to the email announcing it:
A great many security improvements have been implemented by Even Rouault.
Much thanks to OSS Fuzz, team OWL337, Roger Leigh, and of course Even Rouault.
Obligatory reminder: Don’t download from libtiff dot org. It’s many years out of date.
An Open Preservation Foundation webinar, “Putting JHOVE to the acid test: A PDF test-set for well-formedness validation in JHOVE,” will be held on November 21, 10 AM GMT (that’s 11 AM in Central Europe and a ludicrous 5 AM or earlier in the US).
At this year’s WWDC, Apple introduced a new format for still images and video. The container is called High Efficiency Image Format (HEIF), and it uses a codec called High Efficiency Video Coding (HEVC). HEIF files can store still images, video, or both at once. Apple doesn’t have proper documentation on its site, as far as I can see, but a slideshow on HEIF and one on HEVC provide a lot of information. Kelly Thompson provides a technical overview.
Posted in News
Tagged Apple, images, video
The ISO specification for PDF 2.0 is now out. It’s known as ISO 32000-2. As usual for ISO, it costs an insane 198 Swiss francs, which is roughly the same amount in dollars. In the past, Adobe has made PDF specifications available for free on its own site, but I can’t find it on adobe.com. Its PDF reference page still covers only PDF 1.7.
ISO has to pay its bills somehow, but it’s not good if the standard is priced so high that only specialists can afford it. I don’t intend to spend $200 to be able to update JHOVE without pay. With some digging, I’ve found it in an incomplete, eyes-only format. All I can view is the table of contents. There are links to all sections, but they don’t work. I’m not sure whether it’s broken on my browser or by intention. In any case, it’s a big step backward as an open standard. I hope Adobe will eventually put the spec on its website.