Why Apple still lets malformed media files reach decoders

Why Apple still lets malformed media files reach decoders – and how to stop it

2 jamweba 1 5/5/2025, 12:07:17 PM

Proposed: a memory-safe, pre-decoder validator layer for media inputs (MP4, MOV, etc) that Apple could deploy without changing existing decoders.

Eliminates a class of zero-click exploits. No format breakage. No patching.

https://jam2we5b3a.medium.com/this-is-the-future-apple-should-already-be-shipping-054c69d78e50

Comments (1)

jamweba · 8h ago

Most media decoders still process unvalidated files — which keeps zero-click attack surfaces wide open.

This write-up outlines a minimal architectural fix: a structural validator that intercepts files before decoding begins.

    It needs no decoder rewrites

    It's format-agnostic (MP4, MOV, PNG, etc.)

    It works with existing delivery paths (AirDrop, Mail, Safari)

    And it could be deployed today

Curious what others think: Why hasn’t this already been adopted? Would Apple (or anyone) ship it?

Redis is open source again (antirez.com)

Widespread power outage in Spain and Portugal (bbc.com)

Someone at YouTube needs glasses (jayd.ml)

I'd rather read the prompt (claytonwramsey.com)

Apple violated antitrust ruling, judge finds (wsj.com)

I use zip bombs to protect my server (idiallo.com)

Judge rules Apple executive lied under oath, makes criminal contempt referral (thebignewsletter.com)

Watching o3 guess a photo's location is surreal, dystopian and entertaining (simonwillison.net)

Show HN: I built a hardware processor that runs Python (runpyxl.com)

Internet in a Box (internet-in-a-box.org)

Qwen3: Think deeper, act faster (qwenlm.github.io)

LibreLingo – FOSS Alternative to Duolingo (librelingo.app)

Firefox tab groups are here (blog.mozilla.org)

Office is too slow, so Microsoft is making it load at Windows startup (pcworld.com)

An end to all this prostate trouble? (yarchive.net)

Finland Bans Smartphones in Schools (yle.fi)

Design for 3D-Printing (blog.rahix.de)

Show HN: Free, in-browser PDF editor (breezepdf.com)

ICE Deports 3 U.S. Citizen Children Held Incommunicado Prior to the Deportation (aclu.org)

Migrating away from Rust (deadmoney.gg)

Claude Integrations (anthropic.com)

Port of Los Angeles says shipping volume will plummet 35% next week (cnbc.com)

I created Perfect Wiki and reached $250k in annual revenue without investors (habr.com)

Try Switching to Kagi (daringfireball.net)

Only Teslas exempt from new auto tariffs thanks to 85% domestic content rule (fuelarc.com)

All four major web browsers are about to lose 80% of their funding (danfabulich.medium.com)

Starting July 1, academic publishers can't paywall NIH-funded research (nih.gov)

Accountability Sinks (250bpm.substack.com)

Jepsen: Amazon RDS for PostgreSQL 17.4 (jepsen.io)

Show HN: My self-written hobby OS is finally running on my vintage IBM ThinkPad (github.com)

How to live an intellectually rich life (utsavmamoria.substack.com)

Sycophancy in GPT-4o (openai.com)

Chain of Recursive Thoughts: Make AI think harder by making it argue with itself (github.com)

The Friendship Recession: The lost art of connecting (happiness.hks.harvard.edu)

Retailers will soon have only about 7 weeks of full inventories left (fortune.com)

Cloth (cloudofoz.com)

Why did Windows 7 log on slower for months if you had a solid color background? (devblogs.microsoft.com)

A faster way to copy SQLite databases between computers (alexwlchan.net)

How a single line of code could brick your iPhone (rambo.codes)

We fell out of love with Next.js and back in love with Ruby on Rails (hardcover.app)

Show HN: I built a synthesizer based on 3D physics (anukari.com)

Xiaomi MiMo Reasoning Model (github.com)

DuckDB is probably the most important geospatial software of the last decade (dbreunig.com)

Why Archers Didn't Volley Fire (acoup.blog)

108B Pixel Scan of Johannes Vermeer's Girl with a Pearl Earring (hirox-europe.com)

How the US defense secretary circumvents official DoD communications equipment (electrospaces.net)

Show HN: I made a web-based, free alternative to Screen Studio (screenrecorder.me)

The Death of Daydreaming (afterbabel.com)

Apple App Store guidelines remove ban on encouraging external payments in US (developer.apple.com)

You Wouldn't Download a Hacker News (jasonthorsness.com)

Why Apple still lets malformed media files reach decoders – and how to stop it

Comments (1)