Why Apple still lets malformed media files reach decoders

Why Apple still lets malformed media files reach decoders – and how to stop it

2 jamweba 1 5/5/2025, 12:07:17 PM

Proposed: a memory-safe, pre-decoder validator layer for media inputs (MP4, MOV, etc) that Apple could deploy without changing existing decoders.

Eliminates a class of zero-click exploits. No format breakage. No patching.

https://jam2we5b3a.medium.com/this-is-the-future-apple-should-already-be-shipping-054c69d78e50

Comments (1)

jamweba · 5h ago

Most media decoders still process unvalidated files — which keeps zero-click attack surfaces wide open.

This write-up outlines a minimal architectural fix: a structural validator that intercepts files before decoding begins.

    It needs no decoder rewrites

    It's format-agnostic (MP4, MOV, PNG, etc.)

    It works with existing delivery paths (AirDrop, Mail, Safari)

    And it could be deployed today

Curious what others think: Why hasn’t this already been adopted? Would Apple (or anyone) ship it?

Show HN: Remixable MCP Server with ChatBotKit (chatbotkit.com)

Yelp Is a Full Featured, Unhinged Boomer Social Media Platform (2024) (poorlyideated.com)

Vibe coding some throwaway image manipulation scripts (github.com)

New Religious Liberty Commission. Progress or Prophecy? (amazingfacts.org)

Show HN: AI Language Tutor (only Spanish now) (enkitalki.com)

Viug: AI-Powered Video Generation Platform (Next.js, AWS, Stripe) (viug.ai)

Show HN: My progress in training dogs to vibe code B2B SaaS apps (dogomation.com)

Transparent Metal (en.wikipedia.org)

China Just Made the Fastest Transistor and It Is Not Made of Silicon (zmescience.com)

Respect the CSV (github.com)

Scaling our fleet through U.S. manufacturing (waymo.com)

How to Build High-Speed Rail on the Northeast Corridor (transitcosts.com)

A Tor/Proxychains indicator for your terminal (github.com)

Show HN: Redactifi: Browser extension that redacts sensitive info from AI prompt (redactifi.com)

Heart Disease Deaths Worldwide Linked to Chemical Widely Used in Plastics (nyulangone.org)

The Code Element (heydonworks.com)

Show HN: AutoSREAgent, a simple SRE Agent to go over your log files (github.com)

Jujutsu Docs (jj-vcs.github.io)

The Creative Power of Constraints (arun.is)

As an experienced LLM user, I don't use generative LLMs often (minimaxir.com)

Show HN: Filmle – Wordle for Films/TV Shows (filmle.site)

The Em Dash Conspiracy: More and More of Reddit Is from LLMs (github.com)

Fx: A (micro)blogging server that you can self-host (github.com)

Starlink Terms of Service (starlink.com)

Goodbye, Skype (blog.kaplich.me)

Trump set to raise millions from crypto and meme coin this month (cnbc.com)

Smaller, faster serialization for Ruby apps and beyond (oldmoe.blog)

Lessons from Agentforce Customer Conversations (salesforce.com)

Israel security cabinet approves plan to 'capture' Gaza, official says (bbc.com)

Accessing subsystem logging configurations used by macOS unified logging (derflounder.wordpress.com)

Ask HN: Looking for prior HN post about author similarity

If Your Commute Is a Nightmare, Blame Congress (bloomberg.com)

Social media use in adolescents with and without mental health conditions (nature.com)

Zero to One: Learning Agentic Patterns (philschmid.de)

AI Agents Are Here. So Are the Threats (unit42.paloaltonetworks.com)

"Social media" has always been oxymoronic (robhorning.substack.com)

M&S pauses recruitment amid ongoing cyber attack (news.sky.com)

Guide to Lower Mainland Arcades (1996) (mikesarcade.com)

China Plans to Bring Back Samples of Venusian Clouds (spectrum.ieee.org)

China's insider trading crackdown is backfiring. Experts explain why (phys.org)

Claude and I write a utility program (blog.plover.com)

Show HN: TextQuery – Query CSV, JSON, XLSX Files with SQL (textquery.app)

Datasets Are All You Need (LLM Learns to Prompt from Data) (github.com)

Google Plans to Roll Out Its A.I. Chatbot to Children Under 13 (nytimes.com)

Distributed server for social and realtime games and apps (github.com)

Flattening Rust's Learning Curve (corrode.dev)

An Introduction to Futarchy (2014) (blog.ethereum.org)

Open Letter Against ProtectEU (tuta.com)

Converting a folder of ZIPs into Git history (op-co.de)

We're having sex inside Moby Dick! The wild architecture of Japan's love hotels (theguardian.com)

Why Apple still lets malformed media files reach decoders – and how to stop it

Comments (1)