jcupitt.bsky.social

08 August 2026 10:44

This is obviously terrible for web services. libvips urged people to make their own libvips binary for a while, but of course no one did haha. We also tried splitting the library into modules, so packagers could have a libvips-untrusted with the unsafe loaders, but no one used that.

jcupitt.bsky.social

08 August 2026 10:43

One more factor: libvips has these exotic loaders because they are useful for scientific work with local, trusted images. Packagers like Debian and Homebrew have a policy of enabling *all* optional dependencies, even if they are dangerous with untrusted data. They don't want user compilation.