https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...
That compression format should have been aggressively removed once the flaws were uncovered. It presented a real-life danger on so many fronts. Imagine engineering documents, medication orders, architectural specs, you name it. That compression algorithm easily could have killed people.
JBIG2 came out around 2000, when the compression issue went public in 2013 it was in widespread use by many Xerox scanners that could scan to PDF and could not be turned off. Of course as non American I have only heard that xerox is synonymous with copying so I might misinterpret the impact the issue had.
> b)in the few examples they did, it was quickly found to be harmful, modifying digits and letters.
If I understand it correctly the refinement encoding that was exploited in this case would have prevented the replacement issues by storing visible differences along with the glyph replacement. However Xerox did not seem to make use of this feature, resulting in the problematic changes even at the highest quality settings.
> you name it.
I think Obamas birth certificate was among the victims. Some of the artifacts conspiracy theorists found on available images of it may have been caused by the JBIG2 compression algorithm of a Xerox scanner.
That's obviously not a good rule as stated, since the best way to follow it to run "rm -rf /" everything, which will give you zero attack surface and zero legacy support.
A more reasonable formulation is: legacy support should not always be prioritized over eliminating attack surface.
So if you want to minimise bugs and attack surface surely a.out is the format to stick with.
Earlier there was make and imake. Now there is make, imake, cmake, ninja, meson etc. My impression is that modern SW does everything what it can to increase the attack surface.