Dependencies among SignalApp and where the ICC profiles are created from which includes the Google copyright.

Notices where this attachment appears

1. Embed this notice
   Alexandre Dulaunoy (adulau@infosec.exchange)'s status on Friday, 27-Oct-2023 18:17:10 JST Alexandre Dulaunoy

   Digging a little bit in the some ICC profiles added in signal-app, I updated the original issue and there is clearly an issue where new ICC profiles are created from the Google skia library.

   https://github.com/signalapp/Signal-Desktop/issues/6031#issuecomment-1702432836

   This issue only appears when the media-quality is to high. Maybe an allow-list strategy like the mat2 tool written by @jvoisin would be better to be sure that new metadata created are discarded by default.

   @signalapp

   #privacy #signal #signalapp #metadata