Sign in

iiinova is part of the Atmosphere — an open, public network where you own your identity.

dangerzone

@dangerzone.social.freedom.press.ap.brid.gy
1.5K followers 0 following 47 posts

Take potentially dangerous PDFs, office documents, or images and convert them to safe PDFs. A @freedomofpress project. [bridged from social.freedom.press/@dangerzone on the fediverse by fed.brid.gy ]

PostsRepliesMedia
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 03/08/2026
We've just published Dangerzone 0.11.0 for Windows, which was lagging behind due to certificates issues. You can find it here: dangerzone.rocks/news/2026-07-02-0.…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
000 0
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/07/2026
Dangerzone 0.11.0 is now available on Linux and macOS (Windows release is coming soon). This release brings several stability and security improvements, such as making OCR much faster and allowing users to convert new documents without leaving the app. This and more in our post about this […]
social.freedom.press
Original post on social.freedom.press
010 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/06/2026
We implemented this by running a local container registry, copying the generated files to a local file system, and then doing things in reverse order in the CI. Pretty fun! Feel free to incorporate this method in your projects!
010 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/06/2026
This leaves an audit trail of our actions, requires two developers to make changes to GHCR, instead of one, and ultimately uses no tokens at all to authenticate.
111 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/06/2026
We send these signatures as a PR, and the reviewer checks the intent of the PR and the target of the signatures. Once the reviewer merges the PR, these signatures are pushed to GHCR via a GitHub action.
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/06/2026
Whenever we issue a new container image, we use Cosign to sign it with our hardware token and intercept the generated signatures: github.com/freedomofpress/ghcr-sign…
github.com
GitHub - freedomofpress/ghcr-signer: Utilities to publish signatures on ghcr.io when Github PAT (Personal Access Tokens) tokens are disabled
Utilities to publish signatures on ghcr.io when Github PAT (Personal Access Tokens) tokens are disabled - freedomofpress/ghcr-signer
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/06/2026
GitHub’s container registry doesn’t authorize fine-grained tokens, but requires personal access tokens — a security flaw. At FPF, we circumvent this limitation by publishing our container images with a specific PR-based workflow we call “The GHCR Signer” ⤵︎ […]
social.freedom.press
Original post on social.freedom.press
110 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 30/04/2026
These two vulnerabilities were disclosed in the final days of April. To our fellow open source colleagues: Best of luck as May approaches 🤞
000 0
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 30/04/2026
All Linux distributions since 2017 were found vulnerable to a trivial way to gain root privileges by a local unprivileged attacker: copy.fail Dangerzone runs its sandbox on Linux everywhere (on Windows and macOS, it uses a Linux VM under the […] [Original post on social.freedom.press]
A screenshot of a terminal session. This session shows a command that invokes Dangerzone's outer container (Podman), a command that invokes the inner sandbox (gVisor), and the payload of the copy.fail exploit. The exploit fails to run because gVisor does not implement the vulnerable protocol.
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 30/04/2026
iTerm2 was found susceptible to PTY confusion: blog.calif.io/p/mad-bugs-even-cat-r… Dangerzone sanitizes control characters before writing to the terminal (see the escaped � characters in the image), so our CLI users are safe.
A screenshot of an iTerm2 terminal. It shows some logs by the Dangerzone CLI, and some Unicode replacement characters (�) in place of the ANSII escape sequences of the original iTerm2 exploit.
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 30/04/2026
🧵 AI-assisted vulnerabilities are all the rage nowadays. We had a close call with two of them in the last few days. Here’s how our defenses held up:
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
Tl;dr: Dangerzone introduced a feature that allows users to auto-update the container used to do conversions. Why that matters and how we implemented it: - attesting provenance of images - making them reproducible - signing them using an auditable system […]
social.freedom.press
Original post on social.freedom.press
003 3
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
That’s about it! There are lots of other challenges involved, such as doing the above in a cross-platform way, while also supporting air-gapped installations. If you encounter a bug or want to know more, please reach out!
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
Also, Dangerzone installations regularly poll the GitHub container registry, and once they detect a new image, verify it against our private key, and make sure the signature is recorded in the transparency log. Then, the new container image is downloaded and used for the next run.
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
Then, we sign our image locally using Cosign (from the @projectsigstore), which records this event in their transparency log. Here’s the signing event for our latest image: search.sigstore.dev/?logIndex=11987… This means no one can silently sign a malicious image.
search.sigstore.dev
Rekor Search
Search the Rekor public transparency log
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
Next, we get a fresh clone of our repo and rebuild the image locally. We ensure it is bit-for-bit the same as the upstream one. Read more about this: dangerzone.rocks/news/2026-03-02-re…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
First, we pick the latest nightly container image and verify the attestations about it, checking its provenance information. This is answering questions like “Was it built indeed in GitHub actions?” or “Is it from our repo?”
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
If you’re interested in reproducible builds, transparency logs and software attestation, keep reading…
101 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
What if the update server is compromised? What if the signing key leaks? What if the developers are coerced somehow? Here’s how we counter these risks: dangerzone.rocks/news/2026-04-02-in…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
⚡ If you are a Dangerzone user, by now you may have encountered a prompt to download a sandbox update. These are important to the software’s stability, but come with their own risks.
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/04/2026
🧵 Dangerzone is a free app developed by FPF that converts potentially dangerous PDFs, office documents, or images into a safe-to-open PDFs. It converts docs into pixels, then reconstructs them as PDFs. Read the thread for important details about our recent sandbox update ⤵️
103 3
Reposted by dangerzone
SecureDrop @securedrop.social.freedom.press.ap.brid.gy · 03/03/2026
Web applications are only as trustworthy as the servers that serve them, and servers can get hacked. That’s why we are introducing WEBCAT, a tool allowing web browsers to verify the origin of code before they run it. 🌞 Today WEBCAT enters alpha testing! If you like to experiment with […]
social.freedom.press
Original post on social.freedom.press
030 3
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/03/2026
For Dangerzone, the reproducibility of our container image is one of our core defenses against supply chain attacks. We explain why and share some tools we created along the way. dangerzone.rocks/news/2026-03-02-re…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
014 4
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 09/02/2026
We’re kickstarting a series of technical articles about recent developments in Dangerzone. First up, we explain how we improved our image's footprint, security and build complexity, by switching from Alpine Linux to Debian Stable: dangerzone.rocks/news/2026-02-05-de…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
001 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 30/01/2026
Join us in FOSDEM 2026 for a double feature: 🎥 "Who’s reproducing the reproducible images?" 📅 Saturday @ 11:50 🔗 fosdem.org/2026/schedule/event/RYM8… 🎥 "Dangerzone: Bleach your documents" 📅 Sunday @ 10:45 🔗 fosdem.org/2026/schedule/event/JZ3F…
fosdem.org
FOSDEM 2026 - Who’s reproducing the reproducible images?
002 2
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/01/2026
Reminder: even with a sanitized document that can't phone home, there are still ways you can be tracked. There are watermarking methods such as printer tracking dots, intentional misspellings and extra spaces, that have been used in the past to detect whistleblowers. Be extra cautious when […]
social.freedom.press
Original post on social.freedom.press
011 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/01/2026
If you have gained access to a document that may be bugged and want to share it with a trusted third-party, it's best to remove tracking codes altogether. Dangerzone does that, in a process that's similar to a photocopy machine: dangerzone.rocks/about
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
121 2
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/01/2026
Anecdotally, the only major PDF reader that loads external content by default is Adobe Acrobat. Still, there are various implementations out there, so check what's the case with your PDF reader.
120 2
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/01/2026
The implementation is closed-source, but the way this usually works is simple: 1. Craft a unique URL in a domain under your control, that serves an 1x1 transparent pixel image. 2. Associate this URL with the document you want to track, and monitor it for any HTTP GET requests. 3. Plant this URL […]
social.freedom.press
Original post on social.freedom.press
110 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/01/2026
Tracking pixels in documents are nothing new in tech circles, but whistleblowers and activists need to be aware of them. Here's what a company promises to their prospects:
Snippet from a company website that advertises its product for tracking PDF documents. The descriptions reads: "[product] uses advanced steganography to embed invisible tracking codes in PDFs, enabling precise and effortless leak detection."
1317 17
Reposted by dangerzone
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 10/12/2025
How do you think Santa is handling cyberthreats? With Dangerzone of course! (Yeah, it took some training.) If you feel like testing his security team, you should know it has a challenge for you: Craft Santa a letter that can bypass Dangerzone's defenses and earn a bounty! 💰🎅 […]
social.freedom.press
Original post on social.freedom.press
088 8
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 10/12/2025
How do you think Santa is handling cyberthreats? With Dangerzone of course! (Yeah, it took some training.) If you feel like testing his security team, you should know it has a challenge for you: Craft Santa a letter that can bypass Dangerzone's defenses and earn a bounty! 💰🎅 […]
social.freedom.press
Original post on social.freedom.press
088 8
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 03/12/2025
We just released a major update to Dangerzone, it's now easier to install and use than ever before! If you're a journalist, use Dangerzone to sanitize documents you receive from sources and protect yourself from malware: dangerzone.rocks/news/2025-12-02-0.…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
013 3
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/12/2025
Dangerzone 0.10.0 has been released, containing two major changes: sandbox auto-updates and embedding Podman for macOS and Windows. Check the announcement here: dangerzone.rocks/news
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
010 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 04/11/2025
The first release candidate for Dangerzone 0.10.0 is out, and we’re looking for feedback from users, especially on macOS and Windows. Thanks! dangerzone.rocks/news/2025-11-03-0.…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
01111 11
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 26/08/2025
Docker Desktop releases prior to August 20th (v4.44.3) had a vulnerability that allowed malicious containers to compromise the host. Dangerzone is not affected, since it creates containers without network access. Still, if you haven't updated your Docker Desktop installation, this is your […]
social.freedom.press
Original post on social.freedom.press
013 3
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 10/07/2025
Dangerzone 0.9.1 has been released. This release mainly contains bug fixes for Windows and macOS platforms. dangerzone.rocks/news/2025-07-10-0.…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
020 2
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 22/05/2025
Coming to Dataharvest in Belgium? Feel free to reach out to us, we would be happy to talk about Dangerzone or related topics. If you don’t want to scout for folks wearing “Freedom of the Press Foundation” t-shirts, send us a Signal message instead to meet […]
social.freedom.press
Original post on social.freedom.press
001 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 09/04/2025
Dangerzone 0.9.0 has been released. This release makes our container images fully reproducible, brings security updates, and introduces experimental support for Podman Desktop on Windows and macOS. dangerzone.rocks/news/2025-04-09-0.…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
052 5
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 04/04/2025
Big props to our SecureDrop colleagues for taking a swing at the "Javascript crypto is considered harmful" Leviathan: securedrop.org/news/introducing-web… tl;dr: Browsers should be able to load security-sensitive pages only when the […]
social.freedom.press
Original post on social.freedom.press
034 4
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 01/04/2025
A new Docker Desktop version (4.40.0) is out, which resolves this issue. If you are in a previous version, we suggest you upgrade from the in-app updater (Settings -> Software updates -> Check for updates).
000 0
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 27/03/2025
If you are affected by this issue, a *short-term* mitigation is downgrading Docker Desktop to version 4.38.0. Read the following for more details: github.com/freedomofpress/dangerzon… For a long-term mitigation, watch this space and/or our GitHub issue […]
social.freedom.press
Original post on social.freedom.press
110 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 25/03/2025
Windows users on the most recent version of Docker Desktop are impacted by this issue as well. Docker has just merged a fix, which should resolve the issue once it is released.We'll post another update once a fixed version of Docker Desktop is available.
100 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 19/03/2025
We're aware that Dangerzone sometimes fails to convert files on macOS 15.2 or greater, and are investigating the issue. We will post an update to this thread once we have a workaround or a final fix. The corresponding GitHub issue is github.com/freedomofpress/dangerzon….
github.com
GUI fails with "Unknown error code '0'" (macOS) · Issue #1101 · freedomofpress/dangerzone
Converting certain documents on the latest macOS (15.2) results in an error 'Unknown error code '0'. Details What happened? Attempting to convert a .docx or .ppt file results in "Unknown error code...
120 2
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 27/01/2025
For our Apple macOS users: Before upgrading to macOS Sequoia, please first ensure you've upgraded Docker Desktop to avoid a known issue. More information here: dangerzone.rocks/news/2025-01-27-do…
dangerzone.rocks
Dangerzone
Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF.
010 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 08/01/2025
PSA for our macOS users: macOS may report Docker as malware, due to a code-signing certificate that recently expired. Please follow this GitHub issue for a workaround, if you are affected: github.com/docker/for-mac/issues/75…
github.com
[Workaround in description] Mac is detecting Docker as a malware and keeping it from starting · Issue #7520 · docker/for-mac
Description Whenever Docker is started, this error is shown: Malware Blocked. “com.docker.socket” was not opened because it contains malware. this action did not harm your Mac. Reproduce Start Dock...
010 1
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 24/12/2024
Dangerzone 0.8.1 has been released! This is mainly a security release that tackles a security vulnerability in the quarantined environment where documents are opened. Vulnerabilities like this are expected and do not compromise the security of Dangerzone, but users are strongly advised to […]
social.freedom.press
Original post on social.freedom.press
003 3
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 02/12/2024
@runasand @GIJN There's lots of practical advice in this article that's easy to follow, and will considerably improve your security posture: gijn.org/resource/introduction-inve… Also, we can't stress this enough: "It’s worth noting that photos and […]
social.freedom.press
Original post on social.freedom.press
000 0
dangerzone @dangerzone.social.freedom.press.ap.brid.gy · 28/11/2024
This account is now bridged to #Bluesky at bsky.app/profile/dangerzone.social.… if you want to follow us there. :)
001 1