William Patin

Motion Designer & Coder

[William Patin @WilliamPatin]

@jayfaker @Oddernod Affinity was acquired by Canva last year, so...

[William Patin @WilliamPatin]

🚨Lottie-Player 2.05-2.07 compromised. Please take action.

[LottieFiles @LottieFiles]

Incident Response for Recently Infected Lottie-Player versions 2.05, 2.06, 2.0.7

Comm Date/Time: Oct 31st, 2024 04:00 AM UTC

Incident: On October 30th ~6:20 PM UTC - LottieFiles were notified that our popular open source npm package for the web player @lottiefiles/lottie-player had unauthorized new versions pushed with malicious code. This does not impact our dotlottie player and/or SaaS services. Our incident response plans were activated as a result. We apologize for this inconvenience and are committed to ensuring safety and security of our users, customers, their end-users, developers, and our employees.

Immediate Mitigation Actions
- Published a new safe version (2.0.8)
- Unpublished the compromised package versions from npm
- Removed all access and associated tokens/services accounts of the impacted developer

Impact
- Versions 2.0.5, 2.0.6, 2.0.7 were published directly to https://t.co/kVbgscVXnk over the course of an hour using a compromised access token from a developer with the required privileges.

- The unauthorized versions contained code that prompted for connecting to user’s crypto wallets.

- A large number of users using the library via third-party CDNs without a pinned version were automatically served the compromised version as the latest release. With the publishing of the safe version, those users would have automatically received the fix.

Recommended Steps
- If using 2.0.5, 2.0.6 and 2.0.7 versions please update to the latest version 2.0.8
-- SHA: sha512-PWfm8AFyrijfnvGc2pdu6avIrnC7UAjvvHqURNk0DS748/ilxRmYXGYkgdU1z/BIl3fbHCZJ89Zqjwg/9cx6NQ==

- If you are unable to update the player immediately, it is recommended that you communicate to Lottie-player end-users to NOT accept any attempts to connect their crypto wallets.

Next Steps
- LottieFiles continues to work through its incident response plan and has also engaged an external incident response team to help further investigate the compromise.

- We have confirmed that our other open source libraries, open source code, Github repositories, and our SaaS were not affected.

If you believe you’re affected, don’t hesitate to reach out to us at [email protected]

[William Patin @WilliamPatin]

@plug_everything @aescripts Weighter

[William Patin @WilliamPatin]

@Oddernod The future is now. Go check out state of the art websites built on WebGPU. They might look like Motion Design, but they're 100% code-based. Motion isn't dead, it's just morphing. We ain't seen nothing yet. 2/2

[William Patin @WilliamPatin]

@Oddernod A few years from now, Motion Design will fall under the definition of creative programming. I had the same vision 10 years ago, and transitioned to coding in order to be future proof. Nowadays I kind of feel like the operator from The Matrix, seeing images in code. 1/2

[William Patin @WilliamPatin]

@AeCartographer Clever. Did something similar using matrix transformation in expressions a few years back. How does it behave when points move behind the camera's view plane?

[William Patin @WilliamPatin]

@workbench_tv @AmplifyMotion I've never really minded using "reduce project" or copy-pasting in AE, but now I can't unsee it! Hold my beer...

[William Patin @WilliamPatin]

@workbench_tv Just for clarification: AE's viewer would stop refreshing, while the UI remained responsive. Clicking the new reordering arrow would cause AE to refresh, but the issue would persist across restarts. It was very weird, especially as I was only previewing a handful ProRes files.

[William Patin @WilliamPatin]

@workbench_tv I've encountered a similar recurring bug in CC23. Reordering items in the project pane would cause the viewer to refresh, but it'd retrieve one outdated frame at a time from the scratch disk. Reinstalling AE CC22 as a fallback made the bug go away. No more issues ever since🤞

[mrdoob @mrdoob]

https://t.co/Zefsal6MVx

[William Patin @WilliamPatin]

@vmedium Throwing my hat into the ring 🎩 https://t.co/gmHTPxQc7U – Motion Designer, Coder & Post Production all-rounder

[William Patin @WilliamPatin]

@zachlieberman It also works with faces... 😬

[William Patin @WilliamPatin]

@chriszachary Nice, Chris! The caret shouldn't blink on input though 😬 I'll show my way out...

[William Patin @WilliamPatin]

Seeing #mographPaidMe unfold, with all the licenses and maintenance fees, the ever increasing hardware & IT requirements, the energy costs, and the training it requires, it's about time we globally up our freelancing rates >50%. We're all too cheap!

[Doc Bastard @DocBastard]

Dear paediatricians,

Try this.

[One Devloper Army @OneDevloperArmy]

Six Stages of Debugging

Step 1 : That can’t happen.

Step 2 : That doesn’t happen on my machine.

Step 3 : That shouldn’t happen.

Step 4 : Why does that happen?

Step 5 : Oh, I see.

Step 6 : how did that ever work?

[Neil deGrasse Tyson @neiltyson]

SCIENTISTS: “We’ve produced the first-ever image of a supermassive Black Hole, 55-million light years away”
RESPONSE: “Oooh!”

SCIENTISTS: “We’ve concluded that humans are catastrophically warming Earth”
RESPONSE: “That conflicts with what I want to be true, so it must be false”

[William Patin @WilliamPatin]

@workbench_tv It's a matter of education, and that's why our generation's having a problem with this. When subscription services can be canceled at any time, they're a blessing – take Arnold or Octane for example! We just have to sub/unsub to monthly services more dynamically.

[William Patin @WilliamPatin]

@mrdoob Developers: look at this awesomely fluid WebGL tech demo!
Browsers: Woop-woop!
Middle-grade mobile device: Nah.