News

Image-format Deprecation

Google and Mozilla have announced their intention to enable JPEG XL by default in Chromium 155 and Firefox 157, respectively. JPEG XL is a revolutionary image format which is superior for lossless, lightly-compressed, and moderately-compressed images, and supports progressive rendering as the images are downloaded.

Inferencium has been using JPEG XL as its exclusive internal image format for most static images since 2025, with AVIF used for animated images and highly-compressed images. To align Inferencium's web services with this approach, all image formats other than JPEG XL will be deprecated upon release of both of the aforementioned versions of Chromium and Firefox. The deprecation period will be followed 3 months after the release of the web browser with the latest release date by removal of the deprecated image formats. Most static image formats will be replaced by JPEG XL, with the exception of animated image formats, such as GIF, which will be replaced by animated-AVIF images, and highly-compressed images, which will be replaced by static-AVIF images.

Failure to use an up-to-date web browser supporting JPEG XL and AVIF will result in loss of Inferencium-services functionality and the ability to view images located on Inferencium infrastructure. Safari does not support progressive JPEG XL images, but will otherwise correctly render JPEG XL images upon downloading the entirety of them.

Infrastructure Relocation

Inferencium has relocated to a new location. As a result of this relocation and its limited selection of internet service providers, Inferencium has switched internet service provider from YouFibre to Fibrenest.

This migration decreases download and upload bandwidth from 2000/2000 Mb/s to 500/80 Mb/s, respectively, and is expected to be temporary until better options are available at the location.

Also due to this migration, Inferencium's primary public IPv4 address has changed from 185.154.146.5 to 185.241.226.159.

Network Upgrade

Inferencium has switched internet service provider from POP Telecom to YouFibre.

This upgrade includes download and upload bandwidth increases from 1000/100 Mb/s to 2000/2000 Mb/s, respectively, resulting in a more responsive experience across Inferencium services, faster download and upload speeds, and allowing more simultaneous connections.

As a result of this change, Inferencium's primary public IPv4 address has changed from 92.27.157.206 to 185.154.146.5.

SSH Key Update

On 2024-03-29, a backdoor was publicly disclosed in the XZ Utils software. Inferencium systems did have the affected versions of this software installed, and the tools were used. The software has since been downgraded to the last-known safe version.

After extensive research, it has been discovered that specific criteria must be met for the backdoor to be effective. Based on what is known, Inferencium systems are unaffected by this attack for the following reasons:

• Inferencium systems run Gentoo Linux, which does not include Debian and Red Hat OpenSSH patches.
• Inferencium systems use musl libc, not glibc. As musl does not support glibc's non-standard IFUNC functionality, the backdoor cannot run.
• Inferencium systems use Clang as the system compiler, and lld as the system linker, not GCC and ld.
• Inferencium systems use OpenRC as the init system, not systemd. libsystemd and systemd-notify do not work with OpenRC.

The only criteria met by Inferencium systems is amd64 as the system architecture; this is not enough for the backdoor to be effective. Even if all criteria other than running glibc were met, Inferencium systems would still be unaffected by this attack due to musl not supporting the required IFUNC functionality which the backdoor seems heavily dependent on.

Despite the evidence, it is unknown exactly what this malicious code does and is capable of in entirety. As a precautionary measure, I have generated a new SSH key and classified the previous key as compromised. You can find my new key on the Key webpage.

There is no evidence that my previous key was compromised, so this is entirely a precautionary measure. All files and Git commits, tags, and releases signed with the previous key, even after discovery of the backdoor, up to 2024-04-01, are secure and validly signed by me; the key should not be trusted after this date.

I completely support Lasse Collin during this time. Support should be provided to him for what occurred to his project and how it was sabotaged. He clearly had good intentions and was burnt out from the commitment to his project, which led to Jia Tan taking advantage of him. He has posted his own, official statement on behalf of the XZ Utils project and how it intends to move forward. Assistance should be provided to support both him and the community.

Source Code Mirror - Codeberg

Inferencium source code repositories are now mirrored at Codeberg. In case of service disruption of the main Inferencium source code repositories, the mirrors can be used to access the source code.

Due to terms of service restrictions, proprietary code and related repositories, such as firmware, are unable to be mirrored to Codeberg.