A compression engineer argues against JPEG XL on the Web and demonstrates a 1,918-byte decode bomb

Sources: post, HN discussion
Summary: The author previously endorsed JPEG XL for Interop 2024 and now argues its lossy efficiency and decode speed have both been overtaken. The concrete operational finding is separate from the opinion: he reports a 1,918-byte JPEG XL image that takes 17.43 seconds of user time to decode on an M5 Pro with the Rust decoder, and that decoder is the one now reaching Chrome and Firefox. He also reports recompressed JPEGs taking about 33 percent longer to decode, which bounds the often-cited 20 percent size saving. The comparison figures are his own measurements on size-matched encodes, and no browser vendor response is recorded.
Why it matters: A decode cost that large from under two kilobytes is a denial-of-service shape for any service that decodes user-supplied images.