Hacker News Reader

Comment by jl6 | Hacker News Reader

Are you saying PDFs are a threat? More so than a web page?

Slightly OT, but you would be surprised at how much power PDFs have (especially when opened in Adobe Acrobat/Reader). I recently came across this monstrosity[1] on HN, and the author mentions this:

> Scripts can supposedly do things like make arbitrary database connections, detect attached monitors, import external resources, and manipulate 3D objects.

That's an unprecedented level of power for what is supposedly a simple document format.

That being said, PDFs are only a threat when opened in a with support for these obscure APIs, such as Adobe's own readers. You (probably) will be fine opening untrusted PDFs in Chrome's PDF reader (PDFium) and Preview.

[1]: https://github.com/osnr/horrifying-pdf-experiments

You should totes makes this a top level HN post!!!! (I typed in my statutory copied one line NeWS program back in the day too. Never again)

https://news.ycombinator.com/item?id=17915296

Thanks! I also heard it's got a email sender (and receiver?) inbuilt.

Note; Chrome's PDF reader executes the nested JS in his breakout PDF game. IIRC, the only one that did support it.

Not that PDFium is any worse than Adobe, but certainly not much better.

There were multiple vulnerabilities related to PDF parsing in Adobe/Acrobat Reader/, firefox (pdf.js) and document viewers(libpopler, Okular). Also, there was a "game of life" implementation in PostScript and you can expect same level of capabilities in PDF.

PostScript at least has the excuse that it _is_ a programming language (for assembling documents for printing, but still a proper programming language) while PDF is supposed to be a fixed document format. PDF has far too much power for what it is supposed to do.

Microsoft got it right with (O)XPS -- none of that dynamic stuff that lets you do all kinds of naughty things to the system with a properly formed document like PDF can do.

That of course depends on what you think it’s supposed to do.

PDF is not just a representation of paper, you can for instance also build forms.

It would be nice if there was a separate ‘static paper’ only extension/mime type but there isn’t.

> Microsoft got it right with (O)XPS -- none of that dynamic stuff that lets you do all kinds of naughty things to the system with a properly formed document like PDF can do.

On the other hand, they also get it wrong with other things and we end up with SYSTEM-level compromises due to a vulnerability in a font!

The pdf format is essentially an executable. Whether or not the browser sandboxes it correctly is a matter of debate.

Reply on news.ycombinator.com