Hacker News Reader

> why should a static document reader be able to run arbitrary code

Because PDF was never meant to be a static format, and Adobe Reader was never meant to be a static document reader.

However, since most PDFs are static anyway, I think it would be a very good idea for PDF reader softwares to treat every PDF as a static document by default, and only allow scripting after the user clicks Yes on a scary-looking warning.

View on HN

Correct. I wasn't clear, so let me clarify: I regard every PDF I read as a static document. That's how I see them and that's how I read them, with readers that treat them as static. I have no use for a PDF document that wants to acts as software and I wouldn't use a bug-nest of a piece of software to run it.

You're not the target market for those types of PDF's then. In large corporate environments, PDF's are roughly the equivalent of small web-apps that handle a lot of the data entry and sharing across the organization.

I'm not a proponent of this approach, but it is what it is and it is the reason that Reader is such a bloated security-ridden nightmare.

Then those features should only be enabled by default in corporate versions of Adobe Reader. Average internet users have very little use for non-static PDFs, except the occasional "fill out this form" PDFs where you can't save any changes.

Reply on news.ycombinator.com