211–220 of 238 posts
Earlier quoted context omitted.
One should reject all PDF:s except /a-standards compliant ones.
Let me tell you about the lord and savior of the printing industry, the PDF/X standard...
I like the archivable series, the document comes with what is needed to render it.
It's hard to overstate the ingenuity that went into this! Despite what people say in the comments here, both browsers really do not let you execute PDF JavaScript willy nilly. Outside of browser environments you are mostly safe anyway because JavaScript is rarely supported, with the big exception being Acrobat. The cleverness of pdftris is not so much Tetris in PDF but how it found its way around the restrictions tha…
Earlier quoted context omitted.
There is no recent version of Acrobat Reader for Linux, and old (was it 5.x beta?) versions rarely work on modern distros.
Acrobat 9.5 works fine on Linux, if a little slow. This Tetris game makes it crash though.
Edit: only now I see that's also from 2009 with updates into 2013. Do you where one can easily download the latest patched version?
Not just web browsers, Acrobat (and probably other PDF readers) have supported executing Javascript in PDFs for decades.
It's hard to overstate the ingenuity that went into this! Despite what people say in the comments here, both browsers really do not let you execute PDF JavaScript willy nilly. Outside of browser environments you are mostly safe anyway because JavaScript is rarely supported, with the big exception being Acrobat. The cleverness of pdftris is not so much Tetris in PDF but how it found its way around the restrictions tha…
You can manipulate form fields at anytime, and setInterval is provided so you can have things that run in an infinite loop. But yeah, as a first approximation, the only things js in pdf can do is mutate form fields and react to events related to form fields, unless your pdf reader is acrobat and that's something else entirely.
I believe this is even true for Acrobat with default settings, because while you can trigger JavaScript when a document is opened (/OpenAction) Acrobat will ask for permission.
He never heard back from them.
This is amazing and terrifying (I am a security engineer and parsing complex document formats is a never-ending treasure trove of vulnerabilities).
Theres a malaysian movie where the main premise is a hacker who uses pdf executions to steal one cent from every persons bank account. Its pretty interesting.
Earlier quoted context omitted.
You can manipulate form fields at anytime, and setInterval is provided so you can have things that run in an infinite loop. But yeah, as a first approximation, the only things js in pdf can do is mutate form fields and react to events related to form fields, unless your pdf reader is acrobat and that's something else entirely.
My point is that nothing runs without at least one initial user interaction - which makes a big difference for security. I believe this is even true for Acrobat with default settings, because while you can trigger JavaScript when a document is opened (/OpenAction) Acrobat will ask for permission.
I would be surprised if Doom was playable in a PDF that was being read in a LCD screen of a thermometer.