Show HN: Tetris in a PDF

Post by weinzierl » Fri, Jan 10, 2025, 10:38 PM UTC

brumar wrote: post #219

weinzierl wrote: post #216

Earlier quoted context omitted.

My point is that nothing runs without at least one initial user interaction - which makes a big difference for security. I believe this is even true for Acrobat with default settings, because while you can trigger JavaScript when a document is opened (/OpenAction) Acrobat will ask for permission.

I think I got your point but might have expressed myself badly. The pdf can run js and messes with the display right at opening time, without any warning or ask for permission.

Post by ddoice » Sat, Jan 11, 2025, 7:07 AM UTC

nadis wrote: post #47

freedomben wrote: post #37

You glorious bastard, what a cool project! This is already a contender for most hacker project of the year :-) (below is not serious) I would advise people against using this in production though because it's still missing some critical features. For example: 1. The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work. 2. It doesn't work…

"The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work." -- this comment made my me laugh/choke on my coffee and I have no regrets.

Post by skykooler » Sat, Jan 11, 2025, 9:12 AM UTC

ninalanyon wrote: post #202

I'm very pleased that this did not work in Firefox on Linux Mint. Unfortunately it does work in Vivaldi.

Post by grgergo » Sat, Jan 11, 2025, 5:46 PM UTC

sexy_seedbox wrote: post #134

geor9e wrote: post #54

Earlier quoted context omitted.

A tetris PDF could be in a 1 pixel iframe right on this page and you'd never know it. So it doesn't require any user action to download one.

That's why you run NoScript along side with UBO

Post by btown » Sat, Jan 11, 2025, 8:44 PM UTC

Thorrez wrote: post #153

btown wrote: post #132

Earlier quoted context omitted.

For Chrome's PDF renderer, the runtime is V8, so we're literally one (hilarious) line of code away from this glorious future existing today: https://pdfium.googlesource.com/pdfium/+/refs/heads/main/fpd... > // Use interpreted JS only to avoid RWX pages in our address space. Also, --jitless implies --no-expose-wasm, which reduce exposure since no PDF should contain web assembly. > return "--jitless";

You could write an LLM in plain JS, right?