Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Doom (1993) in a PDF

doompdf.pages.dev

Post reply on HN
Print view View original

31–40 of 78 posts

Re: Show HN: Doom (1993) in a PDF

#31

Post by vk6 »

armSixtyFour wrote: post #9

Now how do I add another WAD file to this. Someone needs to play sigil on this.

I just added this as a feature. You can launch the game with custom WADs at the site's landing page (https://doompdf.pages.dev/). It'll open a new PDF file as a blob URL (and you can even save and redistribute the PDF it generates).

A disclaimer though - I don't have any experience with Doom modding. I don't know if the behavior of this feature is correct. All it does is it loads the PWAD by passing the "-file" argument to the game's main function.

Re: Show HN: Doom (1993) in a PDF

#32

Post by microtonal »

lolinder wrote: post #21
quotemstr wrote: post #20

Earlier quoted context omitted.

The flip side is that because the industry has converged on just a few embedded scripting systems (JS, Lua, etc.) we can concentrate our security hardening efforts on these few engines and benefit everyone. If PDF, like PostScript, were its own custom thing, it couldn't have been able to benefit from this hardening. In the end, JS was a fine choice.

The concern isn't that it was JS, the concern is that there's a scripting system inside of PDF at all. Why? What? Form validation is a lousy excuse because forms themselves were a bridge too far for the format. Why do we need to be able to validate them? I knew PDFs could be dangerous, but I didn't realize it was because they're intentionally designed to allow embedded scripts .

I don't think forms are a bridge too far, it was very common that forms were provided as PDF and it is more convenient for the sender and receiver to fill the fields on a computer for readability, etc. before printing.

However, forms could be handled by a very simple DSL that would be easy to write a safe interpreter for.

Re: Show HN: Doom (1993) in a PDF

#33

Post by quotemstr »

microtonal wrote: post #32
lolinder wrote: post #21

Earlier quoted context omitted.

The concern isn't that it was JS, the concern is that there's a scripting system inside of PDF at all. Why? What? Form validation is a lousy excuse because forms themselves were a bridge too far for the format. Why do we need to be able to validate them? I knew PDFs could be dangerous, but I didn't realize it was because they're intentionally designed to allow embedded scripts .

I don't think forms are a bridge too far, it was very common that forms were provided as PDF and it is more convenient for the sender and receiver to fill the fields on a computer for readability, etc. before printing. However, forms could be handled by a very simple DSL that would be easy to write a safe interpreter for.

JavaScript is already a simple language. There's no requirement to have a JIT even. What makes you believe a custom language would be any safer or better in another way?

Re: Show HN: Doom (1993) in a PDF

#35

Post by yoz »

This is amazing, but there are even wilder ways to run arbitrary code inside a PDF. How about stringing together several thousand segment commands in JBIG2 (one of the image codecs supported in PDF) to create a programmable virtual machine? https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

Re: Show HN: Doom (1993) in a PDF

#38

Post by llm_trw »

DiggyJohnson wrote: post #27
llm_trw wrote: post #25

Earlier quoted context omitted.

We had that language, it was postscript. Then pdf came along and said: no this is too dangerous the only thing in a document should be layout information not arbitrary code. And here we are two decades later. My hatred of pdf has no end. It killed postscript for dynamic pages and djvu for static pages.

This is a very concise explanation, thanks for putting it so clearly. It’s not the features or requirements that are the focus of the scorn, per se, but how we got here. I still prefer and use PDF all the time, but between overly dynamic crap and the mainstream tooling, well… “hate” is a reasonable hyperbole.

Hate is too weak a term for what I feel for Adobe.

Adobe kept PDF as a proprietary format from 1992 to 2008. You got the reader for free ... on windows, with a single executable. You didn't get an editor and had to pay through the nose for one from Adobe.

It wasn't until the late 2010s that it actually became a free-ish standard, if you think that a 3,500 page document is a 'standard'.

The only reason why adobe did it is because djvu was eating their lunch, between 2002 and 2008 it was the defacto standard for scanned documents in academia. The documents were easy to edit. The image compression is still better than the native compression on PDF.

To add insult to injury after displacing postscript on windows in the name of security, not only did they add a scripting language to PDF, they added one written in two weeks at a time when it was so bad no one used it for anything but pop-ups and with more security vulnerabilities than you could shake a stick at. I suppose we should be happy Adobe didn't put flash in. Oh wait, they did: https://www.reddit.com/r/Adobe/comments/yqisho/flash_content...

Post reply on HN