Live data from Hacker News

Show HN: Doom (1993) in a PDF

doompdf.pages.dev

51–60 of 78 posts

Re: Show HN: Doom (1993) in a PDF

#52
So I find this neat, I can see a potential practical application as being able to demonstrate a piece of engineer work INSIDE a resume when you apply for a job which I think is really creative.

But do you all think there are other use-cases for this technology? Like, could you distribute apps using PDFs on highly constrained devices (like iphone possibly, or maybe managed devices e.g. play station, xbox, kiosks?) Just throwing out ideas.

Are there other obvious uses for this?

I think when I was playing around with adobe reader I saw you could put movies in them, too. I believe that you're able to make customization's to the menu bar. It seems to be fairly flexible for what it is.

Re: Show HN: Doom (1993) in a PDF

#53
Also, if any, this looks why the current industry sucks, putting little and shitty languages everywhere making PDF files very dangerous. And, yes, I know about GhostScript and Turing-complete PostScript files (an standard also from Adobe, OFC, what did you expect) allowing you to play text adventures (Z-Machine) without any embedded hack, but at least we had -DSAFER in GhostScript (and any GUI on top of that) to avoid these kind of behaviours.

Inb4 "this is the true hacker spirit", I know, yes, this is cool stuff and the true meaning of a hacker, but in the end I'd choose DJVU for a document format.

Re: Show HN: Doom (1993) in a PDF

#54
post #3

> limited JS runtime of the PDF engine humanity has gone too far

Seriously though, is there another format that:

1. Can be easily and freely shared by email / cloud drive, including assets, images and fonts.

2. Supports form filling and saving the form data in the file directly (as opposed to sending it somewhere over HTTP). Basically the electronic equivalent of a paper form that can be filled, send by email and stay filled.

3. Supports (cryptographic) signatures that are again part of the document, and can easily and securely be verified by end users. This is a very important use case in the EU, where electronic signatures are based on cryptography, not "I pinky swear I'm John Smith" DocuSign.

4. Has perfect print fidelity.

We keep complaining about PDF (and rightly so), but there's truly no other format to replace it. The W3c / Whatwg / whatever could probably come up with one based on web technologies, but they haven't yet.

There's Epub which solves a very narrow use case of PDF (electronic book distribution where perfect control over presentation is not required), but nothing that solves the "business" use cases.

Re: Show HN: Doom (1993) in a PDF

#57

Earlier quoted context omitted.

That’s the only way we know how to go

This. I'm eagerly awaiting the replicators that will explore the cosmos and spread the knowledge of our existence. If we can get them done before we poison ourselves.

You assume that we are the thing being replicated.

Nature is crafty. It could be the case that we humans are the replicators, not the main show.

Re: Show HN: Doom (1993) in a PDF

#58
post #25

Earlier quoted context omitted.

:-) I'll never quite appreciate why people say things like this. Having some kind of embedded scripting is useful for all sorts of things, often form validation. A sufficiently complex validation system becomes Turing complete, so you might as well skip the hassle of a custom language and go right to JavaScript. Once you have JavaScript, input, and some way of updating a graphical pixel grid, you're at Doom-completen…

We had that language, it was postscript. Then pdf came along and said: no this is too dangerous the only thing in a document should be layout information not arbitrary code. And here we are two decades later. My hatred of pdf has no end. It killed postscript for dynamic pages and djvu for static pages.

This is very misleading thinking. We've came a very long way from PS security-wise and this is a good thing and should be appreciated.

The fallacy I see in many comments - either directly or between the lines - is to think that since we can run Doom in PDF, hell's gates must have opened and we can do literally anything, especially anything malicious.

This is not the case.

PDF is basically comprised of immutable parts and interactive elements that user agents are supposed to render visibly distinctly. Also user agents are not supposed to run any code without explicit user interaction.

Contemporary user agents do a good job in both respects.

PDFtris and the Doom example are possible because they live in a very small niche of features that enable relatively unobtrusive still interactive form processing. Forms allow code, but do not stick out as much as other interactive elements do and they are relatively flexible. Having found that feature niche is the real genius of PDFtris and related exploits.

Still, they need user interaction. There is no way to do anything behind your back in PDF.

Another fallacy I see in this and the related threads,is that Adobe Acrobat vulnerabilities are PDF vulnerabilities. Yes, Adobe did a terrible job with Acrobat, but in my opinion not at all with the format and specification of PDF - especially not when it comes to security.

Re: Show HN: Doom (1993) in a PDF

#59
post #3

> limited JS runtime of the PDF engine humanity has gone too far

Seriously though, is there another format that: 1. Can be easily and freely shared by email / cloud drive, including assets, images and fonts. 2. Supports form filling and saving the form data in the file directly (as opposed to sending it somewhere over HTTP). Basically the electronic equivalent of a paper form that can be filled, send by email and stay filled. 3. Supports (cryptographic) signatures that are again p…

Adding JS to PDF seriously undermines these benefits. If Turing-complete logic can draw arbitrary images on the document, you can no longer have any print fidelity at all, and what you signed cryptographically may have said things you didn't know it said. It may start interfering with #1 if email systems start blocking "malicious" PDF features, too. Only benefit #2 survives.

I have no idea what the folks at Adobe were thinking when they decided to add this feature that could eventually eliminate most of the benefits of their product.

None of this is to say that the Doom implementation is anything less than a very cool hack.

Re: Show HN: Doom (1993) in a PDF

#60
post #59

Earlier quoted context omitted.

Seriously though, is there another format that: 1. Can be easily and freely shared by email / cloud drive, including assets, images and fonts. 2. Supports form filling and saving the form data in the file directly (as opposed to sending it somewhere over HTTP). Basically the electronic equivalent of a paper form that can be filled, send by email and stay filled. 3. Supports (cryptographic) signatures that are again p…

Adding JS to PDF seriously undermines these benefits. If Turing-complete logic can draw arbitrary images on the document, you can no longer have any print fidelity at all, and what you signed cryptographically may have said things you didn't know it said. It may start interfering with #1 if email systems start blocking "malicious" PDF features, too. Only benefit #2 survives. I have no idea what the folks at Adobe wer…

probably the same thing that netscape did when adding javascript to the web. "now we can add some basic client-side validation to these forms". PDFs can be used as form templates, so having some basic validation is reasonable.
Post reply on HN