Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

51–60 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#51
post #36

The fact that companies still have the email-> employee pc -> acrobat reader pipeline enabled says a lot about what companies really think about security, posturing aside. (home users too, but they can plead ignorance)

The reason being that there are almost no high-profile breaches I can think of where PDF vulnerabilities have been blamed. Unlike Office macros, Flash etc etc.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#52

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

IIRC the epub format used for e-books is essentially a container with html.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#53

Earlier quoted context omitted.

I don’t know if this is true, but I’ve been told that the pdf spec at one point did/does contain some MS DOS emulation. I’m seriously close to banning acrobat the program for my employees, just haven’t found a rock solid alternative that I can trust to not implement the same dumb parts of the spec.

I think that chrome uses (used?) poppler, and is quite good for displaying pdfs.

no, chrome uses its own engine called pdfium.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#55

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

While working with the PDF format I sometimes get the impression that this complexity is what Adobe wants. As a result, Adobe Reader is the only viewer that implements the entire spec and can handle all (or most) quirks.

This is especially apparent when trying to edit arbitrary PDF files, which is sometimes not so easy or even impossible. Just the definition of fonts and the text layout is already so complicated that this is the logical consequence.

But perhaps the format has simply grown and led to additional requirements such as PDF/A, PDF/X, PDF/E and now PDF 2.0, the next standard that makes everything even more complex... Will this every stop?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#56

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

For a walk through PDF's history and file format, check out Chas Emerick's 2018 Red Monk tech talk: "Building 100 year systems in the shadow of PDF".

https://www.youtube.com/watch?v=5EPn6plqkEs

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#57

Do people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive. I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.

.. tried Zathura on LUbuntu just now for the first time ; appears to be a VIM for documents viewing or something.. no interest in Zathura here!

Maybe try mupdf instead?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#59

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

Is djvu a viable alternative and if so, why isn't it used as widely as pdf?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#60

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

PDFs are supposed to look the same on every computer. Webpages can’t do that yet.

moreso, webpages were never meant to, by design. It is not print media without the print.
Post reply on HN