Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

Post reply on HN
Print view View original

61–70 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#61

Post by Already__Taken »

joshschreuder wrote: post #43
devwastaken wrote: post #26

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

Isn't that sort of what MHTML is? https://en.wikipedia.org/wiki/MHTML I remember saving .mht files with IE as a kid when working on assignments so I could disconnect the dialup and give my parents their phone line back :)

With service workers we're almost a save-as shim away from being back to this.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#62

Post by jgtrosh »

schoen wrote: post #23
kvakil wrote: post #14

Earlier quoted context omitted.

and just like that, you've convinced me to install it. Different strokes for different folks, I suppose. :)

I was also convinced to install it, although after trying it, it looks more like less for PDFs than vim for PDFs (as many of the commands search or scroll in complex ways, but none of them modify the PDF). Still, it's interesting to have something like less for PDFs!

IMO mupdf is the real less for PDFs. It is so lightweight and straightforward it makes everything else seem terribly bloated.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#63

Post by fiddlerwoaroof »

ernst_klim wrote: post #59
time-domain0 wrote: post #5

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

Is djvu a viable alternative and if so, why isn't it used as widely as pdf?

Weren’t there licensing or patent issues?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#64

Post by devwastaken »

joshschreuder wrote: post #43
devwastaken wrote: post #26

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

Isn't that sort of what MHTML is? https://en.wikipedia.org/wiki/MHTML I remember saving .mht files with IE as a kid when working on assignments so I could disconnect the dialup and give my parents their phone line back :)

Sort of, but mhtml isn't a good format. It was a hacky way of taking what emails did. It's embedding all content in a single file, not as an archive. Rather it should be you can open up the HTML archive like an actual archive and see the individual files.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#65

Post by ct520 »

ryacko wrote: post #58
kibibu wrote: post #49

Earlier quoted context omitted.

Are you suggesting we replace PDF with TempleOS?

No, just run Adobe in a virtual machine with constrained access to other files. Although TempleOS clearly is a divine revelation.

I’ll get IT on it STAT! Regular employees going to love accessing PDFs in a VM

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#66

Post by technion »

As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use.

I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has changed much. They've certainly managed to bolt on a whole lot of new features, but that can only make the position worse.

As much as this sounds like a call to kill Adobe, something needs to happen before that's feasible. For the average enterprise, Adobe Reader is far more ingrained than these products were. Case in point, in organisation I asked the question of whether Chrome's PDF viewer would cut it for them. One large department then ordered Adobe Professional for every user. They told me they didn't need it, they just knew I wouldn't propose removing a product they'd actually paid for.

Adobe Reader needs its HTML5 moment - an alternative that's not just "good enough for most people", but one that's actually better.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#67

Post by acqq »

devwastaken wrote: post #64
joshschreuder wrote: post #43

Earlier quoted context omitted.

Isn't that sort of what MHTML is? https://en.wikipedia.org/wiki/MHTML I remember saving .mht files with IE as a kid when working on assignments so I could disconnect the dialup and give my parents their phone line back :)

Sort of, but mhtml isn't a good format. It was a hacky way of taking what emails did. It's embedding all content in a single file, not as an archive. Rather it should be you can open up the HTML archive like an actual archive and see the individual files.

Opera 12 (the original one, before the managers decided that it should be based on Chromium) had the .zip files support built in; that means that if the URL was

somepath/archive.zip/index.html

and index.html refers to other files, they would be read from the same zip, even if they are only inside of the zip.

I used it a lot for the local archives of the bigger content, it is amazingly convenient, and I'm sad that the same approach was not used anywhere else.

It's not trivial to get it right, in the security aspects (the zip implementation has to be robust, the url handling too) but it's doable and it would be very practical to have it.

Tangentially, the good thing of the zip format is that it has so called "central directory" which means that you don't even have to load the whole archive if not all data is needed, just the last part of the file, and from there you get the offset and the location of the needed file. So the Zip files could work beautifully with the

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ra...

when they are huge(1). The small ones are most effective to be downloaded at once, of course.

1) I've actually done such a sequence by hand a few times when I had a slow internet and knew that I don't need the whole zip file, but just to see that all files are inside: I've made the range request for the end of the file which would be enough for the estimated number of files inside, and so I've had the list of all the files in the archive without needed to download the whole archive: I've reconstructed the same file size but left the rest of it be zeroes, and some of the zip tools I've used treated the archive directory exactly as I needed it.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#69

Post by madshiva »

AnaniasAnanas wrote: post #8

Do people still use Adobe reader nowadays? Last time that I tried it in my school's library it took half a minute to load and render my document, and after that the whole UI was unresponsive. I had a much better experience with Sumatra on windows and Zathura on Linux where my documents open almost instantly.

Our Security "leader" don't want service now because of brexit... we still use Adobe Reader, not updated.

I want die.

Post reply on HN