Live data from Hacker News

50 CVEs in 50 Days: Fuzzing Adobe Reader

research.checkpoint.com

71–80 of 173 posts

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#71

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

Did PDF version 2.0 made any improvement to clarity? I think it was released last year.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#73
post #68

If you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.

Is such a link even still neccessary?

Edge, firefox and chrome have built in PDF readers.

For more control sites can self-embed pdfjs so no external reader is required.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#74

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

Is djvu a viable alternative and if so, why isn't it used as widely as pdf?

DJVU is raster format. It's intended for scans and archiving printed media. It's possible to use it for documents produced digitally, but I don't think it will be a good idea.

PDF "core" is not that bad, but 90s "multimedia" craze turned it into badly designed graphical application runtime.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#75
post #72
post #68

If you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.

What the shit is there? Where is the most popular alternative, FoxitReader?

Foxit reader is closed source and the mentioned ones on that site are not.

Addendum: Most links of the bottom row don't work anymore. Needs updates

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#76

It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.

You can take a PDF and plot it, print it, display it on screen and it will always look the same. SVG is a closer to PDF than html is - and svg gets a lot of grief for having an overly complicated spec too.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#77

As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has change…

Who's going to go into an entrenched, mature market?

The money's going to the easy places, new markets.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#78
post #67

Earlier quoted context omitted.

Sort of, but mhtml isn't a good format. It was a hacky way of taking what emails did. It's embedding all content in a single file, not as an archive. Rather it should be you can open up the HTML archive like an actual archive and see the individual files.

Opera 12 (the original one, before the managers decided that it should be based on Chromium) had the .zip files support built in; that means that if the URL was somepath/archive.zip/index.html and index.html refers to other files, they would be read from the same zip, even if they are only inside of the zip. I used it a lot for the local archives of the bigger content, it is amazingly convenient, and I'm sad that the…

The reason I don't suggest zip is due to it's insecurity, like zip bombing. Itd be better for archival if we just had tar, and then sometime lightweight on top of it if compression is wanted. That way you could have js generate the archive client side.

It is interesting how the older web got some things right, though, and now it's 2018 and those ideas one would think should be robust by now, isn't even there.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#79
post #75
post #72

Earlier quoted context omitted.

What the shit is there? Where is the most popular alternative, FoxitReader?

Foxit reader is closed source and the mentioned ones on that site are not. Addendum: Most links of the bottom row don't work anymore. Needs updates

That site is, in my opinion, hilariously bad for the non tech-user.

Top row:

Platform (what's that?): GNU (isn't that some kind of African animal?) Linux (oh, I know that one, it's the cute penguin!)

The rest of the text in those boxes is mostly techno-babble for non-tech users (Gnome? KDE? DjVu?!??)

I understand the intent behind it, but it would only serve a very small niche of users, who can already fend for themselves.

Everyone else would go like: PDF? Ah, that's Adobe!

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#80

If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.

I actually enjoy reading the PDF spec - it’s here for anyone who wants to take a look https://www.adobe.com/content/dam/acom/en/devnet/pdf/pdfs/PD...

Like every bit of business software, there’s a load of stuff that shouldn’t be in there. It’s a really flexible container format though, and every one of these features went in because there was a need. Times change, things change and it could do with a tidy up, but it’s probably impossible without breaking everything for a load of businesses.

Post reply on HN