If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.
50 CVEs in 50 Days: Fuzzing Adobe Reader
71–80 of 173 posts
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#72If you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#73If you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.
Edge, firefox and chrome have built in PDF readers.
For more control sites can self-embed pdfjs so no external reader is required.
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#74If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.
Is djvu a viable alternative and if so, why isn't it used as widely as pdf?
PDF "core" is not that bad, but 90s "multimedia" craze turned it into badly designed graphical application runtime.
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#75If you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.
What the shit is there? Where is the most popular alternative, FoxitReader?
Addendum: Most links of the bottom row don't work anymore. Needs updates
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#76It's amazing browsers have so far decided to just not have an HTML archive format that could replace PDF. The majority of what PDF does can be better done in a webpage. Why not just an extension like .phd but is actually a .tar.gz that contains a webpages assets. Present like pdf's are, and done.
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#77As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has change…
The money's going to the easy places, new markets.
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#78Earlier quoted context omitted.
Sort of, but mhtml isn't a good format. It was a hacky way of taking what emails did. It's embedding all content in a single file, not as an archive. Rather it should be you can open up the HTML archive like an actual archive and see the individual files.
Opera 12 (the original one, before the managers decided that it should be based on Chromium) had the .zip files support built in; that means that if the URL was somepath/archive.zip/index.html and index.html refers to other files, they would be read from the same zip, even if they are only inside of the zip. I used it a lot for the local archives of the bigger content, it is amazingly convenient, and I'm sad that the…
It is interesting how the older web got some things right, though, and now it's 2018 and those ideas one would think should be robust by now, isn't even there.
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#79Earlier quoted context omitted.
What the shit is there? Where is the most popular alternative, FoxitReader?
Foxit reader is closed source and the mentioned ones on that site are not. Addendum: Most links of the bottom row don't work anymore. Needs updates
Top row:
Platform (what's that?): GNU (isn't that some kind of African animal?) Linux (oh, I know that one, it's the cute penguin!)
The rest of the text in those boxes is mostly techno-babble for non-tech users (Gnome? KDE? DjVu?!??)
I understand the intent behind it, but it would only serve a very small niche of users, who can already fend for themselves.
Everyone else would go like: PDF? Ah, that's Adobe!
Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader
#80If you read the PDF spec from the late 90's, it is Stephen King novel-scary... container format, multiple encodings, encryption, embedded binaries, embedded JavaScript and more.
Like every bit of business software, there’s a load of stuff that shouldn’t be in there. It’s a really flexible container format though, and every one of these features went in because there was a need. Times change, things change and it could do with a tidy up, but it’s probably impossible without breaking everything for a load of businesses.