50 CVEs in 50 Days: Fuzzing Adobe Reader • Hacker News Board

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#101

Post by saagarjha » Thu, Dec 13, 2018, 12:18 PM UTC

throwaway12iii wrote: post #100

wongarsu wrote: post #97

Earlier quoted context omitted.

To be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't…

pdf.js has had 26 pull requests merged in the last month. 5,622 additions and 6,991 deletions. That's just in the project directly, not in the dependencies. Since it's such a quickly evolving project, I wondered where form support is up to. https://github.com/mozilla/pdf.js/issues/7613 Form support is not complete. Seems like it required quite a rewrite to get the foundation in a good place to finish it off. Are ther…

> Remember the Apple display system used to be based on PDF rendering

Does Quartz not still try to match PDF in the way its render structure is composed internally?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#102

Post by gpvos » Thu, Dec 13, 2018, 12:53 PM UTC

tonyedgecombe wrote: post #95

SmellyGeekBoy wrote: post #90

Earlier quoted context omitted.

The same could be said for the Microsoft Office file formats. Or PSD, for that matter.

The Office formats are well specified, they are complex because that is the nature of the software but it is a world away from something like PSD or even PDF.

PDF is actually quite well specified, there are not many holes in the specification itself.[0] As to what Adobe Reader will do when it encounters an out-of-spec file, that is a lot fuzzier.

On the other hand, the Office file formats (especially Word) have many un- or underspecified cases.

[0] The only one I know of is finding the end of compressed inline image data.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#103

Post by executesorder66 » Thu, Dec 13, 2018, 12:59 PM UTC

technion wrote: post #66

As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has change…

> One large department then ordered Adobe Professional for every user. They told me they didn't need it, they just knew I wouldn't propose removing a product they'd actually paid for.

Why would they do that though?

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#104

Post by the_duke » Thu, Dec 13, 2018, 1:06 PM UTC

TeMPOraL wrote: post #99

jeeceebees wrote: post #84

Earlier quoted context omitted.

Distill[1] is another example of interactive scientific papers (with a focus on machine learning). But is there really a good reason to not just keep these in browser? I don't really know if there's much value in reading these locally. Maybe this would be a good fit for an electron app? [1] https://distill.pub/

That behind us, there's also a matter of reliability and control. Services live much shorter than data they process; given today's trend, I wouldn't expect an online-only paper to be available after 5-10 years. Having a self-contained bundle would let me archive it independently, and would prevent any third parties from being able to interfere with my reading/exploration.

You can write self contained, single file .html documents just fine.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#105

Post by singhrac » Thu, Dec 13, 2018, 1:07 PM UTC

wongarsu wrote: post #97

technion wrote: post #66

As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has change…

To be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't…

Chromium uses Pdfium, which is based on the Foxit code base, actually, since they bought some pieces of it: https://www.foxitsoftware.com/blog/the-interesting-history-a....

Actually I've never had rendering bugs with Chrome, though it's certainly happened with Firefox.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#106

Post by joneser005 » Thu, Dec 13, 2018, 1:13 PM UTC

Sahhaese wrote: post #73

fghtr wrote: post #68

If you have a PDF document on your web site, please consider putting a link to https://pdfreaders.org/ instead of unfair advertisement of Adobe Reader.

Is such a link even still neccessary? Edge, firefox and chrome have built in PDF readers. For more control sites can self-embed pdfjs so no external reader is required.

Unfortunately, yes it is. Just yesterday, my wife tried to open a pdf transcript from her college. It would not open on anything other that Adobe Reader on a traditional os, putting it out of reach for her, being an Android/Chromebook user. Neither Chrome nor Google Drive/Docs could open it. And I could only open it in Adobe Reader on my laptop - not Firefox, not Chrome, and not whatever default viewer my laptop has. We've had this problem with PDF's from another organization, too. It is a real problem.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#107

Post by Already__Taken » Thu, Dec 13, 2018, 1:22 PM UTC

singhrac wrote: post #105

wongarsu wrote: post #97

Earlier quoted context omitted.

To be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't…

Chromium uses Pdfium, which is based on the Foxit code base, actually, since they bought some pieces of it: https://www.foxitsoftware.com/blog/the-interesting-history-a... . Actually I've never had rendering bugs with Chrome, though it's certainly happened with Firefox.

We don't find bugs with it it's just limited. Can't highlight, can't rotate individual pages, can't save rotated pages (you have to "print" it to "Save as pdf" again, awful ux)

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#108

Post by Already__Taken » Thu, Dec 13, 2018, 1:23 PM UTC

Santosh83 wrote: post #94

microtonal wrote: post #85

Earlier quoted context omitted.

Which gives (except for pdf.js) more PDF readers written in C, some with a long history of CVEs, and typically not sandboxed by default. Since many people are using a PDF reader to read PDFs from relatively untrusted sources, do yourself a favor and at least use a reader that does not have full system access. macOS: Preview.app (uses macOS sandboxing) Linux: Evince Flatpak on Wayland (Flatpak uses sandboxing. Wayland…

> Windows: no clue I think UWP apps are sandboxed by default, so something like Xodo PDF could be a possibility.

or Edge

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#109

Post by shawnz » Thu, Dec 13, 2018, 1:35 PM UTC

wongarsu wrote: post #97

technion wrote: post #66

As much as many of us lament the state of much of today's software, if you think of products from a certain era - IE6, Flash, Java web applets - they all had a commonality in their code quality. These are mostly a non-issue these days, but it's not because they suddenly stopped having bugs and still get active use. I remember rolling out Adobe Reader in those days and as a product, I don't believe its core has change…

To be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't…

A counterpoint: for a while I was working at my uni's help desk, and we would ask all clients to print PDFs from Chrome as a matter of course just because it was so much more reliable at producing the correct output on paper, even when compared to Adobe Reader.

Re: 50 CVEs in 50 Days: Fuzzing Adobe Reader

#110

Post by [deleted] » Thu, Dec 13, 2018, 1:37 PM UTC

singhrac wrote: post #105

wongarsu wrote: post #97

Earlier quoted context omitted.

To be fair, in my experience Chrome's and Firefox's PDF viewers don't cut it. They are good for a quick preview, but especially when printing they occasionally render things slightly wrong, which is unacceptable for a file format whose entire point is to look the same everywhere. Also forms. That doesn't mean that there aren't any alternatives. Foxit for example is pretty good. But in-browser alternatives just aren't…

Chromium uses Pdfium, which is based on the Foxit code base, actually, since they bought some pieces of it: https://www.foxitsoftware.com/blog/the-interesting-history-a... . Actually I've never had rendering bugs with Chrome, though it's certainly happened with Firefox.

[deleted]