Live data from Hacker News

Firefox 88.0

mozilla.org

11–20 of 209 posts

Re: Firefox 88.0

#11
post #3

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

Disabled by default, right? Why would you open up such a stupid security hole?

Re: Firefox 88.0

#12
post #3

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

True, but I don't see how it would be any worse than running JS on any other web page. Assuming it is implemented in a safe way, that is.

Re: Firefox 88.0

#13
post #6
post #3

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

Is this using the browser's own JS engine? Do things like NoScript allow one to turn off PDF JS? On the flip side, are there any examples of PDF JS being actually useful and not a vector for tracking/exploits?

This desperately needs an option to disable PDF js.

Re: Firefox 88.0

#14
post #8

> Print updates: Margin units are now localized. Print in firefox is totally broken. The change to Chromium was the last nail in the coffin for printing. The new web does not care.

??? I print through Firefox all the time with no issues. What exactly were you experiencing?

Re: Firefox 88.0

#15
post #3

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

Can't find the video but there was a sec talk where the host would demonstrate a few horrendous ones.

maybe that one?

https://media.ccc.de/v/36c3-10832-how_to_break_pdfs

Re: Firefox 88.0

#16
post #3

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

I have an idea. Why not allow embedding a full browser engine inside of a PDF, complete with tabs and extensions? I hate having to leave Adobe Acrobat in order to read my Gmail, so I think this feature could be really useful. Anyone who builds a PDF can include their own custom browser that their users will love.

Re: Firefox 88.0

#17
>The ‘Take a Screenshot’ feature was removed from the Page Actions menu in the url bar.

Odd, this is the only place I accessed it from. Not a big deal as it's still on the context menu and also can be added as a tool bar item but I am curious the rationalization behind this change. That seemed like a great place to have it to me.

Re: Firefox 88.0

#18
> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features.

That's the first item listed under Features, yet I wouldn't classify that as a feature! That's a vulnerability waiting for an exploit.

Re: Firefox 88.0

#19
post #6
post #3

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

Is this using the browser's own JS engine? Do things like NoScript allow one to turn off PDF JS? On the flip side, are there any examples of PDF JS being actually useful and not a vector for tracking/exploits?

[deleted]

Re: Firefox 88.0

#20
post #3

> PDF forms now support JavaScript embedded in PDF files. Some PDF forms use JavaScript for validation and other interactive features. The amount of complexity that one can put into a PDF is both surprising and a tad frightening.

I have an idea. Why not allow embedding a full browser engine inside of a PDF, complete with tabs and extensions? I hate having to leave Adobe Acrobat in order to read my Gmail, so I think this feature could be really useful. Anyone who builds a PDF can include their own custom browser that their users will love.

Just run Emacs :)
Post reply on HN