Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Linux Running in a PDF

linux.doompdf.dev

Post reply on HN
Print view View original

51–60 of 116 posts

Re: Linux Running in a PDF

#51

Post by sigmoid10 »

neilv wrote: post #46

1. Linux Running in a PDF (doompdf.dev) 114 points by theden 4 hours ago | flag | hide | 37 comments 2. Ingesting PDFs and why Gemini 2.0 changes everything (sergey.fyi) 978 points by serjester 17 hours ago | flag | hide | 323 comments As people start bolting various kinds of PDF parsers and evaluators to LLMs, there's got to be some interesting hack potential.

PDFs have always been a highly attractive attack vector, because most people associate them purely with text and have no clue that you can easily embed executable code. Combine that with how atrociously many vulnerabilities there are in popular readers like acrobat, and you have a perfect gateway for getting your company hacked.

Re: Linux Running in a PDF

#53

Post by mschuster91 »

taurknaut wrote: post #23
yapyap wrote: post #16

Earlier quoted context omitted.

I mean if he’s searching for a good PDF reader I doubt he’ll be opening it in Adobe Reader

I had assumed it went the way of Adobe Flash many years ago.

It's still alive and kicking in anything government. Third party support for forms and other kinds of interactive stuff is ... lacking.

Re: Linux Running in a PDF

#54

Post by anthk »

sigmoid10 wrote: post #51
neilv wrote: post #46

1. Linux Running in a PDF (doompdf.dev) 114 points by theden 4 hours ago | flag | hide | 37 comments 2. Ingesting PDFs and why Gemini 2.0 changes everything (sergey.fyi) 978 points by serjester 17 hours ago | flag | hide | 323 comments As people start bolting various kinds of PDF parsers and evaluators to LLMs, there's got to be some interesting hack potential.

PDFs have always been a highly attractive attack vector, because most people associate them purely with text and have no clue that you can easily embed executable code. Combine that with how atrociously many vulnerabilities there are in popular readers like acrobat, and you have a perfect gateway for getting your company hacked.

Converting all your PDF's to max-quality sized DJVU's (at least the ones without forms) would be the first thing to do in any company. Maybe not for graphic design because $ADOBE, but for documentation it's perfectly safe to do so.

Re: Linux Running in a PDF

#55

Post by anthk »

nialv7 wrote: post #35

Using JS for this feels like cheating... I wonder if similar things would be possible with PostScript?

With PostScript you have zmachine.ps which is a ZMachine (zork and friends) interpreter to play text adventure games.

And OFC there's a chess engine in PS, a tic tac toe, and with patience you could even play NES games, but you might need to play with the stack a lot.

Re: Linux Running in a PDF

#56

Post by lemonberry »

sigmoid10 wrote: post #51
neilv wrote: post #46

1. Linux Running in a PDF (doompdf.dev) 114 points by theden 4 hours ago | flag | hide | 37 comments 2. Ingesting PDFs and why Gemini 2.0 changes everything (sergey.fyi) 978 points by serjester 17 hours ago | flag | hide | 323 comments As people start bolting various kinds of PDF parsers and evaluators to LLMs, there's got to be some interesting hack potential.

PDFs have always been a highly attractive attack vector, because most people associate them purely with text and have no clue that you can easily embed executable code. Combine that with how atrociously many vulnerabilities there are in popular readers like acrobat, and you have a perfect gateway for getting your company hacked.

I received a spam/scam text yesterday with a PDF embedded in it. I deleted it immediately. I also emailed my clients to let remind them not to open them either.

Re: Linux Running in a PDF

#57

Post by anthk »

ptspts wrote: post #40
nialv7 wrote: post #35

Using JS for this feels like cheating... I wonder if similar things would be possible with PostScript?

From the computation point of view, it's possible. PostScript has integer arithmetic operations needed for x86 CPU emulation. It also has mutable byte strings, which are useful as emulated memory.

PostScript it's Turing Complete. Get GhostScript, zmachine.ps and some game, such as calypso.z3. You can just ddg/google them freely.

Re: Linux Running in a PDF

#58

Post by anthk »

lima wrote: post #45
rolandog wrote: post #44

Does anyone know if running PDFs through the following filter (as in [0]) prevent malicious actors? gs \ -dNOPAUSE \ -sDEVICE=pdfwrite \ -sOUTPUTFILE=clean.pdf \ -dBATCH \ dirty.pdf [0]: https://tex.stackexchange.com/a/481609/29430

It can make things worse: Ghostscript is not particularly safe to run on untrusted/potentially malicious input. It has a giant attack surface and no proper mitigations, unlike the PDF reader in your browser. At a minimum, you'd have to sandbox it using something like gVisor.

GhostScript has -dSAFER as default since decades. If any, you can always use pdf2djvu to convert that PDF into a DJVU file. On the PDF in your browser... if it runs JS, you can get p0wned twice, even if it's sandboxes. Vuls in browsers are like segfaults with dubious codecs.
Post reply on HN