Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Making a PDF that's larger than Germany

alexwlchan.net

Post reply on HN
Print view View original

131–140 of 156 posts

Re: Making a PDF that's larger than Germany

#131

Post by kevincox »

grotorea wrote: post #122
berkes wrote: post #98

Earlier quoted context omitted.

What javascript can escape my browser, (edit: or an HTML page) for example?

Are the non-browser PDF readers more vulnerable? Do most even execute the Javascript?

I would expect so simply because browsers are fairly hardened pieces of software. Adobe Acrobat is decently hardened but it seems to be far behind browsers.

It is worth noting that Chromium and later Firefox both added PDF viewers that live inside the browser sandbox. They are essentially web-apps that render the PDF. When I worked at Google they strongly recommended using Chrome for opening PDF files because they felt much more comfortable about its security and sandboxing than other PDF readers.

On another perspective is that you are likely browsing the internet anyways. In fact you likely got the PDF by visiting a website. So you have already exposed a huge attack surface (your browser) to a possible hostile adversary. It is better to expose them to the same attack surface again (plus whatever security the PDF reader itself provides) than to give them a fresh new attack surface.

Re: Making a PDF that's larger than Germany

#132

Post by afiori »

venusenvy47 wrote: post #125
amelius wrote: post #92

Earlier quoted context omitted.

PDF is an executable file. Many people are worried about running Javascript but still use PDF files without problems.

Is it really executable on the OS? Doesn't it require a native application to run it on an OS?

No, they are not executable by the OS (generally).

Formats are on a gradient between "completely code" and "completely data" and PDFs are quite close to the "completely code" extreme'; I guess this is what the parent meant.

Re: Making a PDF that's larger than Germany

#133

Post by afiori »

berkes wrote: post #126
lukan wrote: post #110

Earlier quoted context omitted.

XMLHttpRequest to send anything the site knows anywhere. And row hammer, to breach the sandbox. https://en.wikipedia.org/wiki/Row_hammer

Row hammer is an exploit. It wasn't "by design". While that may technically be "escaping the sandbox" it's a different case, because it was never meant to work, will be fixed and often is fixed.

Almost every "escaping the sandbox" is due to some kind of bug.

Sure if the PDF standard exposed a "globalThis.runBlobAsNativeExecutable" function it would be worse, but it is still escaping the sandbox.

Re: Making a PDF that's larger than Germany

#134

Post by Elzair »

shp0ngle wrote: post #95
jl6 wrote: post #68

PDF is a fabulous format. I mean, it’s an awful format in so many ways, technically speaking, but the net effect of having a self-contained static file in your custody stands in blissful contrast to the user-hostile dynamic/SaaS website that can be taken away at a moment’s notice. PDF/A is the true PDF - it strips out most of the dangerous cruft. Anyway, if you like weird PDF hijinks, here’s a polyglot PDF/A CSV file…

about pdf/a... until recently there was not even an easy way to figure out if pdf is really pdf/a; now there is (verapdf) and it's crazy complex piece of software and maybe I'm wrong but the only way to convert arbitrary pdf to pdf/a with open source software is to convert it to postscript and back with ghostscript - which is affero licensed... with all the possible problems it entails. (there is old version that is…

You could use the pdfium library as an alternative to Ghostscript.

Re: Making a PDF that's larger than Germany

#135

Post by JKCalhoun »

da_chicken wrote: post #118
JKCalhoun wrote: post #113

Earlier quoted context omitted.

PDF is supposed to a be a printer format, not a word processing document format. While I too would love to nail down a PDF subset to be a standard (for example requiring the accessibility tags that make text extraction easy) perhaps trying to create a hybrid format, one that satisfies both printers and resizable windows, is already an impossible goal. (I've always had to keep my love of PDF a secret from fellow nerds…

I really appreciate what PDF can accomplish, but I also really dislike that it turns into a black box. There really ought to be something that can describe a document structure and also describe document layout in a durable and portable manner. In the range of XML/JSON HTML+CSS PDF PS RAW, it really does feel like there's something missing between HTML and PDF. And it can't be LaTeX, because the document shouldn't be…

ePub is kind of trying to be that? Or maybe that hews too close to HTML.

It can reflow but tries to paginate HTML ... the way printing a web page tries to paginate HTML, ha ha.

Re: Making a PDF that's larger than Germany

#136

Post by financypants »

ourmandave wrote: post #103
jl6 wrote: post #68

PDF is a fabulous format. I mean, it’s an awful format in so many ways, technically speaking, but the net effect of having a self-contained static file in your custody stands in blissful contrast to the user-hostile dynamic/SaaS website that can be taken away at a moment’s notice. PDF/A is the true PDF - it strips out most of the dangerous cruft. Anyway, if you like weird PDF hijinks, here’s a polyglot PDF/A CSV file…

The "in your custody" part is important, when Amazon starts yoinking books from your account. https://www.nytimes.com/2009/07/18/technology/companies/18am...

I buy all my books paperback, even if I listen to them on audible, for posterity’s sake.

Re: Making a PDF that's larger than Germany

#137

Post by peterldowns »

JKCalhoun wrote: post #114
amelius wrote: post #92

Earlier quoted context omitted.

PDF is an executable file. Many people are worried about running Javascript but still use PDF files without problems.

For better or worse, the years I spent working on Preview for Apple (and PDFKit) I felt bad that our (Apple's) PDF implementation was far short of Adobe's. Radars would show up with PDFs attached, "Preview Does Not Display 3D Image in PDF Like Acrobat" or similar. And I would feel so ... inadequate. PDFKit could render and capture basic annotations ... and that was about it. We could show you forms, allow editing, bu…

If it makes you feel any better, Preview is by far the best PDF viewer and editor (I use it for signatures and adding text) I've ever used. I like that the PDF previews in Finder are instant and accurate. I like that it shows as much PDF and as little UI/menubar as possible. I like that it never asks me to upgrade or log in. The search tools work well. I can stitch PDFs together (if I google how to, always forget) and pull certain pages out as their own files.

For all of the PDFs I've ever encountered, Preview has been sufficient and capable. Thank you for your hard work!

Re: Making a PDF that's larger than Germany

#138

Post by SpaghettiCthulu »

eirikbakke wrote: post #129
amelius wrote: post #92

Earlier quoted context omitted.

PDF is an executable file. Many people are worried about running Javascript but still use PDF files without problems.

When I ordered an official PDF copy of my college diploma, the order form had an option to enable "tracking" in the PDF file. Sure enough, when the recipient opened the PDF file (and when I tried it myself on a different machine), I got a notification from the company that generated the PDF...

That's horrific! I had no idea that was even a feature of PDFs!

Re: Making a PDF that's larger than Germany

#139

Post by shiftpgdn »

financypants wrote: post #136
ourmandave wrote: post #103

Earlier quoted context omitted.

The "in your custody" part is important, when Amazon starts yoinking books from your account. https://www.nytimes.com/2009/07/18/technology/companies/18am...

I buy all my books paperback, even if I listen to them on audible, for posterity’s sake.

Do you buy them after you’ve finished listening?

Re: Making a PDF that's larger than Germany

#140

Post by svantana »

tremarley wrote: post #27

“But unlike Acrobat, the Preview app doesn’t have an upper limit on what we can put in MediaBox. It’s perfectly happy for me to write a width which is a 1 followed by twelve 0s: Screenshot of Preview’s Document inspector, showing the page size of 352777777777.78 x 10.59 cm. If you’re curious, that width is approximately the distance between the Earth and the Moon. I’d have to get my ruler to check, but I’m pretty sur…

By my counting, that document is ~ 373 km^2, which is much smaller than germany. It turns out the ruler was needed after all
Post reply on HN