4 ms·
PDFium wins on functionality and performance; I thought pdf.js won on security but this vulnerability makes me wonder. If PDFium and pdf.js are on par (or even
by surrealize 11y ago
PDFium wins on functionality and performance; I thought pdf.js won on security but this vulnerability makes me wonder. If PDFium and pdf.js are on par (or even close) security-wise, in my view that tilts the tradeoff toward PDFium.
- pcwalton 11y agoDo not mentally categorize software into "has never had a vulnerability" versus "has had vulnerabilities" buckets. Especially for software as widely used, and as closely scrutinized, as browsers.
- JoshTriplett 11y ago> Do not mentally categorize software into "has never had a vulnerability" versus "has had vulnerabilities" buckets. Right. Software that has never had a vulnerability is either 1) software that has never had careful scrutiny, 2) software that has no potential security implications whatsoever, or 3) software that has gone through some formal verification and proof process (exceedingly rare).
- surrealize 11y agoI don't think I did. Security is obviously not a black-and-white thing, and my words "on par" and "close" are entirely consistent with a shades-of-grey view. Nonetheless, the posterior distribution shifts based on new evidence. Are you making a claim about which one is more secure? I'm genuinely curious about how they stack up against one another. pdf.js is obviously managed code, which I'm sure helps. But it also seems like it has less person-power behind it, now and historically. Do you agree with that perception? Why or why not?
- pcwalton 11y agoI don't know how many people work on PDFium. But I don't think that it's particularly relevant to security whether 3 people or 30 people work on a project. Both Chrome and Firefox are fully maintained with top-notch security teams.