4 ms·

Every major browser has a built-in PDF viewer (except maybe Safari? I don't own a mac). Mozilla's is the only one that's written in JS. The rest are proprietary

Every major browser has a built-in PDF viewer (except maybe Safari? I don't own a mac). Mozilla's is the only one that's written in JS. The rest are proprietary native blobs. There have been security vulnerabilities (significant ones) found in the native PDF viewer blobs before, so given the choice between a same-origin policy breakage in pdf.js and an exploit in a native PDF viewer that can own my entire machine, I'll take pdf.js any day. Maybe it would be better if browsers didn't have a pdf viewer, though. Then I'd have to manually download it and open it in a viewer to get owned, which is not going to happen with an ad network. The fact that every major pdf viewer app tries to install a browser plugin doesn't help.

tim333 11y ago
>Maybe it would be better if browsers didn't have a pdf viewer I think the main reason Chrome bothered making one was because Adobe's reader kept having security vulnerabilities. I trust Chrome's one more than Adobe's. (I just looked up cvedetails.com for Adobe » Acrobat Reader. Security Vulnerabilities Total number of vulnerabilities : 434)
realityking 11y ago
> except maybe Safari? I don't own a mac Safari uses the same library as Apple's Reader. So it's a proprietary native blob. Edit: While Chrome uses a native blob, I believe it's not proprietary. I think they use pdfium (https://pdfium.googlesource.com/pdfium/ https://pdfium.googlesource.com/pdfium/)
- TazeTSchnitzel 11y ago
  It is proprietary, but PDF is the foundation of OS X's graphics, so it's very well-tested.
  - mccr8 11y ago
    Being well-tested from the perspective of regular use is not quite the same as being well-tested from the perspective of defending against a hostile actor.