5 ms·

For comparison, NIST NVD lists 445 CVEs for Acrobat, or at least 17 per year since introduction. However CVEs haven't been maintained since the early 90s, so th

by _wmd 11y ago

For comparison, NIST NVD lists 445 CVEs for Acrobat, or at least 17 per year since introduction. However CVEs haven't been maintained since the early 90s, so that number should be much higher. I think pdf.js does just fine.

mike_hearn 11y ago
pdf.js does a lot less, of course. Really you should compare Firefox to Acrobat, as they are both rich media rendering apps with a lot of functionality.
- deleted 11y ago
  [deleted]
- wlesieutre 11y ago
  pdf.js does a lot less, just how I like it. I can view PDFs and not have a constant stream of critical vulnerabilities to worry about. Did you know Acrobat supports viewing 3D models in PDFs? Not even kidding[1]. It has an unnecessarily huge attack surface. I will never use that and I work in engineering at a factory. [1] For example, http://help.actify.com/download/attachments/6651965/SF_export_pdf_acrobat_reader.png?version=1&modificationDate=1340282613673&api=v2 http://help.actify.com/download/attachments/6651965/SF_expor...
- Drdrdrq 11y ago
  Pdf.js does less, but in most cases it does all the things users ever wanted from Acrobat, so the comparison is sound.
- slrz 11y ago
  One of the points of something like pdf.js is that in most cases you don't need all that extra fluff. You just want to look at some PDF. So doing less is exactly what allows pdf.js to be (more) secure.
mappu 11y ago
>CVEs haven't been maintained since the early 90s Can you clarify what you mean by this?
- ak4g 11y ago
  The wording was confusing for me too. At first reading I understood it as saying CVEs were no longer being issued for Acrobat, which definitely isn't the case. I assume the intended meaning was that Acrobat was first released in 1993[0], but the first CVE was CVE-1999-0001 (source: downloaded the raw dump from [1], ran grep -m1 CVE-....-0001). But, I'm doubtful there would have been all that many CVEs issued for Acrobat from 1993-1998. There was only one CVE that mentioned "Acrobat" each year from 1999-2001, and three in 2002. The more recent years are the fun ones - but I have no idea whether that's a result of freshly-introduced exploitable bugs or just increased attention. [0]: https://en.wikipedia.org/wiki/Adobe_Acrobat_version_history https://en.wikipedia.org/wiki/Adobe_Acrobat_version_history [1]: https://cve.mitre.org/data/downloads/index.html https://cve.mitre.org/data/downloads/index.html

by _wmd 11y ago

mike_hearn 11y ago

pdf.js does a lot less, of course. Really you should compare Firefox to Acrobat, as they are both rich media rendering apps with a lot of functionality.

deleted 11y ago
[deleted]
wlesieutre 11y ago
pdf.js does a lot less, just how I like it. I can view PDFs and not have a constant stream of critical vulnerabilities to worry about. Did you know Acrobat supports viewing 3D models in PDFs? Not even kidding[1]. It has an unnecessarily huge attack surface. I will never use that and I work in engineering at a factory. [1] For example, http://help.actify.com/download/attachments/6651965/SF_export_pdf_acrobat_reader.png?version=1&modificationDate=1340282613673&api=v2 http://help.actify.com/download/attachments/6651965/SF_expor...
Drdrdrq 11y ago
Pdf.js does less, but in most cases it does all the things users ever wanted from Acrobat, so the comparison is sound.
slrz 11y ago
One of the points of something like pdf.js is that in most cases you don't need all that extra fluff. You just want to look at some PDF. So doing less is exactly what allows pdf.js to be (more) secure.

mappu 11y ago

>CVEs haven't been maintained since the early 90s Can you clarify what you mean by this?

ak4g 11y ago
The wording was confusing for me too. At first reading I understood it as saying CVEs were no longer being issued for Acrobat, which definitely isn't the case. I assume the intended meaning was that Acrobat was first released in 1993[0], but the first CVE was CVE-1999-0001 (source: downloaded the raw dump from [1], ran grep -m1 CVE-....-0001). But, I'm doubtful there would have been all that many CVEs issued for Acrobat from 1993-1998. There was only one CVE that mentioned "Acrobat" each year from 1999-2001, and three in 2002. The more recent years are the fun ones - but I have no idea whether that's a result of freshly-introduced exploitable bugs or just increased attention. [0]: https://en.wikipedia.org/wiki/Adobe_Acrobat_version_history https://en.wikipedia.org/wiki/Adobe_Acrobat_version_history [1]: https://cve.mitre.org/data/downloads/index.html https://cve.mitre.org/data/downloads/index.html