4 ms·

Early History of PostScript (1985)

37 points by _acme 10y ago

616c 10y ago
So I started to read about Postscript in attempt to learn more about printers and what's hackable about them. I know all the embedded stuff is about using embedded web servers with crap configs and coding, but there is something appealing to the potential of powning a printer by just sending it a print job. Has anyone studied that, a la devttys0.com, and how did you get there? I am digging through old PS books, so I am hoping in a decade when I finish that to learn from your comments if left here. Haha.
- tacostakohashi 10y ago
  Some of the best resources are: PostScript Language Reference Manual (PLRM) http://hepd.pnpi.spb.ru/docs_html/ThinkingInPostScript.pdf http://hepd.pnpi.spb.ru/docs_html/ThinkingInPostScript.pdf Experiment with GhostScript, the #ghostscript channel on freenode Although PostScript is a complete programming language, allowing obvious attacks like going into an infinite loop, exhausting memory, etc, it's also easy enough for the printer to sandbox print jobs to prevent you from doing anything too nasty. Also, PostScript is really on used to define the print job output, it doesn't give you low-level control over the hardware or anything.
  - Someone 10y ago
    It's not low-level, but you could send faxes from some Apple Laserwriters from postscript (although that may not have been a generic faxing ability, according to https://en.m.wikipedia.org/wiki/Stump_the_Experts#Sample_Questions https://en.m.wikipedia.org/wiki/Stump_the_Experts#Sample_Que...)
    - 616c 10y ago
      Cool. Now only to find an Apple Laserwriter in my neck of the woods. Haha.
  - 616c 10y ago
    This is the book I am referring to. As for ghostscript, good point. Is it used enough even on the printer side to be exploitable, or you mean exploiting clients sending print jobs? I don't follow 100%.
    - GregBuchholz 10y ago
      What do you mean by exploiting or owning a postscript printer? By its nature you send it programs expressed in a Turing complete language, and it executes them. The Blue Book is a nice PostScript tutorial: http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF
      - 616c 10y ago
        I thought I was to infer from the parent commenter that the fun is learning to write Postscript documents to send to a program and use vulnerabilities in Ghostscript, and that would be useful in compromising a printer itself. For example, if I want to DoS a printer, I send it a corrupt job, with intentionally nasty PS directives. I have seen people do that. But what if we take it a step further? I want print jobs stored on the printer, with potentially sensitive info. Do HP printers at the software level use Ghostscript on some models, and I can use known parsing problems to get gs to dump memory, or file system info, that I can later find through Embedded JetDirect admin web server or other means? Can I use it gain root and then make reverse shells? I know some modern printers run embedded Linux, but that's all I know. Again, I am interested to know if ghostscript is just a known Postscript platform generally or it is also used in printer themselves, is a useful exploit vector, and I am ignorant. Either way, I am ignorant. I am new to this domain and wish to learn more. Sorry for the dumb questions. (Also have the Blue Book in my list of lazy/bored reading materials.)
        tacostakohashi 10y ago
        ghostscript is licensed and embedded in some printers, so if you found and exploit, it's quite likely it would work on those printers too. However, I suggested it mainly as convenient implementation to learn & experiment with, since it's a very faithful implementation of the spec.
  - agumonkey 10y ago
    Typography reminiscent of ThinkingForth ..
imglorp 10y ago
Time to cue the NeWS reminiscing. Around that time, X11, NeXT computer, Apollo Domain, and SUN (where the network was the computer) were all pondering how get programs to run on one machine and output on another. Printers and display screens were kind of the same thing if you though in terms of shipping a vector program around instead of a bitmap, so there were a number of advantages to that scheme. Of course, X went the bitmap route. But Sun Openwindows was built on PS, and it was glorious. * https://en.wikipedia.org/wiki/NeWS https://en.wikipedia.org/wiki/NeWS * https://en.wikipedia.org/wiki/Display_PostScript https://en.wikipedia.org/wiki/Display_PostScript * http://art.net/~hopkins/Don/lang/NeWS.html http://art.net/~hopkins/Don/lang/NeWS.html Not to be confused with Sony NEWS... https://en.wikipedia.org/wiki/Sony_NEWS https://en.wikipedia.org/wiki/Sony_NEWS
- arethuza 10y ago
  Somewhere on my personal ToDo list is to get hold of a suitable SPARC box and get HyperNeWS running again to see if it really was as awesome as I remember.
- markc 10y ago
  I remember the fateful announcement of MIT choosing X-Windows over NeWS. It seemed obvious that NeWS was the more elegant solution, but lost out over what was apparently a mix of political and technical reasons. What a huge fork in the road that was.
- agumonkey 10y ago
  Hold on, Don Hopkins is on HN; he gave me a huge list of things to read since the days of NeWS. url incoming... done: https://news.ycombinator.com/item?id=11520680 https://news.ycombinator.com/item?id=11520680 ps: he made other lengthy comments full of gems; check his comment thread.
markc 10y ago
>"There are four PostScript printers announced and demonstrated by three OEM vendors..." Brian Reid must have written this shortly before DEC announced its PostScript printer. I was involved in projects interrupted by PostScript's ascendancy - twice. 1) Circa 1984-85, Digital Equipment Corp. (DEC) Hardcopy I/O group was building a high-speed (40PPM) laser printer. The initial graphics language was GIDIS, a DEC proprietary graphics language. Mid-project, we had an abrupt change of direction. We were flown from Maynard, MA (helicopter to Logan!) to Adobe in Palo Alto to meet the team there, including Chuck Geschke, and got the lowdown on PostScript. Based on the meeting, we changed our bit-slice processor firmware from interpreting GIDIS to a single drawing primitive: draw-trapezoid. The Adobe PS interpreter spit out trapezoids and we rendered them. Worked quite well, though the change of direction killed our graphics interpreter development project which involved rather interesting algorithms for things like filling bound areas, Bresenham's line drawing algorithm, curve/ellipse rendering, pattern rendering, etc. 2) Shortly thereafter I was working on an Interpress interpreter for Intel 80286 at Compugraphic Corp. Somewhat hellish given the interpreter didn't fit in memory and there was no "virtual memory" so we needed to manually swap in/out memory segments. We had a Xerox Star for a compatibility reference standard. Fun toy. Along with our Apple Lisa, it was among the first WIMP interface machines I ever used. Mid-project the Interpress interpreter project was canned in favor of PostScript which was becoming dominant. Interpress was a very efficient byte-level encoding, but PostScript was much more interesting. As an HP calculator fan, I found the use of a stack and postfix fairly natural and I hand-edited a fair amount of PostScript for testing / debugging / experimentation.
jacquesm 10y ago
This is a very nice postscript related story in a recent HN comment about Wes Clark: https://news.ycombinator.com/item?id=11184792 https://news.ycombinator.com/item?id=11184792

37 points by _acme 10y ago

616c 10y ago

So I started to read about Postscript in attempt to learn more about printers and what's hackable about them. I know all the embedded stuff is about using embedded web servers with crap configs and coding, but there is something appealing to the potential of powning a printer by just sending it a print job. Has anyone studied that, a la devttys0.com, and how did you get there? I am digging through old PS books, so I am hoping in a decade when I finish that to learn from your comments if left here. Haha.

tacostakohashi 10y ago
Some of the best resources are: PostScript Language Reference Manual (PLRM) http://hepd.pnpi.spb.ru/docs_html/ThinkingInPostScript.pdf http://hepd.pnpi.spb.ru/docs_html/ThinkingInPostScript.pdf Experiment with GhostScript, the #ghostscript channel on freenode Although PostScript is a complete programming language, allowing obvious attacks like going into an infinite loop, exhausting memory, etc, it's also easy enough for the printer to sandbox print jobs to prevent you from doing anything too nasty. Also, PostScript is really on used to define the print job output, it doesn't give you low-level control over the hardware or anything.
- Someone 10y ago
  It's not low-level, but you could send faxes from some Apple Laserwriters from postscript (although that may not have been a generic faxing ability, according to https://en.m.wikipedia.org/wiki/Stump_the_Experts#Sample_Questions https://en.m.wikipedia.org/wiki/Stump_the_Experts#Sample_Que...)
  - 616c 10y ago
    Cool. Now only to find an Apple Laserwriter in my neck of the woods. Haha.
- 616c 10y ago
  This is the book I am referring to. As for ghostscript, good point. Is it used enough even on the printer side to be exploitable, or you mean exploiting clients sending print jobs? I don't follow 100%.
  - GregBuchholz 10y ago
    What do you mean by exploiting or owning a postscript printer? By its nature you send it programs expressed in a Turing complete language, and it executes them. The Blue Book is a nice PostScript tutorial: http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF http://www-cdf.fnal.gov/offline/PostScript/BLUEBOOK.PDF
    - 616c 10y ago
      I thought I was to infer from the parent commenter that the fun is learning to write Postscript documents to send to a program and use vulnerabilities in Ghostscript, and that would be useful in compromising a printer itself. For example, if I want to DoS a printer, I send it a corrupt job, with intentionally nasty PS directives. I have seen people do that. But what if we take it a step further? I want print jobs stored on the printer, with potentially sensitive info. Do HP printers at the software level use Ghostscript on some models, and I can use known parsing problems to get gs to dump memory, or file system info, that I can later find through Embedded JetDirect admin web server or other means? Can I use it gain root and then make reverse shells? I know some modern printers run embedded Linux, but that's all I know. Again, I am interested to know if ghostscript is just a known Postscript platform generally or it is also used in printer themselves, is a useful exploit vector, and I am ignorant. Either way, I am ignorant. I am new to this domain and wish to learn more. Sorry for the dumb questions. (Also have the Blue Book in my list of lazy/bored reading materials.)
      - tacostakohashi 10y ago
        ghostscript is licensed and embedded in some printers, so if you found and exploit, it's quite likely it would work on those printers too. However, I suggested it mainly as convenient implementation to learn & experiment with, since it's a very faithful implementation of the spec.
- agumonkey 10y ago
  Typography reminiscent of ThinkingForth ..

imglorp 10y ago

Time to cue the NeWS reminiscing. Around that time, X11, NeXT computer, Apollo Domain, and SUN (where the network was the computer) were all pondering how get programs to run on one machine and output on another. Printers and display screens were kind of the same thing if you though in terms of shipping a vector program around instead of a bitmap, so there were a number of advantages to that scheme. Of course, X went the bitmap route. But Sun Openwindows was built on PS, and it was glorious. * https://en.wikipedia.org/wiki/NeWS https://en.wikipedia.org/wiki/NeWS * https://en.wikipedia.org/wiki/Display_PostScript https://en.wikipedia.org/wiki/Display_PostScript * http://art.net/~hopkins/Don/lang/NeWS.html http://art.net/~hopkins/Don/lang/NeWS.html Not to be confused with Sony NEWS... https://en.wikipedia.org/wiki/Sony_NEWS https://en.wikipedia.org/wiki/Sony_NEWS

arethuza 10y ago
Somewhere on my personal ToDo list is to get hold of a suitable SPARC box and get HyperNeWS running again to see if it really was as awesome as I remember.
markc 10y ago
I remember the fateful announcement of MIT choosing X-Windows over NeWS. It seemed obvious that NeWS was the more elegant solution, but lost out over what was apparently a mix of political and technical reasons. What a huge fork in the road that was.
agumonkey 10y ago
Hold on, Don Hopkins is on HN; he gave me a huge list of things to read since the days of NeWS. url incoming... done: https://news.ycombinator.com/item?id=11520680 https://news.ycombinator.com/item?id=11520680 ps: he made other lengthy comments full of gems; check his comment thread.

markc 10y ago

>"There are four PostScript printers announced and demonstrated by three OEM vendors..." Brian Reid must have written this shortly before DEC announced its PostScript printer. I was involved in projects interrupted by PostScript's ascendancy - twice. 1) Circa 1984-85, Digital Equipment Corp. (DEC) Hardcopy I/O group was building a high-speed (40PPM) laser printer. The initial graphics language was GIDIS, a DEC proprietary graphics language. Mid-project, we had an abrupt change of direction. We were flown from Maynard, MA (helicopter to Logan!) to Adobe in Palo Alto to meet the team there, including Chuck Geschke, and got the lowdown on PostScript. Based on the meeting, we changed our bit-slice processor firmware from interpreting GIDIS to a single drawing primitive: draw-trapezoid. The Adobe PS interpreter spit out trapezoids and we rendered them. Worked quite well, though the change of direction killed our graphics interpreter development project which involved rather interesting algorithms for things like filling bound areas, Bresenham's line drawing algorithm, curve/ellipse rendering, pattern rendering, etc. 2) Shortly thereafter I was working on an Interpress interpreter for Intel 80286 at Compugraphic Corp. Somewhat hellish given the interpreter didn't fit in memory and there was no "virtual memory" so we needed to manually swap in/out memory segments. We had a Xerox Star for a compatibility reference standard. Fun toy. Along with our Apple Lisa, it was among the first WIMP interface machines I ever used. Mid-project the Interpress interpreter project was canned in favor of PostScript which was becoming dominant. Interpress was a very efficient byte-level encoding, but PostScript was much more interesting. As an HP calculator fan, I found the use of a stack and postfix fairly natural and I hand-edited a fair amount of PostScript for testing / debugging / experimentation.

jacquesm 10y ago

This is a very nice postscript related story in a recent HN comment about Wes Clark: https://news.ycombinator.com/item?id=11184792 https://news.ycombinator.com/item?id=11184792