7 ms·

This sounds very strange to me. Many people are pretty excited that Mozilla is doing this Rust thing and trying to move the rendering engine to a safer language

by hannob 10y ago

This sounds very strange to me. Many people are pretty excited that Mozilla is doing this Rust thing and trying to move the rendering engine to a safer language. And now they start a project that: a) wants to keep flash alive longer. b) wants to replace their javascript (aka already memsafe) PDF renderer with a C++ one. I mean I get that pdf.js is not perfect. It had some bad security vulns in the past. But pdfium also has a pretty bad wrap when it comes to vulns (I got plenty of bounties for it myself). But more than that: It's moving from a memsafe language back to C++. That doesn't seem to make any sense at all. If anything they should move their PDF renderer to Rust. And Flash... please just let it die in peace and don't put any more effort into supporting it.

makomk 10y ago
Hell, even I managed to get a vuln bounty out of PDFium despite never actually looking for vulnerabilities in it.
geofft 10y ago
The Pepper API is supposed to be super easily sandboxable, though, right? It would be extremely strange if they decided to run PDFium and Pepper Flash unsandboxed, since I expect that the upstream projects treat them in the security model where Chrome sandboxes them. But if they are sandboxing it (and hopefully writing the sandbox in a memory-safe language), does it matter much? Or am I just completely confused?
- deleted 10y ago
  [deleted]
- dmix 10y ago
  Firefox sandboxes plugins like Flash and DRM plugins [1]. They weren't sandboxing web content previously (which I assume means PDF.js wasn't sandboxed?). But they announced this year [2] that they will be copying Chrome's security model and again supporting per-tab sandboxing. Instead of running all web content in one big process. Not sure if this was rolled out yet. [1] https://support.mozilla.org/en-US/questions/1111998 https://support.mozilla.org/en-US/questions/1111998 [2] http://www.myce.com/news/firefox-finally-gets-sandboxing-improve-security-stability-performance-79102/ http://www.myce.com/news/firefox-finally-gets-sandboxing-imp...
dmix 10y ago
I really hope their security people push back on this (assuming they haven't already trumped security people who had a say in these high level decisions). Although I didn't read the flash thing as finding a reason to keep it longer? Edit: removed comment about Chromium, I forgot PDF.js was manually installed :p
- throwaway2048 10y ago
  Chrome's PDF reader is based off of foxit, which is also C++.
  - deleted 10y ago
    [deleted]
  - dmix 10y ago
    Right, PDFium is the default. I've been using the PDF.js plugin for a while now and disabled the default via chrome://plugins. Fortunately Chrome stopped supporting Foxit and Adobe PDF plugins with version 45 (released a year ago) when they depreciated NPAPI. > As of Chrome 45, support for old, insecure NPAPI plugins is permanently removed. I believe Adobe Reader and Foxit Reader both integrate with web browsers through NPAPI plugins. If so, the old NPAPI-based Adobe Reader and Foxit Reader no longer works in Chrome, regardless of whichever version you have installed. http://www.chromium.org/developers/npapi-deprecation http://www.chromium.org/developers/npapi-deprecation It's interesting that they still expose their own C++ code to remote PDFs which apparently had some servere bugs: http://blog.talosintel.com/2016/06/pdfium.html http://blog.talosintel.com/2016/06/pdfium.html
  - ComodoHacker 10y ago
    Do you have a source for this?
    - izacus 10y ago
      Uh, you can easily see it in the Chrome source itself? Google actually maintains the fork itself here: https://pdfium.googlesource.com/ https://pdfium.googlesource.com/
JohnTHaller 10y ago
There is a ton of existing valuable, fun, educational, historical, etc Flash content on the web. There's no reason to cut off access to it if it can be handled more securely and more cheaply, which is what this project is intending to do. If they convert to this new system, they can retire a chunk of the older plugin framework which will soon only allow Flash anyway.
- WhitneyLand 10y ago
  Maybe it's worth someone else keeping access to the existing content alive, but that doesn't mean it has to live inside Firefox and use up time and money that could be better invested in forward looking tech. Separate projects/apps should instead be maintained by whomever thinks it's worth the investment. If no one else steps up to maintain such a niche Flash project, then we know maybe the content wasn't worth saving.
  - jbpetersen 10y ago
    Personally I'd like to see money and/or talent tossed at The Internet Archive for things like this. Flash support runs contrary to maintaining a modern browser, while it's entirely aligned with the mission to preserve parts of the internet as reference material.
- scrollaway 10y ago
  Shumway. Shumway shumway SHUMWAY! This is what Shumway was supposed to be for. Creating a Flash runtime in javascript/html5 which would allow all that "existing valuable fun, educational, historical etc Flash content" to live on, without making it attractive to continue creating Flash content. Allowing all that content to be archived for the future. Unfortunately, according to that same thread, Shumway's been killed off. Without shumway, we're now losing a huge chunk of the web's early history and the first years of online video games, gaming on the web, etc. Whatever.
  - moron4hire 10y ago
    Homestar Runner alone is worth it.
cpeterso 10y ago
PDF.js doesn't support PDF forms, while PDFium does. Like Shumway and Flash, the long-tail of PDF compatibility is a lot of work spent on something that is not part of the Web.
- caf 10y ago
  Is that actually something you need in your browser's default PDF renderer, though?
  - izacus 10y ago
    Of course. It's part of the PDF standard and PDF government forms and similar that you just fill out and print are very common. So switching to Pdfium means added user friendliness and convenience for users and significantly higher performance (when we last evaluated PDF.js, it was far from fast).
  - CJefferson 10y ago
    It is if your browser's default behaviour is to use the built in renderer. I've been confused in the past that a PDF was "broken", when in practice it was Firefox.
hellofunk 10y ago
> It's moving from a memsafe language back to C++ JS a safer language than C++? I would argue the opposite.
- Manishearth 10y ago
  Any vulnerability that can be caused in PDF.js due to a JS engine bug can be caused by a regular website. IIRC it doesn't access privileged apis.
- pcwalton 10y ago
  How many use-after-frees leading to remote code execution have you seen in JavaScript?
- aikah 10y ago
  It is certainly memory safe. C++ is obviously not.
bobajeff 10y ago
I'm pretty sure they're still on path to deprecate flash regardless of which plugin api it's using. That said it doesn't look like they are on path to integrate pepper-flash in any reasonable timeline. It's not even listed in the goals/milestones. It may be too complicated as I've heard the sentiment that pepper-flash uses 150% of PPAPI.
necessity 10y ago
I for one find it funny that they claim they wish to reduce the time spent on "a complete web browsing experience, but are not a core piece of the Web platform" reduce complexity and maintenance cost etc, and start with... maintaining their useless PDF viewer. Take it off your code base. Is it a browser or a PDF viewer? I guess expecting sanity from Mozilla really is insane.
- AlphaSite 10y ago
  Integrated PDF viewers are pretty much a necessary for a little of people.
- barnacs 10y ago
  I don't get this whole trend of trying to cram everything into browsers. People have been working on PDF viewers, media players, document editors and a whole bunch of applications for decades. Some are more lightweight, some are more feature rich, others are prettier, easier to use or more reliable. Yet there's this weird trend to throw all that away and reimplement everything as part of this huge beast. Why?
  - TeMPOraL 10y ago
    Part of the appeal may simply be an UX thing. For instance, I don't think a PDF reader should be a part of the browser codebase, but when I'm reading papers I found on HN, I like it that the PDF opens as another browser tab, not a separate application window.
    - barnacs 10y ago
      I think browsers shouldn't really have tabs in the first place. That's the job of a window manager. And then you can decide which one to use. Do you want tiling or floating windows? Do you want workspaces? Stacked, tabbed, side-by-side layouts? Hotkeys or UI for navigation? Performance or features? And so on.
      - TeMPOraL 10y ago
digi_owl 10y ago
I fear that Mozilla is going the way of Opera. They can't keep up with the juggernauts with full time staff (Google, MS, Apple) so they are caving in and slowly going "me too".
- alphapapa 10y ago
  Don't they pull in several hundred million dollars a year? Shouldn't they be able to hire enough staff to develop Firefox with that money?
  - Sylos 10y ago
    Well, Google, Microsoft and Apple pull in several billion per year... And in 2014, Mozilla had expenses of 212 million for software development, so they definitely do invest most of their budget there. https://static.mozilla.com/moco/en-US/pdf/Mozilla_Audited_Financials_2014.pdf https://static.mozilla.com/moco/en-US/pdf/Mozilla_Audited_Fi...
    - _Codemonkeyism 10y ago
      Sadly that report doesn't tell us where the 212 million went into, I would suspect not mainly in Firefox. Also it would be interesting what the 212 million of sofware development include from a payroll perspective, e.g. is it mostly developers, how much they are paid etc.
    - alphapapa 10y ago
      > Well, Google, Microsoft and Apple pull in several billion per year... Yes, but Mozilla doesn't also maintain the world's largest search engine, sell an operating system and office suite and gaming systems, or make computers, laptops, tablets, phones, and develop chips to run them on. All Mozilla does is make software. And they only have one primary product. If x hundred million dollars per year is not enough for them to do that, I don't think the problem is that they don't have enough money.
- jeswin 10y ago
  >Mozilla is going the way of Opera Nope, that's not happening. Instead, it seems Mozilla is investing more of their relatively smaller resources on the most important two things that actually matter: a) Browser engine and b) JavaScript. This is exactly what they should do. Produce the fastest, leanest, safest browser core. After playing with Servo, I feel it will be as big a release as the original Firefox was in the early 2000s.
blub 10y ago
And yet, shipping something that works and is performant while at the same time reducing development effort is apparently more important for Mozilla than using Rust or Javascript. In other words: market realities are more important than philosophical arguments about programming languages. They took the right decision IMO, they can't afford working on irrelevant side-projects when they're losing the browser war.

by hannob 10y ago

makomk 10y ago

Hell, even I managed to get a vuln bounty out of PDFium despite never actually looking for vulnerabilities in it.

geofft 10y ago

The Pepper API is supposed to be super easily sandboxable, though, right? It would be extremely strange if they decided to run PDFium and Pepper Flash unsandboxed, since I expect that the upstream projects treat them in the security model where Chrome sandboxes them. But if they are sandboxing it (and hopefully writing the sandbox in a memory-safe language), does it matter much? Or am I just completely confused?

deleted 10y ago
[deleted]
dmix 10y ago
Firefox sandboxes plugins like Flash and DRM plugins [1]. They weren't sandboxing web content previously (which I assume means PDF.js wasn't sandboxed?). But they announced this year [2] that they will be copying Chrome's security model and again supporting per-tab sandboxing. Instead of running all web content in one big process. Not sure if this was rolled out yet. [1] https://support.mozilla.org/en-US/questions/1111998 https://support.mozilla.org/en-US/questions/1111998 [2] http://www.myce.com/news/firefox-finally-gets-sandboxing-improve-security-stability-performance-79102/ http://www.myce.com/news/firefox-finally-gets-sandboxing-imp...

dmix 10y ago

I really hope their security people push back on this (assuming they haven't already trumped security people who had a say in these high level decisions). Although I didn't read the flash thing as finding a reason to keep it longer? Edit: removed comment about Chromium, I forgot PDF.js was manually installed :p

throwaway2048 10y ago
Chrome's PDF reader is based off of foxit, which is also C++.
- deleted 10y ago
  [deleted]
- dmix 10y ago
  Right, PDFium is the default. I've been using the PDF.js plugin for a while now and disabled the default via chrome://plugins. Fortunately Chrome stopped supporting Foxit and Adobe PDF plugins with version 45 (released a year ago) when they depreciated NPAPI. > As of Chrome 45, support for old, insecure NPAPI plugins is permanently removed. I believe Adobe Reader and Foxit Reader both integrate with web browsers through NPAPI plugins. If so, the old NPAPI-based Adobe Reader and Foxit Reader no longer works in Chrome, regardless of whichever version you have installed. http://www.chromium.org/developers/npapi-deprecation http://www.chromium.org/developers/npapi-deprecation It's interesting that they still expose their own C++ code to remote PDFs which apparently had some servere bugs: http://blog.talosintel.com/2016/06/pdfium.html http://blog.talosintel.com/2016/06/pdfium.html
- ComodoHacker 10y ago
  Do you have a source for this?
  - izacus 10y ago
    Uh, you can easily see it in the Chrome source itself? Google actually maintains the fork itself here: https://pdfium.googlesource.com/ https://pdfium.googlesource.com/

JohnTHaller 10y ago

There is a ton of existing valuable, fun, educational, historical, etc Flash content on the web. There's no reason to cut off access to it if it can be handled more securely and more cheaply, which is what this project is intending to do. If they convert to this new system, they can retire a chunk of the older plugin framework which will soon only allow Flash anyway.

WhitneyLand 10y ago
Maybe it's worth someone else keeping access to the existing content alive, but that doesn't mean it has to live inside Firefox and use up time and money that could be better invested in forward looking tech. Separate projects/apps should instead be maintained by whomever thinks it's worth the investment. If no one else steps up to maintain such a niche Flash project, then we know maybe the content wasn't worth saving.
- jbpetersen 10y ago
  Personally I'd like to see money and/or talent tossed at The Internet Archive for things like this. Flash support runs contrary to maintaining a modern browser, while it's entirely aligned with the mission to preserve parts of the internet as reference material.
scrollaway 10y ago
Shumway. Shumway shumway SHUMWAY! This is what Shumway was supposed to be for. Creating a Flash runtime in javascript/html5 which would allow all that "existing valuable fun, educational, historical etc Flash content" to live on, without making it attractive to continue creating Flash content. Allowing all that content to be archived for the future. Unfortunately, according to that same thread, Shumway's been killed off. Without shumway, we're now losing a huge chunk of the web's early history and the first years of online video games, gaming on the web, etc. Whatever.
- moron4hire 10y ago
  Homestar Runner alone is worth it.

cpeterso 10y ago

PDF.js doesn't support PDF forms, while PDFium does. Like Shumway and Flash, the long-tail of PDF compatibility is a lot of work spent on something that is not part of the Web.

caf 10y ago
Is that actually something you need in your browser's default PDF renderer, though?
- izacus 10y ago
  Of course. It's part of the PDF standard and PDF government forms and similar that you just fill out and print are very common. So switching to Pdfium means added user friendliness and convenience for users and significantly higher performance (when we last evaluated PDF.js, it was far from fast).
- CJefferson 10y ago
  It is if your browser's default behaviour is to use the built in renderer. I've been confused in the past that a PDF was "broken", when in practice it was Firefox.

hellofunk 10y ago

> It's moving from a memsafe language back to C++ JS a safer language than C++? I would argue the opposite.

Manishearth 10y ago
Any vulnerability that can be caused in PDF.js due to a JS engine bug can be caused by a regular website. IIRC it doesn't access privileged apis.
pcwalton 10y ago
How many use-after-frees leading to remote code execution have you seen in JavaScript?
aikah 10y ago
It is certainly memory safe. C++ is obviously not.

bobajeff 10y ago

I'm pretty sure they're still on path to deprecate flash regardless of which plugin api it's using. That said it doesn't look like they are on path to integrate pepper-flash in any reasonable timeline. It's not even listed in the goals/milestones. It may be too complicated as I've heard the sentiment that pepper-flash uses 150% of PPAPI.

necessity 10y ago

I for one find it funny that they claim they wish to reduce the time spent on "a complete web browsing experience, but are not a core piece of the Web platform" reduce complexity and maintenance cost etc, and start with... maintaining their useless PDF viewer. Take it off your code base. Is it a browser or a PDF viewer? I guess expecting sanity from Mozilla really is insane.

AlphaSite 10y ago
Integrated PDF viewers are pretty much a necessary for a little of people.
barnacs 10y ago
I don't get this whole trend of trying to cram everything into browsers. People have been working on PDF viewers, media players, document editors and a whole bunch of applications for decades. Some are more lightweight, some are more feature rich, others are prettier, easier to use or more reliable. Yet there's this weird trend to throw all that away and reimplement everything as part of this huge beast. Why?
- TeMPOraL 10y ago
  Part of the appeal may simply be an UX thing. For instance, I don't think a PDF reader should be a part of the browser codebase, but when I'm reading papers I found on HN, I like it that the PDF opens as another browser tab, not a separate application window.
  - barnacs 10y ago
    I think browsers shouldn't really have tabs in the first place. That's the job of a window manager. And then you can decide which one to use. Do you want tiling or floating windows? Do you want workspaces? Stacked, tabbed, side-by-side layouts? Hotkeys or UI for navigation? Performance or features? And so on.
    - TeMPOraL 10y ago

digi_owl 10y ago

I fear that Mozilla is going the way of Opera. They can't keep up with the juggernauts with full time staff (Google, MS, Apple) so they are caving in and slowly going "me too".

alphapapa 10y ago
Don't they pull in several hundred million dollars a year? Shouldn't they be able to hire enough staff to develop Firefox with that money?
- Sylos 10y ago
  Well, Google, Microsoft and Apple pull in several billion per year... And in 2014, Mozilla had expenses of 212 million for software development, so they definitely do invest most of their budget there. https://static.mozilla.com/moco/en-US/pdf/Mozilla_Audited_Financials_2014.pdf https://static.mozilla.com/moco/en-US/pdf/Mozilla_Audited_Fi...
  - _Codemonkeyism 10y ago
    Sadly that report doesn't tell us where the 212 million went into, I would suspect not mainly in Firefox. Also it would be interesting what the 212 million of sofware development include from a payroll perspective, e.g. is it mostly developers, how much they are paid etc.
  - alphapapa 10y ago
    > Well, Google, Microsoft and Apple pull in several billion per year... Yes, but Mozilla doesn't also maintain the world's largest search engine, sell an operating system and office suite and gaming systems, or make computers, laptops, tablets, phones, and develop chips to run them on. All Mozilla does is make software. And they only have one primary product. If x hundred million dollars per year is not enough for them to do that, I don't think the problem is that they don't have enough money.
jeswin 10y ago
>Mozilla is going the way of Opera Nope, that's not happening. Instead, it seems Mozilla is investing more of their relatively smaller resources on the most important two things that actually matter: a) Browser engine and b) JavaScript. This is exactly what they should do. Produce the fastest, leanest, safest browser core. After playing with Servo, I feel it will be as big a release as the original Firefox was in the early 2000s.

blub 10y ago

And yet, shipping something that works and is performant while at the same time reducing development effort is apparently more important for Mozilla than using Rust or Javascript. In other words: market realities are more important than philosophical arguments about programming languages. They took the right decision IMO, they can't afford working on irrelevant side-projects when they're losing the browser war.