4 ms·

People should publish PDF version of a document. But if they send the working copy around, then the history may be helpful for other collaborators. Think of git

by chj 9y ago

People should publish PDF version of a document. But if they send the working copy around, then the history may be helpful for other collaborators. Think of git. They can even merge the changes easily.

aaronchall 9y ago
Agreed. History should be considered a feature.
- joosters 9y ago
  And it is. That's fine, as long as the user actively turns that feature on, and by default no data is leaked.
kbenson 9y ago
Unfortunately, companies don't do that. They send the doc/docx. They also send the xls/xlsx instead of the csv. Protecting users from accidentally doing a very wrong thing is better than being slightly more helpful as a default. Security should be the default. IIRC there have been cases where confidential information has been found by looking through the history in government released documents.
- Const-me 9y ago
  docx/xlsx are better, they are zipped XMLs too, just like odf. Older ones, doc & xls are closer to sqlite, for the same reason, performance. I remember finding confidential information in these files received from third parties they probably didn’t want to disclose, e.g. offer price that was before the last edit.
- bigiain 9y ago
  You know you can pop calc with a csv file opened in Excel? from http://georgemauer.net/2017/10/07/csv-injection.html http://georgemauer.net/2017/10/07/csv-injection.html : UserId,BillToDate,ProjectName,Description,DurationMinutes 1,2017-07-25,Test Project,Flipped the jibbet,60 2,2017-07-25,Important Client,"Bop, dop, and giglip", 240 2,2017-07-25,Important Client,"=2+5+cmd|' /C calc'!A0", 240 Yeah - that "=2+5+cmd|' \c calc'!A0" gets Windows to execute code...
gumby 9y ago
> People should publish PDF version of a document. Oh please no! PDF is quite user-unfriendly (e.g. can't reflow, typically can't cut/paste properly) designed to emulate an ancient medium that has benefits and drawbacks different from screens. And PDF, while executable, is essentially compiler output, with all the destruction of semantics that implies.
- abtinf 9y ago
  It depends on what your are trying to do. Short of exporting to an image format, PDF is the best format for preserving and sharing a final rendered output. All of the things you list as drawbacks are virtues if your purpose is static presentation.
- pjmlp 9y ago
  I only have issues with ebooks, outside them it is just perfect. Cut/paste only fails on me, when whoever created the PDF had the brilliant idea of using images instead of actual text, e.g. scans. Something that using another format won't help. Maybe you should use another PDF reader?
- Fnoord 9y ago
  For a resume, PDF is ace. I don't want the reader to see version history or copy/paste (even though its peanuts with a half decent PDF reader). I want them to print it.

by chj 9y ago

aaronchall 9y ago

Agreed. History should be considered a feature.

joosters 9y ago
And it is. That's fine, as long as the user actively turns that feature on, and by default no data is leaked.

kbenson 9y ago

Unfortunately, companies don't do that. They send the doc/docx. They also send the xls/xlsx instead of the csv. Protecting users from accidentally doing a very wrong thing is better than being slightly more helpful as a default. Security should be the default. IIRC there have been cases where confidential information has been found by looking through the history in government released documents.

Const-me 9y ago
docx/xlsx are better, they are zipped XMLs too, just like odf. Older ones, doc & xls are closer to sqlite, for the same reason, performance. I remember finding confidential information in these files received from third parties they probably didn’t want to disclose, e.g. offer price that was before the last edit.
bigiain 9y ago
You know you can pop calc with a csv file opened in Excel? from http://georgemauer.net/2017/10/07/csv-injection.html http://georgemauer.net/2017/10/07/csv-injection.html : UserId,BillToDate,ProjectName,Description,DurationMinutes 1,2017-07-25,Test Project,Flipped the jibbet,60 2,2017-07-25,Important Client,"Bop, dop, and giglip", 240 2,2017-07-25,Important Client,"=2+5+cmd|' /C calc'!A0", 240 Yeah - that "=2+5+cmd|' \c calc'!A0" gets Windows to execute code...

gumby 9y ago

> People should publish PDF version of a document. Oh please no! PDF is quite user-unfriendly (e.g. can't reflow, typically can't cut/paste properly) designed to emulate an ancient medium that has benefits and drawbacks different from screens. And PDF, while executable, is essentially compiler output, with all the destruction of semantics that implies.

abtinf 9y ago
It depends on what your are trying to do. Short of exporting to an image format, PDF is the best format for preserving and sharing a final rendered output. All of the things you list as drawbacks are virtues if your purpose is static presentation.
pjmlp 9y ago
I only have issues with ebooks, outside them it is just perfect. Cut/paste only fails on me, when whoever created the PDF had the brilliant idea of using images instead of actual text, e.g. scans. Something that using another format won't help. Maybe you should use another PDF reader?
Fnoord 9y ago
For a resume, PDF is ace. I don't want the reader to see version history or copy/paste (even though its peanuts with a half decent PDF reader). I want them to print it.