4 ms·

I'd never use the words PDF and goodness in the same sentence. I doubt Didier Stevens (http://blog.didierstevens.com/ http://blog.didierstevens.com/) would eith

by iuguy 16y ago

I'd never use the words PDF and goodness in the same sentence. I doubt Didier Stevens (http://blog.didierstevens.com/ http://blog.didierstevens.com/) would either. Don't get me wrong, I like Chrome (in fact I'm using it now) but it's a browser. I don't want a document viewer, I just want to surf the Internet.

AndrewDucker 16y ago
The web serves files. Some of them are HTML, some of them are not. I don't have a problem with web browsers displaying anything that has a standard defining it.
- iuguy 16y ago
  But is it the browser's job to internally render the files, or pass them on to the appropriate player? As smart as the Google guys are, PDF is a mess of a format. Why should we think that Google are better than anyone else at implementing one safely?
  - ximeng 16y ago
    Of possible interest to people wondering about security of PDFs is that the current Honeynet Project Forensic Challenge requires analysis of a malicious PDF. Not a direct link with Google, although it looks like the project itself is fairly active with Google Summer of Code. Edit: link for interested parties http://project.honeynet.org/node/583 http://project.honeynet.org/node/583
pjscott 16y ago
The more accurate "PDF decreased badness" doesn't roll off the tongue quite as well. But I must take issue with the way you make a distinction between viewing documents and surfind the internet. A lot of web content, unfortunately, happens to be in PDF format. Why shouldn't your browser support quick-and-easy viewing of PDF files?
- iuguy 16y ago
  You're asking a really good question, but if you'll may I think you're asking the wrong one. To answer your question, why shouldn't your browser support quick and easy viewing of PDF files, I think the answer is that my browser's job is to render HTML downloaded over a given protocol (such as HTTP or HTTPS) and appropriately supported non-plugin extras as best as possible. For example, I have a virtual world. This virtual world is designed for a niche, lets say vehicle mechanics. You can look at any vehicle and strip it down or away to see each layer like an onion skin in my world. Why should your browser do that instead of giving it over to a plugin by the format company's author? If your browser does that the people that write the browser have to support it to a certain extent - if they implement the popen() function in the spec, well they're importing the standard into the browser but if popen("/bin/ls") works then so should popen("/bin/ls;cat%20/etc/passwd"). My point is that the people that make browsers make really great browsers, the people that make PDF readers make great PDF readers. To pull the browser guys off to make a PDF reader is the same as pulling a PDF reader guy to make a browser, it's not their core business. I'd rather trust a company for whom PDF reading is core business (like sumatra) than those that feel PDF reading is only part of their revenue stream (like adobe).

by iuguy 16y ago

AndrewDucker 16y ago

The web serves files. Some of them are HTML, some of them are not. I don't have a problem with web browsers displaying anything that has a standard defining it.

iuguy 16y ago
But is it the browser's job to internally render the files, or pass them on to the appropriate player? As smart as the Google guys are, PDF is a mess of a format. Why should we think that Google are better than anyone else at implementing one safely?
- ximeng 16y ago
  Of possible interest to people wondering about security of PDFs is that the current Honeynet Project Forensic Challenge requires analysis of a malicious PDF. Not a direct link with Google, although it looks like the project itself is fairly active with Google Summer of Code. Edit: link for interested parties http://project.honeynet.org/node/583 http://project.honeynet.org/node/583

pjscott 16y ago

The more accurate "PDF decreased badness" doesn't roll off the tongue quite as well. But I must take issue with the way you make a distinction between viewing documents and surfind the internet. A lot of web content, unfortunately, happens to be in PDF format. Why shouldn't your browser support quick-and-easy viewing of PDF files?

iuguy 16y ago
You're asking a really good question, but if you'll may I think you're asking the wrong one. To answer your question, why shouldn't your browser support quick and easy viewing of PDF files, I think the answer is that my browser's job is to render HTML downloaded over a given protocol (such as HTTP or HTTPS) and appropriately supported non-plugin extras as best as possible. For example, I have a virtual world. This virtual world is designed for a niche, lets say vehicle mechanics. You can look at any vehicle and strip it down or away to see each layer like an onion skin in my world. Why should your browser do that instead of giving it over to a plugin by the format company's author? If your browser does that the people that write the browser have to support it to a certain extent - if they implement the popen() function in the spec, well they're importing the standard into the browser but if popen("/bin/ls") works then so should popen("/bin/ls;cat%20/etc/passwd"). My point is that the people that make browsers make really great browsers, the people that make PDF readers make great PDF readers. To pull the browser guys off to make a PDF reader is the same as pulling a PDF reader guy to make a browser, it's not their core business. I'd rather trust a company for whom PDF reading is core business (like sumatra) than those that feel PDF reading is only part of their revenue stream (like adobe).