Offhand I can't really think of a way to manage the problem. Instead I am looking at ways to identify the bad parts of it and improve detection. Email me if you

Offhand I can't really think of a way to manage the problem. Instead I am looking at ways to identify the bad parts of it and improve detection. Email me if you would like more details. At this point the specification is not going to just remove or change the problem elements simply because outside the context of the Internet, their not bad. The specification merely offers flexibility to those using or creating PDF files. It is the abuse of that flexibility that make it extremely difficult to identify "known bad" files or protect against them. What I was getting at was a centralized approval system similar to an issuing certificate. In other words, to use certain functionality, you would need to request it from a trusted entity. This of course would be outrageous and likely to be circumvented, but it never hurts to dream.