4 ms·
This is 100%. I'm not sure, however, that I even trust PDFs these days. Somewhat paranoid there are zero days on libgen, etc.
by leoh 6y ago
This is 100%. I'm not sure, however, that I even trust PDFs these days. Somewhat paranoid there are zero days on libgen, etc.
- wolfgke 6y ago> Somewhat paranoid there are zero days on libgen, etc. Do you have an alternative to trusting them?
- cpach 6y agoSure, PDF is a bit hairy. But you also can choose to not use Acrobat Reader. If you use e.g. Preview (macOS) or Evince (Linux) then I would wager that it’s not exactly trivial to get remote code execution. (Most probably possible though, but it would probably take some work.)
- leoh 6y agoI think all clients are a bit questionable since it's such a complex format and because most clients are not written in safe languages. Although they're rarer, even Mac OS X's Preview.app has had CVEs.
- aj3 6y agoHere's a tip: the safest way to open sketchy pdf is through PDF.js that's used in browsers as it relies on the same JS sandbox you use to browse net all day. Other than that - open documents in a VM (with reverting to the previous snapshot after viewing the file) or install Qubes where this is default behaviour.