5 ms·

From what I understand this wasn't so much about bundling everything into the web browser. It was more about the handling of links to PDF files that are served

by jwatt 6y ago

From what I understand this wasn't so much about bundling everything into the web browser. It was more about the handling of links to PDF files that are served with `content-disposition:attachment` to get the browser to open the "choose an app to open this file" system dialog. Without Firefox being registered with the system as an app that could open PDF files, users wouldn't be given the option to open it with Firefox (often they'd be prompted to open it using Edge). That was annoying people. Regarding your security concern, Firefox's PDF viewer is PDF.js. Parsing PDF files in a JS sandbox and rendering it to an HTML <canvas> in a sandboxed process should be more secure than rendering it using an unsandboxed app that parses/renders using system APIs.

Doctor_Fegg 6y ago
That's great news. I get fed up of random PDFs littering my Downloads folder.
kbenson 6y ago
> Regarding your security concern, Firefox's PDF viewer is PDF.js. Parsing PDF files in a JS sandbox and rendering it to an HTML <canvas> in a sandboxed process should be more secure than rendering it using an unsandboxed app that parses/renders using system APIs. Almost definitely. You can go to https://www.exploit-db.com/ https://www.exploit-db.com/ and search for PDF and see many application exploits for PDF viewers, and that includes for linux (and not just commercial applications, Poppler is on there as well, though more than just a few years back). PDFs have shown that they are a fertile ground for exploit, so running them though a sandboxed VM is a very good way to limit that problem to some degree.
est31 6y ago
> Without Firefox being registered with the system as an app that could open PDF files, users wouldn't be given the option to open it with Firefox (often they'd be prompted to open it using Edge). That was annoying people. Huh that's cool that it's fixed now. It annoyed me so much that I installed an extension for it: https://addons.mozilla.org/de/firefox/addon/open-in-browser/ https://addons.mozilla.org/de/firefox/addon/open-in-browser/

by jwatt 6y ago

Doctor_Fegg 6y ago

That's great news. I get fed up of random PDFs littering my Downloads folder.

kbenson 6y ago

> Regarding your security concern, Firefox's PDF viewer is PDF.js. Parsing PDF files in a JS sandbox and rendering it to an HTML <canvas> in a sandboxed process should be more secure than rendering it using an unsandboxed app that parses/renders using system APIs. Almost definitely. You can go to https://www.exploit-db.com/ https://www.exploit-db.com/ and search for PDF and see many application exploits for PDF viewers, and that includes for linux (and not just commercial applications, Poppler is on there as well, though more than just a few years back). PDFs have shown that they are a fertile ground for exploit, so running them though a sandboxed VM is a very good way to limit that problem to some degree.

est31 6y ago

> Without Firefox being registered with the system as an app that could open PDF files, users wouldn't be given the option to open it with Firefox (often they'd be prompted to open it using Edge). That was annoying people. Huh that's cool that it's fixed now. It annoyed me so much that I installed an extension for it: https://addons.mozilla.org/de/firefox/addon/open-in-browser/ https://addons.mozilla.org/de/firefox/addon/open-in-browser/