PDFs are indeed a bit scary. A few months back I was triaging a GH issue where someone had attached an .rtf of their failure log and I was definitely tingling

PDFs are indeed a bit scary. A few months back I was triaging a GH issue where someone had attached an .rtf of their failure log and I was definitely tingling at the thought of opening it. I felt a bit paranoid doing it, but I curled it down on a different laptop, went offline, and then checked to see what `file` thought. It reported that the file was actually a PDF and I was almost certain it was a spearphishing attempt. (I'm not a committer on this project, so I probably wouldn't have been the target if it was.) I finally convinced myself to go online to fetch a PDF -> plaintext converter package, go back offline, and see what it found inside. (Though I wondered if the converter itself would ignore or could be vulnerable to the same kinds of exploits.) It ultimately just looked like an appropriate log, though I never directly opened it. I decided to risk coming off as paranoid and told the reporter not to do this going forward (and they promptly/happily replaced the attachment with an unformatted copy/paste--better than getting pwned).