4 ms·

I liked Mozilla's idea of pdf.js since it is intrinsically sandboxed by using javascript, and makes use of all the architecture that it is already providing rat

by nwah1 4y ago

I liked Mozilla's idea of pdf.js since it is intrinsically sandboxed by using javascript, and makes use of all the architecture that it is already providing rather than shipping an entirely separate rendering pipeline. Adobe's products have been a source of endless security vulnerabilities, and no matter how much sandboxing you do it is intrinsically unsafe. The first best thing would be for PDF to die, but the second best thing would be pdf.js If you care about security, turn off this feature and use the pdf.js extension. If you absolutely need form-filling, then run the standalone adobe reader and uninstall it at the earliest possible time.

hknmtt 4y ago
what would you replace pdf with? svg?
- nwah1 4y ago
  To me, cloud documents are better for most cases. They allow exporting to multiple file types, and allow you to edit after sending it out. While also often preserving revision history, and enabling collaboration. The next best options would be open source document formats. EPUB, ODT, SVG, exported HTML like MHTML (MHT)... all good options.
  - Denvercoder9 4y ago
    > and allow you to edit after sending it out There's whole industries out there where the immutability of PDF is a feature, not a bug.
    - nwah1 4y ago
      Cloud documents allow sending out read-only links, and revision history can be preserved. Even for such things as contracts, something like PandaDoc or DocuSign is way better than PDF. I mainly see PDFs used for sending documentation, HR onboarding info, and contracts. None of those uses require immutable files, and they are easy to become obsolete. Paid e-books could also be done through web readers. But EPUB exists. For archival purposes, I recognize that there is a use for files, and I listed some options that are all better than PDF. A PDF reader requires complexity on the order of a web browser. It has enormous amounts of legacy baggage. And it is proprietary and still adding more features regularly. Its existence is akin to that of Flash. It comes from an era where web standards were immature.
      - ArchitectAnon 4y ago
        Technical drawings and visuals
      - permo-w 4y ago
        replacing PDFs with cloud documents is cutting your ears off to spite your nose. so now what, instead of a potentially insecure PDF file, you have a potentially insecure webpage probably hosted by a company you have no control over that requires wifi connection to access, that you likely can’t trust the continuous accuracy of? in reality what we need is a better standard
        nwah1 4y ago
        Would argue that avoiding the cloud is cutting off your ears to spite your face, but you are free to make your own choices. If you are distributing code, will you share it via tarballs and zip files, or will you share it via a hosted service like GitLab or GitHub? Most people undestand that the latter is superior in every way, and you can still have the offline archives via having a full clone of the repo locally. I would argue that the same logic applies generally. If you share your resume, it would be smarter to use a static github page tied to a git repo, than it would be to simply email a file. That file may have a typo or become obsolete. And in reality you are likely trusting email service providers anyways... ie the cloud. Having a full archive of it locally with a local git repo means you actually aren't locked into them. My use of the term cloud was meant to be a fully general concept, and I wasn't advocating any particular locked-in concept. I'm simply advocating leveraging specialization of labor. If you sew all your own clothing, build you own house, build your own car, etc... then by all means, run your own email servers, send zip files, and write your own operating system. Definitely keeps your trust surface low.
    - Kuinox 4y ago
      A pdf can be edited this "feature" is broken.
  - mhd 4y ago
    "Cloud documents"? Are we talking Google Docs here? I mean, there's nothing special about that, it's just a very limited word processor that uses the ginormous web stack for rendering. Pretty much impossible to map most usages of PDF to that.
jfk13 4y ago
> If you absolutely need form-filling FWIW, I believe pdf.js has some support for forms nowadays, though I haven't used it personally/don't know how complete it is. https://blog.mozilla.org/attack-and-defense/2021/10/14/implementing-form-filling-and-accessibility-in-the-firefox-pdf-viewer/ https://blog.mozilla.org/attack-and-defense/2021/10/14/imple...
- chrismorgan 4y ago
  I’ve filled in one or two PDF forms in the last year, they’ve worked perfectly.
- input_sh 4y ago
  It's more like drawing on top of a PDF than properly implementing proprietary "standards", but the end result is more than adequate.
  - ale42 4y ago
    Current Firefox supports filling regular PDF forms properly, they can be read by Acrobat and Apple's Preview without problems. It also allows creating annotation, in which case it's actually like drawing on top of the PDF.
runamok 4y ago
They do touch on the security aspect but there is a whole lotta attack surface to worry about. Fta: Microsoft made a particular point of outlining its efforts to ensure the new Adobe PDF tool is secure. Miscreants will use malware-infused PDFs to muscle their way into enterprise networks, so Microsoft's Edge Vulnerability Research team was involved in the process of bringing the Adobe engine to Edge. That includes adding security features to the PDF stack such as PartitionAlloc a secure heap implementation developed on Chromium and already used in Edge, according to Gareth Evans, principal security research lead at Microsoft. "PartitionAlloc is designed in such a way as to keep objects of different types separate from each other with minimal intervention from the developer," Evans wrote. The package also includes mitigations such as Intel's Control Flow Enforcement Technology to protect against the hijacking of control-flow transfer instructions, a technology that complements Microsoft's Control Flow Guard. Fuzzing – automatic testing for vulnerabilities – is another security feature included with the new Edge PDF stack. In addition, Edge's Acrobat engine will be included in the software vendor's bug bounty program to incentivize developers to find and report flaws. And there have been quite a few flaws in Adobe's PDF code.
- cokeandpepsi 4y ago
  [dead]
- deleted 4y ago
  [deleted]
- ht85 4y ago
  > a secure heap implementation developed on Chromium and already used in Edge "Don't worry guys, all the buffer overflows will lead them nowhere!"
timvisee 4y ago
The article mentions secur{e,ity} 8 times. Seems excessive. This will be secure for sure! /s
yjftsjthsd-h 4y ago
The one thing I've had against pdf.js is speed - IME it's noticeably slower to render than native code, which is kinda expected, a decent trade, and still annoying.
compsciphd 4y ago
imagine you ran it within a one off VM that edge just provided a remote display that edge displayed within the right location. the isolation will be provided by a full hardware vm that will be thrown away when not needed anymore. I'd argue that's higher isolation than even pdf.js
- nly 4y ago
  There's an idea. Then your user can't copy and paste anything or print the PDF
  - compsciphd 4y ago
    you've never printed from a vm or copy/pasted to a remote display env?

by nwah1 4y ago

hknmtt 4y ago

what would you replace pdf with? svg?

nwah1 4y ago
To me, cloud documents are better for most cases. They allow exporting to multiple file types, and allow you to edit after sending it out. While also often preserving revision history, and enabling collaboration. The next best options would be open source document formats. EPUB, ODT, SVG, exported HTML like MHTML (MHT)... all good options.
- Denvercoder9 4y ago
  > and allow you to edit after sending it out There's whole industries out there where the immutability of PDF is a feature, not a bug.
  - nwah1 4y ago
    Cloud documents allow sending out read-only links, and revision history can be preserved. Even for such things as contracts, something like PandaDoc or DocuSign is way better than PDF. I mainly see PDFs used for sending documentation, HR onboarding info, and contracts. None of those uses require immutable files, and they are easy to become obsolete. Paid e-books could also be done through web readers. But EPUB exists. For archival purposes, I recognize that there is a use for files, and I listed some options that are all better than PDF. A PDF reader requires complexity on the order of a web browser. It has enormous amounts of legacy baggage. And it is proprietary and still adding more features regularly. Its existence is akin to that of Flash. It comes from an era where web standards were immature.
    - ArchitectAnon 4y ago
      Technical drawings and visuals
    - permo-w 4y ago
      replacing PDFs with cloud documents is cutting your ears off to spite your nose. so now what, instead of a potentially insecure PDF file, you have a potentially insecure webpage probably hosted by a company you have no control over that requires wifi connection to access, that you likely can’t trust the continuous accuracy of? in reality what we need is a better standard
      - nwah1 4y ago
        Would argue that avoiding the cloud is cutting off your ears to spite your face, but you are free to make your own choices. If you are distributing code, will you share it via tarballs and zip files, or will you share it via a hosted service like GitLab or GitHub? Most people undestand that the latter is superior in every way, and you can still have the offline archives via having a full clone of the repo locally. I would argue that the same logic applies generally. If you share your resume, it would be smarter to use a static github page tied to a git repo, than it would be to simply email a file. That file may have a typo or become obsolete. And in reality you are likely trusting email service providers anyways... ie the cloud. Having a full archive of it locally with a local git repo means you actually aren't locked into them. My use of the term cloud was meant to be a fully general concept, and I wasn't advocating any particular locked-in concept. I'm simply advocating leveraging specialization of labor. If you sew all your own clothing, build you own house, build your own car, etc... then by all means, run your own email servers, send zip files, and write your own operating system. Definitely keeps your trust surface low.
  - Kuinox 4y ago
    A pdf can be edited this "feature" is broken.
- mhd 4y ago
  "Cloud documents"? Are we talking Google Docs here? I mean, there's nothing special about that, it's just a very limited word processor that uses the ginormous web stack for rendering. Pretty much impossible to map most usages of PDF to that.

jfk13 4y ago

> If you absolutely need form-filling FWIW, I believe pdf.js has some support for forms nowadays, though I haven't used it personally/don't know how complete it is. https://blog.mozilla.org/attack-and-defense/2021/10/14/implementing-form-filling-and-accessibility-in-the-firefox-pdf-viewer/ https://blog.mozilla.org/attack-and-defense/2021/10/14/imple...

chrismorgan 4y ago
I’ve filled in one or two PDF forms in the last year, they’ve worked perfectly.
input_sh 4y ago
It's more like drawing on top of a PDF than properly implementing proprietary "standards", but the end result is more than adequate.
- ale42 4y ago
  Current Firefox supports filling regular PDF forms properly, they can be read by Acrobat and Apple's Preview without problems. It also allows creating annotation, in which case it's actually like drawing on top of the PDF.

runamok 4y ago

They do touch on the security aspect but there is a whole lotta attack surface to worry about. Fta: Microsoft made a particular point of outlining its efforts to ensure the new Adobe PDF tool is secure. Miscreants will use malware-infused PDFs to muscle their way into enterprise networks, so Microsoft's Edge Vulnerability Research team was involved in the process of bringing the Adobe engine to Edge. That includes adding security features to the PDF stack such as PartitionAlloc a secure heap implementation developed on Chromium and already used in Edge, according to Gareth Evans, principal security research lead at Microsoft. "PartitionAlloc is designed in such a way as to keep objects of different types separate from each other with minimal intervention from the developer," Evans wrote. The package also includes mitigations such as Intel's Control Flow Enforcement Technology to protect against the hijacking of control-flow transfer instructions, a technology that complements Microsoft's Control Flow Guard. Fuzzing – automatic testing for vulnerabilities – is another security feature included with the new Edge PDF stack. In addition, Edge's Acrobat engine will be included in the software vendor's bug bounty program to incentivize developers to find and report flaws. And there have been quite a few flaws in Adobe's PDF code.

cokeandpepsi 4y ago
[dead]
deleted 4y ago
[deleted]
ht85 4y ago
> a secure heap implementation developed on Chromium and already used in Edge "Don't worry guys, all the buffer overflows will lead them nowhere!"

timvisee 4y ago

The article mentions secur{e,ity} 8 times. Seems excessive. This will be secure for sure! /s

yjftsjthsd-h 4y ago

The one thing I've had against pdf.js is speed - IME it's noticeably slower to render than native code, which is kinda expected, a decent trade, and still annoying.

compsciphd 4y ago

imagine you ran it within a one off VM that edge just provided a remote display that edge displayed within the right location. the isolation will be provided by a full hardware vm that will be thrown away when not needed anymore. I'd argue that's higher isolation than even pdf.js

nly 4y ago
There's an idea. Then your user can't copy and paste anything or print the PDF
- compsciphd 4y ago
  you've never printed from a vm or copy/pasted to a remote display env?