3 ms·
They want to keep all the complexity and bullshit that made PDF files a security nightmare plus add a bunch of new ones. They want iframes, video, audio, javasc
by autoexec 3y ago
They want to keep all the complexity and bullshit that made PDF files a security nightmare plus add a bunch of new ones. They want iframes, video, audio, javascript, service workers, even WASM support!
Documents are best when they're just documents and can't instantly infect your device just by opening them. The odds of this format being any less toxic than PDF is zero. It'd be pretty nice if we could have a document format that printed well, but didn't also allow for RCE attacks, violate your privacy, or require a locked down environment and ad blockers just to view safely.
- felixfbecker 3y agoAdobe Acrobat is what made PDF a security nightmare. The browser sandbox is by far the most secure execution environment we have.
- geraldhh 3y agoeven security focused products like foxit's are probably best known for their vulnerabilities
- autoexec 3y agoI can't remember the last time a year passed without at least one sandbox escape discovered in chrome. There was one less than two months ago, and perhaps there's already been another patched after the start of this year (https://www.securityweek.com/google-patches-six-vulnerabilities-with-first-chrome-update-of-2024/ https://www.securityweek.com/google-patches-six-vulnerabilit...). It'd be much better to support a sane subset of features than to allow a document to do everything and anything leaving you to just hope that the sandbox holds up to protect the rest of your system against the inevitable vulnerabilities.