5 ms·

PDF is a fabulous format. I mean, it’s an awful format in so many ways, technically speaking, but the net effect of having a self-contained static file in your

by jl6 3y ago

PDF is a fabulous format. I mean, it’s an awful format in so many ways, technically speaking, but the net effect of having a self-contained static file in your custody stands in blissful contrast to the user-hostile dynamic/SaaS website that can be taken away at a moment’s notice. PDF/A is the true PDF - it strips out most of the dangerous cruft. Anyway, if you like weird PDF hijinks, here’s a polyglot PDF/A CSV file that is also its own original soundtrack as a polyglot Amiga soundtracker mod: https://www.lab6.com/6 https://www.lab6.com/6

throwaway290 3y ago
Does it anything else? Maybe pwn me via my PDF viewer?;)
- TeMPOraL 3y ago
  It contains Bitcoin hashes, rendering them one by one as it mines them.
martin_a 3y ago
> PDF/A is the true PDF As someone working in the graphic industry, I'd say PDF/X is the true PDF, but ymmv. :-)
amelius 3y ago
PDF is an executable file. Many people are worried about running Javascript but still use PDF files without problems.
- shp0ngle 3y ago
  Yeah but the javascript can only do things inside the pdf.
  - berkes 3y ago
    What javascript can escape my browser, (edit: or an HTML page) for example?
    - lukan 3y ago
      XMLHttpRequest to send anything the site knows anywhere. And row hammer, to breach the sandbox. https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer
      - berkes 3y ago
        Row hammer is an exploit. It wasn't "by design". While that may technically be "escaping the sandbox" it's a different case, because it was never meant to work, will be fixed and often is fixed.
        afiori 3y ago
        Almost every "escaping the sandbox" is due to some kind of bug. Sure if the PDF standard exposed a "globalThis.runBlobAsNativeExecutable" function it would be worse, but it is still escaping the sandbox.
    - grotorea 3y ago
      Are the non-browser PDF readers more vulnerable? Do most even execute the Javascript?
      - kevincox 3y ago
        I would expect so simply because browsers are fairly hardened pieces of software. Adobe Acrobat is decently hardened but it seems to be far behind browsers. It is worth noting that Chromium and later Firefox both added PDF viewers that live inside the browser sandbox. They are essentially web-apps that render the PDF. When I worked at Google they strongly recommended using Chrome for opening PDF files because they felt much more comfortable about its security and sandboxing than other PDF readers. On another perspective is that you are likely browsing the internet anyways. In fact you likely got the PDF by visiting a website. So you have already exposed a huge attack surface (your browser) to a possible hostile adversary. It is better to expose them to the same attack surface again (plus whatever security the PDF reader itself provides) than to give them a fresh new attack surface.
  - jk3000 3y ago
    Famous last words :)
  - muskypirate 3y ago
    It is not about JS. Look into BadPDF as an example.
- JKCalhoun 3y ago
  For better or worse, the years I spent working on Preview for Apple (and PDFKit) I felt bad that our (Apple's) PDF implementation was far short of Adobe's. Radars would show up with PDFs attached, "Preview Does Not Display 3D Image in PDF Like Acrobat" or similar. And I would feel so ... inadequate. PDFKit could render and capture basic annotations ... and that was about it. We could show you forms, allow editing, but if the PDF had Javascript that would add two fields and put the sum in a third field I had to shrug and say, "Oh well." The effort of hoisting a JavaScript interpreter/runtime was beyond my skillset anyway. But then I kind of came to see our subset of PDF support as a kind of feature. It's true, we left out the kitchen sink. Adobe was/is clearly interested in putting everything into PDF. And I mean, as pointed out here, at least you could open a PDF in Preview and not worry about any Javascript executing. ;-)
  - peterldowns 3y ago
    If it makes you feel any better, Preview is by far the best PDF viewer and editor (I use it for signatures and adding text) I've ever used. I like that the PDF previews in Finder are instant and accurate. I like that it shows as much PDF and as little UI/menubar as possible. I like that it never asks me to upgrade or log in. The search tools work well. I can stitch PDFs together (if I google how to, always forget) and pull certain pages out as their own files. For all of the PDFs I've ever encountered, Preview has been sufficient and capable. Thank you for your hard work!
    - amluto 3y ago
      And somehow Acrobat (current paid version from Creative Cloud) is the worst PDF form filing option.
    - B1FF_PSUVM 3y ago
      > If it makes you feel any better, Preview is by far the best PDF viewer and editor Seconded. At least most pleasant to use for most things, and never balked at anything I needed to see, fortunately.
    - JKCalhoun 3y ago
- venusenvy47 3y ago
  Is it really executable on the OS? Doesn't it require a native application to run it on an OS?
  - afiori 3y ago
    No, they are not executable by the OS (generally). Formats are on a gradient between "completely code" and "completely data" and PDFs are quite close to the "completely code" extreme'; I guess this is what the parent meant.
- eirikbakke 3y ago
  When I ordered an official PDF copy of my college diploma, the order form had an option to enable "tracking" in the PDF file. Sure enough, when the recipient opened the PDF file (and when I tried it myself on a different machine), I got a notification from the company that generated the PDF...
  - SpaghettiCthulu 3y ago
    That's horrific! I had no idea that was even a feature of PDFs!
    - layer8 3y ago
      PDFs are roughly on par with web pages feature-wise, including JavaScript or other actions that execute on load. Adobe did this, of course, to stave off the competition from the early web. Nowadays, PDF readers disable most of that by default (if they even support it).
shp0ngle 3y ago
about pdf/a... until recently there was not even an easy way to figure out if pdf is really pdf/a; now there is (verapdf) and it's crazy complex piece of software and maybe I'm wrong but the only way to convert arbitrary pdf to pdf/a with open source software is to convert it to postscript and back with ghostscript - which is affero licensed... with all the possible problems it entails. (there is old version that is just gpl, works on most pdfs but is 15 years old or such.) i needed to deal with pdf/a in a previous job... was not fun.
- account42 3y ago
  > which is affero licensed... with all the possible problems it entails And what problems are those? Besides making it harder to leech off the community without giving back of course.
- Elzair 3y ago
  You could use the pdfium library as an alternative to Ghostscript.
  - shp0ngle 3y ago
    I don't think there is a way to do that with pdfium. I have tried to look at it and failed. Maybe I didn't look hard enough.
ourmandave 3y ago
The "in your custody" part is important, when Amazon starts yoinking books from your account. https://www.nytimes.com/2009/07/18/technology/companies/18amazon.html https://www.nytimes.com/2009/07/18/technology/companies/18am...
- financypants 3y ago
  I buy all my books paperback, even if I listen to them on audible, for posterity’s sake.
  - shiftpgdn 3y ago
    Do you buy them after you’ve finished listening?
    - addminztrator 3y ago
      You guys buy books? I only buy the ones I keep coming back to after I've read them through libgen
rqtwteye 3y ago
“ PDF is a fabulous format” I will never forgive the pain PDF caused me when I worked on a project to parse millions of PDF files from various sources. Just reconstructing paragraphs was a huge effort not even mentioning parsing tables. I think we should do better for something that’s basically a standard. PDF manuals also suck big time.
- niels_bom 3y ago
  Did you go the “display it, then OCR what’s displayed” route as a last ditch effort?
- JKCalhoun 3y ago
  PDF is supposed to a be a printer format, not a word processing document format. While I too would love to nail down a PDF subset to be a standard (for example requiring the accessibility tags that make text extraction easy) perhaps trying to create a hybrid format, one that satisfies both printers and resizable windows, is already an impossible goal. (I've always had to keep my love of PDF a secret from fellow nerds. But here's another secret, I like printing documents out from time to time.)
  - da_chicken 3y ago
    I really appreciate what PDF can accomplish, but I also really dislike that it turns into a black box. There really ought to be something that can describe a document structure and also describe document layout in a durable and portable manner. In the range of XML/JSON <-> HTML+CSS <-> PDF <-> PS <-> RAW, it really does feel like there's something missing between HTML and PDF. And it can't be LaTeX, because the document shouldn't be a programming language at all. "The document is a program" has proven itself to be a terrible scheme overall.
    - JKCalhoun 3y ago
      ePub is kind of trying to be that? Or maybe that hews too close to HTML. It can reflow but tries to paginate HTML ... the way printing a web page tries to paginate HTML, ha ha.

by jl6 3y ago

throwaway290 3y ago

Does it anything else? Maybe pwn me via my PDF viewer?;)

TeMPOraL 3y ago
It contains Bitcoin hashes, rendering them one by one as it mines them.

martin_a 3y ago

> PDF/A is the true PDF As someone working in the graphic industry, I'd say PDF/X is the true PDF, but ymmv. :-)

amelius 3y ago

PDF is an executable file. Many people are worried about running Javascript but still use PDF files without problems.

shp0ngle 3y ago
Yeah but the javascript can only do things inside the pdf.
- berkes 3y ago
  What javascript can escape my browser, (edit: or an HTML page) for example?
  - lukan 3y ago
    XMLHttpRequest to send anything the site knows anywhere. And row hammer, to breach the sandbox. https://en.wikipedia.org/wiki/Row_hammer https://en.wikipedia.org/wiki/Row_hammer
    - berkes 3y ago
      Row hammer is an exploit. It wasn't "by design". While that may technically be "escaping the sandbox" it's a different case, because it was never meant to work, will be fixed and often is fixed.
      - afiori 3y ago
        Almost every "escaping the sandbox" is due to some kind of bug. Sure if the PDF standard exposed a "globalThis.runBlobAsNativeExecutable" function it would be worse, but it is still escaping the sandbox.
  - grotorea 3y ago
    Are the non-browser PDF readers more vulnerable? Do most even execute the Javascript?
    - kevincox 3y ago
      I would expect so simply because browsers are fairly hardened pieces of software. Adobe Acrobat is decently hardened but it seems to be far behind browsers. It is worth noting that Chromium and later Firefox both added PDF viewers that live inside the browser sandbox. They are essentially web-apps that render the PDF. When I worked at Google they strongly recommended using Chrome for opening PDF files because they felt much more comfortable about its security and sandboxing than other PDF readers. On another perspective is that you are likely browsing the internet anyways. In fact you likely got the PDF by visiting a website. So you have already exposed a huge attack surface (your browser) to a possible hostile adversary. It is better to expose them to the same attack surface again (plus whatever security the PDF reader itself provides) than to give them a fresh new attack surface.
- jk3000 3y ago
  Famous last words :)
- muskypirate 3y ago
  It is not about JS. Look into BadPDF as an example.
JKCalhoun 3y ago
For better or worse, the years I spent working on Preview for Apple (and PDFKit) I felt bad that our (Apple's) PDF implementation was far short of Adobe's. Radars would show up with PDFs attached, "Preview Does Not Display 3D Image in PDF Like Acrobat" or similar. And I would feel so ... inadequate. PDFKit could render and capture basic annotations ... and that was about it. We could show you forms, allow editing, but if the PDF had Javascript that would add two fields and put the sum in a third field I had to shrug and say, "Oh well." The effort of hoisting a JavaScript interpreter/runtime was beyond my skillset anyway. But then I kind of came to see our subset of PDF support as a kind of feature. It's true, we left out the kitchen sink. Adobe was/is clearly interested in putting everything into PDF. And I mean, as pointed out here, at least you could open a PDF in Preview and not worry about any Javascript executing. ;-)
- peterldowns 3y ago
  If it makes you feel any better, Preview is by far the best PDF viewer and editor (I use it for signatures and adding text) I've ever used. I like that the PDF previews in Finder are instant and accurate. I like that it shows as much PDF and as little UI/menubar as possible. I like that it never asks me to upgrade or log in. The search tools work well. I can stitch PDFs together (if I google how to, always forget) and pull certain pages out as their own files. For all of the PDFs I've ever encountered, Preview has been sufficient and capable. Thank you for your hard work!
  - amluto 3y ago
    And somehow Acrobat (current paid version from Creative Cloud) is the worst PDF form filing option.
  - B1FF_PSUVM 3y ago
    > If it makes you feel any better, Preview is by far the best PDF viewer and editor Seconded. At least most pleasant to use for most things, and never balked at anything I needed to see, fortunately.
  - JKCalhoun 3y ago
venusenvy47 3y ago
Is it really executable on the OS? Doesn't it require a native application to run it on an OS?
- afiori 3y ago
  No, they are not executable by the OS (generally). Formats are on a gradient between "completely code" and "completely data" and PDFs are quite close to the "completely code" extreme'; I guess this is what the parent meant.
eirikbakke 3y ago
When I ordered an official PDF copy of my college diploma, the order form had an option to enable "tracking" in the PDF file. Sure enough, when the recipient opened the PDF file (and when I tried it myself on a different machine), I got a notification from the company that generated the PDF...
- SpaghettiCthulu 3y ago
  That's horrific! I had no idea that was even a feature of PDFs!
  - layer8 3y ago
    PDFs are roughly on par with web pages feature-wise, including JavaScript or other actions that execute on load. Adobe did this, of course, to stave off the competition from the early web. Nowadays, PDF readers disable most of that by default (if they even support it).

shp0ngle 3y ago

about pdf/a... until recently there was not even an easy way to figure out if pdf is really pdf/a; now there is (verapdf) and it's crazy complex piece of software and maybe I'm wrong but the only way to convert arbitrary pdf to pdf/a with open source software is to convert it to postscript and back with ghostscript - which is affero licensed... with all the possible problems it entails. (there is old version that is just gpl, works on most pdfs but is 15 years old or such.) i needed to deal with pdf/a in a previous job... was not fun.

account42 3y ago
> which is affero licensed... with all the possible problems it entails And what problems are those? Besides making it harder to leech off the community without giving back of course.
Elzair 3y ago
You could use the pdfium library as an alternative to Ghostscript.
- shp0ngle 3y ago
  I don't think there is a way to do that with pdfium. I have tried to look at it and failed. Maybe I didn't look hard enough.

ourmandave 3y ago

The "in your custody" part is important, when Amazon starts yoinking books from your account. https://www.nytimes.com/2009/07/18/technology/companies/18amazon.html https://www.nytimes.com/2009/07/18/technology/companies/18am...

financypants 3y ago
I buy all my books paperback, even if I listen to them on audible, for posterity’s sake.
- shiftpgdn 3y ago
  Do you buy them after you’ve finished listening?
  - addminztrator 3y ago
    You guys buy books? I only buy the ones I keep coming back to after I've read them through libgen

rqtwteye 3y ago

“ PDF is a fabulous format” I will never forgive the pain PDF caused me when I worked on a project to parse millions of PDF files from various sources. Just reconstructing paragraphs was a huge effort not even mentioning parsing tables. I think we should do better for something that’s basically a standard. PDF manuals also suck big time.

niels_bom 3y ago
Did you go the “display it, then OCR what’s displayed” route as a last ditch effort?
JKCalhoun 3y ago
PDF is supposed to a be a printer format, not a word processing document format. While I too would love to nail down a PDF subset to be a standard (for example requiring the accessibility tags that make text extraction easy) perhaps trying to create a hybrid format, one that satisfies both printers and resizable windows, is already an impossible goal. (I've always had to keep my love of PDF a secret from fellow nerds. But here's another secret, I like printing documents out from time to time.)
- da_chicken 3y ago
  I really appreciate what PDF can accomplish, but I also really dislike that it turns into a black box. There really ought to be something that can describe a document structure and also describe document layout in a durable and portable manner. In the range of XML/JSON <-> HTML+CSS <-> PDF <-> PS <-> RAW, it really does feel like there's something missing between HTML and PDF. And it can't be LaTeX, because the document shouldn't be a programming language at all. "The document is a program" has proven itself to be a terrible scheme overall.
  - JKCalhoun 3y ago
    ePub is kind of trying to be that? Or maybe that hews too close to HTML. It can reflow but tries to paginate HTML ... the way printing a web page tries to paginate HTML, ha ha.