3 ms·

1. Linux Running in a PDF (doompdf.dev) 114 points by theden 4 hours ago | flag | hide | 37 comments 2. Ingesting PDFs and why Gemini 2.0 changes every

by neilv 2y ago

1. Linux Running in a PDF (doompdf.dev) 114 points by theden 4 hours ago | flag | hide | 37 comments 2. Ingesting PDFs and why Gemini 2.0 changes everything (sergey.fyi) 978 points by serjester 17 hours ago | flag | hide | 323 comments As people start bolting various kinds of PDF parsers and evaluators to LLMs, there's got to be some interesting hack potential.

sigmoid10 2y ago
PDFs have always been a highly attractive attack vector, because most people associate them purely with text and have no clue that you can easily embed executable code. Combine that with how atrociously many vulnerabilities there are in popular readers like acrobat, and you have a perfect gateway for getting your company hacked.
- anthk 2y ago
  Converting all your PDF's to max-quality sized DJVU's (at least the ones without forms) would be the first thing to do in any company. Maybe not for graphic design because $ADOBE, but for documentation it's perfectly safe to do so.
  - sigmoid10 2y ago
    Unfortunately that approach falls apart the moment you need to interact with anyone outside your company.
- lemonberry 2y ago
  I received a spam/scam text yesterday with a PDF embedded in it. I deleted it immediately. I also emailed my clients to let remind them not to open them either.
- deltarholamda 2y ago
  PDF is brushing up against "more harm than good". Wish there was a proper alternative.
  - niutech 2y ago
    How about OpenXPS or DjVu?
mrweasel 2y ago
Linux running in a LLM, as a means to hijack computing resources to train an LLM... or mine bitcoins.
- firtoz 2y ago
  Is it able to have data come out of it though, or is it fully... "sandboxed"? I am guessing the only output is the visual feedback you get when it's rendered? Oh... I guess if you can somehow have it trigger a "load an image with this query string" or something that could be a way to communicate with the rest of the world

by neilv 2y ago

sigmoid10 2y ago

PDFs have always been a highly attractive attack vector, because most people associate them purely with text and have no clue that you can easily embed executable code. Combine that with how atrociously many vulnerabilities there are in popular readers like acrobat, and you have a perfect gateway for getting your company hacked.

anthk 2y ago
Converting all your PDF's to max-quality sized DJVU's (at least the ones without forms) would be the first thing to do in any company. Maybe not for graphic design because $ADOBE, but for documentation it's perfectly safe to do so.
- sigmoid10 2y ago
  Unfortunately that approach falls apart the moment you need to interact with anyone outside your company.
lemonberry 2y ago
I received a spam/scam text yesterday with a PDF embedded in it. I deleted it immediately. I also emailed my clients to let remind them not to open them either.
deltarholamda 2y ago
PDF is brushing up against "more harm than good". Wish there was a proper alternative.
- niutech 2y ago
  How about OpenXPS or DjVu?

mrweasel 2y ago

Linux running in a LLM, as a means to hijack computing resources to train an LLM... or mine bitcoins.

firtoz 2y ago
Is it able to have data come out of it though, or is it fully... "sandboxed"? I am guessing the only output is the visual feedback you get when it's rendered? Oh... I guess if you can somehow have it trigger a "load an image with this query string" or something that could be a way to communicate with the rest of the world