8 ms·
Chrome's PDF plugin is closed source, and written in C. It is very useful, but not free as in FOSS.
by snotrockets 14y ago
Chrome's PDF plugin is closed source, and written in C.
It is very useful, but not free as in FOSS.
- efdee 14y agoAnd... ?
- lclarkmichalek 14y agoSomething being closed source matters to some people. You might not be one of them, but other people might have different perspectives that cause them to value an open source option above a closed source equivalent.
- siddhant 14y agoYes but the masses don't care if it's open or closed source.
- LeonidasXIV 14y agoNo, but we should. For the masses that don't.
- PavlovsCat 14y agoThat the masses don't care about open source is reason to work really hard to educate them; not reason to not care either.
- gcb0 14y ago... from there comes most infections on windows PCs running chrome.
- heartbreak 14y agoSource?
- benaiah 14y agoActually, that would be Java.
- iso-8859-1 14y agoSource? I don't believe this since so many levels of confirmation is required. I think the biggest source is the simple links to "KimKSexTape.jpg.exe".
- benaiah 14y agoSource: http://www.kaspersky.com/about/news/virus/2012/Oracle_Java_surpasses_Adobe_Reader_as_the_most_frequently_exploited_software http://www.kaspersky.com/about/news/virus/2012/Oracle_Java_s... (Chrome uses its own PDF system, not Adobe Reader, so it's not even close to the threat level of Java). Java has had multiple drive-by exploits discovered in just the past few months, which by definition don't require confirmation. I was inaccurate, however. Java is almost certainly the cause of most exploits, but I daresay that user inexperience (to put it kindly) is probably the source of most infections. Touchè.
- drzaiusapelord 14y agoThis is ridiculous. The foxit plugin is fully sandboxed and I have not seen any exploits via any of the netsec lists I subscribe to.
- simonster 14y agoWith a couple Google queries, you can find out that the Chrome PDF viewer has had multiple vulnerabilities that allow code to be executed in the sandboxed environment, and that there have also been Chrome vulnerabilities that allow sandboxed code to escape the sandbox. Sandboxing is certainly a good thing, but it's not perfect. Sandboxed code still increases the attack surface. The rationale behind pdf.js is that, because it's almost entirely unprivileged JavaScript, it's unlikely that there's a way to exploit a browser in the presence of pdf.js that wouldn't work in the absence of pdf.js.
- pifflesnort 14y agoThe browsers themselves have also been subject to such vulnerabilities. I dare say the attack surface of a full browser implementation is much larger than just the sandboxing, and sandboxing ideally sits behind all I trusted operations in the browser, providing a single common last line of defense.
- jlongster 14y agoIt's not just a matter of open/closed source. Bundling in yet another C binary is only going to widen the surface area for security vulnerabilities for millions of people, and there's really not a great reason to do so anymore. PDF.js proves that it's possible to write high-performance javascript to do this stuff, without introducing any security risks and it's completely cross-platform. Computers are only going to get faster, and js compilers are only going to get better too.
- jonknee 14y agoBut Chrome's works better and has been around (and useful for millions) for years. Perhaps they'll move to a JS solution in the future, but if I had to choose between the two right now I'd take the faster more complete one.
- pifflesnort 14y agoJS-everywhere ideologues are always trying to buy a hamburger today and pay for it tomorrow. Someday machines will be faster. Someday the implementation will on par with the alternatives. How it works today is what matters to users. Tomorrow the native stack will just make use of more hardware features, it will still be faster, and we'll still be having the same conversation that we'be been having with JS ideologues for 10 years now. "Someday ..." This is what the XML ideologues used to say too. The problem wasn't XML, it was the libraries, or the lack of dedicated XML processing hardware. Then someone realized that if you got rid of the core complexity -- XML -- you could stop layering on piles of additional complexity while trying to work around the root of the problem. Someday...
- jonknee 14y agoThat has nothing to do with anything. If you're just having a dick measuring contest, Google has contributed a ton to the open source community. Google also provides nearly 100% of funding for Mozilla.
- kzrdude 14y agoOpen source is not about smelly dicks, it's about transparency, reusability, philsophy, politics. It's a lot of things (and they matter, because right now, society and technology are changing fast).
- recoiledsnake 14y agoI am not against your main point but I am sure that Microsoft will provide at least 110% of funding if Google pulled their "funding".
- natrius 14y agoIf Microsoft were willing to provide pay as much or more, why aren't they doing it already to make Bing the default search engine?
- batiudrami 14y agoMy guess would be that if the offer is similar, Mozilla would be inclined to stick with Google. I'm sure you know how irritating it is to realise you missed a checkbox and now your homepage and default search are set to Bing - it's probably a user experience Mozilla was happy to avoid. Plus, there are probably some advantages to having Google 'on side'.
- cooldeal 14y agoPerhaps they had made an offer. We never would know. We don't even know the details of the Mozilla-Google deal. For all the openness that Google and Mozilla appear to proffer, the agreement between them is a secret.
- 14y ago
- est 14y agoChrome's built-in PDF plugin is actually from a Chinese company called Foxit. http://googlesystem.blogspot.com/2010/08/google-chromes-pdf-plugin-uses-foxit.html http://googlesystem.blogspot.com/2010/08/google-chromes-pdf-... Now start China bitching.
- damian2000 14y agoI've been using Foxit reader for years without knowing that it was Chinese. Its a great product - fast as hell - beats the pants off Adobe.
- brass9 14y agoI'd started using Foxit for the same reason. But the speed advantage is no longer an issue. Adobe had closed the gap and Acrobat reader now loads just as fast as Foxit. Besides, Acrobat's rendering is far superior to Foxit's (not to mention Foxit fails to load some PDF document or displays garbage) Acrobat is the new Foxit nowadays!
- damian2000 14y agoMy problem with Adobe is that whenever I install any of their products I get the feeling I've just made my system more vulnerable to malware and the like. They've got an atrocious record when it comes to security bugs. E.g. look at the size of this page: https://www.adobe.com/support/security/ https://www.adobe.com/support/security/
- ams6110 14y agoI've not found anything that is even close to on par with Acrobat for fill-in PDF forms either.... Other viewers can sort-of handle it, but the results don't look right most of the time.
- qu4z-2 14y agoI like MuPDF. It doesn't really have an "interface" though. Just page-up, page-down, and +/- to zoom. But if all you're doing is reading pdfs...