3 ms·

As a computer user, I'm thoroughly tired of Adobe's products constant stream of security vulnerabilities. Flash, Adobe Reader, ColdFusion. I avoid their product

As a computer user, I'm thoroughly tired of Adobe's products constant stream of security vulnerabilities. Flash, Adobe Reader, ColdFusion. I avoid their products mostly for this reason. Flash, which I can't avoid completely, I have set up to only run when I say so, which I only do for a couple websites I trust. And why should a static document reader be able to run arbitrary code completely eludes me. Many companies should learn the lesson from Microsoft's huge shift years ago when they implemented the Trustworthy Computing Initiative. They have much larger targets (an operating system, a hypervisor, a database server, a full office suite, etc.) compared to a browser plugin or a document reader, and in my experience they're doing a far better job at keeping security at an acceptable level. Comparing IIS+ASP.NET security versus some frameworks such as Rails (another huge source of vulnerable web applications) is also enlightening.

kijin 14y ago
> why should a static document reader be able to run arbitrary code Because PDF was never meant to be a static format, and Adobe Reader was never meant to be a static document reader. However, since most PDFs are static anyway, I think it would be a very good idea for PDF reader softwares to treat every PDF as a static document by default, and only allow scripting after the user clicks Yes on a scary-looking warning.
- facorreia 14y ago
  Correct. I wasn't clear, so let me clarify: I regard every PDF I read as a static document. That's how I see them and that's how I read them, with readers that treat them as static. I have no use for a PDF document that wants to acts as software and I wouldn't use a bug-nest of a piece of software to run it.
  - purephase 14y ago
    You're not the target market for those types of PDF's then. In large corporate environments, PDF's are roughly the equivalent of small web-apps that handle a lot of the data entry and sharing across the organization. I'm not a proponent of this approach, but it is what it is and it is the reason that Reader is such a bloated security-ridden nightmare.
    - kijin 14y ago
      Then those features should only be enabled by default in corporate versions of Adobe Reader. Average internet users have very little use for non-static PDFs, except the occasional "fill out this form" PDFs where you can't save any changes.

kijin 14y ago

> why should a static document reader be able to run arbitrary code Because PDF was never meant to be a static format, and Adobe Reader was never meant to be a static document reader. However, since most PDFs are static anyway, I think it would be a very good idea for PDF reader softwares to treat every PDF as a static document by default, and only allow scripting after the user clicks Yes on a scary-looking warning.

facorreia 14y ago
Correct. I wasn't clear, so let me clarify: I regard every PDF I read as a static document. That's how I see them and that's how I read them, with readers that treat them as static. I have no use for a PDF document that wants to acts as software and I wouldn't use a bug-nest of a piece of software to run it.
- purephase 14y ago
  You're not the target market for those types of PDF's then. In large corporate environments, PDF's are roughly the equivalent of small web-apps that handle a lot of the data entry and sharing across the organization. I'm not a proponent of this approach, but it is what it is and it is the reason that Reader is such a bloated security-ridden nightmare.
  - kijin 14y ago
    Then those features should only be enabled by default in corporate versions of Adobe Reader. Average internet users have very little use for non-static PDFs, except the occasional "fill out this form" PDFs where you can't save any changes.