Hacker News Reader

Comment by _wmd | Hacker News Reader

For comparison, NIST NVD lists 445 CVEs for Acrobat, or at least 17 per year since introduction. However CVEs haven't been maintained since the early 90s, so that number should be much higher. I think pdf.js does just fine.

View on HN

pdf.js does a lot less, of course. Really you should compare Firefox to Acrobat, as they are both rich media rendering apps with a lot of functionality.

pdf.js does a lot less, just how I like it. I can view PDFs and not have a constant stream of critical vulnerabilities to worry about.

Did you know Acrobat supports viewing 3D models in PDFs? Not even kidding[1]. It has an unnecessarily huge attack surface.

I will never use that and I work in engineering at a factory.

[1] For example, http://help.actify.com/download/attachments/6651965/SF_expor...

Pdf.js does less, but in most cases it does all the things users ever wanted from Acrobat, so the comparison is sound.

One of the points of something like pdf.js is that in most cases you don't need all that extra fluff. You just want to look at some PDF. So doing less is exactly what allows pdf.js to be (more) secure.

>CVEs haven't been maintained since the early 90s

Can you clarify what you mean by this?

The wording was confusing for me too. At first reading I understood it as saying CVEs were no longer being issued for Acrobat, which definitely isn't the case. I assume the intended meaning was that Acrobat was first released in 1993[0], but the first CVE was CVE-1999-0001 (source: downloaded the raw dump from [1], ran grep -m1 CVE-....-0001).

But, I'm doubtful there would have been all that many CVEs issued for Acrobat from 1993-1998. There was only one CVE that mentioned "Acrobat" each year from 1999-2001, and three in 2002. The more recent years are the fun ones - but I have no idea whether that's a result of freshly-introduced exploitable bugs or just increased attention.

[0]: https://en.wikipedia.org/wiki/Adobe_Acrobat_version_history

[1]: https://cve.mitre.org/data/downloads/index.html

Reply on news.ycombinator.com