Hacker News Reader

PDF is required for JS to run due to code generation in the PDF rendering pipeline facility.

Right, so the question becomes: "What controls are in place?"

Does the JS run in a true sandbox? Inside, outside, or beside the usual browser sandbox? Are network requests allowed? Filesystem access? Are granular permissions required/available?

You can just block PDFs. It is easier than blocking js in web pages.

I don't want to block PDFs.

I want to block JS in PDFs, by default, like I do in web pages.

I'd also be happy to hear that the JS runtime in PDFs is run in a tight document sandbox, operates only on a highly constrained DOM-equivalent, and has zero network or filesystem access. Seems reasonable.

> Zero websites automatically get JavaScript access from me, and many other savvy web users.

Even if this weren't true, it would still be false that "all websites already use JavaScript".