Hacker News Reader

Comment by jazzyjackson | Hacker News Reader

Is injecting malware into PDFs still a thing? If so, it could be a national security matter to give people access via a trusted source so they don’t have to go to a grey market to get their research papers.

And I’ll just +1 here that even when I did have access through university, the flow for logging into elsevier was like 8 clicks, and then after finding the paper, the button to download and read it was hidden on the side as an image-button, no alt or title text. Just an image with the word “download pdf”

So yeah, I went to sci-hub every time.

View on HN

Or it was configured to only allow IPs from library computers. Or one had to use VPN if working from one's dorm room and not campus to get access. Just all around a big hassle.

Reminds me of being a kid living in a small town in the mountains of Norway. The only music I could buy was the Top10 CDs on display at the kiosk. Being rotated only a few times a year and not at all my taste. But with p2p filesharing I could listen to all kinds of music. Often times the illegal way is just so much more convenient, not because it's free, but because it doesn't have lots of artificial hurdles.

> Is injecting malware into PDFs still a thing?

Nope. Most people read PDFs inside the browser, with the same sandbox protections as other web content.

IIRC Firefox uses a JavaScript based PDF reader (pdf.js), but Chrome/Chromium uses a native library (PDFium).

Both have had exploits in the past, but I would trust the pdf.js approach more.

Sandboxes can be escaped from.

You can only get guaranteed protection from malware infections through the internet if you turn off your machine.

Even then there might be some remote management exploits which would work on turned off machines, so unplug the cables aswell.

Thats not a reason to fudge with the definitions. The existence of sandboxes doesnt mean there are no more pdf exploits. There still are and sandboxes dont mitigate it entirely.

There is also more ways then just turning off your machine. Its needlessly oversimplifying complex topics. Topics that are very interesting and have severe implications. Especially if we are talking about state level espionage.

So in short, no you are wrong. PDF exploits are still a thing. You made unjustified assumptions.

Reading my post it sounds confrontational. Thats not my intent.

I only confirmed what you said.

The best way to reduce the number of bugs (exploits) in a system is to get rid of it.

Since you've brought up state level espionage, this might be the reason why states are run by hordes of bureocrats processing physical paperwork (this is an oversimplification of course).

>this might be the reason why states are run by hordes of bureocrats processing physical paperwork (this is an oversimplification of course).

Nice point, thanks for bringing it up. Reminded me of https://www.theguardian.com/world/2013/jul/11/russia-reverts... >Russian guard service reverts to typewriters after NSA leaks

Reply on news.ycombinator.com