I see many submissions from blackhat.com are direct PDF links, but that does not make me feel very comfortable.
The presentations get published.
Isn't this totally normal?
I mean, sure it'd be totally blackhat to publish a brand new pdf exploit this way, but blackhat as a conference went way beyond those roots a long time ago.
On the one hand, you'd think anyone technologically savvy wouldn't do that.
On the other hand, accidentally clicking on links in PDF's is the bane of my existence. I constantly consume academic books and papers as PDF's on my iPad in the built-in Books app, tap somewhere with my Apple Pencil for any number of reasons (to pan, to zoom, to highlight), and bam I'm transported 100's of pages away and with no back button.
If I could ask for any PDF reader feature, it would be to improve link handling. If it's an internal link, for the love of god include a back button. And if it's an external link for a web browser, for the love of god require a confirmation dialog first. I should never be led to a malware URL because of an accidental click.
(Modulo any Xen exploits that make it through and affect Qubes. no security is perfect.)
By the way, thanks to the clever Qubes design, quite few Xen exploits affect Qubes OS [0]. Especially after 4.0 with VT-d hardware virtualization [1].
[0] https://www.qubes-os.org/security/xsa/
[1] https://www.qubes-os.org/news/2017/07/31/qubes-40-rc1/#fully...
My guess is that my brain has subconsciously tuned out engaging pdf content because of how difficult it is to use in-browser... Especially when dealing with text sizes and zooming sigh. It's even worse with pdfs on mobile :(
Also the sudden break from "website" to "pdf" format is often jarring.
PDF is a beast. It's a ridiculous file format. There's a reason why even after all these years, reading PDFs still kinda sucks.
On android I have to use a firefox fork called iceraven to be able to install pdf.js extension to use mozilla's own pdf.js to load pdf's in my tabs. Afaik, there's no other way to do it.