Hacker News Reader

Comment by JupiterMoon | Hacker News Reader

Is there anyone else reluctant to open a pdf from the NSA?

(a) It's from their museum facility (if you ever get the chance to visit the National Cryptologic Museum in Maryland TAKE IT TAKE IT TAKE IT)[1], not the NSA itself.

(b) It's a scan of a 30-year-old report on a completed project, redacted heavily. Nothing more.

(c) If they want your inside leg measurement they've got better ways to find it without feeding you a PDF they overtly created.

[1] Where else will you find a teaching exhibit for visiting schoolkids that lets them cypher a message on a no-shit four rotor WW2 German Enigma machine, hand it to a friend, and watch them decrypt it on another Engima machine at the other side of the room? (Hint: valuable museum pieces.) Also, working (or at least blinkenlights powered up) exhibits like a CM1 Connection Machine and a Cray X-MP, and a history of their amazing linguistics branch[2] ...

[2] Who have the world's largest collection of bible translations. Want to know why? It's worth your while to pay them a visit.

>TAKE IT

Seconded. I went midweek around noon and it was pretty quiet so I got a personal 90 minute tour by an NSA retiree. He was very knowledgeable about crypto history, esp. as used in the cold war and WWII. They had Turing's "bombe", multiple Enigma variants, many lesser-known crypto machines, historic correspondence, a Cray YMP, codetalkers exhibit, spy satellites, and tons of other good stuff. Everything is free - except merchandise in the gift shop, which is also pretty unique.

I'd wager a guess that [2] was necessary for messages using it as a code, e.g., page number+word number, or page number and then the Nth word or letter.

Nope.

The real answer is, the NSA is all about communications -- which isn't just electronics: it includes a huge element of linguistics.

The Bible angle: when a new tribe or culture is contacted, the very first thing that happens is that Christian missionaries get all excited and do their best to go there to spread the gospel. To do this, they have to learn the language sufficiently well to translate the Bible. So you've got this one text (with a quantifiably-variant or de-facto invariant baseline) that gets translated into every language on the planet as fast as is humanly possible after that language is discovered. It's a Rosetta stone.

I forget the number that was given for how many different-language Bibles the NSA has in their library, but it was impressive -- something over 900 languages.

Looks like there are folks working on the Klingon version of the Bible.

This is pretty optimistic, in quite a few dimensions... :-)

There's a translation into Polari:

http://www.josephrichardson.tv/polari-bible.html

(Implications guaranteed to set a few Church-men's heads exploding.)

In response:

(a) I wish I could but I doubt I ever will. I've heard so much bad stuff about US border guards being annoying and transiting through the US being slow and painful that I won't even use a US hub anymore.

(b) Cool I guess I can't know if this is true without opening it though? This is partly the fault of the pdf spec itself. Maybe a more transparent document format would help (does that even exist)?.

Furthermore. I actually really want to read it. I'd really like to trust the NSA. However, their record is not good on being trustworthy.

How is PDF not as transparent as any other open binary format (though PDF is more like mixed)?

Edit:

> Maybe a more transparent document format would help (does not even exist).

I don't know if more transparent, but djvu exists for scanned documents. Postscript also exists but I would doubt that it's safer than PDF.

I am aware that the pdf specific is open. However pdf does a lot of things and is somewhat complex. I argue more than is needed for transmitting documents. Can you personally verify that a given pdf does nothing malicious?

Can you personally verify that a given jpeg does nothing malicious? Same thing, you trust (or not) your reader and its parser and hope it doesn't have any remote code execution vulnerability. Or you stop reading PDF files and stop viewing images.

Nope I can't. In reality how many exploits have actually been contained in jpegs vs pdf though?

That's an other question. Parsers of multimedia formats often have nasty vulnerabilities though. The most vulnerable part of PDF readers is the handling of embedded javascript. It can be easily evaded by using a viewer that doesn't implement the javascript functionalities of PDF, most files don't use it anyway.

Wow this got a lot of downvotes. I don't normally comment on downvotes but I'm wondering why so many? What about this is causing annoyance?

Not really. If the NSA would feed me a harmful pdf, it would come so I wouldn't know it is from NSA.

You can use http://www.zamzar.com/url/ and then convert it to an image file.

There's also online viewers like Google Docs, which I think basically do this server-side:

https://docs.google.com/gview?url=https://www.nsa.gov/public...

Download it, block all ports, run pdf reader in a chroot...B)

And on a separate X server. It's more like trusting your reader than the PDF file itself.

>destroy computer after reading.

Perfectly common, of course. Usually the way to do this is to use a virtual machine which you then throw away.

but why do you trust your hypervisor? QEMU had a floppy controller escape bug published last month. Xen has one today.

By doing this the chain of things that have to be broken for an exploit to escape is getting longer.

So the best thing you can do is to nest different kind of VM hypervisors with different OS guests and read the pdf in the innermost machine.

Or just read it on someone else's computer?

There's a name for that. The Stallman Co-Computer.

If you are that paranoid, then you shouldn't open any pdf that you find on the internet. The NSA has the ability to proxy any file you download and inject anything they want.

I'll open it on my work computer, they surely already have access to anything important anyway.

Reply on news.ycombinator.com