Hacker News new | ask | show | jobs
by johnlorentzson 2292 days ago
This kind of makes me wonder why PDFs can even act maliciously in the first place. Why does it have the ability to do these things?
3 comments
masklinn 2292 days ago
PDF derives from PostScript which is a full-blown programming language so it's an "original sin" either way.

Then over time Adobe added a number of interactive (forms), multimedia and rich media (embedded JS) features, leading to even more vectors.

link
gpvos 2292 days ago
The page description language part of PDF is based on Postscript, but explicitly simplified to be non-Turing-complete and safe (if implemented sanely). The later additions are the main culprit I think.
link
Piskvorrr 2291 days ago
"if implemented sanely" - oh well. The original idea was nice.
link
MaxBarraclough 2292 days ago
I think it's just that Adobe wanted to add more features, even ones that have no place in the PDF format.
link
maxerickson 2291 days ago
Because computer, a benign feature of pdf can still lead to an exploit in a viewer.

Note the attempts at the link to sanitize image formats that don't have over the top complexity.

If your question is why an electronic document format has support for images and interactivity, I don't know what to tell you.

link