On Sun, Oct 11, 2026 at 12:19:58PM +0100, Peter Hillier-Brook wrote: > On 11/10/2026 07:09, [email protected] wrote: > > On Sun, Oct 11, 2026 at 12:45:14AM +0100, Peter Hillier-Brook wrote: > > > On 10/10/2026 21:49, songbird wrote: > > > > thanks to those who have replied, i'm just back to > > > > this project to see if i can make any headway easily > > > > enough or if i should just delete the message and get > > > > on with life. :) > > > > > > > > > > > > songbird > > > > > > > Coming late to the party: I generally save the PDF and then open it with a > > > text editor. It's not the easiest to work with, but it's safe. > > > > I don't think so, no more than a PDF viewer (heck, even pdftotext links to > > libpoppler, so I guess everything these days is as (un)safe as libpoppler > > is). > > > > Something has to convert the PDF structure (i.e. "interpret" it) for your > > text editor to understand it. On top, you add your editor's vulnerabilities. > > I think we are at cross purposes. I don't want to open (interpret) the pdf: > I just want to see what it contains for the sake of interest.
Open for viewing was *exactly* what I meant by "interpreting". Something has to traverse the data structure of the pdf (one big top-level interpreter there), render the fonts (yet another complex sub-interpreter in there, or three), uncompress the images (more of that), yadda, yadda. Otherwise it won't be able to "paint" the PDF for you to see it. It's enough that one of those has a security vulnerability. So if you have reasons to suspect that the PDF is under control of some malicious actor, it's not a bad idea to render it under limited privileges (some unprivileged user, a container, a VM, an airgapped hardware, in rough ascending order of tightness). Cheers -- t
signature.asc
Description: PGP signature
