Adobe PDF Exploits In the Wild

mambosauce writes "Brian Krebs, via the security fix blog is reporting that the recent PDF vulnerabilities which were patched only for Adobe Reader 8 and not 7 are being exploited via banner ads. As if there haven't been enough banner ad attacks this year now we have another one targeting one of the most popular applications in the world this weekend. At this rate there won't be many safe applications left to use."

Comments

Use a different PDF viewer instead

[Anonymous Coward]

That's what foxit and kpdf are for.

Re:Use a different PDF viewer instead

[ScrewMaster]

No kidding. FoxitReader is a hell of an improvement over Adobe's crap, even if it isn't open source.

Re:Use a different PDF viewer instead

[Anonymous Coward]

Unfortunately, I have to have it installed to do testing with PDFs since we have scripts that generate the things and sometimes they don't work correctly.

So I downloaded the new version of acrobat, and the thing doesn't actually upgrade. It installs and leaves the old version still on the system... WTF?? Adobe is retarded...

Re:Use a different PDF viewer instead

[iamacat]

Yeah, Preview is pretty good too. Unlike Acrobat, it starts instantly without the annoying logo popping up for half a minute in the middle of the screen and blocking all the other applications.

Re:Use a different PDF viewer instead

[mikapc]

I second that. Foxit is so much faster and less of a resource hog then adobe reader.

Re:Use a different PDF viewer instead

[FudRucker]

in case anyone is interested kpdf is part of KDE's kde-graphics package...

Re:Use a different PDF viewer instead

[ScrewMaster]

Might be you have a permissions problem on the program folder or the files. You'd think the installer would have reported that fact, but maybe not. Log in as Administrator and see if it upgrades then.

Re:Use a different PDF viewer instead

[JackieBrown]

Okular in kde4

Re:Use a different PDF viewer instead

[Constantine XVI]

And if you need more OSS in your diet, there's SumatraPDF (http://blog.kowalczyk.info/software/sumatrapdf/)

Re:Use a different PDF viewer instead

[Zackbass]

I like Foxit and use it in place of Acrobat Reader, but there's one problem I have with it that makes me have to start up Acrobat Reader sometimes. Some types of PDFs like datasheets seem to cause the program to grind with what looks like completely rerendering the page every time it's scrolled. It gets hung up for a couple of seconds with every motion making it almost unusable for some documents but Acrobat Reader works perfectly with the same files. Anyone have some idea what this is about?

Re:Use a different PDF viewer instead

[Tibby Lickle]

I've found this to be a great little program. The latest version includes support for bookmarks and search, which I particularly missed in previous versions. I've had to get used to not flinching whenever I accidentally click on a PDF link. My only criticism is that I haven't found a way of using this as a browser plugin - but then I've never really missed this functionality, so I haven't looked too hard.

Re:Use a different PDF viewer instead

[Anonymous Coward]

Ah, yes. There's more information on that here.

Re:Use a different PDF viewer instead

[Futil3]

Sumatra PDF is a very speedy and free (GPLv2) reader for the Windows people. (no affiliation, just a happy user.)

Re:Use a different PDF viewer instead

[Anonymous Coward]

> So I downloaded the new version of acrobat, and the thing doesn't actually upgrade. It installs and leaves the old version still on the system... WTF?? Adobe is retarded...

That's not a bug, it's a feature! (Really, no sarcasm tag!)

Most of us using Adobe's shit in a production environment need the ability to continue using the old version, especially when we discover what the "upgraded" version breaks and how much harder it sucks.

The best way to upgrade anything in a production environment that's running smoothly is not to upgrade. Failing that, being able to install the "new hotness" (that is, the new-donkey-balls-suckingness) and run it in parallel with the "old and busted" (that is, the stable and working system on which your business depends) is the next best thing.

Re:Use a different PDF viewer instead

[drozofil]

Okular, part of KDE4, is fine too. And it's open source. Some windows/macosx binaries should be made available any time soon, if not already done. Linux binaries are available, source package are too.

Re:Use a different PDF viewer instead

[tokul]

FoxitReader is a hell of an improvement over Adobe's crap

Some people measure things in (centi|mili)meters instead of inches.

Re:Use a different PDF viewer instead

[Anonymous Coward]

Yes but ...
* Can FoxitReader view Flash. WMV, Real and Quicktime content embedded into PDF files?
* Can FoxitReader edit PDF files if they have been encypted and signed using Reader Extensions Server?
* Can FoxitReader let its user participate in PDF reviews?
* Does FoxitReader support submitting forms to a server backend using XML?
* Does FoxitReader let you participate in online meeting using Adobe Acrobat Connect?
* Does FoxitReader let you condense PDF files into a booklet?
* Can you sign documents with FoxitReader if they have been flagged as such?
* Does FoxitReader support OpenGL acclerated embedded 3D content?
* Does FoxitReader support DirectX and other accelerated graphics API's?

I am getting tired or all the Adobe Reader bashing from people that does not understand how capable this product really is. It can pretty much do everything that Acrobat Professional can do if the PDF signature permits it to. It's a piece of software aimed at everyone, from coorperations to home users. Adobe Reader is pretty much Adobe Acrobat without the save feature enable by default and the PDF Writer.

Re:Use a different PDF viewer instead

[mambosauce]

no ones arguing the sweetness of programs like foxit, there just aren't too many fortune 500 companies that i know of with it installed

Re:Use a different PDF viewer instead

[siride]

Most people don't need that, though, when they are just viewing PDFs on the web. Nobody is really saying that Foxit/et al can or even should do all of what you are saying. But they're okay with that because they don't need to participate in online meetings through a PDF reader.

Re:Use a different PDF viewer instead

[RMH101]

* Do I care about any of this shit, when all I want is to be able to safely view a PDF file within a few seconds of clicking on it?

View OpenGL content embedded in PDFs. For fucks sake.

Re:Use a different PDF viewer instead

[hairyfeet]

Does anyone know if the exploit works in foxit or any of the other pdf alternatives? I haven't bothered with anything but foxit since the adobe reader became bloatware. It would really suck if I had to recommend adobe just to protect my customers from adobe bugs.

Re:Use a different PDF viewer instead

[ScrewMaster]

So what?

You can make the same claim about any lightweight application compared to any overloaded kitchen-sink program that grew out of control. FoxitReader does what most people want a PDF reader to do: it reads PDFs. It does so reasonably well, and it's free. Furthermore, as other posters have pointed out, there are many similar programs that do what Adobe's reader used to do, so there's obviously a demand for something that Adobe no longer offers. As it happens FoxitReader serves my limited requirements perfectly well. I'm not alone in that. I'm still going to evaluate some of the other programs mentioned in this thread, however: some of them sound useful.

I'm sick and tired of software vendors trying to garner every last ounce of marketshare by including everything of which they can possibly think. There's a reason Adobe's software is bloatware, there's a reason Microsoft's software is bloatware, there's a reason Roxio's software is bloatware, there's a reason all major software vendors ship bloatware. They aren't satisfied with keeping 90% of their customers happy, they just have to try for 100% ... and in the process, they usually make most of their customers unhappy, or at least, not as happy as they once were.

For my part, I am fed up with development processes that lose their vision, completely lose sight of the actual user problems they were trying to solve in the first place. There's a place for compact, efficient programs like FoxitReader. There's a place for programs like DeepBurner, which reminds me a lot of Nero 3.5: lightweight, fast, and does the job.

Not all of us want all-encompassing applications that try to be everything to everyone. If Adobe had half a brain they'd offer a Reader Light for those that just want to view basic PDFs.

Re:Use a different PDF viewer instead

[ScrewMaster]

View OpenGL content embedded in PDFs. For fucks sake.

Yeah, that was kinda my reaction as well.

Re:Use a different PDF viewer instead

[toddestan]

That's like installing MS Office to view a 1kb readme.txt file. I don't need anything on that list all I want is something that lets me look at basic PDF files, not something that is bloated all to hell from useless features, like Quicktime embedded into PDF files.

Re:Use a different PDF viewer instead

[Anonymous Coward]

PDF. "Portable DOCUMENT format."
When was the last time you opened up your favorite book or magazine and saw video (flash, wmv, quicktime)? When was the last time your favorite book required 3D acceleration (DirectX or OpenGL content)?
Do most people want/need to be able to condense pdf files into a booklet, or participate in reviews, or participate in online meetings with their pdf files?

For a portable document viewer, it seems like a lot of bloat and unnecessary features to me. If you want to include these features, offer a version with them separate from just a plain viewer. If there is such a large market for 3rd party PDF viewers, ones with a smaller footprint and faster open time, shouldn't that say something to Adobe to offer JUST a viewer without extra crap?

Foxit, Xpdf, Kpdf, eXPert, Sumatra, PDF-XChange, probably TONS of others... Just like how people started flocking to Phoenix/Firebird,Firefox once Mozilla started adding in Email and News and other things that didn't help with regular Web Browsing. .02

Re:Use a different PDF viewer instead

[Anonymous Coward]

ASStroturf much?

Re:Use a different PDF viewer instead

[heson]

NO, and thats why its better.

Re:Use a different PDF viewer instead

[ConceptJunkie]

I haven't bothered with anything but foxit since the adobe reader became bloatware

It's been around that long? The Acrobat Reader is a funny piece of software. The first 3 versions were complete crap. Then it got good for about two versions, then they turned it back into crap. That's the one thing I've found about a lot of commercial software... they can never leave well enough alone because they need to force the upgrade cycle, so even once you get a good version, it just as liable to get completely ruined in the relentless drive to "force" people to upgrade.

Look at Vista, where they literally eliminated every reason anyone would ever want to use it (except for some improved security, which is offset by vastly increased annoyances) and then finally just shipped it out of desperation of needing _anything_ to sell.

If MS didn't need to force upgrades to feed their monopoly they could have stuck with perfecting XP. I don't know why Adobe keeps making the Acrobat Reader, or I guess it's just called Reader now, bigger, slower and more bloated with each version, except that they probably need it to see more copies of Acrobat.

And thus, we see the real flaw of commercial software, just like we see the real flaw of government agencies. If they actually did their job right, you wouldn't need them any more.

Re:Use a different PDF viewer instead

[billcopc]

OUT! Back to 4chan you go.

Re:Use a different PDF viewer instead

[Yvan256]

And why would people on Mac OS X want a PDF viewer for?

Re:Use a different PDF viewer instead

[kaens]

Actually, that's in emacs23 if I remember correctly.

Re:Use a different PDF viewer instead

[(Score.5, Interestin]

Sumatra is a nice, small, fast PDF viewer, but its downside is that it has a rather quirky interface that makes many users think it doesn't support the features they expect. Look at the Sumatra support forums for examples of people asking for support for a particular feature only to be told that it's already present, you just have to know that it's accessed via Ctrl-Alt-Shift-Esc-Z rather than a "Find" menu option or hitting Ctrl-F like any other app.

Solution:

[CSMatt]

Don't use Adobe Reader.

Re:Solution:

[farlukar]

Captain obvious to the rescue!

Re:Solution:

[Anonymous Coward]

Don't use Adobe Reader. Stay offline is a better proposition?

Re:Solution:

[zerocool^]

Use Foxit Reader.

Re:Solution:

[Anonymous Coward]

Captain fanboy to the rescue!

One of the most popular?

[calebt3]

And IE isn't already in this category?

"Safe" application?

[Chas]

[Windows User] WUZZAT?

You have a multitude of applications, varying versions of operating systems, and scores of browser versions out there.

Is it REALLY any surprise that there are security holes like this? The miracle is that there aren't MORE.

Note: I'm NOT saying that these holes aren't a bad thing and shouldn't be patched. But this idiotic notion of a "safe" app just irks the shit outta me.

The only "safe" app is one that has absoloutely no interaction with other programs or the user whatsoever. (IOW it don't exist.)

Re:"Safe" application?

[albert.wavering]

Applications would be secure if they didn't have to deal with people . . .

Re:"Safe" application?

[youthoftoday]

If everyone did things in pure functional programming languages there would be no side-effects.

Re:"Safe" application?

[SanityInAnarchy]

It is possible to write provably safe apps. As in, mathematical proofs.

In fact, there is a company which specializes in writing damn-near absolutely safe, bug-free apps. They do it in about as much time as the competition writes buggy, insecure apps, because the lack of bugs in the first place means less of a debugging cycle. They charge about twice as much, because very few other companies provide that much quality.

Can't remember their name now, though.

Re:"Safe" application?

[robo_mojo]

Can't remember their name now, though.
That's a shame, because I'd like to send my application to work for them.

Got one phishing email attachment w/PDF

[JoeCommodore]

I recently received an email spam with a PDF (not the file.xxx.exe I normally see in such emails), I figured that was one of the exploit files.

Some vague "Your Account" message from "Bank Trust" from some a 3rd party email with the Manual_Invoice.pdf attachment. 134k

Re:Got one phishing email attachment w/PDF

[Anonymous Coward]

Yeah, I got that one, too. Thing is, I don't remember opening an account with Bank Trust. I went to the website and tried logging in with all my various bank logins, and none of them worked. I think someone at Bank Trust really screwed up when they sent that message out. Morons.

Re:Got one phishing email attachment w/PDF

[sqlrob]

Possibly infected, possibly not. That's one of the tricks to get around spam filters.

Re:Got one phishing email attachment w/PDF

[Anonymous Coward]

Post your login details here, and we'll check. It might be that one of your banks is our subsidiary.

Bank Trust Security Guy.

Re:Got one phishing email attachment w/PDF

[calebt3]

Sorry for the inconvenience. We have fixed it now. The new method also requires your email address, SSN, and your ebay/payal IDs and passwords.

Re:Got one phishing email attachment w/PDF

[Anonymous Coward]

Er... you do realize that it was a scam right? If I were you I would change your bank login details because they try to use what you sent them!

Re:Got one phishing email attachment w/PDF

[alx5000]

Er... you do realize that it was a joke right? If I were you I would change your sarcasm detection details because they try to mislead you when you use them!

Blocking Banner Ads

[AngelKurisu]

This is just another addition to the mounting list of reasons I block most banner ads. Why should I download something that could be dangerous, and adds no value to my browsing experience? I manually un-block certain sites I know to have decent levels of quality assurance in their ads (Penny Arcade, Slashdot, for example). I'd much rather directly micropay for content than be served completely worthless ads anyhow.

Re:Blocking Banner Ads

[calebt3]

I have also unblocked ads for /., but it's kinda pointless because I won't allow doubleclick through NoScript. Why do we need animated ads?

Re:Blocking Banner Ads

[prichardson]

If you would prefer to micropay for content, why don't you become a slashdot subscriber? It seems to me that a lot of people say they would want to micropay for content, but when faced with the amount of content they consume fear being nickel and dimed to death (or in this case penny-nickel and penny-dimed).

Re:Blocking Banner Ads

[jonaskoelker]

Because the brain responds to motion. If it's animated, it's more likely you will look at it (and then fork over some money).

lynx

[acidrain]

At this rate there won't be many safe applications left to use.

Good old lynx. Surfing the web in text-only since the beginning of internet time.

Re:lynx

[McDutchie]

Good old lynx. Surfing the web in text-only since the beginning of internet time.

I know you were kidding, but it's still worth pointing out that Lynx is not necessarily safer than any other app.

Re:lynx

[arth1]

Lynx isn't text-only. It calls up other programs for parsing various content types. In true Unix style, it is a toolbox program, meant to interoperate with (call AND be called by) other programs.

Nothing stops you from setting lynx to use Adobe Acrobat Reader for pdf files, just like you set Firefox to use Adobe Acrobat Reader for pdf files. No difference there, except that Acrobat Reader does the configuration of Firefox for you automatically. But if you're a lynx user, it would likely take you less time to set the association manually by editing a file than it would be for a typical windows user to click through the wizard dialogs to have it done automatically.

Well that explains the 32mb update

[Sepiraph]

that I got from Acrobat 8 today and it downloaded really slow. Still it is good to know that it is being patched fairly quickly.

If only...

[Darundal]

...there were web browsers that allowed you to block certain types of code, or had extensions that would perform a similar function...

Re:If only...

[John3]

OK, obviously trolling but I'll bite...

Firefox

Re:If only...

[calebt3]

Didn't you see the /sarcasm tags?

Re:If only...

[Anonymous Coward]

Redundant? Seems to be harmless, URL for Firefox which was not provided by the parent post. Guess they give out mod points to anyone nowadays.

Re:If only...

[John3]

No...don't see any tags for that post. Possibly I need to enable display of tagging?

Thanks!

Re:If only...

[Phoinix]

I still cannot understand why FF has to show PDF inside browser by default. I always get a customized version of Firefox. It has the PDF thingy disabled (in the installer) by adding // before the pref("plugin.scan.Acrobat", "5.0"); in the all.js file and a modified prefs.js (I am aware of the "PDF Download" extension but I like the other options with this version). It also includes some extensions by default (ConQuery, Extended Link Properties, Flashblock, Google Send to Phone, Coralize, All-in-One Gestures, MR Tech Local Install, Dict, Add Bookmark Here, and Zotero) additional "searchplugins", a custom "prefs.js", "hostperm.1", and "localstore.rdf".

Yet Another Misleading Headline

[dotancohen]

This is NOT "Adobe PDF Exploits In the Wild" but rather "Adobe Acrobat Reader Exploits In the Wild". The problem in is Reader, not in PDF. That's like calling Outlook scripting worms "email viruses". Oh, wait, blame the technology, not the software. Sorry, I forgot.

Re:Yet Another Misleading Headline

[Anonymous Coward]

well, pdf is excessively complex. do we really need a full ecmascript implementation in a document format?

Re:Yet Another Misleading Headline

[arth1]

well, pdf is excessively complex. do we really need a full ecmascript implementation in a document format?

The question is whether we needed another such format, when there already was PostScript.

Re:Yet Another Misleading Headline

[dotancohen]

PDF is a subset of PS. In fact, valid PDF is valid PS.

Re:Yet Another Misleading Headline

[catagras]

Actually they are related. None of them is a subset of the other.

Feel like digging into this?

http://partners.adobe.com/public/developer/ps/index_specs.html
http://www.adobe.com/devnet/pdf/pdf_reference.html

Re:Yet Another Misleading Headline

[dotancohen]

According to Wikipedia:

The PDF combines three technologies:

        * A sub-set of the PostScript page description programming language, for generating the layout and graphics.
        * A font-embedding/replacement system to allow fonts to travel with the documents.
        * A structured storage system to bundle these elements and any associated content into a single file, with data compression where appropriate. So it seems that the document structure is a subset of PS, but in addition to that subset of PS, PDF has the ability to generate tar-type files that contain the PS code, the necessary fonts, and possibly other data (images? music? scripts?).

The solution will not be Silverlight

[G3ckoG33k]

Whatever some companies might want to imply, the solution will not be anything called Silverlight. It would be like replacing Photoshop, because of some vulnerability, with Excel...

Re:The solution will not be Silverlight

[slaingod]

Except the problem is with Acrobat Reader, not Flash.

Re:The solution will not be Silverlight

[friedman101]

Microsoft's answer to pdf is xps. Their answer to flash is silverlight.

Proprietary software continues to bite users.

[jbn-o]

At this rate there won't be many safe applications left to use.

There are plenty of free software programs to use. The issue here has to do with proprietary software restrictions on user's freedoms to inspect, share, and modify programs. Just because Adobe is unwilling to modify older versions of their PDF reader doesn't mean their users should be restricted from doing so.

Re:Proprietary software continues to bite users.

[SanityInAnarchy]

*cough* *sputter* What?

Slashdotters always making me spill my coffee...

Oh, I see... is the issue that people are running older versions of Acrobat?

If they can't be bothered to upgrade to the latest version, what makes you think they'll patch themselves? Are you suggesting that the big advantage of me running Free Software here is that I could be running kpdf 0.2 and patch the security holes? Or are you suggesting that someone who can't be bothered to update their software is going to have a better time of it on Linux, for which I've never seen a built-in, GUI way to force auto-updates?

Of course, if you were going to suggest that Free Software doesn't have security bugs, I'd really have to laugh in your face...

Re:Proprietary software continues to bite users.

[empaler]

SanityInAnarchy, please say hello to PingXao.

Re:Proprietary software continues to bite users.

[Anonymous Coward]

But it can update ALL YOUR SOFTWARE from the same program. And there's notifications about having updates for install just a click away.

Re:Proprietary software continues to bite users.

[Anonymous Coward]

Actually, on all modern Linux distributions, this kind of thing would be an automated security update. Think Windows update, but with transparency if you are interested what actually goes into the patches, AND with a shitload more applications considered part of the core and therefore supported for automatic security fixes. And oh, no update is ever forced nor secret.

Re:Proprietary software continues to bite users.

[SanityInAnarchy]

Indeed, that is one of the things I love about Linux.

But I don't think for a second that it has anything to do with the software being open. After all, the same mechanism delivers updates to my proprietary nvidia drivers.

Re:Proprietary software continues to bite users.

[SanityInAnarchy]

Yes, that's the nice thing about it being free as in beer.

Again, nothing to do with it being Free Software.

Re:Proprietary software continues to bite users.

[SanityInAnarchy]

Actually, on all modern Linux distributions, this kind of thing would be an automated security update.

Nope, it'd be a nag-you security update. No matter how easy, you're still going to have users who just refuse to click on the thing.

Think Windows update, but with transparency...

Using Kubuntu, and I've used (and developed for) Gentoo. I know how package managers work.

Re:Proprietary software continues to bite users.

[jbn-o]

What I said was perfectly clear. Whether users want to upgrade to an ostensibly (we don't really know, nor are we allowed to check) more secure version of any given proprietary program is their business and a red herring of an issue. But Adobe shouldn't restrict its users from fixing and helping others fix Adobe programs. The way things are now, Adobe's users can only get the improvements Adobe deems necessary on Adobe's schedule and they must also get any downgrades that come along with those fixes. Such is the case for all proprietary software, not just Adobe's, and this poses a real practical problem for ordinary computer users. Therefore the more important issue here is an ethical one: is it right to treat people in this way? This is the kind of issue businesses want to dissuade you from asking, leading you instead to think that the heart of this issue is what you're asking about: some variant on whether or how quickly users will upgrade to the next version of the proprietor's black box software.

Re:Proprietary software continues to bite users.

[SanityInAnarchy]

But Adobe shouldn't restrict its users from fixing and helping others fix Adobe programs.

I don't agree with RMS; I think that's entirely their right. As a user, it means I'm much more likely to use KPDF, but at no time do I think they "shouldn't do that".

I'm not sure if this is still the case when a monopoly is in effect -- for instance, I do consider it a bit unethical the way the Flash specs are presented, especially when it seems to be wanting to replace the Web. (Entirely -- Flash itself has a plugin called AIR which embeds Webkit, an HTML engine.) But this is mainly because Flash has no real competitors, and is not interoperable. Adobe Reader has plenty of competitors, and is using a standard format (PDF).

this poses a real practical problem for ordinary computer users.

Not really. At least, unless you have a reason to not want the latest version (and there are sometimes valid reasons), Adobe's interests are aligned with the customers' -- they have every reason to provide a security patch in a timely fashion.

leading you instead to think that the heart of this issue is what you're asking about

That may be true, but it doesn't make what I just said about the practical implications any less true.

Again: I love free software. As a user, I love the freedoms it gives me. As a developer, I usually don't mind giving those same freedoms to my users. But I neither use nor develop exclusively free software, and I see nothing wrong with that.

And I have read many of the gnu.org philosophy papers. I understand and respect your philosophy, and I do not share it. I'm not sure there's much you can say to change my mind. I hope, at least, that when I do develop free software, you find it useful.

Where's the update for v6?

[PingXao]

I bought and paid for a license for Adobe Acrobat v6. Where's my update? I have no plans whatsoever to pay for an upgrade that consists of bloatware just to get a security fix. The manufacturer, Adobe in this case, should be liable for this flaw since it has now been pointed out to them. For all vulnerable versions.

Re:Where's the update for v6?

[Anonymous Coward]

See, that's the nice thing about Acrobat (despite all you haters out there) - you can install separate versions of Adobe Reader and the full Acrobat program. Install a patched version of the reader and use the plugin for that in your browser (or better yet, don't!). Then if you ever need to actually use the full program (to edit text, check color values, change trap settings, etc), you open the file you need in the full program. Ahhh, but that makes too much sense now, doesn't it?

Re:Where's the update for v6?

[Anonymous Coward]

I am putting them on notice (as if they care)...

If Adobe doesn't issue a fix for V.6 by Tuesday, I will remove it from all computers I manage. The "patch Tuesday" cycle will include removing Acrobat 6 and replacing it with Foxit Reader 2.2. I just downloaded and tested Foxit, and it appears to work as advertised, with no reporting back to a third party about which pdf documents are "popular." That is the "feature" which put the kabosh on upgrading to v.7.

If v.6 is not affected, then they should say that. There website states "all previous versions" affected.

Re:Where's the update for v6?

[Skuld-Chan]

So just out of curiosity - how many versions should Adobe be fixing? I want my fix for Acrobat Exchange 1.0 (1993).

Benifits of Adobe Reader? Seriously.

[Nemilar]

Seriously, Adobe Reader has gotten huge in terms of file size, when compared to xpdf/kpdf/foxit/etc. I'm wondering if someone can explain to me what all this extra code is for? Obviously it must be doing something, but personally I've never seen the difference.

Vendor responsibility? Hahahahaha

[uuxququex]

If vendors would be responsible for their faulty software there wouldn't be any of the larger software companies around anymore.

It would be a much better world if software engineering would grow up and would be kept to the same standards as "proper" engineering though.

Re:Vendor responsibility? Hahahahaha

[John Hasler]

> If vendors would be responsible for their faulty software there wouldn't be any of the
> larger software companies around anymore.

And this would be a bad thing why?

Re:Vendor responsibility? Hahahahaha

[Sancho]

There would effectively be no software, and thus no computers.

A luddite might think that's ok....

Re:Vendor responsibility? Hahahahaha

[John Hasler]

> There would effectively be no software...

All the software I use would still be available. So would most closed-source software: most does not come from the "larger software companies".

Re:Vendor responsibility? Hahahahaha

[Sancho]

The implications of vendor responsibility extend far beyond just large companies. The Linux kernel has had flaws, too. If someone was accountable for them, those people probably wouldn't continue writing software.

I've rethought things, though, and I think that what would really happen is that only large software houses would exist, and they'd have to carry insurance on their products. That's effectively how they'd deal with being responsible for flaws. Software prices would be higher because of this, and free software would be virtually non-existant.

But Foxit doesn't work!

[Anonymous Brave Guy]

Foxit is so much faster and less of a resource hog then adobe reader.

It also doesn't work. For example, two-page documents generally start with page 1 on the right, yet in two-page mode Foxit insists on displaying pages 1 and 2 together, 3 and 4 together, etc. I discovered this when I tried it after seeing comments like the parent and GP posts, and also discovered that there have been bugs logged on this for eons but no-one seems to care about fixing it. The software was uninstalled from my PC within two minutes of installing it and filed under "beyond hope".

One of these days, people on Slashdot will realise that something that is free/or more secure is still worthless if it doesn't actually do the job it's supposed to do.

Re:But Foxit doesn't work!

[Anonymous Coward]

Just because it isn't good for what *you* want to do doesn't mean that *I* can't use it. It works for everything I need it for, and it is about 5 million times faster than acrobat reader. So it is free, probably more secure, and does everything I need. That makes it far from worthless in my book.

Re:But Foxit doesn't work!

[dmsuperman]

I've never had a problem with it. First of all, what does it matter which side it's on, if you're reading it the same anyway :s

Second of all, it's a huge improvement. Adobe Reader takes forever to open up (even on my fast computer), but Foxit comes up in seconds. And it's free. Beat that, Adobe.

Re:But Foxit doesn't work!

[milsoRgen]

Adobe Reader takes forever to open up (even on my fast computer), but Foxit comes up in seconds. Ain't that the truth... I remember Maximum PC (or was it CPU?), either way they were able to download, install and run Foxit before Adobe had even finished loading up.

Re:But Foxit doesn't work!

[Anonymous Brave Guy]

First of all, what does it matter which side it's on, if you're reading it the same anyway :s

Because some documents use double-page spreads for their layout? Of the four things I was looking at that day, three of them happened to be like this, which is why Foxit was pretty much useless for me.

Re:But Foxit doesn't work!

[dmsuperman]

Meh, I spose. I've never seen anything like that, so I was imagining something like a book, where it wouldn't really matter if page 1 was on the left or on the right.

Re:But Foxit doesn't work!

[langelgjm]

First of all, what does it matter which side it's on, if you're reading it the same anyway :s

It matters when you're reading book-like documents where odd pages are supposed to always be on the right.

Second of all, it's a huge improvement. Adobe Reader takes forever to open up (even on my fast computer), but Foxit comes up in seconds.

I agree - personally, I use Acrobat, but I put Foxit on my parents' computer, which is old and slow, and they like it much better. Before they would always complain about opening PDFs.

Re:But Foxit doesn't work!

[acherusia]

I think in this case, you're mistaking a number of people's reasons for using Foxit. I know I personally was recommended it by my very nongeeky brother for the sole reason that it's faster. I know my brother. He does't give a damn about security, and hell, it's not like Adobe's reader isn't free too. He just likes it because it loads a lot faster than Adobe's reader. Which is pretty much the exact same reason I use it too. Fast is good. I like fast.

Personally, I have never encountered the problem you have. I don't particularly doubt you that it exists, but I don't think I've ever used Foxit in two page mode. And so this horrible fatal flaw that irritates you so badly is completely and utterly irrelevant to me. You want to hate it for that? No skin off my nose if you use a different reader. For me, Foxit serves my needs just fine, and the needs of everyone I know with it installed just fine. So maybe it doesn't work for you, but it sure works fine for a bunch of people.

Re:But Foxit doesn't work!

[Anonymous Brave Guy]

Just to be clear, I'm not claiming Foxit is useless for everyone. But people tend to present it as a direct substitute for Adobe Reader, which it demonstrably isn't.

For what it's worth, I've never understood the complaints about Reader's speed. The old version on my old PC fired up within a second or two. Version 8 on my new PC fires up within one second. I once had an in-between version installed on an old machine at work that seemed to take an irritating amount of time to load a bunch of plug-ins, but even then you could switch a lot of them off if it bothered you. Are you sure people aren't just slagging off Reader for an old problem that has long since been fixed?

Re:Benifits of Adobe Reader? Seriously.

[calebt3]

I don't know what the exra code is doing, but the fact that only one of those alternatives you offered works in Windows, (ordinary) people's options are severely limited.

disable javascript

[bcrowell]

The article doesn't say explicitly, but I'm assuming this is related to the fact that the default configuration of AR will execute javascript that's embedded in pdf files. This is both a privacy issue (people can track readers) and a security issue (more than one stack overflow bug has been discovered that's related to js). To disable js, go to Edit, Preferences, JavaScript, and uncheck "Enable Acrobat JavaScript".

There have been a lot of posts along the lines of "why the hell even use AR?" Well on Linux, I actually have Firefox set to open pdf files in xpdf, because it's faster, and I also habitually use xpdf to view pdf files when I'm not in a browser. (Evince is a little slower, but a little more full-featured and modern.) But I also have a copy of AR 8 installed on my Linux box, because it has some features that I find really useful once in a while, and also I want to be able to test my pdf files sometimes and make sure they'll look right for AR users. It's one of only two proprietary apps I have on my machine, the other being Flash. It would be great if the OSS community could produce a pdf viewer that was just a little more full-featured than Evince. (Flash is a whole different issue -- many of the things Gnash can't do, it can't do because of patents.)

Re:disable javascript

[Anonymous Coward]

Do we know this is a bug in AR scripting?

Registering external handlers (or plug-ins) with your web browser massively increases exposure to security threats. It's the security/convenience trade-off, I personally will always choose inconvenience.

xpdf is the only reader I use but the lack of AA is staring to make it a real eyesore :-(

I have both...

[SanityInAnarchy]

Rather, both kpdf and acroread.

The main reason I have acroread is because I can -- it's one less program people can whine about not having on Linux, and you never know when I'll run into something kpdf can't handle.

But I also have it because it has one feature I dearly wish kpdf did: the ability to rotate the rendered PDF. Take a widescreen, clamshell laptop/notebook, turn it on its side, and let a page of a book fill the screen, and you have a pretty nice eBook reader.

Re:I have both...

[gEvil (beta)]

But I also have it because it has one feature I dearly wish kpdf did: the ability to rotate the rendered PDF. Take a widescreen, clamshell laptop/notebook, turn it on its side, and let a page of a book fill the screen, and you have a pretty nice eBook reader.

I did that for a while a few summers ago. Take a Project Gutenberg text file (or any text file), throw it into your favorite word processor/page layout program, choose a nice body font, give it some reasonable margins, stick page # footers in, then export it all out to a PDF. Fire up Acrobat Reader, set the background color to a nice cream color, rotate the page 90 degrees, hit fullscreen, find a nice comfy chair and read! Flipping the page was a matter of hitting the mouse button, which is where my thumb was resting anyways. Worked quite well.

Re:I have both...

[whoever57]

But I also have it because it has one feature I dearly wish kpdf did: the ability to rotate the rendered PDF.

Evince can do this.

Re:I have both...

[xaxa]

one feature I dearly wish kpdf did: the ability to rotate the rendered PDF. KGhostView will do this. I don't know why Kpdf won't.

Re:I have both...

[nushoin]

Evince is very nice.

My only problem with it is that I did not find a way to disable it's font-smoothing.
Did my homework, searched through all the forums and found no answer.

If anyone knows how to do that, I'd be happy to hear.

Re:Benifits of Adobe Reader? Seriously.

[Idiot with a gun]

Your options will always be extremely limited if you restrict yourself to only one OS.

What???

[Jane Q. Public]

Maybe I misunderstood... but who the hell uses .pdf for banner ads anyway?

I, for one, would also recommend other readers. The most recent incarnation of Adobe Reader is even slower than before, and they took a perfectly usable interface and messed it up.

Whatever happend to, "If it ain't broke, don't fix it!" ??

Browser warning?

[ssjx]

So the banner serves a pdf which runs some javascript that uses a hole to install a trojan? Surely the user will be prompted by the browser to ask whether they want to open the pdf to begin with? Unless it was a pdf that the user was actually after that was tampered with, why would anyone open an unknown pdf accidently? I suppose, there are always the click happy that will open anything...

Re:Browser warning?

[robo_mojo]

Surely the user will be prompted by the browser to ask whether they want to open the pdf to begin with?

There's an HTTP header:

Content-disposition: inline

With a typically configured browser, it doesn't ask the user anything if you use that, it just launches the plugin. However, you can change the configuration to treat it like a file download instead.

Re:Benifits of Adobe Reader? Seriously.

[domatic]

Adobe appears to be moving away from PDF as "electronic paper" to "all singing all dancing Internet Document". You can now embed movies, audio, and javascript in PDF to make some sort of "active document". Personally, I think PDF has jumped the shark.

Re:Benifits of Adobe Reader? Seriously.

[chubs730]

True. I usually run at least 6 boxes at a time, just to cover all the major operating systems. I'd never want to be without the software clones I need!

Hello? Flash?!

[Dachannien]

People have been doing this with Flash (another now-Adobe product) for ages. One flash ad redirects you to a second flash widget on a malicious website to get around Adobe's lame attempts at cross-site protection, and that second flash ad gives you the business.

Malware, that is. Intarweb gold. Russian tea.

No more safe apps

[nurb432]

"At this rate there won't be many safe applications left to use."

One can only hope this comes to pass. Perhaps if mostly everything on the planet is compromised people will actually care enough to do something about it.

xrandr

[John Hasler]

> Take a Project Gutenberg text file (or any text file), throw it into your favorite word
> processor/page layout program, choose a nice body font, give it some reasonable margins,
> stick page # footers in, then export it all out to a PDF. Fire up Acrobat Reader, set the
> background color to a nice cream color, rotate the page 90 degrees, hit fullscreen...

Seems like a lot of wasted effort. Why not just use xrandr to rotate the display?

Re:xrandr

[SanityInAnarchy]

I never did this with Gutenberg.

In my case, because I didn't know about xrandr, originally did this on OS X, and I really only want to rotate that one book. I'd rather not have to rearrange the rest of my windows.

And I didn't use the cursor, I used spacebar, I think. Nice, big target.

Re:Benifits of Adobe Reader? Seriously.

[B3ryllium]

DRM, most likely.

Amusing coincidence.

[John Pfeiffer]

Funny that I should read this headline RIGHT NEXT to an Adobe Acrobat ad being run on /.

Ah come on...

[Animaether]

the page layout (right vs left) is hardly a major issue when it concerns Foxit, a PDF -reader-. I can fully understand if you want it to work correctly for a PDF authoring app, so that it comes out the printer the way you see it on screen, but geeze.

It's like calling ThunderBird "beyond hope" because the thunderbird team appear to be unwilling to fix the folder rename issue on the Windows platform (renaming "Test" to "test" will tell you that it already exists. durrr. https://bugzilla.mozilla.org/show_bug.cgi?id=92165 - July 2001. )

That said, next version (there's always a next version) of Foxit should have this implemented a la Adobe's Reader. If it is, then that's implemented a whole lot quicker than the aforementioned asinine TB bug ( http://www.foxitsoftware.com/bbs/archive/index.php/t-192.html - September 2005 ), although I agree that it should have been implemented in an afternoon's work (even done dirtily so by inserting a blank invisible page in the page array).

Re:Benifits of Adobe Reader? Seriously.

[perlchild]

Their various forms of DRM come to mind

Get off my lawn!

[Anonymous Coward]

Damn kids.

"Warning: PDF"

[MillionthMonkey]

I had to upgrade from Acrobat Reader 6 to 7 at work, more than a year ago. My memory is hazy and repressed but this is what I seem to remember.

First you downloaded the upgrade installer for 7.0. It rebooted the computer. Then 7.0 started up, and downloaded the upgrade installer for 7.0.1. Then it rebooted the computer. Then 7.0.1 started up, and downloaded the upgrade installer for 7.0.2. Then it rebooted the computer. Then 7.0.2 started up, and downloaded the upgrade installer for 7.0.3. Then it rebooted the computer. Then 7.0.3 started up, and downloaded the upgrade installer for 7.0.4. Then it rebooted the computer.

My current laptop has 7.0.4. Before I attempt to upgrade to 8.1.2, maybe one of you can let me know if my prediction is right:

First you download the upgrade installer for 8.0. Then it reboots the computer. Then 8.0 starts up, and downloads the upgrade installer for 8.1. Then it reboots the computer. Then 8.1 starts up, and downloads the upgrade installer for 8.1.1. Then it reboots the computer. Then 8.1.1 starts up, and downloads the upgrade installer for 8.1.2. Then it reboots the computer and congratulations, you can safely surf the web without someone turning off your antivirus using a hole in Adobe Acrobat Reader!

I can barely wait to get started.

Re:"Warning: PDF"

[MillionthMonkey]

Never mind, I just did the upgrade and it seems they must have fired the clowns who wrote the installers for 7.

Re:"Warning: PDF"

[Anonymous Coward]

Yup - I've seen that too. Very annoying.

I gave up after the second reboot and uninstalled Acrotwat. Then I downloaded an install package from adobe and put that on in one go without having to jump the hoops. Still not great though.

Acrobat?

[shpoffo]

Interesting that people still use it that much. It is so much bloat now that it's kind of a bust.

Adobe eBook DRM status? (post-Sklyarov)

[An Anonymous Hero]

Wishing I wasn't forced to use Acrobat for increasingly many eBooks...

While Touretzky prefaces his page on the subject with "Computer professionals who have examined these mechanisms have found them easy to defeat", I miss something able to decrypt or print the latest crop -- where APDFPR says

APDFPR Error
The document was created with 'eBook Exchange (EBX_HANDLER) 128-bit security v.3' encryption handler. This protection method is not supported.

Yet I see some nicely decrypted ones floating around. E.g. (one of many for purely instructional purposes): ISBN 0387954775 here.

Having the eBook and the etx.etd file I guess that should in principle be possible, but how's that done in practice?

Speed up Acrobat Reader

[plover]

A long time ago, I learned that Acrobat Reader is so damn slow to launch because of all the crap plugins that are loaded with it. I couldn't remember exactly which of the various modules I removed, but a quick Google gave me this: http://dwtips.com/2006/06/17/how-to-speed-up-pdf-loading-with-adobe-acrobat/ It looks like the same type of instructions that I followed way back when.

Re:Benifits of Adobe Reader? Seriously.

[Idiot with a gun]

Or, do like a lot of people, and have a dual boot setup. I run Linux the vast majority of the time (over 98%), but for that 2% of the time I need something that I can't run in Wine, I have a small XP install to use.

Theory != practice

[EmbeddedJanitor]

For Joe and Jane Sixpack, PDF=Acrobat, www=IE. Saying that other readers/browsers are safe is irrelevant for the majority of people.

Re:Theory != practice

[dotancohen]

For Joe and Jane Sixpack, PDF=Acrobat, www=IE. Saying that other readers/browsers are safe is irrelevant for the majority of people. Now why do you think that is? Because of misleading articles like this. When bugs are found in IE, should the media report that the Internet is flawed?

Google to the rescue

[plover]

A quick Google turned up this list of plugins, so if you want to pick and choose which bits of extreme uselessness you want to avoid, it makes it a bit easier. Seriously, does anybody think it's a good idea to let a PDF send an email?

Anyway, if you remove any of those files from your Reader/plug_ins folder, Acrobat Reader won't load them at launch time. It speeds up loading time of ordinary PDFs tremendously.

What I really really don't understand is why Acrobat Reader doesn't dynamically load those plug-ins only upon demand? Seriously, why does it need to bring in any of that extra code just to display a catalog page from a web site? Digital signatures? If the PDF doesn't have one, I don't need to load the code to verify it. Accessibility? I'm not handicapped, I don't need or use a screen reader, ever. eBooks? I've never bought one, and probably won't for many years to come. And I never, ever, ever want to let a PDF send an email. That's just WRONG.

It's a tremendous load of crap, made worse by their "always load, just in case" philosophy.

SumatraPDF - open source PDF reader

[Anonymous Coward]

SumatraPDF is a free, open source PDF reader for Windows.
It is light-weight, ~1 megabyte.

http://blog.kowalczyk.info/software/sumatrapdf/

acrobat upgrade.

[leuk_he]

hmm, is also had acrobat 7.09 on my system. but since i killed all the upgrade/patch stuff it never upgraded to 8. i download verion 8 from adobe and it replace version 7 for me. ut now it tells me i have to reboot my system. having to have to close my firefox is bad enoug, and now i got to reboot... they got to be kidding.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Sorry, you lose

[belg4mit]

Flash isn't an Adobe *developed* product. It was originally created by Macromedia.

Apple...

[DanJ_UK]

Cue all the mac fan boys;

Re:Benifits of Adobe Reader? Seriously.

[Bios_Hakr]

I use it because the model manuals I use have embedded 3d graphics:

http://www.youtube.com/watch?v=F2dKBYRQj68

It's nice when you can grab a part and spin it virtually to see exactly how the assembly should look.

It does work

[Snaller]

It just doesn't have some features you would like.

Reading comprehension FTW

[Dachannien]

Where did I say that Flash was an Adobe developed product?

Removing old versions of Reader?

[Keruo]

Reader seems to be able to overwrite the current version, but if you have damaged version of older reader installed(5,6,7) you have serious issues trying to get rid of those things.

Does anyone have good resources for removing old versions of adobe reader manually?

Adobe website comes pretty much empty when looking for cleanup tools.

Re:Benifits of Adobe Reader? Seriously.

[Skuld-Chan]

Acrobat/Reader actually has a huge amount of customer requirements. For example it can display and render forms, interact with web services/databases, display 2d/3d annots, display flash/wmv/quicktime movies, play sounds etc, and sign/create digital signatures. It also has a javascript engine.

Funny thing is - if you remove all those extra plugins so that it has as much functionality as kpdf and foxit reader it has a smaller memory footprint and loads faster than either.

Reader 7

[Anonymous Coward]

Unfortunately, popular e-Book software requires Reader 7 instead of a newer version (or other PDF readers), preventing many people from upgrading, which is part of why this horribly outdated and vulnerable software is still in use.

No, it doesn't

[Anonymous Brave Guy]

It does have a two-page side-by-side display, which is what I need.

However, that feature does not work like the corresponding features of other software products, or indeed the accepted standard for centuries in real world publishing. You can call that a missing feature all you like, but it's still a bug to anyone who wants to use the feature that's already there, and as the Foxit forums demonstrate, there are a lot of such people.

Re:No, it doesn't

[Snaller]

Bla bla.

You said it didn't work - that is a lie, it does.

But its too slow, try this one instead - also free:
http://www.docu-track.com/home/prod_user/PDF-XChange_Tools/pdfx_viewer