F-Secure Suggests Ditching Adobe Reader For Free PDF Viewers
hweimer writes "Yesterday at RSA security conference, F-Secure's chief research officer recommended dropping Adobe Reader for viewing PDF files because of the huge amount of targeted attacks against it. Instead, he pointed to PDFreaders.org, a website maintaining a list of free and open source PDF viewers."
I've been using Foxit Reader for some time on my aging laptop because of performance issues with Adobe Reader 9, and it works great. http://www.foxitsoftware.com/pdf/reader/
It's interesting that of the 8 alternatives mentioned, only Okular is listed as being available across the board on Windows, Mac OS X, and (as they put it), "Free Operating Systems." (Linux, BSD, etc.) Even so, it involves installing KDE on top of Windows or Mac OS X, but at least it can be done.
The only two-platform reader, Yap, appears to be based on GNUStep, and I don't actually see a Windows download on the web page.
acroread is the only decent pdf viewer for linux.
F-Secure posted a PDF with exploits to uninstall Adobe Reader and install a new free reader.
Acrobat utterly takes the biscuit when it comes to being the most execrably awful, arrogant, bloated, buggy, piece of software ever made, ever. And that's in a world where Microsoft exists as well.
But as if that isn't bad enough, it ALSO ranks as the most tragic irony in *all* *computing* *history* that such a screamingly, revoltingly, tear-out-your-hair-and-become-a-monk awful software is essentially based on an open standard. I'll say that again: PDF is an *open* ISO standard. HOW did Adobe rape and strangle it to death like they did? If anyone wants an example of how unspeakably evil marketing and sharp practices can be, they need look no further than Adobe Acrobat.
If I never used Acrobat ever again it would be too soon.
"And the meaning of words; when they cease to function; when will it start worrying you?"
Monoculture.
It's always bad & that's why standards are good.
Sumatra PDF is also available in a portable format.
upon the advice of my lawyer, i have no sig at this time
using this guys logic, he should be saying to dump Microsoft and use another OS due to the large number of breakins on Windows boxes. Notice I didn't say attacks because attacks do not mean security failure. I'll bet he picked his words, or MS did, for legal reasons.
anyways, Microsoft and RSA have been buddy buddies for a few years now so it's no wonder MS has the RSA picking on Adobe. Adobe has almost as large a distribution channel as Microsoft and that makes Adobe a big target. Add to it Adobe's Flash and the target is as large as the one on Tux.
LoB
"Anyone who stands out in the middle of a road looks like roadkill to me." --Linus
"...because of the huge amount of targeted attacks against it."
So let's also put forward the same suggestion directed at Windows?
Being the most targeted is not a good reason to switch (being the most exploited may be). However, rather than say "acroread sucks, try something else", shouldn't a security company actually check the security of the alternatives? Alternative does not automatically imply better; how do I know that the alternatives are not worse?
How many of the alternatives implement all the features require (and implement them securely)? Viewing an owner's guide PDF or some such isn't a big deal (I'd hope they can all do that); I need to know if all the form handling works correctly (because I need to use that).
"Yesterday at RSA security conference, F-Secure's chief research officer recommended dropping Adobe Reader for viewing PDF files because of the huge amount of targeted attacks against it.
I used to use Adobe's PDF reader but while running Windows XP, I got a message prompting me to upgrade my Adobe reader to the latest.
I attempted to and the downloaded file was quite small. On completing the installation, I found out that I was stuck with a directory heavy at 200MB! Uninstalling the extras did not help matters.
Later on, I discovered Foxit Reader. I haven't looked back and I am not worried about Adobe misbehaving for I know the would not like Microsoft to gain any traction with their XPS format.
That was my response to the dreamweaver CS3 install that dumped over 800 meg of bolt-on garbarge and two new services BEFORE starting the actual dreamweaver install.
And the new-and-improved dreamweaver was almost exactly the same as the macromedia version. They added a new CSS selector and a new tab for their adobe ajax framework. And they broke the best interakt extension. So the product went backwards, despite trending towards epic MS levels of application footprint.
They acquired the interackt folks and I think CS4 suckers are still waiting for the supported port.
Everything adobe touches turns to shit if you ask me.
Earlier this month while doing my US Federal taxes, I ended up installing the Windows version of Acrobat Reader 8 under Wine just to fill in the IRS PDF-based tax forms. None of the other readers I tried were both A) capable of handling the IRS forms correctly; and B) stable enough on Ubuntu 8.10 to actually use. Other readers I tried included Evince, another Open Source one (I forget which), and several versions of Acrobat Reader for Linux (both from the Ubuntu restricted repo and direct from Adobe).
The Windows version under Wine was an iffy proposition at best, but I was able to get it working eventually. The installers for 7.x and 9.x bombed outright; 8.x installed, but wouldn't let you click past the EULA! Once past the EULA issue (regedit to the rescue!), 8.x on Wine worked OK. Workable, but far from an ideal solution...
I have a ton of DRM protected eBooks from my college. They only work in Adobe Acrobat Reader. How do I remove the DRM, or would removing the DRM so that I can use them in a third party PDF viewer be a violation of my license with the college and publishers?
I really don't want to lose my eBook library, but I don't want to get infected either.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
It's amazing that Foxit Reader has nearly all the functionality of the newest Acrobat Reader, but the installer is 10X smaller! And not to speak about how much more stable it is. Now I put Foxit on every computer I use. Foxit is so much better than Acrobat Reader, that every time I see it on a computer I think to myself "Are you effing kidding me????!!!"
I really don't understand how did the Adobe SW engineers manage to make such a bloated and unstable POS.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
Unfortunately, Adobe Reader is currently the only PDF viewer that can be consistently counted on to render all PDF files properly.
Here is one example:
http://article.gmane.org/gmane.linux.redhat.fedora.general/336357
If you're a zombie and you know it, bite your friend!
The Open Document Format - ODF was supposed to replace PDF anyway. Why not hasten the process and make a PDF to ODF converter?
The ODF Alliance should be on that case to do a converter program to convert all document formats to ODF format.
Remember, Slashdot does not have a -1 disagree moderation, and no, troll, flamebait, and overrated are not substitutes.
I have been forced to switch back to the official Adobe Acrobat Reader to print many documents, at least in Windows. Foxit and Sumatra are simply no good at printing. Foxit was okay with some documents but not others. Sumatra always tried to generate multiple gigabytes to send to my HP LaserJet 2200D. Acrobat Reader on the other hand was able to manage every document I tried with a megabyte or two, at most.
Is Okular for Windows any better?
Insert self-referential sig here.
They would, if Linux was able to run 99% of the world's Windows applications. Yes, I know there are some PDFs out there that Evince et al can't open, but so far I haven't found any and I have *hundreds* of PDFs on my computer so chances are they're a stastistically insignificant percentage and, as such, unlikely to bother the average user.
No problem is insoluble in all conceivable circumstances.
using this guys logic, he should be saying to dump Microsoft and use another OS due to the large number of breakins on Windows boxes.
Unless he thought that the cost of switching OSes was significantly higher than the cost of switching to another free piece of software on top of that OS. With Windows, people need it to do things that no other operating system can do, namely, running Windows-only applications as well as they can be run. Switching to another OS requires either dealing with emulation, a VM, or not being able to run those programs at all. In addition, there are costs in either a steep learning curve going to linux or hardware to get a Mac. Cost to change: many, many hours of learning or a few thousand dollars.
On the other hand, as long as these PDF readers can read any pdf that adobe can, and as long as they're free like adobe is, there's no other cost. Hell, you can even have adobe installed just in case you'll need it, but make another reader the default for everything, thereby giving you the security of having another reader without any loss in functionality. Cost to change: maybe half an hour.
In other words, your bias is showing.
Actually, what would also be a huge help (regardless of reader) would be to only use PDF where it was appropriate to do so -- namely, when the end user actually needs to print said document.
I realize there's pretty much no point in saying this, as it seems that many designers -- especially in large organizations -- seem to give little thought to the end user, and the usability of their site. (inappropriate or unnecessary use of pdf, flash, javascript, popups (still!) etc )
I'm tired of going to a site to find that in order to find out -- for example, where an event is going to take place -- that I have to download a 3 page pdf document, one that would have been so much easier and quicker and accessible as html on a webpage.
I'm willing to bet that, at the very least, half of all pdfs created do not need to be pdfs in the first place.
Okular has no chance there. Not amongst regular Windows users at least.
Step 1 - Go to PDFreaders.org - no issue
Step 2 - Click on "Download" on the intersection between Okular and Windows - no issue
Step 3 - Click "Download latest installer for immediate installation. - no issue
Step 4 - Run the KDE installer - not so much an issue, as what it does is
Step 5 - Click Next - "install from Internet" is the default setting, sounds reasonable
Step 6 - Select a download server - "What the hell did I just download then?"
Step 7 - Select an available release - Ehh? Whut?
Step 8 - Select the package you want to install - Well, that's just fucked up. 140+ packages to choose from. They're sorted by package name ONLY, cannot sort by package notes.
Step 9 - Look for something called Okular as package name. None found
Step 10 - "Oh, well, maybe these are packages I want in addition to Okular. I mean, I downloaded the Okular installer, right?"
Step 11 - Click Next
Step 12 - Installation/Update finished
Step 13 - Realise that NOTHING has been installed.
Step 14 - Get annoyed
Step 15 - Call tech support (realise this is a free program and there's noone to yell at)
Step 16 - Download and run the installer again (because they forgot where they downloaded it to)
Step 17 - Get to the package list and start reading very carefully
Step 18 - Wonder why the hell the package list goes Czech, Kashubian, Welsh, Danish, German, Greek, English, Esperanto, Spanish, Estonian [spelling package]
Step 19 - Realise there's still no Okular package anywhere
Step 20 - Read the list for the 3rd time and note that "Graphics applications" has a note "(including Okular)"
Step 21 - Wonder why the hell the download Okular link from before doesn't give you the fucking package to begin with
Step 22 - Notice that you're now downloading 40 (forty!) packages from the servers
Step 23 - Notice that one of these files are 60+ MB
Step 24 - Wonder why they call Acrobat Reader bloated and slow when that installer is less than 25 MB and takes about 30 seconds to install, just by clicking Next until you're done.
Step 25 - Notice that you now have a folder called "Programs" in your Start menu's program folder, which is aparently a sym-link to the program folder (doesn't point to itself though)
Step 26 - Find the "KDE 4.22 Release" folder in Programs and notice these programs:
Step 27 - Wonder once more why the hell people call Acrobat Reader bloated when this program installs with 5 extra programs.
Step 28 - Start the bloody program!
Step 29 - KConf_update.exe would like to run. So, Acrobat Reader running its updater - Bad! This - GOOD!
Step 30 - TRY to put frustrations aside and use the program
That installer REALLY needs some work.
And if you are going to have a Windows program, be as kind as to have an actual uninstaller. NONE of the KDE programs installed are listed in (Add/Remove)Programs(and Features). No uninstallers in the start menu either. I realise a lot of vocal FOSS supporters don't like Windows, but please - if you're going to advocate FOSS, at least make it live up to the LOW standards of Windows software (the non-malicious part of that group).
This isn't FUD, this is based on my own experiences:
I've found that the latest Foxit Reader is unable to show certain PDFs, in particular those created using the latest version of Adobe Acrobat. I created some PDFs in Acrobat 9 and when loaded into Foxit Reader 3.0, showed up entirely blank. The only way to view them was to put Adobe Reader on instead. So I did.
I'm not sure why Foxit showed these PDFs entirely blank. Maybe Acrobat 9 has a new version of the PDF standard that's incompatable, I don't know. What I do know is it means that if I want to gurantee the viewing of PDF files, I pretty much require Adobe products, which isn't that bad if you're using Reader 9 (much faster than version 8).
Possibly a vendor lock-in mechanism, but I'm tired of fighting. It's easier just to go with Adobe and get on with work.
For a while now I was ignoring my inner voice yelling "Uninstall Adobe Reader", This sounds like a good reason for me to do that now. Sumatra here I come.
-- It is the mark of an educated mind to be able to entertain a thought without accepting it. -- Aristotle
Linux: ready for the desktop!
Does anybody have something to share about rendering quality?
Evince seems to do a splendid job of rendering (and printing) PDFs that don't have forms in them. Does anyone know if the forms extension is part of the ISO standard, or is it a proprietary Adobe thing? Because if it is a proprietary extension, it hardly seems fair to blame Linux for not handling it properly, nor for Adobe's inability to make a product that doesn't suck.
Foxit does not yet support JetForm/LiveCycle based PDFs. Neither does OSX's Preview.
I wish people would stop using LiveCycle to produce PDFs, from what I can tell the format is not documented in the PDF ISO specification. Additionally, the newer format does not seem to provide any features that were not previously available in PDF. One can only speculate that it was done out of laziness or to thwart competition after they opened the format.
it is an open standard, you are welcome to do so.
Semi-automatic amateur armchair Australian philosopher; conjecture ready at any moment...
I'm not entirely certain of that compatibility problem. Many Mac users don't run Windows apps at all and comparability is not necessarily an issue. Part of what drives many Mac users is that it is NOT Windows and so they feel better because of it. For some people, it only takes knowing that there is a viable alternative for them to make the switch. "All the advantages of Mac without the price!"
Step 1: Don't buy anything with DRM protection.
Step 2: Repeat.
This list is more comprehensive.
I used to use Adobe's Linux Acrobat Reader; 4 was the first version I recall using. I loved that Adobe provided a Linux release, even if it wasn't open (I prefer open programs, but I won't cry if I don't get them). I kept upgrading as new versions were released, until, I think, 8 (maybe?) This version decided that it would install a bunch of shit into ~/.local, overriding KDE's PDF icons with its own that were out of place, and generally making a mess of itself. Cleaning up ~/.local didn't help, because acroread would create that horrible, horrible mess each time I started it. If I wanted to change file associations, etc, I would do it! I don't need a program doing it behind my back. Ask me, that's fine; don't just do it, though.
So I ditched acroread. I realized that kpdf does everything I need it to, it integrates with my desktop, and it doesn't try to force changes on me. I'd probably still be a happy acroread user if they didn't decide that they should take over my desktop. That works on windows, where people have become resigned to programs fucking them over. But it doesn't work for me.
Almost all come with that retarded GNU license (which means you can't use it commercially)
What do you mean? The GPL explicitly allows for commercial use or sale.
Mod points: Guaranteed to remove your sense of humor.
Side effects may include gullibility and temporary retardation
Why can't somebody create a PDF Reader with MIT style licence? Come on guys!
OK, let us know when you've written it...
Yah good choice.
http://blogs.zdnet.com/security/?p=2996
Apple's "Preview" (included with OS X, and did anyone mention that OS X's display model is visual PDF or something like that?) does pretty much everything you need there, better than Acrobat, and with less bloat. (And to the other poster who was wondering, yes, you can fill in forms. Can't create/edit them, though.) But although it runs on Intel, it doesn't run on Windows. Sorry. :(
Village idiot in some extremely smart villages.
Since my profs and TAs seem to love Acrobat's "comments"(those stupid yellow icons that display on a mouseover), are there any on linux that will display them? I've had no luck with Evince or Okular on hardy.
What went wrong with the linux acroread? I use it on ubuntu 8.04 with no problems except for no encryption, which hasn't been a problem yet.
"They were pure niggers." – Noam Chomsky
I tried to get by with foxit reader for a couple years, updating as often as it requested. I found that unfortunately it was not a suitable replacement in all cases. As someone else already mentioned, it cannot open the newest PDFs made by the newest Acrobat (though that is to be expected). However that is not my biggest problem with foxit.
My biggest problem is that the foxit plugin for firefox is terrible in terms of long-term stability. I have never seen a plugin consume memory so voraciously; even flash isn't that bad. If I opened a pdf in firefox through the foxit plugin, and then closed the window, firefox would nonetheless proceed to consume all available memory and drag my system to its knees in a few days or less, even without opening up any additional pdfs in that time period. Removing foxit and installing the adobe reader solved that problem.
I would very much prefer to not use the Adobe reader, but when the alternative is that bad I don't have much choice.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
The free PDF Viewer from Tracker Software is a wonderfully fast PDF reader, and comes with annotation capability right out of the box. They are very developer friendly, and their PDF XChange printer drivers produce PDF's that are tighter and better optimized than Adobe themselves. Great company to work with, and a great free PDF viewer.
LOAD "SIG",8,1
LOADING...
READY.
RUN
One more to consider. I haven't tried this product yet but will soon. NOTE: It ain't free. It's based on Java. But it's less expensive and if they keep the package trim and secure, that's fine by me. I just don't want to deal w/A-D'oh-be anymore.
PDF Studio(tm) for Linux, Mac & Windows
http://www.qoppa.com/index.html
Disclaimer: If this product sucks, my apologies in advance for suggesting it.
An effective "democracy" creates the illusion the people have a say in their government.
Adobe suggests ditching F-Secure for other anti-malware products.
But that won't happen and people aren't going to switch PDF readers, until the security software itself starts identifying Acrobat installations as riskware and displaying dialog boxes alerting users to the security risk and what actions they need to take (what types of alternatives are available to use)..
All I need is a PDF reader that will render correctly, won't create security problems, and will run on Win32. What's current thinking on this? The alternatives listed:
I lived with reader 7.0. I heard about the banner exploits that serve up pdfs, and sure enough one day somethingawful.com's ad banner service served up a pdf document. I immediately force closed it before that bloated application took the 10 seconds it takes to load, then upgraded to the latest version. Now IE crashes whenever I close it. Not too big a deal on its own but friggen annoying when another program uses IE to display something. Uninstalled reader 9.0, then reinstalled it. Same issue...
You can edit PDFs and paste text onto forms with the Gimp. Kinda painful, but it works and then you can save the file in any format you want.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
For most PDFs I use xpdf, but for longer texts I prefer Acroread despite the obvious flaws. So far I haven't found any other PDF reader for Linux that does subpixel font rendering. Are there any Free readers that don't smudge up the fonts?
Escher was the first MC and Giger invented the HR department.
On the other hand, I very often get PDFs that evince can't print correctly. For example, anything lilypond outputs is full of artifacts when printed in evince, perfect when printed in acroread or viewed in evince...
If anyone wants a vim-like PDF reader, try apvlv.
They talked about this months ago in their blog http://www.f-secure.com/weblog/archives/00001623.html Out of context taken quote "we're not recommending Foxit."
bump [sorry :(]
I have exactly the same problem, I'd choose free software over closed source any time, but AFAIK there is no libre pdf reader that support reading (not to mention writing) comments, that's why I keep an old copy of acrobat 7 around (much faster and less bloated that newer versions)
Does anyone know an alternative?
Unfortunately it is true that some PDFs only work with Acrobat (although I admit that I have never met a "protected" PDF that was worth the protection). So in some cases, installing Acrobat seems to be necessary, even on MacOS X, where the OS provides a pretty good PDF Viewer. However, when you do that, Adobe installs plugins in your browser and changes browser settings without even asking, just like any other malware. And after every upgrade you have again to go through the settings and repair the damage Adobe has done. I wouldn't complain if Acrobat was an improvement over the built in PDF Viewer, but it is slower, bloated, has an inconsistent user interface (being inconsistent in itself it cannot be consistent with the other applications of the plattform). And in the single area where you would wish some improvement over Mac OS X Preview, namly in printing (ever tried to print a document as a booklet?), it delivers no improvement. So it is probably fair to classify Acrobat as malware: a nuisance to the user with hardly any benefit.
I have a strange feeling that AutoHotkey could be set up to do that automatically every time you open the application.
Am I the only one here that uses xpdf?
For awhile, being the Open Source geek I am, I was using Sumatra exclusively for reading PDFs. Then, and insurance agent sent me a quote for health insurance, and 2 out of the 4 pages rendered blank. At first I thought there was a problem with the pdf file, but I tried downloading Adobe Reader, and it rendered just fine.
I would love to suggest an open source, lightweight, more secure pdf reader for my friends and family, but if there are going to be docs that won't render right, I can't suggest anything other than Adobe Reader, unfortunately. My friends and family would quickly come to distrust my recommendations if I recommend things and then they have problems with them.
I think the bigger issue here is, should we be thinking about trying to offer an alternative format for device-independent "ePaper"? PDF seems to be a moving target, and more of a proprietary format than a true standard (I think Adobe submitted a version of the PDF format to ISO a couple years back, didn't they? But I guess they must keep changing the format, or something. I suppose the version they submitted as a 'standard' might have been crippled, missing a lot of the features that the full Adobe Acrobat implements).
Someone earlier suggested that we should be trying to push ODF as an alternative, but the problem with that is that word processor files are meant to fill a slightly different role than PDF. The seemingly most likely candidate to come to mind is the old .dvi (device independent file) format created for the TeX system. Can anything other than TeX/LaTeX create .dvi files? Like, could you print to dvi in OO.org the same way you can print to pdf?
Ditching PDF.
And Flash.
And Java.
Get that shit off the web.
99.9% of the time it's useless crap that serves up all sorts of ads, malware, sucks up your CPU, etc.
Blocking it doesn't help because then the site doesn't work.
Javascript is actually the only one that serves a useful purpose in most cases, and the only one that can't easily be replaced while keeping functionality the same.
Isn't it funny how so much of what passes as "security advice" is really nothing more than an advertisment for FOSS?
Very shamelessly so, one might add.
Whenever I tried to open any of the IRS PDF forms, it would crash back to the desktop. Just *poof*, no error messages or anything. It worked OK with PDFs that didn't have forms in them, but if that was all I needed I would've just used Evince.
The PDF format should be dumped in favor of SVG, the sooner, the better.
A lot of people have posted alternatives to Acrobat Reader and I have my own preferences as well. I used to like "kpdf" because it was nice to just drag-n-drop a file and the viewer would be displayed. Sadly, kpdf doesn't seem to be getting updated any more -- at least for KDE 3.x (I haven't tried using V4.x yet). Gnome seems to think that "gv" is good for displaying PDFs and it is capable of doing that. To a point. Sure.. "gv" launches a heck of a lot faster than Reader but, more and more, I've been running into PDFs that will not render properly unless Adobe's viewer is used. For example, some documents appear as though they might be formatted to be displayed in landscape when you view them using something other than Reader; the page is shifted off the right side of the window. Changing the page format to landscape doesn't help. View the same document using Reader and it's properly displayed in portrait. Since a lot of documents that are being distributed by vendors, governments, schools, are being created (one presumes) using Adobe's tools, any Reader alternatives have to be able to deal with this. I always thought that the PDF format was a standard. Looks like maybe I was wrong to think that.
CUR ALLOC 20195.....5804M
Weird. Worked for me, but that's actually a bad thing. This kind of inconsistency is sort of disturbing.
I keep an old kernel around for when I need to use my old version of Matlab; the newer ones cause it to crash early and often.
"They were pure niggers." – Noam Chomsky
if it knows its an outdated version, there is update available,
it knows that current version is vulnerable to attack, so it should refuse
to open, let the user ignore at his own peril
much better than , hey there is an update available, you haven't viewed any pdfs for 2 years, its urgent that you upgrade, if you view a bad pdf you'll be owned!!!
Does any free pdf reader that runs on linux support embedded movies and other special annotations?
Sometimes you'll have to give up functionality for freedom. The question is what is your freedom worth to you? You should value software freedom for it's own sake and work to add the missing features or help others do so on your behalf (which is why it's better to prefer a less-functional free program than a more powerful proprietary program). If you value the ability to keep your documents from others without your permission, or keep your computer under your control and not someone stranger's control, you'll soon learn to value your freedom to share and modify programs whether you're a programmer or not.
Even if you look at this from a perspective that doesn't respect freedom (always unwise) you'll be compelled to choose free software--other mandates will force you to make decisions which naturally exclude proprietary software. For example, American educational organizations which must obey FERPA can't release student information willy-nilly. So they should not choose programs they know may allow unauthorized access to sensitive records, like the kinds you'll find on many educational workers' workstations. It's not hard to see how a Javascript program running under the authority of such a worker could grant an unauthorized party access to sensitive information. This necessarily guides what software these workers should run and how that software ought to be configured; inconveniences become side issues.
Digital Citizen