F-Secure Suggests Ditching Adobe Reader For Free PDF Viewers

hweimer writes "Yesterday at RSA security conference, F-Secure's chief research officer recommended dropping Adobe Reader for viewing PDF files because of the huge amount of targeted attacks against it. Instead, he pointed to PDFreaders.org, a website maintaining a list of free and open source PDF viewers."

Comments

Already there

[andytrevino]

I've been using Foxit Reader for some time on my aging laptop because of performance issues with Adobe Reader 9, and it works great. http://www.foxitsoftware.com/pdf/reader/

Re:Already there

[zonky]

Yes, it's so feature compatible with adobe, they've added similar exploits! http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1104

Re:Already there

[andytrevino]

Free as in beer, not as in speech. The article lists a number of alternatives with varying degrees of maturity and practical utility...

For example, I'm not going to install KDE on Windows just to read PDFs, and if I'm going to recommend an alternative PDF reader to one of my Average Joe friends, customers or relatives I'm not going to have them download one without an installer or from a website whose name has nothing to do with the product (MuPDF) that looks like it was designed circa 1997. Appearance is everything, you know, which is something that I think has greatly contributed to Firefox's success: both the product and the website look smooth, classy and refined.

Re:Already there

[DanWS6]

I was a firm believer in foxit, until I had to fill out my 1040 and related forms. Some of the fields were just screwed up. I had to cave and install acrobat. I died a little inside that day.

Re:Already there

[FRiC]

Until Foxit Reader (at least the Windows version, no experience with other versions) can support Unicode, it will never replace Adobe Reader.

Re:Already there

[blind biker]

And what I find quite important: it renders text quite well. At least I don't see a big difference between how Foxit renders text vs. Acrobat. But, as I was saying in another post, Sumatra does a very bad job - so much so, that I feel slightly nauseated when reading documents with Sumatra.

Not Much Cross-Platform

[Kelson]

It's interesting that of the 8 alternatives mentioned, only Okular is listed as being available across the board on Windows, Mac OS X, and (as they put it), "Free Operating Systems." (Linux, BSD, etc.) Even so, it involves installing KDE on top of Windows or Mac OS X, but at least it can be done.

The only two-platform reader, Yap, appears to be based on GNUStep, and I don't actually see a Windows download on the web page.

Re:Not Much Cross-Platform

[Kelson]

Doesn't Apple have their own non-adobe pdf reader built into OS X?

Yes, Preview can read PDFs (among many other formats) well enough that I didn't even install Adobe Reader when I bought a new MacBook a few months ago. Admittedly I'm not sure how well it handles forms, but it has no problems with static PDF files.

Of course, I doubt it's open source/free software, so it wouldn't be on this list anyway.

Re:Not Much Cross-Platform

[pete-classic]

Forms support is decent, but not perfect. I reported a couple of bugs I ran into filling out my tax forms this year. Specifically, I couldn't save a PDF in Adobe Reader that had form data already saved in it with Preview. And the digits didn't align correctly in the bank routing and account number fields.

I use it frequently. My only other gripe is that the search is brain-dead. (It "ors" all the search terms. which is never what I want. Putting an "AND" between them doesn't help :-/)

It might sound like I don't like it, but these are actually my only complaints. Very solid app.

It's also worth noting that PDF export is built right into the print subsystem. No goofy third party print drivers. No need for individual apps to understand PDF.

-Peter

For those on the go

[compro01]

Sumatra PDF is also available in a portable format.

Re:For those on the go

[drizek]

I was introduced to Sumatra from portable apps and now use it instead of FoxIt. It does have a few issues here and there, but it seems to work better.

I dropped Adobe PDF reader for a different reason

[bogaboga]

"Yesterday at RSA security conference, F-Secure's chief research officer recommended dropping Adobe Reader for viewing PDF files because of the huge amount of targeted attacks against it.

I used to use Adobe's PDF reader but while running Windows XP, I got a message prompting me to upgrade my Adobe reader to the latest.

I attempted to and the downloaded file was quite small. On completing the installation, I found out that I was stuck with a directory heavy at 200MB! Uninstalling the extras did not help matters.

Later on, I discovered Foxit Reader. I haven't looked back and I am not worried about Adobe misbehaving for I know the would not like Microsoft to gain any traction with their XPS format.

Re:Acrobat: The Worlds Worst Software

[5of0]

But it's malware that sings! That right there makes the difference.

Foxit is unsuitable

[GF678]

This isn't FUD, this is based on my own experiences:

I've found that the latest Foxit Reader is unable to show certain PDFs, in particular those created using the latest version of Adobe Acrobat. I created some PDFs in Acrobat 9 and when loaded into Foxit Reader 3.0, showed up entirely blank. The only way to view them was to put Adobe Reader on instead. So I did.

I'm not sure why Foxit showed these PDFs entirely blank. Maybe Acrobat 9 has a new version of the PDF standard that's incompatable, I don't know. What I do know is it means that if I want to gurantee the viewing of PDF files, I pretty much require Adobe products, which isn't that bad if you're using Reader 9 (much faster than version 8).

Possibly a vendor lock-in mechanism, but I'm tired of fighting. It's easier just to go with Adobe and get on with work.

Re:Foxit is unsuitable

[GF678]

One more thing I forgot to mention - I switched from Acrobat to PDFCreator a while back. It's very good, and anything I render using PDFCreator works just fine with Foxit Reader. Also has the side benefit of being open source and an example of an actually GOOD open source product. Unfortunately this doesn't discount the fact that other people might use Acrobat to render THEIR PDFs, and I don't want to cut myself off from being able to view them.

Broken ones are JetForm/LiveCycle based

[bigtrike]

Foxit does not yet support JetForm/LiveCycle based PDFs. Neither does OSX's Preview.

I wish people would stop using LiveCycle to produce PDFs, from what I can tell the format is not documented in the PDF ISO specification. Additionally, the newer format does not seem to provide any features that were not previously available in PDF. One can only speculate that it was done out of laziness or to thwart competition after they opened the format.

Re:Okular has no chance there ...

[LiquidFire_HK]

Well, to be fair, the KDE on Windows page does say, in bold,

KDE on Windows is not in the final state, so applications can be unsuitable for day to day use yet.

The installer is far from suitable for end-users as well. I'm not sure why the website would link to the KDE installer without any instructions (there is no installer specific to Okular, or any specific KDE program, yet).

Tracker Software

[eric2hill]

The free PDF Viewer from Tracker Software is a wonderfully fast PDF reader, and comes with annotation capability right out of the box. They are very developer friendly, and their PDF XChange printer drivers produce PDF's that are tighter and better optimized than Adobe themselves. Great company to work with, and a great free PDF viewer.

Re:How about a security review?

[mrbene]

I think F-Secure's unofficial stance is outlined best in their blog from a while back:

we're not recommending Foxit. We're not recommending Sumatra. Or PDF-Xchange, CoolPDF or eXPert PDF. Instead, we recommend users to find their own Adobe Reader replacement. This way we get more heterogeneous userbase, which is a good idea security-wise.

Re:What about DRM PDFs?

[bendodge]

Kpdf (part of KDE 3.5) had a checkbox to ignore DRM. I don't know of Okular (KDE 4) does.

The Gimp is Cross-Platform

[flyingfsck]

You can edit PDFs and paste text onto forms with the Gimp. Kinda painful, but it works and then you can save the file in any format you want.