Slashdot Mirror
Adobe Chided For Insecure Acrobat Reader
The Register covers security firm Secunia calling out Adobe for its insecure distribution practices with regard to Adobe Reader. (Here is Secunia's note.) The accusation is that the way Adobe provides Reader extends the software's window of vulnerability once an exploit has begun to circulate. Version 9.1 of Reader, which is what you get when you visit the official download site, contains 10 vulnerabilities that were patched by later releases. "Adobe Systems has been taken to task for offering outdated software on its downloads page that contains dozens of security vulnerabilities, several of which are already being exploited in the wild... Visitors who obtain Adobe Reader from the company's official downloads page will find that it installs version 9.1 of the program on their computers, even though the most recent version was 9.1.2 at time of writing. That could put users at considerable peril given the number of vulnerabilities fixed in the two iterations that have come since 9.1, complains Secunia..."
There's a version without vulnerabilities?
Just about every binary distribution on windows is doing something similar these days. Short of someone building a proper, open, distributed, secure package manager for windows, they're probably doing the best they can by having updates at all. It's better than having to go check the webpage for corrections.
That said, if this kind of complaint becomes more common, and all software is seen as flawed in this regard, then it'll be a great push towards proper package management on windows.
Adobe Reader has always been bad for this - even back when it was called Acrobat Reader.
Aside from having dozens of different versions installed - whatever version you installed was always out of date, unless you started it up(which took ages), and clicked the Check for Updates button. Then it'd tell you you're out of date. You download an update, it restarts, and then you do it again... and it downloads another update. It installs the update, and restarts, and then you do it a third time to check for another update.
After all, jumping from 8.1 to 8.1.3 is much too large of an increment. Each version must be applied incrementally, and it's completely illogical to download every required update at the same time.
Ahh... the fond memories! It takes me right back. Now I remember their artificially slow installers, that did nothing for minutes on end just because of your OS. Such pleasant times!
Dont use Acrobat... There are several alternatives available all less bloated:
GPL'd PDF reader: http://blog.kowalczyk.info/software/sumatrapdf/index.html
Commercial: http://www.foxitsoftware.com/pdf/reader/
I can't think of anything witty right now
That depends on the difference between 9.1 and 9.1.2. If the difference is a week or two (i.e. the bug fixes haven't been out long) then it's not unreasonable to have a delay updating the download (although it would obviously be better to update it as well rather than distribute known vulnerabilities). If the difference between them is several months or more then it's less excusable and they've had plenty of time to update it.
How many websites have you seen that say "here's a PDF of a document - you'll need to download Adobe Reader [insert link] if you want to view it" and how many say "here's a PDF of a document - you'll need to download a PDF reader such as Adobe Reader [insert link], Foxit [insert link], ... if you want to view it"? Most commercial sites that distribute PDFs recommend Adobe, and if you're not a techy then you'll assume that Adobe is all you can use. Why do you think so many people used IE6 when Firefox and Opera were available?
If all a person ever needs to do is read a document published on the web, he doesn't even NEED any features.
At least you've made the clarification. There are too many people who reckon Acrobat is bloated because they have never done anything more with a PDF than double-click the icon and read it. In the Industry I work, Acrobat is missing features that we need, which we make up by using plugins.
Who the heck still uses Acrobat Reader?
Anyone who needs to do more with a PDF than simply read it.
How about the other five listed here?I'm not running Linux, so I can't wipe your bottom for you. Maybe some research on your part would be useful?
Here, I'll save you some effort and GoogleThatForYou
Finally had enough. Come see us over at https://soylentnews.org/
Evince is pretty lacking in PDF functionality anyway. If you want to compare best of breed on each system, you should probably compare KPDF. It would still fall short of Acrobat Reader. However, I think it's silly to expect otherwise, given that Adobe set the standard AND develop the software meeting that standard in one go.
google docs opens pdf's
Adobe began using javascript in their reader beginning with v7 and that has opened up this whole new world of security issues. Wouldn't it be better if the 'reader' just rendered a static file and didn't run embedded script?
> How many websites have you seen that say "here's a PDF of a document -
> you'll need to download Adobe Reader [insert link] if you want to view it"
If the webmaster had ever watched an end user try to use a computer, he'd Stop Doing That.
Almost universally, the end user does not understand the above paragraph. He gets as far as the link to Acrobat Reader, clicks it (even though of course his computer already has Acrobat Reader; but he doesn't know that, because he doesn't even know what it means), and expects to immediately see the content he's looking for (even though he hasn't clicked, or even noticed, the link to the actual document; generally he thinks the download link he just clicked *is* the document). If he's lucky, at this point, the web browser downloads Yet Another Copy of the Adobe installer and puts it in the default download folder (probably the desktop, unless the computer's been worked over by a competent computer geek at some point). At this point the user has absolutely no idea why the document isn't opening, so he tries again. And again. I've never EVER seen an end user's default download folder with fewer than three copies of the Adobe installer, and six or eight is more common. Eventually, depending on what kind of person the user is, he either gives up (this is the most common outcome) or seeks help from someone he thinks is a computer expert. If he's lucky, his "computer expert" actually understands enough about computers to help him, but at least half the time it's somebody just as clueless as he is (albeit more confident), and they tell him his computer has a virus, which confirms what he suspected anyhow.
Cut that out, or I will ship you to Norilsk in a box.
Acrobat is like a giant virus on every machine I've run it on.
SumatraPDF is much, much faster and better.
Besides Adobe is a Fox news sponsor. Don't give them your money or your ram!!!
http://portableapps.com/de/apps/office/sumatra_pdf_portable
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.