Delivery-Date: Mon, 13 Jul 2015 04:11:33 -0400
Return-Path: <tor-talk-bounces@lists.torproject.org>
X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on moria.seul.org
X-Spam-Level: 
X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,DKIM_ADSP_CUSTOM_MED,
	DKIM_SIGNED,FREEMAIL_FROM,FROM_LOCAL_NOVOWEL,HK_RANDOM_FROM,RCVD_IN_DNSWL_MED,
	T_DKIM_INVALID,T_RP_MATCHES_RCVD autolearn=ham version=3.3.1
X-Original-To: archiver@seul.org
Delivered-To: archiver@seul.org
Received: from eugeni.torproject.org (eugeni.torproject.org [38.229.72.13])
	(using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by khazad-dum.seul.org (Postfix) with ESMTPS id 283C61E0B37;
	Mon, 13 Jul 2015 04:11:32 -0400 (EDT)
Received: from eugeni.torproject.org (localhost [127.0.0.1])
	by eugeni.torproject.org (Postfix) with ESMTP id 92D6E375A0;
	Mon, 13 Jul 2015 08:11:02 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by eugeni.torproject.org (Postfix) with ESMTP id D55A7374FA
 for <tor-talk@lists.torproject.org>; Mon, 13 Jul 2015 08:10:56 +0000 (UTC)
X-Virus-Scanned: Debian amavisd-new at 
Received: from eugeni.torproject.org ([127.0.0.1])
 by localhost (eugeni.torproject.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id lB7czXsurIRC for <tor-talk@lists.torproject.org>;
 Mon, 13 Jul 2015 08:10:56 +0000 (UTC)
Received: from mail-wi0-x232.google.com (mail-wi0-x232.google.com
 [IPv6:2a00:1450:400c:c05::232])
 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
 (Client CN "smtp.gmail.com",
 Issuer "Google Internet Authority G2" (not verified))
 by eugeni.torproject.org (Postfix) with ESMTPS id 8732E37463
 for <tor-talk@lists.torproject.org>; Mon, 13 Jul 2015 08:10:56 +0000 (UTC)
Received: by wicmv11 with SMTP id mv11so54655082wic.1
 for <tor-talk@lists.torproject.org>; Mon, 13 Jul 2015 01:10:53 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:in-reply-to:references:date:message-id:subject:from:to
 :content-type; bh=WcQGevuB76O9YPV8s6/gC/saYgaFe3O3KvXTyxdTV/Y=;
 b=YujtCJn1MBB6ycLrVbxKqqjDJm7DkNiQIc1N0rVYR5kYgGS73hgHQWGRYKAzL2VA1a
 6kip+HnGlOpvJRjF4/1rSI/s01LhzDuGUrGEHbZT5xzMI21vNw5AVvufS7Pf4JS/Rvj3
 wfuSUfYPOARQfAlpOL0PgFZeYGEehcv5tJSg4xkbsXONrGk0N2WAZrQi+Hd6eEww1RUk
 uI8E5aEe0Dl+zAIzGSsZspgALoo4nAdislYYxsS/kbiYo9+Ruyg2xJ/vGbkJ8O5YQKMN
 Y+C59sghf1OuINgS3J3bwJczqOur+z/bA5mK3vXC9VkQpuQz69OrqvI8gAWs+BQuB7bU
 1APg==
MIME-Version: 1.0
X-Received: by 10.195.11.168 with SMTP id ej8mr64906582wjd.150.1436775053706; 
 Mon, 13 Jul 2015 01:10:53 -0700 (PDT)
Received: by 10.194.81.97 with HTTP; Mon, 13 Jul 2015 01:10:53 -0700 (PDT)
Received: by 10.194.81.97 with HTTP; Mon, 13 Jul 2015 01:10:53 -0700 (PDT)
In-Reply-To: <55A2F248.6090606@rawbw.com>
References: <5596ED9F.3050302@cryptolab.net> <5596F0E5.8050101@riseup.net>
 <1435955784.11081.31.camel@larsluthman.net>
 <55971E8D.7090507@riseup.net> <559D1282.1020502@agol.dk>
 <CAAgxajGSzYztzVzpsujpSskupMUkc9KAJ3zV5cCzdP1C=xW74A@mail.gmail.com>
 <20150712212724.7aeaf951@spuncut.agol.dk>
 <55A2F248.6090606@rawbw.com>
Date: Mon, 13 Jul 2015 01:10:53 -0700
Message-ID: <CAAgxajFmgiWZ4TFuDh+U+0CDdAd3Ou4ZF1Stkyeoss+MrgnXLg@mail.gmail.com>
From: Apple Apple <djjdjdjdjdjdjd32@gmail.com>
To: tor-talk@lists.torproject.org
X-Content-Filtered-By: Mailman/MimeDel 2.1.15
Subject: Re: [tor-talk] pdf with tor
X-BeenThere: tor-talk@lists.torproject.org
X-Mailman-Version: 2.1.15
Precedence: list
Reply-To: tor-talk@lists.torproject.org
List-Id: "all discussion about theory, design,
 and development of Onion Routing" <tor-talk.lists.torproject.org>
List-Unsubscribe: <https://lists.torproject.org/cgi-bin/mailman/options/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=unsubscribe>
List-Archive: <http://lists.torproject.org/pipermail/tor-talk/>
List-Post: <mailto:tor-talk@lists.torproject.org>
List-Help: <mailto:tor-talk-request@lists.torproject.org?subject=help>
List-Subscribe: <https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk>, 
 <mailto:tor-talk-request@lists.torproject.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: tor-talk-bounces@lists.torproject.org
Sender: "tor-talk" <tor-talk-bounces@lists.torproject.org>

On 13 Jul 2015 00:12, "Yuri" <yuri@rawbw.com> wrote:
> It is nothing inherently unsafe in pdf format itself, and any other
document formats aren't any safer. You probably confuse pdf and PostScript,
which is more like a programming language.

No I think we are definitely talking about PDF files in this thread.
History has shown that whenever there is any kind of non-trivial parsing
involved with an application then there is a high risk of exploitable bugs.

Just look at how many CVEs get posted against things like web browsers,
packet sniffers, document viewers. Even things like compression
implementations and XML parsers have the occasional vulnerability.

PDF parsers have it particularly bad since the PDF format specification is
very big and complex and controlled by a single organisation which is
desperately trying to retain market share by piling on new features.

PostScript is something entirely unrelated. It is a way of describing the
layout of documents with words, like a very early CSS or Latex. I remember
claims about it being Turing complete but I think that this is in a similar
spirit to C++ templates being Turing complete. I have doubts over whether
it has enough IO capabilities to do anything malicious on its own.

You do raise an interesting point regarding embedded JavaScript inside PDF
files which can also be used to exploit vulnerabilities in the viewer. Many
PDF viewers will execute this code without the user even knowing about it.

If a PDF convertor ignores these embedded scripts then I think that is a
definite bonus point for Niels' conversion strategy.
-- 
tor-talk mailing list - tor-talk@lists.torproject.org
To unsubscribe or change other settings go to
https://lists.torproject.org/cgi-bin/mailman/listinfo/tor-talk

