On 08/16/14 14:00, Norman Gray wrote:
...
> At <http://nxg.me.uk/temp/openbsd-faq-suggestion/> you will find,
> for your delectation and delight:
> 
>   * A PDF of sections 1--5 of the FAQ;
>   * An HTML version of this;
>   * A tarball containing the source of the scripts which generate these
>   from XML originals.
> 
> The idea of the PDF is that it's something which could potentially
> be sold on dead trees (which might be useful/attractive for the
> reasons above).

I used to generate PDF files of the FAQ.  I stopped this a few years
ago, when I decided that the use of PDF files was not to be encouraged
in any way, shape or form.  Adobe writes crap code and does what they
can to push it onto as many computers as they can.  It has become a
popular place to find zero-day exploits permitting undetected entry into
corporate computer systems.  And looking at how people use PDF files, it
just isn't needed.

(trivial example of the use of a PDF exploit: Phish a department for
e-mail access.  Get a few sets of e-mail creds, log into their webmail.
 Find a PDF someone sent to the entire department (or company!) about an
office event.  Pull it down, weaponize it, and then RESEND the PDF file
via e-mail to the exact same people it was sent to before, with the
subject line, "Updated office event info!".  Who WOULDN'T feel safe
opening this?  It's from a coworker about something you know is legit.
Ta-da, almost every computer in the department is now infected.)

Now, this is in no way an OpenBSD problem, Adobe Flash and PDF code do
not run on OpenBSD (thank goodness!), but I will do nothing to encourage
the use of this format anywhere, as long as Adobe is a major supplier of
readers on major platforms, and as long as their corporate attitude
towards security is, "Wah-wah-wah, everyone's picking on me!"

Anything involving PDF files will NOT have my personal blessing.

You also need to look at the license of the FAQ and website material --
most of it is released just under standard copyright, so any
redistribution requires the permission of the copyright holder.

Nick.

Reply via email to