News for hackers. Stuff that matters.
Re:The evolution of the web, and a eulogy for XHTML2 by shakna on Sunday October 27, 2019 @11:25AM (#21370280)
> If anyone constructed a PDF, which was itself blank but, via embedded JavaScript, loaded parts of itself from a remote server, people would rightly balk and wonder what on earth the creator of this PDF was thinking — yet this is precisely the design of many “websites”.

Unfortunately, this is also the case for many PDFs amongst some of the more niche use-cases. Like NDA-bound many-thousand paged specifications. The PDF standard lets you do it, so some do. Not all readers actually support embedded JS, but most do in some limited capacity.

Re:The evolution of the web, and a eulogy for XHTML2 by saagarjha on Sunday October 27, 2019 @12:25PM (#21370676)
Can you just print the PDF and get something reasonable out of it?
Re:The evolution of the web, and a eulogy for XHTML2 by shakna on Sunday October 27, 2019 @01:17PM (#21371011)
Yes and no. Whatever prints the PDF has to be able to run the JS payload.

In the case of a physical printer, it's usually set up so there's [redacted] instead of blankness (that the JS replaces), so you get redacted images and paragraphs.

In the case of software printing to a static PDF which you can then print, the JS payload is generally set up to embed a series of rather obvious markers so that if the static copy is ever publicly revealed, they can go after you (DRM is easy when you only have a dozen customers in the entire world), but most PDF software that supports JS also supports JS disabling printing features so that little disincentive is unnecessary.