That’s just wrong.

It’s no wonder we have endless security issues when documents that should be just data and metadata (layout) declarations are Turing complete. Sigh.

When the last Tetris PDF was on the HN homepage I looked into ways of disabling JS in PDFs but was unable to find anyway other than disabling JS for the entire browser. I tried messing about with uBlock filters but to no avail. Does anyone know if this can be achieved?

  on one hand: applauds ingenuity

  on other hand: gapes at major security hole in PDF, wonders why this is defacto document type in industry for reading

So you can run a PDF reader inside it to display a PDF? Honestly I am a little worried someone will come up with some sort of smart DRM based on this.

In seriousness, it’s impressive and highlights how awful the PDF format is. Can we have a document format that is less encumbered, more structured, and more accepted as a “real” document yet?

Damn Good stuff, bot the doom and this linux of your! Kudos.

I had done LLM in PDF sometime Nov last year but it wasn't released. Since the doom in pdf uptick, I had released a demo here:

https://x.com/VulcanIgnis/status/1879649889178837025

Actually you don't need an old version of emscripten, hit me up for the Makefile and pdf templates or wait till offical release. My build script will make the pdf work both on chrome and firefox, adobe support is pending.

This is kind of what NSO Group’s Pegasus did to break out of iPhone sandboxing. They exploited a codec to bootstrap a virtual machine with a custom instruction set.

Wow. I guess it was just a matter of time after seeing the Doom and Tetris PDFs.

FYI, the PDF is 6.2 MB.

You people really managed to sprinkle JS everywhere, even on PDF. Shame on you.

On Edge (Chromium), I get this error message instead:

  An embedded page at linux.doompdf.dev says
  TypeError: Cannot set properties of null (setting 'value')
    at Object.0.9657115108887302 (<anonymous>:248:42)
    at set_interval_callback (<anonymous>:43:24)
    at <anonymous>:1:6

Kernel boot message:

”This architecture does not have memory protection”

—_—

Recent and related:

Show HN: Doom (1993) in a PDF - https://news.ycombinator.com/item?id=42678754 - Jan 2025 (74 comments)

I've invented a replacement for the PDF format.

It's called Locked Markdown. `*.lmd`.

It provides 98% of the functionality most people use PDFs for, without all the extra bullshit.

The Spec:

- The most popular Markdown Spec (git flavour?)

- At the top of the page place a hash sum of the markdown below a marker on the page.

LMD Reader:

- Prevents editing the markdown.

- Warns user if the hash sum is not valid.

Example:

```lmd

sha256 77ec0f678315f8a207c3501137e1dfc9642b79a9c93e21807df7b5242846c05c

-------------------------------

# Header 1

Paragraph of text about how bloated the PDF format is.

```

Zip .lmd together with images/videos if required.

See? This is _exactly_ why Facebook banned Linux.

Now all we need is a PDF reader embedded within a PDF. Bonus points for enabling it to open itself for infinite recursion.

Now install the pdf reader and open the pdf inside that os.

Is there even a single solid motivating example for why JS in PDF is useful? Can anyone show a real-world application of JS in PDF where it's actually a good fit?

I just don't see why PDF would be your file format of choice if you're writing JS.