[plug] MS Curriculum at schools and TAFEs ...

[Christian]

On Mon, Apr 23, 2001 at 12:32:31PM +0800, The Thought Assassin wrote:
> > Does this increase the acceptability of PDF in your view?
> 
> > > It isn't even that the present situation particularly
> > > disadvantages Free Software - there are gratis non-free modules as I
> > > understand it - but it illuminates Adobe's attitude to their stewardship
> > > of the standard. If we accept PDF as an open standard because it is "close
> > > enough" for "practical purposes", we send a message that freedom is
> > > unimportant and take the first step along a slippery slope.
> 
> Does that answer your question? :) PDF as it stands right now does not
> seem to be anything less than an open standard in any practical sense. The
> theoretical proprietary lock-in and what it says about Adobe's lack of
> commitment to openness are things that cause me enough concern about the
> future to avoid actively supporting PDF now.

I guess it does! *grin*  Honestly though, calling arc4 a "gratis
non-free module" seems to be stretching things a little.  There are
numerous free software implementations and the code has been around for
years.  Obviously I'm not a lawyer but my understanding regarding things
like trade secrets (which is what RSADSI previously claimed RC4 to be)
is that if you let them out of the bag and/or don't take protecting them
seriously then you pretty much lose your rights.  So, as I understand
it, if RSADSI decided to sue someone (e.g., a free software project) for
the use of RC4 in the guise of arc4, they would almost certainly lose.
Of course, you may then argue that their legal pockets are deeper than
the free software projects so the freedom is only illusory... However,
given that the GPL has never been proven in court, doesn't this pose
exactly the same sort of risk?

I guess what I'm saying is that, while the PDF standard may not be
technically 100% open, there are 100% open/free implementations that are
also 100% compatible with it.  I'm not convinced that this implies that
our stance as a community is "freedom is not important".

> On a related topic...
> As PLUG's resident security and cryptography "guru", what do you think
> about the idea of putting the encryption layer within the document format?

I'm tempted to quote my previous comment the same way you did to me! :P
I'm also not sure when I became "PLUG's resident security and
cryptography ``guru''"! :-)  Still, as usual, I'm more than willing to
give an opinion. ;-)

To answer your question, in a word: stupid.  Or, more correctly,
pointless.  I can't imagine a situation where it provides any genuine
security.  If I write a PDF that I want to keep secret then I just don't
give it to anyone.  If I want to *really* make sure no one gets it then
I might use GNUPG or similar to encrypt it.  There is very, very little
security advantage to including this sort of functionality into the file
viewer.  The only thing I can think of is that if you had a very
powerful attacker who already had almost complete control over the
computer system you were using or was going to physically steal it out
from under you.  By incorporating the encryption into the file viewer
you no longer need to ever store a plaintext copy on the hard disk
(except for the usual caveats on virtual memory).  Having said that, the
attacker may well be able to bypass memory protections and simply read
the data out of memory so it's probably not worth it.  But all of this
is a little far-fetched -- well beyond the security requirements of most
users.  As for providing any protection against the user viewing the
file, it's obviously useless.  Once they have the key they can decrypt
the file and do whatever they want with it.