qpdf VS CryptPad

QPDF is a CLI tool that performs content-preserving transformations on PDF files. We have another tool for managing files!

Given how well Preview.app and Safari work for viewing >99% of PDFs I actually encounter in the wild, this article makes Apple's engineering decisions look good.

It also confirms many suspicions I've had over the years that have led me to, e.g., running all PDFs from questionable sources through VirusTotal before viewing on platforms where I wouldn't normally run antivirus software.

The original article also confirms my suspicions that this step is inadequate:

Because the Launch action can be considered as a danger- ous feature, we conducted a large-scale evaluation of 294,586 PDF documents downloaded from the Internet, in order to research if there are any legitimate use cases at all. Of those documents, only 532 files (0.18%) contained a Launch action. While none of the files was classified as malicious according to the VirusTotal database, we conclude that the Launch action is rarely used in the wild and its support should be removed by PDF implementations as well as the standard.

Incidentally, the Launch action is still present in the most recent version of the PDF standard[1], with only OS-specific launch parameters deprecated (which include passing arguments to the launched executable, so eliminating the deprecated feature is still a significant security gain).

Finally, I'm both personally and professionally curious about how the non-DoS examples in this articles may apply to non-viewer PDF tools and libraries like qpdf[2] and Ghostscript's original and recently reimplemented PDF interpreters[3].

[1] https://pdfa.org/resource/iso-32000-pdf/

(registration required, but at least the base standard is available at no cost; sadly, important incorporated standards like ISO 21757-1:2020 [ECMAScript for PDF] are not)

[2] https://qpdf.sourceforge.io

[3] https://ghostscript.com/blog/pdfi.html

I know you're talking about GUI editing, but I've found libqpdf[1] incredibly useful for making programmatic PDF edits with minimal (typically no) structural disturbance.

[1] https://qpdf.sourceforge.io

Solved this. So the string which we were concerned about depends on the time, which is why it changes everytime a new document is generated with the same source PDF. it is a meaningless string really. from the documentation, it gives this explanatin. To be sure, i raised an issue with the guys at QPDF and they were quick to answer the question too. The explanation theyve given is even more clearer.

Hi, this is my first Emacs package! It provides a transient wrapper for the qpdf command-line tool aimed especially at users of pdf-tools or at least DocView. With it one can, for example, remove/reorder/split/rotate pages of a pdf file, merge pdf files, remove annotations, and apply a range of transformations to a pdf file. See the qpdf documentation.

There are some here, as test files in the qpdf library: https://github.com/qpdf/qpdf/tree/main/qpdf/qtest/qpdf

(I wrote a low-level PDF parser and ran it over the PDF files that happened to be present on my laptop—just regular ones—and ran into some files that (some) PDF viewers open but even qpdf doesn't. I say "even" because qpdf is really good IMO.)

If you're comfortable handling the (typo)graphical aspects of the PDF yourself and have the ability to consume a C++ library, I've had good experiences using the Apache-licensed qpdf[1] library to handle the low-level structural aspects of the PDF standard. It's particularly convenient when your application requires structure-preserving integration of existing PDF content.

Simple example applications, each completed in 2–3 days, both in C#, using C++/CLI to integrate libqpdf:

1. Overlaying fixed-format text on pre-existing blank PDF form pages, ensuring the content of each distinct form page is embedded exactly once, and that all necessary assets (fonts, images, etc.) from the blank form PDF pages are included in the output PDF.

2. Losslessly combining a sequence of PDF, TIFF, and JPEG images into a single PDF with bookmarks pointing to the first page of each source file and existing image compression maintained where possible. In this application, only the source TIFFs were anything other than arbitrary (i.e., the TIFFs were more-or-less baseline images coming from a small number of scanning systems, but the JPEGs and PDFs came from all sorts of different applications).

[1] https://github.com/qpdf/qpdf

Use qpdf https://github.com/qpdf/qpdf

I was looking for a way on macOS to batch remove the user password from a bunch of PDF files that had the same password. I found the easiest way was to use qpdf with the following command:

In my frustration with MS Office, I gave it a chance and searched for MS Office alternatives ... and found https://github.com/cryptpad/cryptpad ! Looks quite nice. Maybe I should set that up on a server.

https://cryptpad.org/

There's a public instance in France to try it out.

CryptPad provides a full-fledged office suite with all the tools necessary for productive collaboration.

I discovered these 3 amazing projects recently:

Cryptpad, essentially google docs/sheets/forms e2e encrypted. It does include collaboration. https://github.com/cryptpad/cryptpad

Immich, google photos self hostable, with share options https://github.com/immich-app/immich

Nginxproxymanager manages certificates and proxies to self hosted stuff through nginx https://github.com/NginxProxyManager/nginx-proxy-manager

Great self hosting stuff!

I work for XWiki SAS. Two products we develop have it:

- XWiki, a extensible wiki platform, experimentally [1] but soon to be fully supported

- CryptPad [2], an end-to-end encrypted collaborative platform. And actually, CryptPad was accidentally born as a first attempt to have this feature in XWiki.

[1] https://extensions.xwiki.org/xwiki/bin/view/Extension/Realti...

[2] https://cryptpad.org/

Hey, very happy to see you so enthusiastic!

I'll be sure to transmit your feedback to the CryptPad team.

I'm not an expert myself so while I might know some stuff, it'd be better to talk to them directly.

Come say hello on the Matrix #cryptpad-general channel [1], don't hesitate to open issues on the bug tracker, and to browse the CryptPad's website [2].

[1] https://matrix.to/#/#cryptpad-general:matrix.xwiki.com

[2] https://cryptpad.org/

https://cryptpad.org https://cryptpad.fr

It's not LibreOffice, but while revisiting CryptPad (which I thought was a multiplayer notepad like etherpad or codimd, except with an encryption key in the url fragment identifier) I was impressed to see that they're expanding to become an entire office suite. You get a WYSIWYG editor (I'd rather wish for markdown but ok), spreadsheet editor, survey forms, and more which I don't remember, all live like google docs but (as I understand it, I didn't audit it) end to end encrypted between the users. It's a bit sluggish because everything has to happen on the client side, so it's a lot of JavaScript, but after the page loads it works smoothly. You can self host it as well, there's a list of instances somewhere on https://cryptpad.org with the official instance being https://cryptpad.fr

LibreOffice has a ton more features and is way harder to port. Case in point: I was at an open source conference where LibreOffice proudly demo'd their new server version, saying it used mapnik. Me, confused, asked huh why'd you use an OpenStreetMap rendering library? Turns out they basically run the ancient C++ UI on the server and make a VNC-like connection and that map tiles is the easiest or fastest way to load the screen. At least, that's what I remember from that presentation, I haven't looked into that madness further, but that's LibreOffice online...

Currently I'm looking at https://cryptpad.org/. But maybe there is an alternative that sucks even less?!