One neat thing I've seen is a PDF that will ping an IP catcher when opened in Adobe, regardless of the security level. The same can be done with word docs, excel spreadsheets, and even SVGs.
Then just have a button for turning those on as needed on a case by case basis
That isn’t really true, it’s not hard for PDF viewers to block by default (or just not implement) the problematic features, which also aren’t critical for the vast majority of PDF files.
The exploitable bugs are typically the usual, some buffer overflow in an underlying image or font library or similar, but unrelated to PDFs being “executable”.
What do you mean by that?
> Beginning with PDF 1.1, a content stream can include PostScript language fragments. These fragments are used only when printing to a PostScript output device; they have no effect either when viewing the document on-screen or when printing it to a non-PostScript device. In addition, applications that understand PDF are unlikely to be able to interpret the PostScript fragments. Hence, this capability should be used with extreme caution and only if there is no other way to achieve the same result. Inappropriate use of PostScript XObjects can cause PDF files to print incorrectly.
> Note: Since PDF 1.4 encompasses all of the Adobe imaging model features of the PostScript language, there is no longer any reason to use PostScript XObjects. This feature is likely to be removed from PDF in a future version.
I don't think Apple's PDF renderer supports e.g. running JS, you'd need real Acrobat for that. Or are you talking about something else?
> they support decoding images which themselves have their own custom compressors that are also basically code themselves.
But this is fundamentally true for anything that displays images, right? Or are the PDF formats particularly bad for some reason?
Most people have some understanding that shady websites can give you malware, a drive-by exploit is pretty rare but it's good that most people think just visiting a site could infect your computer. But a PDF is just a document, right? Just thinking that a PDF is just words on a page is exactly why it's such an insidious threat. Or they'll get a PDF as an email attachment, see that it's not an exe or something weird, and open it because they think a document is safe.