Re: possible issue with ps2pdf (9.25) and transparency

Hello Ken,

many thanks for your explanatory response!

On Sep 17 10:26 Ken Sharp wrote (excerpt):
> At 10:55 17/09/2018 +0200, Johannes Meixner wrote:
>> 
>> I assume currently this is not possible but I would appreciate it
>> when in a future Ghostscript version any non-standard PostScript
>> extension would only be supported when a special command line
>> option was explicitly specified that enables the extension.
>
> I'm afraid that such a setup would break many existing
> applications which use Ghostscript.

I don't think so because my crucial point is that the intended
behaviour can be specified by an appropriate Ghostscript option.

What the default behaviour is is of secondary importance.

E.g. assume there is a Ghostscript command line option
'-dNOEXTENSIONS' then the current default behaviour
would not change so that no existing application would
need to be changed.


> In addition, some of the extension operators are required if the PDF 
> interpreter is to work. The Ghostscript PDF interpreter is (largely) written 
> in PostScript and in particular needs a group of operators such as runpdf, 
> runpdfpagerange etc in order to operate. Also a number of these operators are 
> used directly by our commercial customers so we can't simply deprecate them

I assume those PDF interpreter extension operators are required
while the PDF input pages are processed (and not e.g. only during
Ghostscript initialization where they could be disabled afterwards)
so that those extensions need to be available for arbitrary PDF
input from untrusted origin that might misuse those extensions.

If my assumption is right, the PDF interpreter extension operators
cannot be disabled in practice so that such a Ghostscript command
line option should be named e.g. '-dNOPSEXTENSIONS' to disable
only the PostScript specific extensions but not those for PDF.


> Fundamentally I'm pretty happy with bundling the whole file system and 
> non-standard operator usage together, if you want to do dangerous stuff,
> then you can't use SAFER.

But then one can no longer run Ghostscript in a strict PostScript compliant
way which means "all standard PostScript is supported but nothing more".

This is more a theoretical argument because I assume in practice
99.99% of Ghostscript's users won't care because they never
use Ghostscript directly but indirectly via other tools.

Nevertheless personally I prefer in general to
"Keep Separated Issues Separated" ( 'KSIS' ;-)
cf. item 5 in RFC 1925 at
https://tools.ietf.org/html/rfc1925


> Wwe have a staff meeting in under 2 weeks where I anticipate
> that security will be a topic of discussion..... I'll bring
> your point up there and see what everyone else has to say
> (I shall also practice my pre-emptive ducking > ;-)

Many thanks in advance for it (and good luck with ducking ;-)

I would much appreciate it if you could tell about the results
(even if results are "not yet decided").


Kind Regards
Johannes Meixner
-- 
SUSE LINUX GmbH - GF: Felix Imendoerffer, Jane Smithard,
Graham Norton - HRB 21284 (AG Nuernberg)