Re: ebook security (and the security of the reading customer)

It's not a good day when TeBC subjects overlap with information security subjects. *sigh*

I noticed this morning in a security handler's diary that Foxit PDF reader has an update - and usually the only reason for such a notice in such a location is that the software in question has a vulnerability that could be exploited to the detrement of your privacy, your security, or the proper operation of your computer. A closer look showed that Foxit (like lots of software) has been the target of exploits in the past.

This had led me to reconsider some of what I wrote below.

In short? Books have typos. Software has bugs. These are not the same thing. Typos I can gloss over. Bugs I cannot gloss over. Security bugs usually require the software to be replaced, or at least updated. (This isn't the only place this concept crops up. Nobody should be putting javascript in their EPUBs, especially since EPUB readers should be ignoring it.)

If I buy a book, I do not want to be given software. Moreover, in this particular case, if you gave me a copy of the Foxit reader bound in with your ebook and require me to use it for your book, you may be requiring me to use software that should be replaced due to security concerns. Along with the other possible factors, consider the liability questions alone.

In general, this moves the idea of building ebooks into executables from the "not a good idea" solidly into the "definitely a very bad idea" column. So...

Don't do it. Ever. Please.


... Chris

: chris smith ::::::::::::::::::::::::::::::::::::::::::::::::::
: nihil tam munitum quod non expugnari pecunia possit - cicero :


On Sat, 27 Feb 2010, Chris wrote:
>
> On Fri, 26 Feb 2010, Stuart Bray wrote:
> From http://www.ebook-security.com/faqs.html
> 
> Second, as I read it, it locks your PDF into being read by Foxit.
> So ...
> 
> - first, although you wrote a PDF, it is choosing the reader
> software for me. So in fact, it IS an exe - and it's duplicating
> functionality that most of your customers already have.
> 
> - as a piece of software, it's not going to work at all in some
> corporate environments (some will block any non-approved software)
> 
> - it's likely going to run afoul of firewalls if the software goes
> out to check with the website (which I assume it must, otherwise I
> can easily share the downloaded version)




------------------------------------

------------------------------------------------------
Post a message:   ebook-community [[at]] *
Unsubscribe:      ebook-community-unsubscribe [[at]] *
Switch to digest: ebook-community-digest [[at]] *
Switch to normal: ebook-community-normal [[at]] *
Put mail on hold: ebook-community-nomail [[at]] *
Administrator:    ebook-community-owner [[at]] *

(* == yahoogroups.com)
-------------------------------------------------------Yahoo! Groups Links

<*> To visit your group on the web, go to:
    http://groups.yahoo.com/group/ebook-community/

<*> Your email settings:
    Individual Email | Traditional

<*> To change settings online go to:
    http://groups.yahoo.com/group/ebook-community/join
    (Yahoo! ID required)

<*> To change settings via email:
    [email protected] 
    ebook-community-fullfeatured-hHKSG33TihhbjbujkaE4pw@public.gmane.org

<*> To unsubscribe from this group, send an email to:
    ebook-community-unsubscribe-hHKSG33TihhbjbujkaE4pw@public.gmane.org

<*> Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/