Security question

[vipatel10]

Hi, I'm new to Sumatra, and first of all, let me say thanks for making such a great, lightweight software. Amazing what such a small team can do competing against behemoths like Adobe.

I see that there are a bunch of new cool features in the prerelease. I'm wondering what the thinking is on whether a home user should use the prerelease? One of the reasons I wanted to switch from Adobe is that Adobe has so many security issues, so I'm wondering if I'm more much exposed using the prerelease vs the stable release? Thanks!

[kjk]

There is no more risk in using it than using release.

I recommend using it.

[vipatel10]

Thank you for the response. A follow up question please. So since PDFs are apparently a common attack vector these days, I've been trying to think about how to assess the risk of various PDF software. My amateur assessment came up with 3 factors:

1. Complexity of the software; Here Adobe Reader DC is a ~500mb installation while Sumatra is less than 10mb and doesn't enable a lot of security hole prone features like javascript, etc, so Sumatra clearly wins
2. Popularity of the software (presumably hackers are more likely to target widely used software); Sumatra wins since it's used by way fewer ppl
3. Security budget (Adobe wins because it's a $200bln company with presumably a very large team of people with a big budget that focus just on the security of Adobe Reader and Acrobat while Sumatra has a relatively tiny development team and budget)

So in summary, Sumatra wins on factors 1 and 2 and loses on factor 3, and in my amateur assessment, factors 1 and 2 outweigh factor 3. How did I do with my assessment? Thanks!

[GitHubRulesOK]

SumatraPDF core Engine thus most likely point of failure is MuPDF who supply pdf code to Adobe and take security very seriously but as a large bunch of humans can miss zero day tricks like anybody such as me.

[AnxiousPleaseHelp]

Hi, I'm new to Sumatra, and first of all, let me say thanks for making such a great, lightweight software. Amazing what such a small team can do competing against behemoths like Adobe.

I see that there are a bunch of new cool features in the prerelease. I'm wondering what the thinking is on whether a home user should use the prerelease? One of the reasons I wanted to switch from Adobe is that Adobe has so many security issues, so I'm wondering if I'm more much exposed using the prerelease vs the stable release? Thanks!

Were you ever able to find a solution?

[GitHubRulesOK]

@AnxiousPleaseHelp
The official answer is above "There is no more risk in using it than using release." Thus, there should be no difference between release and pre-release. Both should be as secure as is known at the time of their release. In fact the pre-release is newer and thus in theory patched against more known issues.

All computer software and data is by nature "running" and thus subject to exploitation but MuPDF at the heart of SumatraPDF frequently patch against known issues. SumatraPDF currently does not use the Adobe Scripting abilities as found in PDF thus has always been considered safer than most PDF viewers.