<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - Allow to set the pdf metadata producer"
href="https://bugs.freedesktop.org/show_bug.cgi?id=99514#c5">Comment # 5</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - Allow to set the pdf metadata producer"
href="https://bugs.freedesktop.org/show_bug.cgi?id=99514">bug 99514</a>
from <span class="vcard"><a class="email" href="mailto:paolo.borelli@gmail.com" title="Paolo Borelli <paolo.borelli@gmail.com>"> <span class="fn">Paolo Borelli</span></a>
</span></b>
<pre>(In reply to Adrian Johnson from <a href="show_bug.cgi?id=99514#c3">comment #3</a>)
<span class="quote">> (In reply to Paolo Borelli from <a href="show_bug.cgi?id=99514#c2">comment #2</a>)
> > There are two reasons why we would like to be able to set this metadata:
> >
> >
> > 1) There are libraries that use cairo internally: one example is libgxps
> > which is used to convert xps to pdf and internally uses cairo: I think it
> > would be more accurate to be able to set producer to gxps in that case
>
> In this case you set the creator to gxps. The creator is the code that
> generated the PDF content. The producer is the code that generated the PDF
> structure.</span >
>
Well, the creator would be the program that uses libgxps.
<span class="quote">> > 2) As Ignacio mentioned, there are cases where it would be better to not
> > include any metadata at all. This was reported to us as a security concern,
> > if you have a server application that generates a pdf an attacker can know
> > that the server is using cairo for that specific function and explot known
> > vulerabilities
>
> This is not a valid security concern. It is easy to determine the producer
> by comparing the PDF structure with sample output from various PDF producers.</span >
Security is not black and white, it is about mitigating risk: reading metadata
is much simpler than what you describe. It is unfortunate that we will need to
strip the metadata in post processing...</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the QA Contact for the bug.</li>
</ul>
</body>
</html>