Security question

[vipatel10]

Hi, I'm new to Sumatra, and first of all, let me say thanks for making such a great, lightweight software. Amazing what such a small team can do competing against behemoths like Adobe.

I see that there are a bunch of new cool features in the prerelease. I'm wondering what the thinking is on whether a home user should use the prerelease? One of the reasons I wanted to switch from Adobe is that Adobe has so many security issues, so I'm wondering if I'm more much exposed using the prerelease vs the stable release? Thanks!

[kjk]

There is no more risk in using it than using release.

I recommend using it.

[vipatel10]

Thank you for the response. A follow up question please. So since PDFs are apparently a common attack vector these days, I've been trying to think about how to assess the risk of various PDF software. My amateur assessment came up with 3 factors:

1. Complexity of the software; Here Adobe Reader DC is a ~500mb installation while Sumatra is less than 10mb and doesn't enable a lot of security hole prone features like javascript, etc, so Sumatra clearly wins
2. Popularity of the software (presumably hackers are more likely to target widely used software); Sumatra wins since it's used by way fewer ppl
3. Security budget (Adobe wins because it's a $200bln company with presumably a very large team of people with a big budget that focus just on the security of Adobe Reader and Acrobat while Sumatra has a relatively tiny development team and budget)

So in summary, Sumatra wins on factors 1 and 2 and loses on factor 3, and in my amateur assessment, factors 1 and 2 outweigh factor 3. How did I do with my assessment? Thanks!

[GitHubRulesOK]

SumatraPDF core Engine thus most likely point of failure is MuPDF who supply pdf code to Adobe and take security very seriously but as a large bunch of humans can miss zero day tricks like anybody such as me.