Show HN: Tetris in a PDF

[ThomasRinsma]

I realized that the PDF engines of modern desktop browsers (PDFium and PDF.js) support JavaScript with enough I/O primitives to make a basic game like Tetris.

It was a bit tricky to find a union of features that work in both engines, but in the end it turns out that showing/hiding annotation "fields" works well to make monochrome pixels, and keyboard input can be achieved by typing in a text input box.

All in all it's quite janky but a nice reminder of how general purpose PDF scripting can be. The linked PDF is all ASCII so you can just open it in a text editor, or have a look at the source code here: https://github.com/ThomasRinsma/pdftris/blob/main/gengrid.py

[weinzierl]

It's hard to overstate the ingenuity that went into this!

Despite what people say in the comments here, both browsers really do not let you execute PDF JavaScript willy nilly. Outside of browser environments you are mostly safe anyway because JavaScript is rarely supported, with the big exception being Acrobat. The cleverness of pdftris is not so much Tetris in PDF but how it found its way around the restrictions that browser environments have put up to protect us.

From what I understand pdftris also only works because of user interaction. I think there is no way to run JavaScript in a PDF without user interaction.

[MartinMond]

https://www.nutrient.io/blog/how-to-program-a-calculator-pdf... See here for how we did a calculator in a PDF

[ozaark]

Love the demo video and post but for some reason this doesn't seem to work for me. Running Chrome on Android 14

[freedomben]

You glorious bastard, what a cool project! This is already a contender for most hacker project of the year :-)

(below is not serious)

I would advise people against using this in production though because it's still missing some critical features. For example:

1. The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work.

2. It doesn't work properly in Evince. It just shows an error "The document contains only empty pages"

[nadis]

"The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work."

-- this comment made my me laugh/choke on my coffee and I have no regrets.

[debo_]

I feel stupid for not getting the joke. It would have been nice if you explained it in the ... postscript.

(Yes this is a joke)

[martinflack]

> 1. The Javascript stops working when printed to physical paper.

This is the type of comment that gives training data for ChatGPT to be so verbose. Ha!

[woodrowbarlow]

i recently discovered that the Canadian government depends on this for some fillable forms, because it shows a message at the top that says "JavaScript is disabled" and all the boxes show errors. i couldn't get it to work on Linux and had to dust off a Windows machine (and it still didn't work in firefox, it needed acrobat reader).

[necovek]

> The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work.

I believe you need to rescan it into PDF to get it to work again.

[martin_a]

Regarding #1: Your printer is just too slow. Try finding a printing company near you with a web feed machine, that should help with your FPS.

[zknowledge]

hahaha I wish you almost didn't include the parenthesis. I've had some clients who would definitely email me that point #1.

[dheera]

> Javascript

Oh, so that's what it is. Bleh. Ok.

I thought it was cooler and made use of the fact that PostScript is a Turing-complete language to write Tetris in PostScript.

(I never really understood the PDF format but I always assumed it's some kind of compressed PostScript)

[inetknght]

> The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work.

Science fiction tells us this is only temporary. Print away, those papers will turn into magic in just a few decades!

[lisper]

> The Javascript stops working when printed to physical paper.

It works for me. Maybe you need to upgrade your paper? What version are you using?

[maurya_anand]

"The Javascript stops working when printed to physical paper."

You need to upgrade your paper that supports a minimum FR of 60hz.

[atoav]

3. I open it on my phone and it doesn't work at all. And that is a new phone with a current browser.

[FpUser]

>"1. The Javascript stops working when printed to physical paper. The resulting paper just has a static image and the controls no longer work."

Just wait until e-paper replaces the real one ;)

[banzomaikaka]

thank god you warned the last 2 comments weren't serious

[niqmk]

I actually printed it out and wanted to see if it worked or not.. LMAO

[internetter]

Atari Breakout for PDF: https://cdn.jsdelivr.net/gh/osnr/horrifying-pdf-experiments@...

[a3w]

I see only a red half of the page, and then two pages of text.

[efitz]

This is amazing and terrifying (I am a security engineer and parsing complex document formats is a never-ending treasure trove of vulnerabilities).

[wayvey]

The amount of attack surface in various format parsers is pretty stunning and terrifying indeed

[enews01]

Theres a malaysian movie where the main premise is a hacker who uses pdf executions to steal one cent from every persons bank account. Its pretty interesting.

[mizzao]

The "code execution" in PDF parsing is what enabled this legendary zero-click, zero-day exploit of iOS devices: https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i...

[tashian]

AI agents run in isolated VMs, but PDFs have been out here running in the open for 30 years!

[neuroelectron]

This isn't even the beginning of what's possible in PDFs.

[bityard]

Not just web browsers, Acrobat (and probably other PDF readers) have supported executing Javascript in PDFs for decades.

[unnouinceput]

I was joking in 2007, when I was working at Siemens, to my boss, that an Excel cell can contain God and the Multiverse when I put an ActiveX inside that was basically a program I made which would draw a 3D animation based on parameters contained on other cells. Let's say the boss was impressed though for me was just basic OLE.

I see from time to time that younger generations reinvent/rediscover the wheel and I chuckle.

[Aaron2222]

Doesn't work in Preview unfortunately.

[brumar]

This is even in the ISO standard now

[pimlottc]

Which makes sense, why would browsers randomly add JS to PDF if it wasn’t already part of the standard?

[swyx]

why??? for what possible secure white hat reason could you want to run js in pdfs??!? is nobody sane running the pdf org?

[LetsGetTechnicl]

This is an affront against god. Good work.

[btown]

I, for one, was surprised that Chrome's PDF renderer would allow persistent JS code like this to run - not just limited code in response to user actions, but a real game loop.

But there's a spec for all this and everything! https://www.t10.org/ftp/js_api_reference.pdf (2007) - be warned, the light of Ecma TC39 standardization does not extend to this place.

Chromium's implementation of setInterval for instance (which, in this world, takes a string to evaluate): https://pdfium.googlesource.com/pdfium/+/refs/heads/main/fxj... -> https://pdfium.googlesource.com/pdfium/+/refs/heads/main/fxj...

From a security perspective, they're able to build on top of V8 isolate primitives and Chrome's sandboxing systems - but from the logs, security improvements in PDFium are being continuously developed as recently as the past few weeks! I feel like I've stumbled upon a parallel universe, in the best possible way.

[_yb2s]

This is horrifying, PDFs should not be able to execute code.

[chaps]

They also support iframes! The absolute madness of PDFs is a world wonder. But I'm really still not sure we could do without them.

[bityard]

Gzipped PostScript documents were fairly popular during the 90's and are functionally identical to PDFs for 99% of use cases. (PDF is essentially PostScript, but with more features.)

[seany]

This is great. Will probably give the fun police in r/k12sysadmin a heart attack.

[bwjx]

This is awesome.

Took a bit of prompting but was able to get a semi-working (only in Chrome) Flappy Bird out of Claude in ~10 minutes. Seems like the collision detection needs some work :)

https://github.com/baileywjohnson/flapdfy-bird/blob/main/fla...

[Uptrenda]

Actually works, a bit buggy but its a good POC.

[illegalmemory]

Not only web but majorly all OS pdf renderers support JS. It used to be a major source of malware long back.

[toddm]

This is really cool and fun!

I don't know much about the security issues others have raised, but if you're good enough to make this thing then I deserve to be pwned by you.

Chapeau!

[frizlab]

Fortunately this does not work in Safari where the rendering is done natively.

[GaggiX]

Kinda happy that Evince doesn't start executing JS when opening a PDF.

[weinzierl]

"It was a bit tricky to find a union of features that work in both engines [..]"

I am curious what the constraints are to make this work and in which environments it does? Does it work in PDF viewers outside the browser? Is there documentation what is available in which environment? What is enabled by default, can be switched on or off?

[alphabet9000]

amazing, i didn't know PDF supported javascript.

i've tried making "interactive" PDFs before but using POST and server side rendering rather than client, e.g. a PDF typewriter i made a little while back on http://news.coffee

[Uptrenda]

Well OP, you have definitely made me reconsider my assumptions about PDFium. I had assumed that JS didn't work altogether in Chrome. But clearly there's just bugs in the code I wrote. You've inspired me to have another crack at solving it. But definitely when the time is right. It's going to be a lot of hair pulling, I can see that now.

I'm not sure what your process was for testing your scripts: but for me because there was no meaningful error output I had to incrementally build up my script line by line (which took forever.) So I thought I'd done well when I got my stuff working in Adobe + Firefox. I wonder if now everyone is going to add similar scripts to their resumes :p Doom will be next, maybe?

[kvirani]

Wow... It's only January. I'm so excited to see what you release in February and beyond!