Hacker News

points by fschuett 4 days ago | 0 comments

Why do people try to vibecode PDF engines that already exist in Rust? https://github.com/yfedoseev/pdf_oxide which this project builds on completely misses https://github.com/fschutt/printpdf which was already developed with tons of fixes over years (both with and without AI). MIT license and also builds on WASM with a demo running on https://fschutt.github.io/printpdf/

One Google search (yeah I'm old, sorry, nobody "Googles" anymore) for "rust pdf library" shows this. Yet people now redo and redo and redo everything again just to have "their" semi-broken copy of a HTML -> PDF renderer (and then run into the same edge cases that were already fixed before). There are lots of edge cases in typography especially, I recently had a lot of fixes as I was trying to ocr-and-cleanup a 1732 scan of some books with Claude auto-extracting the font. There were a ton of edge cases in the layout, esp. related to column, footnote and sidebar handling, or things like "Hebrew RTL text accidentally disappears if text breaks weirdly", "1-bit image compression", etc.

I have nothing against AI, I use it heavily myself, but what is annoying is people completely ignoring the years of work of existing projects that do the exact same thing - instead of just forking, but instead re-tokenizing the exact same work again. Most likely the author didn't research "does this already exist" and that's annoying, then you get 100 of similar projects reinventing the world with tokens again and again. Sometimes its beneficial and can lead to faster exploration of new approaches, but in most cases its not and misses edge cases that were solved before.

[–] tchalla 4 days ago

> https://github.com/yfedoseev/pdf_oxide which this project builds on completely misses https://github.com/fschutt/printpdf which was already developed with tons of fixes over years (both with and without AI). MIT license and also builds on WASM with a demo running on https://fschutt.github.io/printpdf/

It seems like fschutt/printpdf is your project. You should definitely at least disclose it in your comment, if that's the case.

[–] fschuett 3 days ago

It‘s my repo yeah, I thought that was obvious from my username, sorry.

[–] rubyfan 3 days ago

It is obvious

[–] vardhan1237 3 days ago

Huge respect for your work on printpdf, and thank you for chiming in!

When we evaluated the Rust PDF landscape, printpdf was actually one of the first crates we looked at for PDF generation. The reason we opted for a stack centered around lopdf and pdf-writer was architectural: PaperPilot's primary focus is heavy manipulation and non-destructive AST transformation of existing, arbitrary, often malformed real-world PDFs (re-ordering cross-reference tables, granular /P permission bitmask hashing, raw object streams, page imposition, booklet folding, and outline splitting).

For document synthesis (HTML/Markdown to PDF), typography and edge-cases (like the RTL/footnote issues you mentioned) are notoriously hard, and we'd love to learn from or collaborate with printpdf's battle-tested approaches there. Thank you for the feedback and all your contributions to Rust's PDF ecosystem!

[–] NullifyNAN 4 days ago

LLM performance increases substantially when the exact software you’re writing is already in the training data.

[–] whizzter 3 days ago

I was thinking the same thing when another PDF library popped up in the .NET subreddit a few hours before this post.

[–] thadt 3 days ago

Because this isn't a library, but an ambitious commercial headed [1] tool. If your needs and use cases match the feature set they're aiming for, and their market research and projections are able to undercut Adobe by an order of magnitude, then they might be on to something.

> Strategic Vision: Evolve PaperPilot from a best-in-class PDF workstation into the Universal Document Operating System for humans and AI agents. [2]

[1] https://github.com/KrushnaVardhanReddy/PaperPilot/blob/main/...

[2] https://github.com/KrushnaVardhanReddy/PaperPilot/blob/main/...

[–] fschuett 3 days ago

„3.6 Gemini? He‘s delusional, take him to the infirmary.“

[–] ashkankiani 4 days ago

I can't wait to exploit all of the known and new pdf CVEs from all these new vibe coded pdf engines. Unless they managed to put in the secret phrase "and don't make any mistakes, especially on security!"

[–] voidhorse 3 days ago

Completely agree, it doesn't help that the models all seem to promote this behavior by writing everything from scratch most of the time.

I explicitly start most programming projects with a request for existing libraries and explicit instructions to the model to prefer using them and keep our logic exclusively to what we need beyond that.

People are forgetting and/or don't realize that just because the actual generation is zero cost does not mean the code is zero cost. Every line of bespoke code is a liability. Every piece of duplicative software you produce for no reason other than "this one is mine" is polluting the ecosystem and creating a noisy landscape in which such problems will just get worse. We are seeing the complete erosion of collective contribution models which has negative implications for the collective maintenance and enhancement of shared knowledge over time.

[–] rererereferred 3 days ago

Maybe people are having fun reinventing the wheel? Maybe they want to try other ways to solve the same problem or pick different trade-offs. Maybe they don't like the license, plenty of software has been written from scratch just to avoid the license of existing software.

[–] frumiousirc 4 days ago

> One Google search (yeah I'm old, sorry, nobody "Googles" anymore)

Maybe that's your answer. Search is so bad and LLM so good that it's faster and easier to re-implement than reuse.

The only thing that slows down the new paradigm is the apparent requirement of posting the output to HN so others will find it.

That irony is not lost on me.

[–] anhyz 3 days ago

> Search is so bad and LLM so good that it's faster and easier to re-implement than reuse.

This is a scary level of AI mania.

Even if you're being assisted by the best frontier model, there is no way that reimplementing a PDF engine from scratch is faster than just using the one that's already there. AI-driven coding still takes time and tokens. A web search takes maybe 60 seconds to search and find the existing implementations?

You could even tell the LLM to configure (or even fork) one of the existing implementations for you, and that would still be way faster than a from-scratch implementation.

[–] gtirloni 3 days ago

LLMs will miss a lot of edge cases. This is critical for a library that parses PDFs. Ask it to review the code for issues and by the 20th time you ask, it still will find issues. How's that faster (or safer)?

I use AI heavily but it's not this omnipresent deity that knows everything at all times.

[–] croes 4 days ago

Fast, easy, safe. Choose two

[–] jeltz 3 days ago

Vibecoding your own PDF engine is choosing none of them.

[–] suhlig 3 days ago

Maybe because yours is listed as having its latest release five years ago, and the one it builds upon only two months ago? Not saying this is the only metric that counts, bit it is easy to check when comparing.

[–] SecondCrack 4 days ago

Is it people ignoring years of work, or the AI they're using? The people haven't read and digested the human history of PDF engine development, that's their excuse, what's AI's?

[–] teh 4 days ago

The readme says: "Small and dependency-light. Pure Rust, built on lopdf, pdf_oxide, rten, and friends.", and paperpilot-pdf/Cargo.toml confirms that.

[–] swsieber 3 days ago

As someone whose commercial software needs to ingest PDFs: I stay away from things like lopdf because of how they fail to handle broken pdfs.

The first project you linked explicitly calls out broken pdf handling.

[–] giancarlostoro 3 days ago

I just want a really exhaustive one in .NET land to be honest, some of these paid companies are getting wild with their pricing schemes.

[–] j45 3 days ago

Possibly using AI as a search engine which it's not always great at, and then deciding why not.

[–] t_mahmood 3 days ago

And unfortunately, these posts goes on frontpage, because AI, but no ai posts are largly ignored.

[–] piokoch 4 days ago

Redoing is almost free today, you can try to redo a lot of stuff, try to gain traction/publicity and maybe that will be your solution that will stick. People were trying this strategy with a lot of stuff (think smartphone cases) but in case of software this is soo easy and dead cheap.

I see the outbreak of PDF readers, AI TUI harnesses, etc.

[–] geraneum 4 days ago

> Redoing is almost free today

Can I get some of those free tokens you’re having?

[–] zamadatix 3 days ago

You may have missed the bulk of the "free" ride: ChatGPT Pro 200 is both being imminently nerfed (even for those who signed up before) and reaching the end of a month of reset candy as they quell that backlash/end a month of "ailu major features or resets". Yes, it was $200... but hear me out first!

In the last 5 days alone I've had the equivalent of 2+ years of ChatGPT Plus Codex quota given for free via resets. I literally leave my PC running in Codex with 8+ Sol 6.1 Max sessions jamming away most of the day writing a desktop environment from scratch (and other things) just because the reset tokens will evaporate if I don't use them. I've even had days with > 1 billion tokens used where it was reset by the morning.

That said, who knows what free ride will appear with AI capital next month!

[–] geraneum 3 days ago

You’re right. As you noted, “free” is not the same as heavily subsidized. The chickens will have to come home to roost.

[–] zamadatix 3 days ago

The more optimistic hope is that actual prices continue to drop at the rate they have been and then by the time the subsidization runs out (even if that's not far from now) it's because there is nothing for the chickens to come home and roost to anymore.

After all, a year ago and doing these same tasks would just fall on its face. The hard part of the problem is solved, now it's not even "do LLMs continue to get better" but "do LlMs keep getting cheaper".

[–] ecto 3 days ago

Lots of people do lots of things.

[–] lelanthran 4 days ago

> Why do people try to vibecode PDF engines that already exist in Rust?

Nothing surprising here; pre-2022/2023, Rust was used primarily for rewriting things (compared to, for example, Go, which was used to write new things, not replacements).

I don't find it surprising that the pattern is continuing.

[–] stymaar 4 days ago

It's not a rust specific thing at all, HN has had it's share of “<something> but written in JavaScript” (as well as in Go[1]) back in the day, it's just a common thing when a language becomes popular, as their are more people wanting to show off that they did something than people with genuinely original ideas worth posting on HN.

It's not that Rust or Go aren't used to write new things, it's just that the bar for reaching the HN front page with new things is much higher than for mere copycats.

[1]: https://hn.algolia.com/?q=written+in+Go

[–] embedding-shape 3 days ago

> Rust was used primarily for rewriting things (compared to, for example, Go, which was used to write new things, not replacements

How could you possibly know this, for either languages?

FWIW, I've only worked and written greenfield software with Rust, and have only worked professionally with Golang to replace existing services. I'm sure I'm not alone in this, nor in the complete opposite. But I don't think either of us could say how either of the languages or "primarily used", that's a bit too much.

[–] lelanthran 3 days ago

Anecdotally, it's not representative of your experience.

But... Rewrite-it-in-Rust is a meme, while rewrite in Go is not.

[–] embedding-shape 3 days ago

> Anecdotally, it's not representative of your experience.

I'm glad you got the gist of my comment :)

> But... Rewrite-it-in-Rust is a meme, while rewrite in Go is not.

Today no, but it definitely was when it first became popular, "X but in Go" was fairly common on the HN frontpage and elsewhere. Just like "X but in Ruby" used to be a thing too, but isn't anymore.

[–] devy 3 days ago

Ditto.

I just ran an security analysis on the repo. As is, it's not looking great (again nothing against vibe/agentic coded projects) the lack of security consideration is astonishing (not suggesting a malice). Definitely NOT production ready.

  Context: about 98% of the commits are by AI bots (Antigravity, Google Jules).
  That explains the bugs below.

  Security bugs

  1. High: the local web API lets any website use the user's files.
  - paperpilot-gateway/src/server.rs:95-98 allows requests from any website, and
    there's no login or authentication.
  - POST /api/v1/pdf/mcp-exec (handlers.rs:233) runs any tool with any file path
    on the machine.
  - So while the API is running, any web page the user visits can make it
    overwrite files with PDFs, create folders, and read back text from any local
    PDF.
  - In the desktop app the user has to switch the API on. But docker-compose.yml
    opens it to the network with no authentication.
  - There's also no limit on request size (usize::MAX), so one huge request can
    exhaust memory.

  2. High: a malicious document can run code in the desktop app.
  - Search results display text from the user's own documents as raw HTML
    without escaping it:
    - WorkspaceSearchModal.svelte:297
    - workspaceSearch.ts:84
    - WorkspaceSearchModal.svelte:118
  - The app has no Content Security Policy, and lets its window read any file on
    disk (tauri.conf.json:28-33, scope "**").
  - So a PDF or DOCX carrying an <img onerror=…> payload could read any local
    file and send it out once the user searches it.

  3. Medium: downloaded models and add-on packs are never verified.
  - There's no checksum check on models (ai_commands.rs, ocr_commands.rs). Some
    come straight from the repo's live main branch, so whatever lands there
    ships to users.
  - Pack downloads (pack_commands.rs:147-151) put pack_id straight into the file
    path. A value containing ../ writes outside the app's data folder.
  - Packs come from huggingface.co/paperpilot/packs, an account I didn't confirm
    the project owns.

  4. Medium/Low: the protection against fetching internal addresses can be
  bypassed (paperpilot-core/src/url_fetch.rs:24-40).
  - It only checks IP addresses typed directly into the URL, not what a domain
    name resolves to.
  - It follows redirects, so a public URL can redirect to an internal one.
  - IPv6 addresses ([::1]), 0.0.0.0 and the 100.64.0.0/10 range get through.
  - The impact is limited because the response must start with %PDF.

  5. Low: CI supply chain.
  - release.yml installs wasm-pack via curl | sh.
  - GitHub Actions are pinned to version tags, not commit hashes.
  - The Android build ignores the lockfile (--no-frozen-lockfile).

[–] geraneum 4 days ago

You got to give it to the AI mega corporations’ pr efforts. They have convinced people that paying them to regenerate something they can get for free, is a sensible idea.

Like this case, the open source project here could be used as a base for further development by AI!