Subject: Re: Plagued by PPTX again

From: [email-masked] (Noel Chiappa)
Date: Tue, 15 Nov 2011 12:56:33 -0500 (EST)

> From: todd glassey <[email-masked]>
 
    > PPTX is Office 2007 format and there are formal readers and format
    > API's for office so that this is a no brainer.

    > http://www.microsoft.com/download/en/details.aspx?id=6

Gee, I don't see my OS listed on that page. What do I do know?

	Noel

---

From: Frank Ellermann <[email-masked]>
Date: Tue, 15 Nov 2011 19:26:55 +0100

> Gee, I don't see my OS listed on that page. What do I do know?

Let DuckDuckGo tell you what it knows about "Powerpoint viewer ubuntu".

FWIW I like ppt(x) better than pdf, "anything pdf" is huge.  For simple
slides (x)html or whatever the "slide" option of xml2rfc produces could
be nice, packaged as "mozilla archive format" or any other style of a
zipped subdirectory.

-Frank

---

From: Douglas Otis <[email-masked]>
Date: Wed, 16 Nov 2011 09:48:58 -0800

On 11/15/11 10:26 AM, Frank Ellermann wrote:
> On 15 November 2011 18:56, Noel Chiappa<[email-masked]>  wrote:
>
Many exploits appear in ppt and pptx formats (where pptx reduces 
scanning complexity).  Limiting acceptance (or publishing) to pdf/a is a 
safer and more stable  choice.  Documentation formats related to IETF 
efforts should be stable to ensure documents can be read at a later date.

In May of this year, patches were needed to mitigate ongoing PPT threats.
http://technet.microsoft.com/en-us/security/bulletin/ms11-036
http://www.openoffice.org/security/cves/CVE-2010-2935_CVE-2010-2936.html
http://blogs.technet.com/b/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx

OpenOffice permits file system based references as well.

-Doug

---

From: Christian Huitema <[email-masked]>
Date: Wed, 16 Nov 2011 22:45:33 +0000

> http://blogs.technet.com/b/mmpc/archive/2009/04/02/new-0-day-exploits-using-powerpoint-files.aspx

A quick look at http://www.adobe.com/support/security/ shows that PDF is not immune to security issues, and has at least as many bulletins out as PowerPoint. Complex presentations formats require complex code, and nobody is perfect.

Just saying, but if we want to ensure that presentations are readable 50 years from now, and do not embed some kind of malicious code, we might stick to ASCII text, right? 

-- Christian Huitema

---

From: Martin Rex <[email-masked]>
Date: Thu, 17 Nov 2011 00:11:16 +0100 (MET)

Christian Huitema wrote:
> A quick look at http://www.adobe.com/support/security/ shows that PDF
> is not immune to security issues, and has at least as many bulletins
> out as PowerPoint. Complex presentations formats require complex code,
> and nobody is perfect.

Not every PDF viewer is so obsessive as the one from Adobe about
trying execute every bit that looks even remotely executable, besides
javascript also every content where the addition of length fields
wraps in integer math.

> 
> Just saying, but if we want to ensure that presentations are
> readable 50 years from now, and do not embed some kind of
> malicious code, we might stick to ASCII text, right? 

I would not go as far as that,
but forcing a format that is free from active content 
is probably a good start:

  http://en.wikipedia.org/wiki/PDF/A

I would also not mind when the Upload _accepts_ PPT or PPTX, when
the IETF tools backend would perform the conversion to PDF/A by itself.

-Martin

---

From: Christian Huitema <[email-masked]>
Date: Thu, 17 Nov 2011 00:17:55 +0000

> but forcing a format that is free from active content is probably a good start...

I used to think that, until somebody showed me how to fuzz a JPEG file. No active content needed, just a syntax  sufficiently complex to allow for coding mistakes or other oversights.

-- Christian Huitema

---

From: Melinda Shore <[email-masked]>
Date: Wed, 16 Nov 2011 16:56:26 -0900

> Just saying, but if we want to ensure that presentations are readable 50 years from now, and do not embed some kind of malicious code, we might stick to ASCII text, right?

Yes, clearly.

It's hard to know what to say about the suggestion that PowerPoint
is an appropriate archival format, other than maybe it's time for
folks to learn more about archiving.  To be honest it's my impression
that it's just people trying to find some reason - any reason - to
justify their preferred tools.  The notion that current PowerPoint
formats being the ones most likely to be interpretable in 2061, of
the formats now available, really doesn't hold up under serious
scrutiny.

But hey, now we know that at least the proponents of the archival
view are going to have crud-free slides, in the interest of
parsability at unknown future times.

Melinda

---

From: Yaakov Stein <[email-masked]>
Date: Thu, 17 Nov 2011 08:57:34 +0000

> Just saying, but if we want to ensure that presentations are readable 50 years from now, 
> and do not embed some kind of malicious code, we might stick to ASCII text, right? 

There are countless attacks on programs and devices that display ASCII code
(I once heard a talk on bricking vintage cellphones by sending specific SMS messages).

I think we really should limit ourselves to permanent markers on transparencies
after fingerprinting the presenters.

Y(J)S

---

From: Robinson Tryon <[email-masked]>
Date: Thu, 17 Nov 2011 12:17:12 -0500

On Wed, Nov 16, 2011 at 8:56 PM, Melinda Shore <[email-masked]> wrote:
>> Just saying, but if we want to ensure that presentations are readable 50
>> years from now, and do not embed some kind of malicious code, we might stick
>> to ASCII text, right?
>
> Yes, clearly.
>

We can certainly hope so!

> Melinda

Reviewing this thread, it seems like there are three central desires
regarding IETF materials:

1) Interoperability: Universal access to working content (e.g. reading
presentation slides from a current meeting)
2) Archiving: Storage and search of content
3) Creation: Ease of content creation/desire to use particular products

If the current formats used to produce content (e.g. PPT, PPTX, ODF,
etc...) can be easily and accurately converted into formats such as
PDF/A-1, and if the text from the source formats can be exported (for
search/accessibility purposes), then I think we can make everyone
happy.

The export tools aren't perfect, of course, so this will place a
burden on content creators to either choose a source format that has
good export or to craft their input files so that they can be cleanly
exported by the available software.

If authors take on the responsibility of creating and verifying the
fidelity of exported versions, then I think everything will be peachy.
What can we do to encourage this practice?

-- Robinson

---

From: Douglas Otis <[email-masked]>
Date: Thu, 17 Nov 2011 09:46:20 -0800

On 11/17/11 9:17 AM, Robinson Tryon wrote:
> On Wed, Nov 16, 2011 at 8:56 PM, Melinda Shore<[email-masked]>  wrote:
Agreed.

PDF/a is something browsers and natively by different OSs that can 
directly display.  When submitting formats that are not PDF/a, convert 
and automatically link to the converted output with a prompt requesting 
approval.

http://www.digitalpreservation.gov/formats/fdd/fdd000125.shtml

-Doug

---

From: Nick Hilliard <[email-masked]>
Date: Thu, 17 Nov 2011 17:48:05 +0000

On 17/11/2011 17:17, Robinson Tryon wrote:
> fidelity of exported versions, 

There are two directly conflicting issues here:

1. presenters are not going to be able to guarantee strict pdf/a v1.4 output

2. the ietf is not going to be able to guarantee an accurate export process

If the IETF is serious about long-term data archival of presentations in
e.g. pdf/a format, it may be best to implement a two-phase process which
accepts pdf from users and then re-exports it to pdf/a.

> then I think everything will be peachy.

perhaps have a data tracker tool which insists on pdf, but also welcomes
other original formats (e.g. .ppt / .pptx / .key / .tex / etc).  Similar to
the I-D upload tool which insists on .txt but welcomes xml / etc.

For the presentation computers, support ppt / pptx / odf / pdf from a
current installation of a well known operating system with good
presentation characteristics (e.g. windows + powerpoint, or os/x with
recent office + keynote).  And just accept that there will be various
presentation compatibility issues from time to time.

Nick

---

From: David Morris <[email-masked]>
Date: Thu, 17 Nov 2011 09:52:39 -0800 (PST)

> What can we do to encourage this practice?

Start by compensating them for the work required to conform to this
requirement?

The IETF is a bunch of volunteers, most of whom carve out time for
participation from time needed to satisfy other responsiblities.

The authors already have issues with the basic tool set and compatiblity
with the computing environments needed for other life responsiblities.
Now you want to dictate a new step.

Adding a new tool/process is absurd. If you have a solution that actually
works for everyone without adding much to their time burden, test it,
demonstrate it with your own materials, etc.

---

From: Henning Schulzrinne <[email-masked]>
Date: Thu, 17 Nov 2011 13:18:11 -0500

I run a fairly large service for reviewing conference submissions, almost all in PDF, with several ten thousand submissions each year. You'd be amazed how much broken PDF is out there, produced by all kinds of tools. Older versions of Microsoft Office and various "free" PDF conversion tools routinely fail to include fonts, for example, thus, violating PDF/A requirements. Others break PDF so that text can't be cut-and-pasted.

We don't even try for PDF/A compliance, just a much narrower set of requirements imposed by the major academic EE/CS publishers (IEEE and ACM).

Unfortunately, I have not found a reasonable online tool (service) that produces correct PDF 100% of the time. Adobe Acrobat works most of the time for the desktop, but is pretty expensive. The Mac version of Word seems to have a high success ratio. http://www.freepdfconvert.com/ works frequently. Etc. We still do a fair amount of hand-tweaking and tool-trying, so if you truly want 100% PDF/A compliance, be prepared not just for buying a fairly expensive tool chain to check this (we use Callas PDFtools for compliance checking), but also technical support staff to deal with the 1% or so of files that won't convert well.

NSF also does online conversion from Word to PDF. It kind of, mostly works. (Such tools tend to be available for Windows servers only, unfortunately, and are certainly not free. These tools typically script an Office client to do the conversion, since that's the only sure way to get something that approximates the PDF output that Office produces. Some use OpenOffice, but this seems to sometimes cause rendering problems.)

Thus, requiring authors to upload "random" PDF isn't unreasonable, in my view, but requiring PDF/A or doing server-side PDF conversion raises the bar significantly, for all parties in the process.

Henning

On Nov 17, 2011, at 12:52 PM, David Morris wrote:

> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

---

From: Michael Richardson <[email-masked]>
Date: Thu, 17 Nov 2011 13:38:58 -0500

>>>>> "Henning" == Henning Schulzrinne <[email-masked]> writes:
    Henning> I run a fairly large service for reviewing conference
    Henning> submissions, almost all in PDF, with several ten thousand
    Henning> submissions each year. You'd be amazed how much broken PDF
    Henning> is out there, produced by all kinds of tools. Older

Interesting thing you do.  It seems that we are a few years away from
having good PDF/A, but:

    Henning> Thus, requiring authors to upload "random" PDF isn't
    Henning> unreasonable, in my view, but requiring PDF/A or doing
    Henning> server-side PDF conversion raises the bar significantly,
    Henning> for all parties in the process.

having things in PDF to start with seems like a good baby step.

-- 
]       He who is tired of Weird Al is tired of life!           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email-masked] http://www.sandelman.ottawa.on.ca/ |device driver[
   Kyoto Plus: watch the video <http://www.youtube.com/watch?v=kzx1ycLXQSE>
	               then sign the petition.

---

From: Robinson Tryon <[email-masked]>
Date: Thu, 17 Nov 2011 16:03:07 -0500

> having things in PDF to start with seems like a good baby step.

Yes, starting with just a "baby step" seems like the best way to
tackle this problem. A simple rule could be: "At least one of the
provided formats should be PDF. Extra Credit if your document conforms
to PDF/A."

On Thu, Nov 17, 2011 at 1:18 PM, Henning Schulzrinne
<[email-masked]> wrote:
>
> [... PDF conversion tools are immature...]
>

Thank you for the notes on PDF conversion. As nice as an automated
tool would be, the overhead in creating and maintaining such a tool
sounds challenging. Add to that the variances between the output of
different programs and shortcomings of the PDF conversion libraries,
and it sounds like a huge bit of work.

For now, I agree that the best possible method of creating the PDFs
would be to ask the authors to create them.

On Thu, Nov 17, 2011 at 12:52 PM, David Morris <[email-masked]> wrote:
> ....If you have a solution that actually

I'm not sure what kind of information is available online comparing
the various tools and methods of creating PDFs from various source
file formats, however if such a resource doesn't exist, I'd be happy
to help work on documentation for a "Best Practices" manual.

Hopefully some very simple and clear documentation would reduce the
burden of PDF conversion to a minimum.

> the I-D upload tool which insists on .txt but welcomes xml / etc.

This sounds like a great idea.

The simplest version of the upload tool could just check file
extensions and make sure that one of the uploaded files is named
"*.pdf". Sure -- someone could intentionally upload an incorrect or
out-of-date exported PDF, but I think that most people are mature
enough to work under the honor system.

Just having a little hurdle in there will be enough to remind the
absent-minded to upload the PDF version alongside their primary source
file.

I'm not really sure who is in charge of developing and deploying tools
for the IETF. Is there someone serving in a technical support role who
would be interested in brainstorming or chatting about mocking-up a
tool?

-- Robinson

---

From: "John Levine" <[email-masked]>
Date: 17 Nov 2011 22:16:23 -0000

>demonstrate it with your own materials, etc.

Are there really presentation programs so lame that they can't export PDFs?

If so, loop back to the beginning of this dicussion in which people
refuse to update decade old software.

R's,
John

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Thu, 17 Nov 2011 14:26:58 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> John Levine
> Sent: Thursday, November 17, 2011 2:16 PM
> To: [email-masked]
> Subject: Re: Plagued by PPTX again
> 
> >Adding a new tool/process is absurd. If you have a solution that
> >actually works for everyone without adding much to their time burden,
> >test it, demonstrate it with your own materials, etc.
> 

Even if there are, there are open source tools that install themselves as printer drivers on Windows which generate PDFs.  The application itself doesn't need PDF support.

---

From: Martin Rex <[email-masked]>
Date: Fri, 18 Nov 2011 00:01:25 +0100 (MET)

> Now you want to dictate a new step.

The awkward xml2rfc I-D authoring process can hardly be compared to
the effort of a minuscule mousemove when saving your presentation.

The additional effort on save + upload (especially for those boasting
about bleeding-edge bells'n'whistles slide-making software) is
less than 10 seconds to select a different format (PDF) on save.
For the data that is uploaded during the IETF Meeting (which is
a significant fraction) network bandwith is not an issue, its local.

Assuming an engineer with $100/hour, 10 seconds = 0.28 cents.

How about the IESG having a box of special brownies at IETF meetings
to reward those nice presentations authors who save the all of the
IETF participants downloading form datatracker combined
a few hours hours per document.

-Martin

---

From: Nick Hilliard <[email-masked]>
Date: Thu, 17 Nov 2011 23:01:56 +0000

> Are there really presentation programs so lame that they can't export PDFs?

Yes, many - but if you're running windows, there is always cutepdf which
acts as a printer driver and you can use it to export pdf from anything.

Or if you use a mac, you can export to pdf from anything from the base o/s.
 If linux / free unix, the de-facto presentation system is OOo, which
supports pdf export natively.

This doesn't address strict pdf/a 1.4 compatibility, but this is a more
subtle problem which the ietf cannot realistically expect its presentation
submitters to handle in a consistent manner.

> refuse to update decade old software.

Apparently, it is considered unhelpful to suggest that people keep within
5y of what's widely supported at any particular time.

Nick

---

From: Randy Bush <[email-masked]>
Date: Fri, 18 Nov 2011 08:14:40 +0800

> http://www.digitalpreservation.gov/formats/fdd/fdd000125.shtml

so where is the web page that tells me for platform x how to convert my
generated pdf, which i have been using as the pub format for years, into
pdf/a?

the link under "Guidelines for Creating Archival Quality PDF Files" is a
broken link.

randy

---

From: "John Levine" <[email-masked]>
Date: 18 Nov 2011 07:03:19 -0000

>submitters to handle in a consistent manner.

OOO and LibreOffice purport to export PDF/A.  I haven't run the
results through a verifier to see how well they do.  But I gather that
we also have people who are opposed in principle to free software* so
never mind.

R's,
John

* - "You don't want to get locked into open source", credited to an IBM
salesman

---

From: Theodore Tso <[email-masked]>
Date: Fri, 18 Nov 2011 07:28:08 -0500

> * - "You don't want to get locked into open source", credited to an IBM

Because once you try an open source mail reader, you'll never want to go back to Lotus Notes?   :-)

-- Ted

---

From: "John R. Levine" <[email-masked]>
Date: 18 Nov 2011 10:27:29 -0800

> Because once you try an open source mail reader, you'll never want to go back to Lotus Notes?   :-)

That was way before IBM ever thought of buying the remains of Lotus.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. http://jl.ly

---

From: David Morris <[email-masked]>
Date: Fri, 18 Nov 2011 10:46:51 -0800 (PST)

> That was way before IBM ever thought of buying the remains of Lotus.

That makes it sound like an urban rumor to me ... I'm pretty sure that
general awareness of open source as a concept let alone competator an IBM
sales man needed to be concerned about post dates IBM's acquisition of 
Lotus.

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 19 Nov 2011 15:18:25 +1300

> sales man needed to be concerned about post dates IBM's acquisition of 

Definitely. It was my boss's boss in IBM, Irving Wladawsky-Berger, who
turned IBM on to Linux and open source in general, and that was years
after IBM bought Lotus and made all employees use Notes.

I can believe it took a year or three for this to influence the salespeople
whose bonus depended on selling proprietary software.

   Brian

---

From: Hector <[email-masked]>
Date: Sat, 19 Nov 2011 06:50:41 -0500

> whose bonus depended on selling proprietary software.

Keep in mind, globalization played a major role in the changing of 
mindsets.  Also only when the IP issues were better framed (and worked 
out, or even expired), coupled with newer generation input, and 
competition from companies who used OPEN SOURCE as their leverage, but 
still charged big time (for support), where things began to change. 
Many corporations were not LEGALLY allowed to use FREE SOFTWARE or 
SHAREWARE when some why some of the open source licenses are molded 
(free for free business, pay for commercial).

We had the #1 product of the year in 1996 and it all began to change 
with open source market begin to kill the market place for commercial 
vendors. We were little lucky for many reasons to restructure and 
survive, but lost millions in the process.  For new startups, I don't 
think it would of worked for them.  If you already established, then 
you  had a chance.

But honestly, open source is really just a buzz word for "free 
software" as most people still don't need the source code. 
Users/Operators just want it to run and it works for them, thats all 
they need.  But once a problem occurs, its generally the same set 
issues of support requirements.  Sometimes it works out fine, and 
usually in the long run, its all cleaned up. But that too requires a 
changing of user mindset to ACCEPT this slower mode of development, 
fixes, fine tuning, etc.  The "Can't complain too much, its free!" 
syndrome also plays a role. If you are technical person, sometimes you 
can roll up your sleeves and go through what is often a horrendous 
development setup (and quite often comes with a complex web of 
multi-components licensing issues) to fix a piece of code.  That's not 
something every user can do nor most wish to do, so there is still the 
support factor.

Hence there is still a reason business still exist - there is a still 
a market that *wants* to pay you to be on their beck and call.

I recall Ozzie's Notes intro and what got me the most (didn't worry 
about it), was that he immediately targeted the high end with a $50 
per seat cost.  That was definitely not the market we were in and I 
recall thinking how long would Notes would be able to keep that up  in 
the long run.  We had customers who were trained with Notes, then 
moved on their own and started with Notes, only to begin looking at 
other software (like ours). My only recall is the comment that it was 
too slow for processing bulk mail.

Today, in my view, is really has not changed much. The more successful 
Open Source is the canned package ones, the ones that come with an 
installation, the binaries already there, no need to recompile and 
they offer a suite of pay support tiers.  Just look at this threads, 
people still complain and expect the best, easy of install and use.

So in essence, it became like we use to have with ShareWare products - 
download a trial version and/or a low end free Community version too. 
    The only real benefit today is when a problem does arise, the 
better open source has many more developers out there that can provide 
a patch. So in this way, its more agile than a corporate package.  Not 
also the case, it could still take losing a tooth, but today the odds 
are good that by the time you discover a problem, it probably was 
already fixed in version 1.2.3.4.5, snapshot 3.xy3.3.

-- 
Hector Santos
http://www.santronics.com

---

From: Robinson Tryon <[email-masked]>
Date: Mon, 21 Nov 2011 01:40:00 -0500

On Fri, Nov 18, 2011 at 2:03 AM, John Levine <[email-masked]> wrote:
> results through a verifier to see how well they do.

I queried google for "ietf powerpoint presentation" and grabbed the
first 10 results that were powerpoint files (9 ppt, 1 pptx):
www.ietf.org/proceedings/56/slides/pwe3-7/pwe3-7.ppt
tools.ietf.org/agenda/81/slides/tcpm-1.ppt
tools.ietf.org/agenda/81/slides/mpls-12.pptx
tools.ietf.org/agenda/81/slides/tsvwg-9.ppt
www.mnot.net/papers/ietf-49-wrec.ppt
www.mnot.net/papers/ietf-50-webi.ppt
www.softarmor.com/xcon/meets/ietf62/04-xcon-netconf.ppt
www.oasis-open.org/presentations/security/SBradner.ppt
www.cdnc.org/gb/news/download/RFJ47th-IETF.ppt
tools.ietf.org/agenda/81/slides/idr-3.ppt

I used a local build of LibreOffice to open up the files and convert
them to PDF/A-1a, then ran them through a PDF validator
(http://www.pdf-tools.com/pdf/validate-pdfa-online.aspx).

Of the 10 files, all validated successfully except for idr-3.pdf. The
pdf file appears fine, the validator just gives an error about an
unknown 'DCTDecode' filter.

I'm sure that PDF validators aren't perfect, but the quick test seems
to indicate that LibreOffice is pretty good at creating valid PDF/A
output. Because it is free (and Free), and has builds for just about
every platform, LibreOffice could be given to any contributor/author
who asks for help exporting materials to PDF/A.

-- Robinson

---

From: Douglas Otis <[email-masked]>
Date: Mon, 21 Nov 2011 13:59:17 -0800

On 11/17/11 4:14 PM, Randy Bush wrote:
> so where is the web page that tells me for platform x how to convert 
> my generated pdf, which i have been using as the pub format for years, 
> into pdf/a? the link under "Guidelines for Creating Archival Quality 
> PDF Files" is a broken link.
The Florida Center for Library Automation website on the page:
http://fclaweb.fcla.edu/content/pdfa-1

Includes a similar link:
Guidelines for Creating Archival Quality PDF Files
http://fclaweb.fcla.edu/uploads/Lydia%20Motyka/FDA_documentation/PDFGuideline.pdf

Don't expect this link will remain stable either. :^(

-Doug

---

From: Steven Bellovin <[email-masked]>
Date: Mon, 21 Nov 2011 20:32:08 -0500

On Nov 21, 2011, at 4:59 PM, Douglas Otis wrote:

>> so where is the web page that tells me for platform x how to convert my generated pdf, which i have been using as the pub format for years, into pdf/a? the link under "Guidelines for Creating Archival Quality PDF Files" is a broken link.
Also see the NSF's guide to good PDF at
https://www.fastlane.nsf.gov/NSFHelp/flashhelp/fastlane/FastLane_Help/create_pdf_files_introduction.htm
-- it gives LaTeX instructions, too.

		--Steve Bellovin, https://www.cs.columbia.edu/~smb

---

From: Randy Bush <[email-masked]>
Date: Tue, 22 Nov 2011 15:36:49 +0200

>>> my generated pdf, which i have been using as the pub format for
>>> years, into pdf/a? the link under "Guidelines for Creating Archival
>>> Quality PDF Files" is a broken link. 

i am still not seeing "you have a mac and use all the usual stuff that
produces pdf.  to convert that pdf to pdf/a for archival purposes, use
the following app: <https://foo.bar/>."

randy, playing end user

---

From: Robinson Tryon <[email-masked]>
Date: Tue, 22 Nov 2011 10:00:36 -0500

> the following app: <https://foo.bar/>."

I haven't researched the PDF -> PDF/A route yet. It's possible that
some information is lost in the PDF generation step making it harder
to translate from PDF -> PDF/A (a trivial example is a PDF in which a
non-standard font is used but not embedded).

-- Proprietary --
It looks like Adobe Distiller (part of Acrobat) might be able to turn
PDF -> PDF/A (especially if you're doing all of this work on the same
system).

-- FOSS --
If your source document can be read by LibreOffice, use it to generate
PDF/As. That's the simplest FOSS tool I've used so far.

For those willing to roll their sleeves up a little bit, there's
always ghostscript on the command line.

If we take a look at ghostscript, we find this useful information
(http://ghostscript.com/doc/current/Ps2pdf.htm#PDFA).

"To create a PDF/A document, please follow instructions about creating
a PDF/X-3 document, with the following exceptions..."

So the docs at least say that it's possible.

For people who don't want to wrangle on the command-line, there is a
print driver. CUPS-PDF is designed to make it easier for people to
print to pdf on OSX
(http://hints.macworld.com/article.php?story=2007082812233971)

Apparently on OSX, CUPS-PDF uses ps2pdf. I don't have an OSX system
nearby for testing and tweaking, but with a little work, I assume that
one could massage the install process a little bit and make it
possible for a user to simply print to "Local PDF/A Printer" from an
application, and have a nicely compliant PDF/A pdf spit out the other
end.

-- Robinson