Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google releases a fix for flash, before Adobe

securitywatch.pcmag.com

Post reply on HN
Print view View original

21–30 of 32 posts

Re: Google releases a fix for flash, before Adobe

#21

Post by nextparadigms »

raganwald wrote: post #6

So is the argument that Google should leave the vulnerability unpatched in its own browser until Adobe get around to patching it in their plugin for other browsers, so as not to publicize the existence of a vulnerability? What if they have detected black hats exploiting the vulnerability. Should they sit on a fix? What if they were building their own implementation of a programming language or tool. For example, what…

This is why it's bad having a cross-platform technology that is proprietary. It's too much to handle for a single company and make it work right on all platforms. When it's open-source, there can be at least one company with its own implementation on each platform, and get it to work right because they have less to handle.

Re: Google releases a fix for flash, before Adobe

#23

Post by fjarlq »

potatolicious wrote: post #20

What BS: > "Even Google isn't well-served by this; not everyone updates their Chrome version immediately, especially updates like this one which require that you restart the browser (and all running browser instances)." Protip: Updating Flash requires the same thing. In fact, updating Flash will shut down all kinds of apps you have running, including all Flash-capable browsers and even some Flash-reliant native apps.

I think you missed the point.

There's potentially a multi-day window of opportunity for Chrome to get hacked, because the malware authors can release new exploits before everybody gets around to restarting their Chrome to pick up the patched version.

So malware authors learn about the new Flash security bug thanks to Google's aggressive patching, and then have perhaps days to exploit it before people get around to restarting Chrome and before Adobe gets around to pushing out a new Flash update.

So Google is aggressive about releasing critical patches, but Chrome is lazy about restarting to receive critical patches.

Not sure what the best way to handle that would be. I would certainly like to receive the patch ASAP. For critical updates Chrome should alert the user with a dialog like "it's critical that Chrome restarts now to keep you protected". For people like me who leave their Chrome running for days at a time, that feature could make all the difference. I might even prefer an option to automatically restart my Chrome to get critical updates.

Re: Google releases a fix for flash, before Adobe

#24

Post by cpeterso »

cultureulterior wrote: post #17
cpeterso wrote: post #8

Earlier quoted context omitted.

> its still by far the single most installed desktop runtime. Flash is likely the single most installed software in the world. Consider how many Windows, Mac, and Linux desktops and Android devices have Flash.

I wonder how it compares with webkit? There's android, iphone, RIM, and chrome.

I think Flash would still outnumber WebKit. Flash is bundled with the Chrome browser, many (all?) Android devices, the RIM PlayBook (but not BlackBerries, AFAIK), webOS phones and tablet. Mac OS X used to bundle Flash, but new Macs do not. Windows has bundled Flash for a long time; I'm not sure if it still does.

For now, the number of Windows PCs worldwide is probably larger the the number of iOS devices, new Macs (if the user hasn't installed Flash to watch YouTube), and RIM BlackBerries. But Apple is selling a LOT of iOS devices, so the balance may shift.

Re: Google releases a fix for flash, before Adobe

#25

Post by trotsky »

If it's a zero day vulnerability then the method to exploit it is already in the wild. Anyway, if this is anything like some of the previous vulnerabilities that chrome patched a few days before Adobe, it's just a case of Adobe's code going through a faster SQA process at google than it does at Adobe. Adobe obviously doesn't have a problem with the practice, so why should PC mag?

Re: Google releases a fix for flash, before Adobe

#26

Post by Volpe »

fjarlq wrote: post #23
potatolicious wrote: post #20

What BS: > "Even Google isn't well-served by this; not everyone updates their Chrome version immediately, especially updates like this one which require that you restart the browser (and all running browser instances)." Protip: Updating Flash requires the same thing. In fact, updating Flash will shut down all kinds of apps you have running, including all Flash-capable browsers and even some Flash-reliant native apps.

I think you missed the point. There's potentially a multi-day window of opportunity for Chrome to get hacked, because the malware authors can release new exploits before everybody gets around to restarting their Chrome to pick up the patched version. So malware authors learn about the new Flash security bug thanks to Google's aggressive patching, and then have perhaps days to exploit it before people get around to re…

How is that any different to Adobe releasing a patch? Chrome updates a darn site more often than Adobe products do. So surely this is a problem regardless who releases?

Re: Google releases a fix for flash, before Adobe

#27

Post by fjarlq »

Volpe wrote: post #26
fjarlq wrote: post #23

Earlier quoted context omitted.

I think you missed the point. There's potentially a multi-day window of opportunity for Chrome to get hacked, because the malware authors can release new exploits before everybody gets around to restarting their Chrome to pick up the patched version. So malware authors learn about the new Flash security bug thanks to Google's aggressive patching, and then have perhaps days to exploit it before people get around to re…

How is that any different to Adobe releasing a patch? Chrome updates a darn site more often than Adobe products do. So surely this is a problem regardless who releases?

Aren't Adobe's patches pushed to everybody and installed immediately upon reception? Without waiting for the user to manually accept or restart, I mean. I don't know for sure.

I think it's safe to say that Flash is buggy as hell, and we would all benefit from the immediate installation of critical patches. I don't think Chrome is doing this yet.

Re: Google releases a fix for flash, before Adobe

#28

Post by potatolicious »

fjarlq wrote: post #27
Volpe wrote: post #26

Earlier quoted context omitted.

How is that any different to Adobe releasing a patch? Chrome updates a darn site more often than Adobe products do. So surely this is a problem regardless who releases?

Aren't Adobe's patches pushed to everybody and installed immediately upon reception? Without waiting for the user to manually accept or restart, I mean. I don't know for sure. I think it's safe to say that Flash is buggy as hell, and we would all benefit from the immediate installation of critical patches. I don't think Chrome is doing this yet.

No, they aren't, that's my point. Neither Chrome nor Flash can expect patch pickup in the order of days - in fact, Flash updates (on Windows and OSX at least) require user intervention, whereas Chrome will do it at browser restart.

One of these is much more likely to occur than the other.

In any case, Chrome's update mechanism promises to get more users patched, quicker, than Flash. Waiting for Flash is nonsensical.

Re: Google releases a fix for flash, before Adobe

#29

Post by tptacek »

potatolicious wrote: post #28
fjarlq wrote: post #27

Earlier quoted context omitted.

Aren't Adobe's patches pushed to everybody and installed immediately upon reception? Without waiting for the user to manually accept or restart, I mean. I don't know for sure. I think it's safe to say that Flash is buggy as hell, and we would all benefit from the immediate installation of critical patches. I don't think Chrome is doing this yet.

No, they aren't, that's my point. Neither Chrome nor Flash can expect patch pickup in the order of days - in fact, Flash updates (on Windows and OSX at least) require user intervention, whereas Chrome will do it at browser restart. One of these is much more likely to occur than the other. In any case, Chrome's update mechanism promises to get more users patched, quicker, than Flash. Waiting for Flash is nonsensical.

I don't think "nonsensical" is the word you want to use here. The majority of the world's susceptible Flash users are not running Chrome. You can reasonably assert that it's not Google's problem that their patch discloses the flaw without providing those people with a usable recourse from it, but it's harder to assert that it's not a problem at all.

Re: Google releases a fix for flash, before Adobe

#30

Post by fjarlq »

potatolicious wrote: post #28
fjarlq wrote: post #27

Earlier quoted context omitted.

Aren't Adobe's patches pushed to everybody and installed immediately upon reception? Without waiting for the user to manually accept or restart, I mean. I don't know for sure. I think it's safe to say that Flash is buggy as hell, and we would all benefit from the immediate installation of critical patches. I don't think Chrome is doing this yet.

No, they aren't, that's my point. Neither Chrome nor Flash can expect patch pickup in the order of days - in fact, Flash updates (on Windows and OSX at least) require user intervention, whereas Chrome will do it at browser restart. One of these is much more likely to occur than the other. In any case, Chrome's update mechanism promises to get more users patched, quicker, than Flash. Waiting for Flash is nonsensical.

My point is when there's a critical Flash update, Chrome doesn't notify me ASAP. So my Chrome might be open for days with a vulnerable Flash without me knowing that it's time to restart. This is why I check About Chrome almost daily (kind of an annoying obsession).

By comparison, on Windows and OSX when there's a Flash update, the user will be notified when the update arrives.

So Chrome delivers the Flash patch really fast, but then doesn't notify users that they need to get it.

And Adobe and Apple deliver the Flash patch slowly, but the user is notified.

Neither of these situations is ideal. What I want is fast arrival of the patch, plus notification. I guess I will look for a Chrome bug on this.

Post reply on HN