Flash's 11th security hole of 2015:
https://helpx.adobe.com/security/products/flash-player.html
Flash is and always has been an absolute joke, I refuse to install it on anything I own.
Adobe issues emergency Flash fix
21–30 of 45 posts
Re: Adobe issues emergency Flash fix
#22Chrome really needs to stop bundling this garbage. Even with whatever Google magic attached to flash, its still a very dangerous plugin, if not the most dangerous. There was just a CVE for the version previous to this one. And the one before that. Its an endless treadmill. This should be a wake-up call to make flash non-default and, if installed, click-to-play only. Its time we started treating it like Java. Like Jav…
Java Applets a bigger malware attack vector than IE / ActiveX ?
Additionally, it was Flash that was compromised, not Pepper. There's a distinction.
Re: Adobe issues emergency Flash fix
#23Love how this is posted tut-tuttingly on the BBC's website -- which went from Real Player to Flash to -- eventually -- mp4 video, but only as a last resort. (Motto: "as a public entity we've never found a proprietary format we don't love".) Indeed, I had a Realplayer One "subscription" that took me something like a year to shut off (they'd claim it was off and then keep sucking money out of my account) which I blame entirely on the BBC.
Re: Adobe issues emergency Flash fix
#24Earlier quoted context omitted.
So Chrome has their own flash written by engineers at Google?
Sort of. http://www.pcworld.com/article/250455/for_flash_on_linux_chr... > Adobe and Google have now created a “Pepper” implementation of Flash Player for all x86/64 platforms supported by the Google Chrome browser, Adobe said.
To clarify, Pepper is not a rewrite of Flash. It's a browser plugin sandbox API.
Re: Adobe issues emergency Flash fix
#25Love how this is posted tut-tuttingly on the BBC's website -- which went from Real Player to Flash to -- eventually -- mp4 video, but only as a last resort. (Motto: "as a public entity we've never found a proprietary format we don't love".) Indeed, I had a Realplayer One "subscription" that took me something like a year to shut off (they'd claim it was off and then keep sucking money out of my account) which I blame…
Playing devil's advocate a little: But a lot of this was down to which streaming format their media partners would sign off on (they wanted certain DRM guarantees).
Real Player was the market leader in DRM-ed video, until Flash improved and took over.
Re: Adobe issues emergency Flash fix
#26Earlier quoted context omitted.
Flash will get a second life with WebAssembly.
If it lives on in an unbreakable, throttleable sandbox, that's not a disaster. It was the leaky native code that was the problem.
My point exactly,Flash(the IDE) isn't a bad thing if it allows artists to create interactive experiences or games on the web,desktop or mobile.
The issue is obviously the Flash player and the browser plugin architecture. With WebAssembly you get the "binary blob" executed without a plugin.
Re: Adobe issues emergency Flash fix
#27If you don't have Click-to-play enabled for Firefox, you should, and here's how you do it: Open Firefox and navigate to about:config. You will be sarcastically warned that you about to void your warranty, just click on the “I’ll be careful, I promise!” button to move on. Now search for: plugins.click_to_play Next you need to right-click and toggle the setting so that the value is true. Once you are done restart Firef…
Here's the Chrome guide:
- Open Settings
- Show Advanced Settings (bottom)
- Content Settings (under Privacy)
- Plugins -> "Let me choose when to run content."
- It will now be click-to-play and enable a icon like the pop-up blocker in the address back to enable all on a page or to whitelist the page.
- You can also whitelist from the settings page by clicking Manage Exceptions, and adding them like this: [*.]youtube.com (all sub-domains, and protocols on youtube.com)
Re: Adobe issues emergency Flash fix
#28I uninstalled Flash a few months ago and don't miss it. I mostly use Firefox, but I do keep Chrome around, so I could use Chrome's Flash if I wanted to, but I don't think I have so far. The only site I commonly visit that doesn't work is BBC News, funnily enough. It's a little annoying because it will work if I change the user agent to iPad, but instead I just don't watch BBC News videos.
So Chrome has their own flash written by engineers at Google?
Google has what's called Pepperflash, which is just the flash executable in a sandbox, similar to what IE8+ has been doing with sandboxing on Vista and newer OS's. Both browsers are incapable of stopping many attacks with their various sandboxing techniques. Flash is just too poorly written and can't be too deeply sandboxed probably because of all the things it needs to do (directly access video drivers, directly access microphones, etc).
Re: Adobe issues emergency Flash fix
#29Earlier quoted context omitted.
The BBC is blog spam? Or did the mods change the link without telling us?
The BBC is blog spam yes. It quotes Kreb's article, which happens to be almost exactly the same, except BBC removed links to the advisory, etc. Edit: in response to TazeTSchnitzel to whom I cannot reply. If BBC included a link to the original post or the actual security advisory I would be less likely to call it blog spam, but I stand by my classification. It is a repost without the sources and with less information…
> in response to TazeTSchnitzel to whom I cannot reply
If you ever cannot reply to a post try clicking the "X minutes ago" link and usually the reply link will then show.
Re: Adobe issues emergency Flash fix
#30Love how this is posted tut-tuttingly on the BBC's website -- which went from Real Player to Flash to -- eventually -- mp4 video, but only as a last resort. (Motto: "as a public entity we've never found a proprietary format we don't love".) Indeed, I had a Realplayer One "subscription" that took me something like a year to shut off (they'd claim it was off and then keep sucking money out of my account) which I blame…
Playing devil's advocate a little: But a lot of this was down to which streaming format their media partners would sign off on (they wanted certain DRM guarantees). Real Player was the market leader in DRM-ed video, until Flash improved and took over.
Agreed, Flash is great for multimedia. That is largely why it is still so widely used. I just don't prefer it over security which is why it is blocked for me by default ;)