Two more Flash 0-days emerge in Hacking Team leak

I'm as grossed out by HT as the next message board nerd, but they didn't develop these bugs; modern industrial software development did. All HT did was weaponize them. These guys aren't the sharpest tools in the shed, so I think you can safely assume other people weaponized these, or worse bugs, as well.

Re: Two more Flash 0-days emerge in Hacking Team leak

#6

Post by dhimes » Sun, Jul 12, 2015, 4:38 PM UTC

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

Re: Two more Flash 0-days emerge in Hacking Team leak

#7

Post by a3n » Sun, Jul 12, 2015, 4:40 PM UTC

tptacek wrote: post #5

a3n wrote: post #2

Hacking Team developed digital smallpox, and failed to safeguard it. Thanks.

I'm as grossed out by HT as the next message board nerd, but they didn't develop these bugs; modern industrial software development did. All HT did was weaponize them. These guys aren't the sharpest tools in the shed, so I think you can safely assume other people weaponized these, or worse bugs, as well.

OK, point taken. But they had them in the lab, did not safeguard them properly (by demonstration), and deserve a shit ton of blame and scorn.

Re: Two more Flash 0-days emerge in Hacking Team leak

#8

Post by ghshephard » Sun, Jul 12, 2015, 4:41 PM UTC

bohm wrote: post #4

guess it's time to disable flash for a few weeks...

A significant portion of the web using community (including myself) stopped using flash 6-12 months ago, when all the zero-days became a monthly occurrence. The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching.

I have not once every missed having flash on my system. It's not just the case that the web is useable, it's that, with the single exception of the BBC, it doesn't seem to use it anywhere I visit.

Re: Two more Flash 0-days emerge in Hacking Team leak

#9

Post by archgoon » Sun, Jul 12, 2015, 4:42 PM UTC

dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

A lot of advertising networks use it to deliver advertisements. Whether it is simple inertia at this point, or because the networks can get a better fingerprint using flash, I don't know.

Also, it used to be the case that Flash had better DRM controls on it, but I'm pretty sure that reason is no longer the case since Encrypted Media Extensions got rolled out.

However, that doesn't explain why Facebook's on-site video player uses Flash.

Re: Two more Flash 0-days emerge in Hacking Team leak

#10

Post by sebcat » Sun, Jul 12, 2015, 4:42 PM UTC

bohm wrote: post #4

guess it's time to disable flash for a few weeks...

I've been running without Flash for a couple of years now. The only thing I can't do that I would like to be able to do is to watch Facebook videos. Other than that, not having Flash installed is not a problem for me.