Two more Flash 0-days emerge in Hacking Team leak • Hacker News Board

Re: Two more Flash 0-days emerge in Hacking Team leak

#21

Post by hkmix » Sun, Jul 12, 2015, 5:01 PM UTC

toja92 wrote: post #18

archgoon wrote: post #15

Earlier quoted context omitted.

Facebook's inline video player uses it. On linux, I get a popup saying that I must install Flash.

In Safari on OS X, Facebook does use the native player. I'm guessing that Facebook encodes video h264 which isn't natively supported in Firefox; rather it relies on support in the operating system. I'm not sure if Chrome on Linux supports h264, however since Chrome also includes its own Flash player I guess that Facebook may be using their own flash player anyway.

Pretty sure there are some settings you need to enable in about:config to get H264 working in Firefox (assuming you have the right gstreamer stuff installed).

Re: Two more Flash 0-days emerge in Hacking Team leak

#22

Post by joosters » Sun, Jul 12, 2015, 5:01 PM UTC

ghshephard wrote: post #8

bohm wrote: post #4

guess it's time to disable flash for a few weeks...

A significant portion of the web using community (including myself) stopped using flash 6-12 months ago, when all the zero-days became a monthly occurrence. The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching. I have not once every missed having flash on my system. It's not just the case that the web is…

The BBC site will use non-flash videos if you browse it on an iPad, but they don't seem smart enough to serve these to you if you use a desktop browser with flash disabled.

Presumably they could implement a non-flash fallback for users but unfortunately they just haven't bothered.

I tried to cheat by modifying my User-Agent to pretend to be an iPad but had no luck...

Re: Two more Flash 0-days emerge in Hacking Team leak

#23

Post by sobkas » Sun, Jul 12, 2015, 5:03 PM UTC

I would like to hear what Adobe have to say about their streak of serious security problems. Not only that, but they should face some consequences for that neglect. At least be forced to publish a working spec for Flash.

Re: Two more Flash 0-days emerge in Hacking Team leak

#24

Post by MatthiasP » Sun, Jul 12, 2015, 5:05 PM UTC

steckerbrett wrote: post #11

dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

What websites use it? I've not encountered a single incompatible website recently, and haven't had flash installed for a long time now.

twitch.tv

Re: Two more Flash 0-days emerge in Hacking Team leak

#25

Post by steveax » Sun, Jul 12, 2015, 5:06 PM UTC

therealmarv wrote: post #17

Is there any Flash security bug recently which makes it outside the Chrome sandbox?

Yep, the one that became public 5 days ago [1]

[1]: https://krebsonsecurity.com/2015/07/adobe-to-patch-hacking-t...

Re: Two more Flash 0-days emerge in Hacking Team leak

#26

Post by dhimes » Sun, Jul 12, 2015, 5:08 PM UTC

ghshephard wrote: post #8

bohm wrote: post #4

guess it's time to disable flash for a few weeks...

A significant portion of the web using community (including myself) stopped using flash 6-12 months ago, when all the zero-days became a monthly occurrence. The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching. I have not once every missed having flash on my system. It's not just the case that the web is…

I'm on some troubleshooting pages for canon that require flash. Seems they are in the process- as there are html 5 vids on the site as well.

Re: Two more Flash 0-days emerge in Hacking Team leak

#27

Post by nitrogen » Sun, Jul 12, 2015, 5:09 PM UTC

hkmix wrote: post #21

toja92 wrote: post #18

Earlier quoted context omitted.

In Safari on OS X, Facebook does use the native player. I'm guessing that Facebook encodes video h264 which isn't natively supported in Firefox; rather it relies on support in the operating system. I'm not sure if Chrome on Linux supports h264, however since Chrome also includes its own Flash player I guess that Facebook may be using their own flash player anyway.

Pretty sure there are some settings you need to enable in about:config to get H264 working in Firefox (assuming you have the right gstreamer stuff installed).

Firefox can also install the free Cisco h.264 codec.

Re: Two more Flash 0-days emerge in Hacking Team leak

#28

Post by Kliment » Sun, Jul 12, 2015, 5:10 PM UTC

steckerbrett wrote: post #11

dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

What websites use it? I've not encountered a single incompatible website recently, and haven't had flash installed for a long time now.

BBC iPlayer is flash-only

Re: Two more Flash 0-days emerge in Hacking Team leak

#29

Post by chinathrow » Sun, Jul 12, 2015, 5:11 PM UTC

bohm wrote: post #4

guess it's time to disable flash for a few weeks...

No, it's time to uninstall all plugins for good.

Re: Two more Flash 0-days emerge in Hacking Team leak

#30

Post by Redoubts » Sun, Jul 12, 2015, 5:13 PM UTC

steckerbrett wrote: post #11

dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

What websites use it? I've not encountered a single incompatible website recently, and haven't had flash installed for a long time now.

HBO Go