Live data from Hacker News

Two more Flash 0-days emerge in Hacking Team leak

theregister.co.uk

41–50 of 193 posts

Re: Two more Flash 0-days emerge in Hacking Team leak

#41
post #5
post #2

Hacking Team developed digital smallpox, and failed to safeguard it. Thanks.

I'm as grossed out by HT as the next message board nerd, but they didn't develop these bugs; modern industrial software development did. All HT did was weaponize them. These guys aren't the sharpest tools in the shed, so I think you can safely assume other people weaponized these, or worse bugs, as well.

[deleted]

Re: Two more Flash 0-days emerge in Hacking Team leak

#42
post #9
post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

A lot of advertising networks use it to deliver advertisements. Whether it is simple inertia at this point, or because the networks can get a better fingerprint using flash, I don't know. Also, it used to be the case that Flash had better DRM controls on it, but I'm pretty sure that reason is no longer the case since Encrypted Media Extensions got rolled out. However, that doesn't explain why Facebook's on-site video…

Facebook appears to have moved to an html player in the last few days.

Re: Two more Flash 0-days emerge in Hacking Team leak

#43
post #23

I would like to hear what Adobe have to say about their streak of serious security problems. Not only that, but they should face some consequences for that neglect. At least be forced to publish a working spec for Flash.

If they say much of anything, they will probably just reiterate that they take security very seriously.

Re: Two more Flash 0-days emerge in Hacking Team leak

#46
post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

Twitch. Which happens to amuse me, which I like to waste time. But .. they seem unwilling to move away from Flash (the only thing I found was a ~3 year old support thread that wants to .. support HLS. Yay. Not that's not helpful)

Twitch without Flash has been available for a while now, if you were willing to use VLC + an IRC client. Twitch HTML5 chat went live on June 30th, HLS was prior to that.

I'd say they're open to ditching Flash.

Re: Two more Flash 0-days emerge in Hacking Team leak

#47
post #4

guess it's time to disable flash for a few weeks...

A significant portion of the web using community (including myself) stopped using flash 6-12 months ago, when all the zero-days became a monthly occurrence. The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching. I have not once every missed having flash on my system. It's not just the case that the web is…

> The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching.

[citation needed]

Re: Two more Flash 0-days emerge in Hacking Team leak

#48
post #45
post #3

And this is just one non-governmental setup's arsenal.

The good part is that this removes the same vulnerability for everyone.

My point, though, is that if a random Italian consultancy can amass multiple Flash 0-days, the folks at the NSA with the $10+ billion budget probably have an essentially endless supply of them (not to mention exploits for other software) at the ready.

Re: Two more Flash 0-days emerge in Hacking Team leak

#49
post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

Twitch. Which happens to amuse me, which I like to waste time. But .. they seem unwilling to move away from Flash (the only thing I found was a ~3 year old support thread that wants to .. support HLS. Yay. Not that's not helpful)

Twitch works just fine with HTML5 these days, including chat.

Re: Two more Flash 0-days emerge in Hacking Team leak

#50
post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

YouTube's Flash player still works a lot better than the HTML5 one. Their HTML5 one desynchs the audio occasionally, cuts off the audio before the video ends, doesn't support a real right click -> copy video URL (all it can do is give a popup with the URL), and still has other small bugs. The Flash one has none of these problems. It seems to be the case in general for most sites that offer HTML5 alternatives that the…

The HTML5 video in iOS is rock solid (Safari/Chrome on iOS). The Chrome/Firefox/IE HTML5 video implementations could be a bit better (in comparison).
Post reply on HN