Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two more Flash 0-days emerge in Hacking Team leak

theregister.co.uk

Post reply on HN
Print view View original

71–80 of 193 posts

Re: Two more Flash 0-days emerge in Hacking Team leak

#71

Post by darklajid »

tl wrote: post #46
darklajid wrote: post #35

Earlier quoted context omitted.

Twitch. Which happens to amuse me, which I like to waste time. But .. they seem unwilling to move away from Flash (the only thing I found was a ~3 year old support thread that wants to .. support HLS. Yay. Not that's not helpful)

Twitch without Flash has been available for a while now, if you were willing to use VLC + an IRC client. Twitch HTML5 chat went live on June 30th, HLS was prior to that. I'd say they're open to ditching Flash.

VLC for HLS I assume (and I only stumbled upon the '/hls' suffix for any url to support that by accident/in that ticket, which still doesn't seem to be officially closed).

IRC for chat is absolutely new to me and would actually be quite nice..

Re: Two more Flash 0-days emerge in Hacking Team leak

#72

Post by darklajid »

DavideNL wrote: post #67
sobkas wrote: post #31

Earlier quoted context omitted.

You can play streams with: livestreamer http://docs.livestreamer.io/ And chat trough their irc server.

I don't think that's needed, i'm looking at Twitch right now (via the normal way) - and i don't have Flash installed.

On an iOS or Apple device?

Re: Two more Flash 0-days emerge in Hacking Team leak

#73

Post by DavideNL »

curiousjorge wrote: post #33

does Chrome and Firefox automatically update the Flash? I can't turn it off because...well lot of video sites made for men that are not Youtube or Twitch but more popular than Vimeo ever will be, requires flash.

Google Chrome - yes, it has Flash built-in.

Firefox - "no", it doesn't have Flash built-in but uses Flash installed in the operating system. However, Flash installed separately for example in Windows/OS X also updates itself.

However, you are screwed either way: always running the latest Flash player version which is known to be constantly full of security bugs, just like in the past 3 years... :)

Re: Two more Flash 0-days emerge in Hacking Team leak

#74

Post by sethd »

dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

I can think of one use case where Flash still makes sense: Live video

A lot of people seemed to be surprised this is the case but tell me what single live streaming protocol is supported across all browsers without a plugin?

With Flash you can stream HLS (HTTP Live Streaming) to a Flash player in full browsers while just directly loading the same HLS playlist in mobile browsers via native players (iOS / Android).

This means you can deliver live streaming over the same audio/video codec (H.264/AAC) and over the same protocol (HLS). This vastly simplifies your streaming infrastructure and removes the need for transcoding on the server, unless you just want to create different qualities for adaptive bitrate streaming.

It would be nice if "desktop" browsers all supported HLS and H.264/AAC natively, that would be a real Flash killer.

Re: Two more Flash 0-days emerge in Hacking Team leak

#76

Post by DavideNL »

sobkas wrote: post #23

I would like to hear what Adobe have to say about their streak of serious security problems. Not only that, but they should face some consequences for that neglect. At least be forced to publish a working spec for Flash.

i'm not sure if it's relevant whatever they'd have to say.

Just look at the news for the past years and there's only 1 conclusion: uninstall Flash or accept increased risk of catching a virus.

Re: Two more Flash 0-days emerge in Hacking Team leak

#77

Post by ran290 »

feld wrote: post #51
dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

Ubiquiti products require it for some functionality, and they're wildly popular for Wifi and wireless ISPs right now. I actually just filed a complaint on their forums. http://community.ubnt.com/t5/UniFi-Wireless/BUG-Adobe-Flash-...

Their latest controller (v4?) removed the Flash requirement for both video (playback) and main (maps) IIRC. Do they still have leftover areas that require Flash?

Re: Two more Flash 0-days emerge in Hacking Team leak

#78

Post by al2o3cr »

dguido wrote: post #66
sobkas wrote: post #23

I would like to hear what Adobe have to say about their streak of serious security problems. Not only that, but they should face some consequences for that neglect. At least be forced to publish a working spec for Flash.

You think that any other software you use is any better? Flash gets it rough because it's widely used and independent of the browser (for the most part). If you're running an update to date flash, that means you're probably running it in a sandbox and probably have silent auto updates turned on. That's good enough for most people. If you're the kind of person that's going to get specifically targeted, then you should…

"You think that any other software you use is any better?"

I certainly HOPE most software I use can do better than this: http://www.cvedetails.com/vulnerability-list/vendor_id-53/pr...

To be certain, Flash gets a lot of attention because of its install base - but it's been a never-ending FOUNTAIN of RCE bugs for much of the last decade.

Re: Two more Flash 0-days emerge in Hacking Team leak

#79

Post by Scarbutt »

feld wrote: post #51
dhimes wrote: post #6

Serious question: why are people still using Flash? I'm surprised by the number of websites that use it.

Ubiquiti products require it for some functionality, and they're wildly popular for Wifi and wireless ISPs right now. I actually just filed a complaint on their forums. http://community.ubnt.com/t5/UniFi-Wireless/BUG-Adobe-Flash-...

What ubnt products require flash? airOS works fine for me without flash.

Re: Two more Flash 0-days emerge in Hacking Team leak

#80

Post by cormullion »

joosters wrote: post #22
ghshephard wrote: post #8

Earlier quoted context omitted.

A significant portion of the web using community (including myself) stopped using flash 6-12 months ago, when all the zero-days became a monthly occurrence. The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching. I have not once every missed having flash on my system. It's not just the case that the web is…

The BBC site will use non-flash videos if you browse it on an iPad, but they don't seem smart enough to serve these to you if you use a desktop browser with flash disabled. Presumably they could implement a non-flash fallback for users but unfortunately they just haven't bothered. I tried to cheat by modifying my User-Agent to pretend to be an iPad but had no luck...

I was going to agree with you, but I've just double-checked, and you CAN access video content on the BBC sites on a desktop (MacOS X Safari) by setting your User-Agent to iPad. However, it's important that you've removed Flash completely from your system (using Flash Uninstaller), rather than just disable Flash (hoping to use Click-To-Flash). For some reason, they detect Flash by some kind of file-path-detection code...
Post reply on HN