151–160 of 193 posts
Earlier quoted context omitted.
Macromedia/Adobe has had 15 years to respond to the news that Internet security matters. 15 years.
15 years ago a pretty sizable chunk of the industry thought heap overflows weren't exploitable for code execution, so I don't think that's the right interval.
Earlier quoted context omitted.
Most software that's as complex as Flash is probably similarly full of bugs. Most of those vulnerabilities reek of huge development teams toiling over a codebase whose foundation was written in the late 90s and had features and fixes duct taped ever since.
Do Chrome and Safari have as bad a track record? Flash has been insecure since originally launched.
This is important because Microsoft seems to use a lot of Flash advertisements without checking them (I've had plenty of "MICROSOFT VERIFIED DRIVER FIXING" ads come up inside of Skype, so I'm sure some zero day could slip though their ad system)
Earlier quoted context omitted.
Twitch without Flash has been available for a while now, if you were willing to use VLC + an IRC client. Twitch HTML5 chat went live on June 30th, HLS was prior to that. I'd say they're open to ditching Flash.
Is there a nice way to get the stream to open in VLC?
Flash is decades old, not that big, and still has use-after-free vulnerabilities? Tools for catching those have been widely available for years. That makes one suspect those vulnerabilities aren't there by accident. We need public disclosure of the code check-in that created the bug, with names. People need to be fired for this.
Work on a massive decades old software project and get ready to have your eyes opened. All the automated static and dynamic software analyzers catch only the easiest flaws, but can catch the more serious ones only if you're skilled and lucky. Firing people for software bugs is the stupidest thing I've heard in a while. Everyone writes horrific software flaws. Everyone. The best of the best programmers just write less…
In a 64-bit environment, at least for development purposes, why can't every single malloc() cause an allocation from new memory page(s)? Then free() removes the page(s) from accessible virtual memory.
Too much overhead for production, but it would sure catch a lot of use-after-free bugs during development. Is nobody doing something like that, or is that part of what you consider "the easiest flaws"?
Important PSA for Skype Users: Open up "Internet Options" (yes, the ones in internet explorer), security tab, and add https://apps.skype.com to the "Restricted Sites" list. Skype will still work fine, however there will be no advertisements. This is important because Microsoft seems to use a lot of Flash advertisements without checking them (I've had plenty of "MICROSOFT VERIFIED DRIVER FIXING" ads come up inside of…
Earlier quoted context omitted.
Do Chrome and Safari have as bad a track record? Flash has been insecure since originally launched.
In a way, yes, they do. Chrome pushes out a dozen or more fixes for remotely exploitable vulnerabilities every 2 weeks.
Compare FF, Safari, IE, Chrome. Same number of bugs per yet but Chrome has 10x less code execution bugs (ie, 10x less likely for your machine to be owned by unknown bugs)
Important PSA for Skype Users: Open up "Internet Options" (yes, the ones in internet explorer), security tab, and add https://apps.skype.com to the "Restricted Sites" list. Skype will still work fine, however there will be no advertisements. This is important because Microsoft seems to use a lot of Flash advertisements without checking them (I've had plenty of "MICROSOFT VERIFIED DRIVER FIXING" ads come up inside of…
Skype on Windows has ads? Is that a recent thing? The Mac version doesn't, or not yet, anyway.
Earlier quoted context omitted.
In essence there are not critical US systems running on Flash and so the defensive side of NSA don't care. And the offensive side is just happy to let it rot, as that means more opportunities for them.
The thorn in the side of removing Flash has been VMware, who, in their latest vSphere 6 release, clearly made the point that "Flash is the future", with announcements towards deprecating their alternative clients. I don't understand what they are thinking - it used to be such a progressive company. I don't know about US Government, but many Governments and sensitive organisations are still using VMware, and this isn'…
Important PSA for Skype Users: Open up "Internet Options" (yes, the ones in internet explorer), security tab, and add https://apps.skype.com to the "Restricted Sites" list. Skype will still work fine, however there will be no advertisements. This is important because Microsoft seems to use a lot of Flash advertisements without checking them (I've had plenty of "MICROSOFT VERIFIED DRIVER FIXING" ads come up inside of…
