Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two more Flash 0-days emerge in Hacking Team leak

theregister.co.uk

Post reply on HN
Print view View original

161–170 of 193 posts

Re: Two more Flash 0-days emerge in Hacking Team leak

#161

Post by dguido »

greggman wrote: post #157
dguido wrote: post #152

Earlier quoted context omitted.

In a way, yes, they do. Chrome pushes out a dozen or more fixes for remotely exploitable vulnerabilities every 2 weeks.

No they don't. Chrome is designed from the ground up for security. It has the same number of bugs as other software of it's size but the type of bugs are much less severe. Compare FF, Safari, IE, Chrome. Same number of bugs per yet but Chrome has 10x less code execution bugs (ie, 10x less likely for your machine to be owned by unknown bugs) http://i.imgur.com/rVgu7Fs.png

The chart you just linked (which doesn't show a timescale) shows Chrome with over 300 exploitable bugs. I doubt the denial of service label, that just usually means that a bug wasn't fully investigated. So, again, how is this different from Flash? Chrome is riddled with vulnerabilities (and Safari is too).

Flash runs in a low-priv environment is nearly every major browser, includes application-specific exploit mitigations, and it silently auto-updates, just like Chrome. It's all a matter of the Flash install base: it's in 90%+ of browsers and it's running the same-ish codebase in all of them, making it a relatively stable platform to develop exploits for. That's it! It's more a factor of market share and not "security."

Every document reader, HTML renderer, JavaScript engine, browser, media player, etc that you use is the same -- a house of cards built on poor memory management :-/.

Re: Two more Flash 0-days emerge in Hacking Team leak

#162

Post by frankzinger »

dguido wrote: post #161
greggman wrote: post #157

Earlier quoted context omitted.

No they don't. Chrome is designed from the ground up for security. It has the same number of bugs as other software of it's size but the type of bugs are much less severe. Compare FF, Safari, IE, Chrome. Same number of bugs per yet but Chrome has 10x less code execution bugs (ie, 10x less likely for your machine to be owned by unknown bugs) http://i.imgur.com/rVgu7Fs.png

The chart you just linked (which doesn't show a timescale) shows Chrome with over 300 exploitable bugs. I doubt the denial of service label, that just usually means that a bug wasn't fully investigated. So, again, how is this different from Flash? Chrome is riddled with vulnerabilities (and Safari is too). Flash runs in a low-priv environment is nearly every major browser, includes application-specific exploit mitiga…

  > Chrome pushes out a dozen or more fixes
  > for remotely exploitable vulnerabilities
  > every 2 weeks.
That equates to 288 remotely exploitable vulnerabilities in Chrome per year.

Here is a chart from the same source with a timeline of sorts: http://www.cvedetails.com/product/15031/Google-Chrome.html?v...

Your statement about Chrome is clearly way off, and that's what your parent was addressing. He never said Chrome was bug-free. And he was right to say that Chrome is way ahead of the other browsers (according to these stats, at least).

Edit: those stats show Chrome is better in terms of CVE severity, not number of annual CVEs.

Re: Two more Flash 0-days emerge in Hacking Team leak

#164

Post by ild »

bitmapbrother wrote: post #148
eridius wrote: post #126

Earlier quoted context omitted.

Are you sure you're actually using the HTML5 player? I am being 100% serious when I say I've never met someone before who thinks YouTube's HTML5 player is good. Among the various issues I've seen: * Sometimes refuses to play anything, without showing any errors, requiring a reload of the page. * Occasional poor performance. * Audio/video desynchronization * Scrubbing the video often causes it to get stuck, refusing t…

Yes, I'm using the HTML5 player. This is easily verified by clicking the right mouse button on the video and seeing the HTML5 context menu. I have no problems with it at all and it's easily superior to the Flash player in performance and resource usage. It also seamlessly plays 1080p 60FPS video without any issues. As for the issues you're experiencing - are you sure you have GPU acceleration turned on? I'm using Chr…

> and it's easily superior to the Flash player in performance and resource usage.

Not on older (3y+) machines.

Re: Two more Flash 0-days emerge in Hacking Team leak

#165

Post by rasz_pl »

101914 wrote: post #106

For me there are generally 3 steps to the process of watching a youtube video. 1. Get the video id. Retrieve HTML containing youtube /watch?v= urls or other urls that contain the video id. Extract the urls from the HTML or other markup garbage. 2. Retrieve the video. Feed the /watch?v= url to a script that does some "find and replace" on the absurdly long googlevideo urls. Below I have given an example of such a scri…

holy crap that is convoluted

I simply use mplayer and javascript oneliner extracting direct mp4 link from YouTubeCenter plugin = streaming video in mplayer without downloading.

Re: Two more Flash 0-days emerge in Hacking Team leak

#166

Post by dguido »

frankzinger wrote: post #162
dguido wrote: post #161

Earlier quoted context omitted.

The chart you just linked (which doesn't show a timescale) shows Chrome with over 300 exploitable bugs. I doubt the denial of service label, that just usually means that a bug wasn't fully investigated. So, again, how is this different from Flash? Chrome is riddled with vulnerabilities (and Safari is too). Flash runs in a low-priv environment is nearly every major browser, includes application-specific exploit mitiga…

> Chrome pushes out a dozen or more fixes > for remotely exploitable vulnerabilities > every 2 weeks. That equates to 288 remotely exploitable vulnerabilities in Chrome per year. Here is a chart from the same source with a timeline of sorts: http://www.cvedetails.com/product/15031/Google-Chrome.html?v... Your statement about Chrome is clearly way off, and that's what your parent was addressing. He never said Chrome w…

I don't think the classification of most of those DoS bugs are correct. I also don't think there's a big difference between 100 vulns per year and 300 vulns per year. You go fishing and you find some each time.

Re: Two more Flash 0-days emerge in Hacking Team leak

#167

Post by __david__ »

stevenh wrote: post #150
chinathrow wrote: post #36

https://twitter.com/BrendanEich/status/619876135623618560

My Macbook kernel panics and force-reboots itself because of a bug in some newer Firefox browser feature(s) which are used by a JS-based GBA emulator which was trending on HN yesterday. I can consistently duplicate the kernel panic by resizing the browser window while the emulator is running. I've never in my life experienced such a catastrophic bug from a Flash demo. At worst, such a devastating bug has a decent cha…

I you are panicking the kernel, that is a kernel bug, not a JS/Firefox bug.

Re: Two more Flash 0-days emerge in Hacking Team leak

#168

Post by yoklov »

PhantomGremlin wrote: post #155
wmt wrote: post #83

Earlier quoted context omitted.

Work on a massive decades old software project and get ready to have your eyes opened. All the automated static and dynamic software analyzers catch only the easiest flaws, but can catch the more serious ones only if you're skilled and lucky. Firing people for software bugs is the stupidest thing I've heard in a while. Everyone writes horrific software flaws. Everyone. The best of the best programmers just write less…

All the automated static and dynamic software analyzers catch only the easiest flaws In a 64-bit environment, at least for development purposes, why can't every single malloc() cause an allocation from new memory page(s)? Then free() removes the page(s) from accessible virtual memory. Too much overhead for production, but it would sure catch a lot of use-after-free bugs during development. Is nobody doing something l…

It's been a while but I'm pretty sure the issues here only happen in extremely contrived edge cases. Not to say they aren't big deals or to downplay them, but I don't think even that would catch them reliably. Not without extremely heavy fuzzing or something.

Re: Two more Flash 0-days emerge in Hacking Team leak

#169

Post by concerned_user »

ghshephard wrote: post #60
ExpiredLink wrote: post #47

Earlier quoted context omitted.

> The plugin is no longer strategic for adobe, they've stopped any forward-looking development on it, and are now in the mode of whack-a-mole reactive security patching. [citation needed]

About four years back Adobe committed to HTML5 on mobile platforms, and noted they would only provide bug fixes and security patches. http://www.cbsnews.com/news/adobe-abandons-flash-player-on-m... http://www.telegraph.co.uk/technology/news/8879783/Adobe-aba...

Simply because at that time both Google and Apple have banned Flash on their respective platforms, otherwise nothing would change.

Re: Two more Flash 0-days emerge in Hacking Team leak

#170

Post by ghshephard »

concerned_user wrote: post #169
ghshephard wrote: post #60

Earlier quoted context omitted.

About four years back Adobe committed to HTML5 on mobile platforms, and noted they would only provide bug fixes and security patches. http://www.cbsnews.com/news/adobe-abandons-flash-player-on-m... http://www.telegraph.co.uk/technology/news/8879783/Adobe-aba...

Simply because at that time both Google and Apple have banned Flash on their respective platforms, otherwise nothing would change.

I'm not sure what your point is, but the reality on the ground, is that if you want to provide access to video, or other rich content, flash is incapable of reaching the largest audience, and the audience that's growing the fastest. Adobe has made it clear there will no longer be any development of flash on the mobile platform. HTML5 is the strategic platform for adobe moving forward.

Absolutely no new major content sites as of around 2014 or so support flash as an option - they are all starting with HTML5 and/or thick local clients.

Flash needs to be EOL'd, and the sooner the better for the security of the Internet.

Post reply on HN