Google releases a fix for flash, before Adobe

Post by fjarlq » Tue, Sep 27, 2011, 6:52 PM UTC

fjarlq wrote: post #30

potatolicious wrote: post #28

Earlier quoted context omitted.

No, they aren't, that's my point. Neither Chrome nor Flash can expect patch pickup in the order of days - in fact, Flash updates (on Windows and OSX at least) require user intervention, whereas Chrome will do it at browser restart. One of these is much more likely to occur than the other. In any case, Chrome's update mechanism promises to get more users patched, quicker, than Flash. Waiting for Flash is nonsensical.

My point is when there's a critical Flash update, Chrome doesn't notify me ASAP. So my Chrome might be open for days with a vulnerable Flash without me knowing that it's time to restart. This is why I check About Chrome almost daily (kind of an annoying obsession). By comparison, on Windows and OSX when there's a Flash update, the user will be notified when the update arrives. So Chrome delivers the Flash patch reall…

I dug around in the Chrome bug database a bit and learned.

Windows Chrome now has better update notification: http://crbug.com/27941

In April the update notification was further improved: http://crbug.com/71202#c24

OSX Chrome still needs better update notification: http://crbug.com/45147

There are different UI challenges on the Mac that have delayed the improvement there. No wonder I've been missing it.

Post by cpeterso » Tue, Sep 27, 2011, 9:05 PM UTC

raganwald wrote: post #10

tptacek wrote: post #7

Earlier quoted context omitted.

Just to be clear: while reasonable people can disagree about patch and disclosure timing, the point that this article makes isn't a fringe point. Virtually every vulnerability researcher goes through some kind of elaborate dance with vendors to coordinate the safest reasonable release of bugs and patches. So it's not as if there's an widely accepted principal of "patch as quickly as possible". There are tens, probabl…

I’m idly imagining a massive Google HoneyFarm with browsers that examine payloads from known “harmful sites” and spam or phishing emails. The moment one of the vulnerabilities is found “in the wild," the patch is automatically pushed into the wild, Adobe be damned.

Google did this just recently:

http://googleonlinesecurity.blogspot.com/2011/08/fuzzing-at-...

One of the exciting things about working on security at Google is that you have a lot of compute horsepower available if you need it. This is very useful if you’re looking to fuzz something, and especially if you’re going to use modern fuzzing techniques. ... We recently decided to apply the same techniques to fuzz Adobe’s Flash Player, which we include with Chrome in partnership with Adobe.

we cranked through 20 terabytes of SWF file downloads followed by 1 week of run time on 2,000 CPU cores to calculate the minimal set of about 20,000 files. Finally, those same 2,000 cores plus 3 more weeks of runtime were put to good work mutating the files in the minimal set (bitflipping, etc.) and generating crash cases. These crash cases included an interesting range of vulnerability categories, including buffer overflows, integer overflows, use-after-frees and object type confusions.

Re: Google releases a fix for flash, before Adobe

Re: Google releases a fix for flash, before Adobe