Adobe issues emergency Flash fix • Hacker News Board

Re: Adobe issues emergency Flash fix

#31

Post by DonHopkins » Wed, Jun 24, 2015, 2:24 PM UTC

tokenizerrr wrote: post #29

thefreeman wrote: post #13

Earlier quoted context omitted.

The BBC is blog spam yes. It quotes Kreb's article, which happens to be almost exactly the same, except BBC removed links to the advisory, etc. Edit: in response to TazeTSchnitzel to whom I cannot reply. If BBC included a link to the original post or the actual security advisory I would be less likely to call it blog spam, but I stand by my classification. It is a repost without the sources and with less information…

> in response to TazeTSchnitzel to whom I cannot reply If you ever cannot reply to a post try clicking the "X minutes ago" link and usually the reply link will then show.

Ha ha, thanks! I've had that problem too. Is that a bug or a feature? How does it work: does it make me travel back in time to before the reply window expired?

Re: Adobe issues emergency Flash fix

#32

Post by hrbrtglm » Wed, Jun 24, 2015, 2:27 PM UTC

Someone1234 wrote: post #27

tomswartz07 wrote: post #20

If you don't have Click-to-play enabled for Firefox, you should, and here's how you do it: Open Firefox and navigate to about:config. You will be sarcastically warned that you about to void your warranty, just click on the “I’ll be careful, I promise!” button to move on. Now search for: plugins.click_to_play Next you need to right-click and toggle the setting so that the value is true. Once you are done restart Firef…

Here's the Chrome guide: - Open Settings - Show Advanced Settings (bottom) - Content Settings (under Privacy) - Plugins -> "Let me choose when to run content." - It will now be click-to-play and enable a icon like the pop-up blocker in the address back to enable all on a page or to whitelist the page. - You can also whitelist from the settings page by clicking Manage Exceptions, and adding them like this: [*.]youtube…

Thanks a lot,

I did not know chrome had this setting option, or I view it but did not really realize what it was for. I'm glad you took some time to list the needed steps.

Re: Adobe issues emergency Flash fix

#33

Post by TallGuyShort » Wed, Jun 24, 2015, 2:28 PM UTC

DonHopkins wrote: post #31

tokenizerrr wrote: post #29

Earlier quoted context omitted.

> in response to TazeTSchnitzel to whom I cannot reply If you ever cannot reply to a post try clicking the "X minutes ago" link and usually the reply link will then show.

Ha ha, thanks! I've had that problem too. Is that a bug or a feature? How does it work: does it make me travel back in time to before the reply window expired?

It actually transports you forward in time. To discourage deeply nested flame wars, there's a waiting period before the reply link appears that grows with the thread.

Re: Adobe issues emergency Flash fix

#34

Post by DonHopkins » Wed, Jun 24, 2015, 2:29 PM UTC

drzaiusapelord wrote: post #28

yalogin wrote: post #8

Earlier quoted context omitted.

So Chrome has their own flash written by engineers at Google?

Google has what's called Pepperflash, which is just the flash executable in a sandbox, similar to what IE8+ has been doing with sandboxing on Vista and newer OS's. Both browsers are incapable of stopping many attacks with their various sandboxing techniques. Flash is just too poorly written and can't be too deeply sandboxed probably because of all the things it needs to do (directly access video drivers, directly acc…

It astounds me how often Flash and Acrobat keep pooping their pants with horrible security holes that require frequent updates. It's been how many decades that this been going on for, now?

Yeah, sure, Flash does a lot of crazy stuff that's hard to sandbox, and everyone who understands the code base probably left Adobe years ago, but what the hell is Adobe's own flagship Acrobat doing, that they just can't get it right no matter how many times they try?

Does pushing out so many updates increase the number of third party spyware toolbars that get installed, or something? Is McCaffe (or NSA) giving them a kickback for every virus vector they install that makes McCaffe Security Scan Plus seem useful, on top of the toolbar kickbacks? http://www.tiagoespinha.net/2010/10/adobe-starts-including-s...

Why don't they just run it through emscripten and be done with it?

Re: Adobe issues emergency Flash fix

#35

Post by bedane » Wed, Jun 24, 2015, 2:31 PM UTC

abrowne wrote: post #3

I uninstalled Flash a few months ago and don't miss it. I mostly use Firefox, but I do keep Chrome around, so I could use Chrome's Flash if I wanted to, but I don't think I have so far. The only site I commonly visit that doesn't work is BBC News, funnily enough. It's a little annoying because it will work if I change the user agent to iPad, but instead I just don't watch BBC News videos.

I miss it when I'm looking for porn to be honest, but not much else.

Re: Adobe issues emergency Flash fix

#36

Post by Mahn » Wed, Jun 24, 2015, 2:38 PM UTC

abrowne wrote: post #3

I uninstalled Flash a few months ago and don't miss it. I mostly use Firefox, but I do keep Chrome around, so I could use Chrome's Flash if I wanted to, but I don't think I have so far. The only site I commonly visit that doesn't work is BBC News, funnily enough. It's a little annoying because it will work if I change the user agent to iPad, but instead I just don't watch BBC News videos.

I find that "click to play" works well enough. So it's always off by default, but you still have the option to make exceptions in the very rare cases where it's needed. I always wonder why is this not enabled by default in all majors browsers in fact.

Re: Adobe issues emergency Flash fix

#37

Post by Mahn » Wed, Jun 24, 2015, 2:43 PM UTC

Someone1234 wrote: post #27

tomswartz07 wrote: post #20

If you don't have Click-to-play enabled for Firefox, you should, and here's how you do it: Open Firefox and navigate to about:config. You will be sarcastically warned that you about to void your warranty, just click on the “I’ll be careful, I promise!” button to move on. Now search for: plugins.click_to_play Next you need to right-click and toggle the setting so that the value is true. Once you are done restart Firef…

Here's the Chrome guide: - Open Settings - Show Advanced Settings (bottom) - Content Settings (under Privacy) - Plugins -> "Let me choose when to run content." - It will now be click-to-play and enable a icon like the pop-up blocker in the address back to enable all on a page or to whitelist the page. - You can also whitelist from the settings page by clicking Manage Exceptions, and adding them like this: [*.]youtube…

Note that if you do this, you don't really need to whitelist specifically youtube, since their player is html5 by default for some time now.

Re: Adobe issues emergency Flash fix

#38

Post by mangeletti » Wed, Jun 24, 2015, 2:51 PM UTC

It turns out there is a faster way to fix the issue. There is a program called Adobe Flash Player Uninstaller that does the trick, and as an added benefit, it also prevents any future zero-day exploit.

Seriously, I've been Flash-free for many months, and I haven't missed a thing. I highly recommend it. Other than some really old websites, everything works as expected (YouTube, news websites with video, etc.).

Re: Adobe issues emergency Flash fix

#39

Post by jwr » Wed, Jun 24, 2015, 2:53 PM UTC

mangeletti wrote: post #38

It turns out there is a faster way to fix the issue. There is a program called Adobe Flash Player Uninstaller that does the trick, and as an added benefit, it also prevents any future zero-day exploit. Seriously, I've been Flash-free for many months, and I haven't missed a thing. I highly recommend it. Other than some really old websites, everything works as expected (YouTube, news websites with video, etc.).

Seconded. On my new Mac I never installed any Adobe software. Several months later and I haven't needed flash even once.

Re: Adobe issues emergency Flash fix

#40

Post by egwynn » Wed, Jun 24, 2015, 2:53 PM UTC

mangeletti wrote: post #38

It turns out there is a faster way to fix the issue. There is a program called Adobe Flash Player Uninstaller that does the trick, and as an added benefit, it also prevents any future zero-day exploit. Seriously, I've been Flash-free for many months, and I haven't missed a thing. I highly recommend it. Other than some really old websites, everything works as expected (YouTube, news websites with video, etc.).

Same here. Though I use extensions like ClickToFlash, which prevent plugin loading by default, but allow me to selectively activate plugins in the DOM by clicking on them.