New Adobe Flash Vulnerabilities Being Actively Exploited On Windows and OS X 167
Orome1 writes "Adobe has pushed out an emergency Flash update that solves two critical vulnerabilities (CVE-2013-0633 and CVE-2013-0634) that are being actively exploited to target Windows and OS X users, and is urging users to implement it as soon as possible. According to a security bulletin released on Thursday, the OS X exploit targets Flash Player in Firefox or Safari via malicious Flash content hosted on websites, while Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content. Adobe has also announced its intention of adding new protections against malicious Flash content embedded in Microsoft Office documents to its next feature release of Flash Player."
Die Flash, Die (Score:5, Funny)
I know many will rush to disagree with me but Flash cannot die soon enough...
Re:Die Flash, Die (Score:5, Funny)
This is German for "the Flash, the".
Re:Die Flash, Die (Score:4, Funny)
Yeah. Remember that time, about 70 years ago, when a bunch of of Americans and British were running around Europe yelling "The German!" So silly.
Re:Die Flash, Die (Score:5, Informative)
And replace it with what? (Score:3, Interesting)
And replace it with what? The atrocity also known as HTML5 which is not write once run anywhere, is an absolute bear to code and despite the hype is nowhere near suitable for gaming yet?
There's a reason Flash is the world's most popular online multimedia platform. It's not without issues, but it is lacking a worthy contender.
Re:And replace it with what? (Score:5, Interesting)
Yep. HTML 5 can offer hardware acceleration on pretty much any mobile device.
The reason for flash was that Java was an ugly POS and people did not want to wiat a full minute for their ugly applets to load while flash was all nice and pretty and loaded instantly.
Flash also exists because of IE. Old IE I may add as IE 9 and IE 10 got their act together and support the HTML 5 video tags. When IE 10 comes out for Windows 7 and XP goes EOL we will see a shift in websites catering to HTML 5 users making flash obsolete for all but the conservative businesses.
Re: (Score:2)
Businesses only upgrade if they have a case. Having websites and cloud services move to HTML 5 is a pretty darn good business case to upgrade. IN the past IE 6 had such a strong marketshare that they didnt have to worry about as webmasters were forced to cater to it.
According to statcounter.com IE 8 usage is falling fast to 14% in the weekdays and 10% at the weekends. IE also is getting auto updated with Windows Update and before did not which is why grandmas kept using IE 6 for many many years. When that n
Re:And replace it with what? (Score:5, Insightful)
Can you tell us what that is?
For me, Flash has never provided anything of value -- just ads and badly written web sites is my opinion of it. I think Flash is crap.
Re: (Score:2, Interesting)
Can you tell us what that is?
Like he said, it doesn't have a viable feature-comparable alternative.
For me, Flash has never provided anything of value -- just ads and badly written web sites is my opinion of it. I think Flash is crap.
Cool story. Meanwhile, even here in 2013, our company started in 1996 is still selling new Flash-based learning courses to companies and government agencies worldwide, and they're still ordering new ones. It's easy for the artists to work in, the code to run the courses hasn't need to be patched or updated in several years, and the major time expense is still having people write the actual instructional content.
Re: (Score:2)
Yup, and it's products like yours why I periodically have go open up the browser of insecurity (IE) to access because it's the only one what has Flash enabled. Usually 2-3 times per year some company-mandatory crap needs it.
But for day to day use? Flash is disabled or just simply not installed because I h
Re: (Score:2)
Yup, and it's products like yours why I periodically have go open up the browser of insecurity (IE) to access because it's the only one what has Flash enabled. Usually 2-3 times per year some company-mandatory crap needs it.
If only there was a viable alternative. I haven't seen a good way to synchronize audio with animation, or to let a non-programmer create good artwork, for that matter. Until an HTML5/SVG authoring environment comes along which can export projects that have all of the functionality of Flash and can be used by an artist, we're stuck with Flash. Flash can export some things to HTML5, but it drops a lot of features when it does so.
Re: (Score:3)
And you can argue with this being a feature - or a bug. Just recently finished some course work over at the American Heart Association website. Flash, natch. The structure of which has not been changed for a decade. The same poorly thought out navigation, the same IE centric, buggy code. Just some new content.
Yes, it's AHA's decision not to spend the money to really look at what they are doing, but it's a pretty standard business practice. If it ever worked, it's good enough.
If I ever find the person
Re: (Score:3)
It's gotten worse lately, now with Captivate and Articulate being released, anyone who can type can create online learning content. I've seen plenty that are no better than a Powerpoint presentation. We have a full staff of instructional designers, artists, etc who actually manage to create engaging and award-winning content, but seeing our competition, I feel your pain.
Re: (Score:2)
>>> ...online multimedia platform.
>> Can you tell us what that is?
> Like he said, it doesn't have a viable feature-comparable alternative.
That... doesn't answer the question. If your argument is that Flash is so awesome because it's the best "online multimedia platform", then you're going to have to back that up to what the fuck an "online multimedia platform" is and why I would want one.
Because yes, like many others in this conversation, I have only seen Flash used for things that I quite
Re: (Score:2)
That... doesn't answer the question. If your argument is that Flash is so awesome because it's the best "online multimedia platform", then you're going to have to back that up to what the fuck an "online multimedia platform" is and why I would want one.
We can start that pretty simply. It is a vector-based graphic and animation tool that allows you to synchronize audio with the animation. That alone has every other alternative beat. Things like drag and drop and all of the various interactions can be reproduced with Javascript in a browser, but letting a non-programmer artist create the content and synchronize the audio with what's going on in the content isn't found in other alternatives.
Re: (Score:2)
Most media options are done in flash. Any type of subscription based service that runs in the browser is flash because there is no standard. And it's going to stay that way so long as Microsoft is going to be a dick and insist everyone else uses their tech for secure streaming.
Re:And replace it with what? (Score:5, Interesting)
For me, Flash has never provided anything of value -- just ads and badly written web sites is my opinion of it. I think Flash is crap.
You're entitled to your opinion.
But Flash remains a remarkably viable platform with mature development tools for animation, video and games. Amanita Design [amanita-design.net] comes vividly to mind with games like Samorost, Machinarium, and Botanicula.
Animation in adds and badly designed websites don't go away simply because their developers have migrated to HTML5.
Re: (Score:2)
It backfires a bit when your argument in favor of Flash being at the heart of a vast and vital industry is citing a company no one has ever heard of and three games that no one has ever heard of.
It sounds as if you live in some tiny little niche universe in which "multimedia platform" is a thing. But you should be aware that for nearly everyone else out there, those words are not even meaningful, much less describe anything important or desired.
Re: (Score:2)
It backfires a bit when your argument in favor of Flash being at the heart of a vast and vital industry is citing a company no one has ever heard of and three games that no one has ever heard of.
Oh, really?
Machinarium is a puzzle point-and-click adventure game developed by Amanita Design. It was released on October 16, 2009 for Microsoft Windows, OS X, Linux, on September 8, 2011 for iPad 2 on the App Store, on November 21, 2011 for BlackBerry PlayBook on May 10, 2012 for Android, on September 6, 2012 on PlayStation 3's PSN in Europe, on October 9, 2012 in North America and on October 18, 2012 in Asia.
Microsoft Windows, Mac OS X, Linux and Android versions of this game were released along with Humble Indie Bundle for Android 4 on November 8, 2012, to customers who paid over the average price.
It won the Excellence in Visual Art award at the 12th Annual Independent Games Festival and the Best Soundtrack award from PC Gamer in 2009. It was nominated for an Outstanding Achievement in Art Direction award by the Academy of Interactive Arts & Sciences and a Milthon award in the 'Best Indie Game' category at the Paris Game Festival.
Gaming site Kotaku named it a runner-up for "PC Game of the Year 2009" alongside Torchlight, losing to winner Empire: Total War. Gamasutra, Gamerview and the Turkish site of Tom's Hardware all selected Machinarium as the 'Best Indie Game' of 2009. AceGamez named Machinarium the 'Best Traditional Adventure Game' of 2009.
Machinarium [wikipedia.org]
In April of last year there was the The Humble Botanicula Debut. [youtube.com]
Re: (Score:2)
I don't know what a "Humble Bundle" is; again, I suspect it's something that features far more prominently in some small specialized market than in the general world. I would suggest that your deep involvement with this niche may be impairing your perspective.
Just glancing at the small games market, 90k sales certainly seems unexceptional. The top few dozen games sold through itunes seem to each have 10k-30k _reviews_, which almost certainly implies many more than 90k sales.
And given that those all, obvious
Re: (Score:2)
I don't know what a "Humble Bundle" is
Then you're not interested in video games.
Flash is for games and video on the Web, and occasionally offline.
Re: (Score:2)
Flash animations go away when you remove flash, use flashblock or soon just use Firefox.
I couldn't care less what games are built with flash. I value not getting hacked by blocking flash more than any minor value flash provides. Adobe has proven themselves unable to provide the level of security I need to leave it on my machines.
Re:And replace it with what? (Score:4, Informative)
Installation was fantastic. When Flash was new under Macromedia, I remember it being only 300K, and it installed immediately without a reboot or restarting the browser. Java at the time weighed in at (I believe) over 12MB and required a reboot. So did most other media players.
Games. Casual gaming on the PC owes itself almost entirely to Flash. Java sucked, and the alternative was to download and install an EXE, which could do just about anything to your PC. Flash made it possible to run games instantly, directly, without an install, on both PC and Mac. It was the Steam of the day, and worked when everything else failed miserably.
Cartoons. Doing stuff in vectors reduced bandwidth a thousand fold. Say what you want about HTML5 and movie codecs, but if you want to do vector animation, Flash is still your only option.
Educational apps. Ever been to a tech site where they have some kind of visual interactive application to show how the technology works? Java should have dominated in this area, but installing Java was painful, the download was huge, and at one time, Java applets couldn't play audio, because that was considered a security violation. Yes, in an attempt to crack down on the annoying audio and MIDI craze, Java banned all audio in applets for a while. No wonder tech sites dumped Java and went to Flash for their presentations.
Say what you will of closed-source, proprietary media players, but all things that tried to compete with Flash have royally sucked. Flash is most definitely useful, and will continue to exist until HTML stops being garbage (which may take another 10 years or so -- if ever).
Re:And replace it with what? (Score:4, Interesting)
Yeah, but is it of value to users? It isn't for me, and I'm not here to provide value for website owners. As a user, requirement for flash means the back button.
Flash gets blocked/not even installed by me an other users because it's crap. Deal with it.
I'm not going to allow Flash ads for any reason -- and if the only thing of value is for ads, that pretty much is what I already thought.
Maybe it's my age showing, but the number of times I feel like I want to watch a video on the internet is vanishingly small. As in, I have no idea the last time I cared enough to watch a video on the internet. Same for games.
I don't give a rats ass if other people want to run Flash -- run wild, it's your computer. But I'd be hard pressed to name a single thing that has ever made me think "gee, I've been missing out by not having Flash".
Re:And replace it with what? (Score:5, Funny)
Good for you... but it turns out that a fair number of the most popular websites on the entire WWW play videos, typically in Flash, and they are watched by people of all ages (perhaps more among the younger set, but certainly not exclusively). Quite a few sites (perhaps not individually the most popular, but a massively common *class* of site) also serve lots of Flash video, although for legal reasons they are only supposed to be watched by adults. People also like to watch videos of events they couldn't make it to and listen to streaming music, both of which are common uses of Flash. You can do web-based video chat or even videoconferencing using Flash (Google Talk can do this, for example).
I don't like Flash, and I certainly don't trust it; I keep it tightly curtailed where it's installed at all. However, it's definitely useful in some cases. HTML5 is catching up, but not fast.
Re: (Score:3)
Re: (Score:2)
Nevertheless, idealism doesn't match reality - a lot of content still requires a flash plugin. Even a story posted on Slashdot yesterday had embedded flash video. :(
So although I use chromium or firefox for most things, I keep Chrome handy for news services etc.
Re: (Score:2)
With me, and my age is getting up there too....I feel I'm watching more and MORE video on the web, but to learn things!!
I'm trying to learn a lot of video and image editing software and tons of stuff out there from tutorials, to special tricks, differences in versions, etc.
And if you
Re: (Score:3)
For video, I've yet to see a HTML5 player that works as well as Flash.
Youtube's? In fact, youtube switches to html5 everytime when it can, guess what? I don't even notice.
Re: (Score:2)
Today it does. If Flash hadn't been around five years ago it would have been forced to use RealPlayer.
Flash may be BUFFERING bad, but BUFFERING Rea BUFFERING lPlayer is even worse. Think about that.
Re: (Score:2)
For video, I've yet to see a HTML5 player that works as well as Flash.
Block Flash in your browser. Go to a website that'll fall back to HTML5 if Flash can't be found (I only know of youtube and funnyplace.org). You might see some warnings about Flash not being loaded, but you can still see the vast majority of the videos.
Re:And replace it with what? (Score:5, Insightful)
There's a reason Flash is the world's most popular online multimedia platform.
Yes. DRM.
Re:And replace it with what? (Score:5, Insightful)
And replace it with what? The atrocity also known as HTML5 which is not write once run anywhere, is an absolute bear to code and despite the hype is nowhere near suitable for gaming yet?
It's true that for this one particular use-case, Flash may still have an edge against open technologies. But 99% of the Flash on the web is either ads or videos. We don't want to see the ads anyway, and HTML5 makes embedding videos without Flash in a standards-compliant fashion relatively easy. And remember, if your site relies upon Flash, no one with an iDevice will be able to use it correctly. And that's not going to change. In contrast, HTML5 videos work fine on both desktop browsers and portable devices.
If the only thing Flash is good for is some types of online gaming, then many users don't need it at all, and for those who do, it should be set by default to use a whitelist and only permit the plugin to be invoked on domains that are specifically authorized by the user.
Re: (Score:2)
Re: (Score:2)
Let me say up front that I'd love to be rid of flash forever, but that said... there seems to be an inseparable bond between multimedia and flash.
However....
I don't have cable... I don't watch enough TV to justify the expense... but there's a handful of shows (3 of them) that I really *do* like to watch each week, and the networks that air them in my area coincidentally also have those shows available for streaming one day after they air, which allows me to watch them at my convenience. The caveat is
Re: (Score:2)
Angry Birds was originally written in Flash. So was Canabault-- which you may not have heard of, but every "running" game out there owes a debt to. There's tons of iOS apps built in Flash.
I'd be perfectly happy to see flash off the browser and used for what it's best at-- desktop or mobile applications.
Before I get flamed for suggesting that Flash is an appropriate dev to
Re: (Score:2)
Got a reference for that? My understanding was that it was originally written in C, for iOS, and later ported to other platforms.
Re: (Score:2)
My impression was that the prototype/proof-of-concept was built in flash, with (as you suggested) the native-code versions built later. I, of course, could be completely mistaken in which case I'm sure someone will correct me, preferably with an anecdotal car-analogy.
Another reason to use Chrome, avoid Safari, Mac. (Score:2)
Re: (Score:3)
This particular vulnerability might be patched, but you're wide open to hundreds of others. Flash is not something a responsible OS distributor should install by default.
How is Chromebook "open" to Flash vulnerability? (Score:3)
Re: (Score:2)
TFA is spreading FUD. I've had self-updating flash on OS X for at least a year now, IIRC. Yes, it has been self-updating for safari and other browsers, all automagically. Yes, you can manually disable autoupdates, but then it's your own damn fault.
Re: (Score:2)
Especially if you're a sysadmin who has to mange installation & updates.
http://www.bynkii.com/archives/2013/02/wtf_flash.html [bynkii.com]
Re: (Score:2)
I know many will rush to disagree with me but Flash cannot die soon enough...
The problem is not Flash. the problem is the absolute incompetence of Adobe. Despite being a large company with lots of resources (programmers, money, etc) they are unable to produce a piece of software that isn't filled with exploitable security flaws. No software is perfect, but this is ridiculous. No, it's beyond ridiculous.
Re: (Score:2)
But.. but... he saved every one of us!
Are there non-malicious uses? (Score:4, Interesting)
I realize that implementing embedded flash objects in Office documents was probably something that mostly happened because Microsoft wanted OLE to make embedding arbitrary stuff in arbitrary stuff happen(unlike Adobe's sick fetish for inserting horrible things into PDFs, which is their own damn fault); but do Flash embeds in Office documents actually occur, in the wild, as something people would actually do and distribute, for anything other than malicious purposes? I honestly can't remember ever having seen a single one, ever.
Re:Are there non-malicious uses? (Score:5, Informative)
People use Word documents to send freaking pictures around, because they don't know they can paste into Paint. They don't know how to send weblinks either, so they paste it into Word and send it on.
Re: (Score:2)
Ugh, and old Windows' Paint to send as big bloated BMP images. :(
Re: (Score:2)
Maybe. I've seen it in business Power Point presentations...and hated it *every* time. If I'm going to waste time, let me do it on Slashdot.
To an impatient, time-pressed captive audience, a lengthy mandatory canned video is "almost malicious." Just give me five bullet points, ask for my decision and get out of my hair.
Typical: Putting a lengthy flash animation such as "All Your Base Are Belong to Me" at the beginning of a power point presentation to sell me on centralized systems management. I'm already
Re: (Score:2)
Relatedly, I believe the reason that Word is being used as the exploit vector on Windows is because it doesn't have the sandboxing of IE/Firefox/Chrome. While you could get a lot more people to run the Windows attack code if you posted it on websites, it doesn't do any good when every popular browser newer than IE6 is locked down to not be able to launch arbitrary programs or write to most of the filesystem or registry.
Re: (Score:2)
Actually from Office 2010 onwards it does have a sandboxed mode which is triggered based
Related to 57 patches for IE next Tuesday? (Score:2)
I wonder if this and Java are related to the HUE monster security update [zdnet.com] for IE?
Huh? (Score:2, Informative)
I'm typing this on a Win 7 notebook w Firefox. KSHE's playing right now (using Flash, of course) and no notification came to me, although some virus defs came through this morning.
Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content
Why? They could as easily infect you with a macro. Who in their right mind opens a Word doc from and unknown source, especially when Windows warns you when you start to open a word doc in Outlook (we use
Re:Huh? (Score:5, Insightful)
>Who in their right mind opens a Word doc from and unknown source
The idiot secretary in the next office over, or the next floor down.
Then the payload mines her email addresses and sends you "Minutes from meeting" or some similar crap. So now instead of having an email from an unknown person you get an email from someone you'd expect to get word documents from. Hopefully you are in a company that has decent A/V on incoming mail, most small businesses don't.
Re: (Score:2)
Secretaries are not a thing anymore.
Re: (Score:2)
Now they're called assistants (or similar) and they still exist every where I've ever worked, there are just a lot fewer of them, and they don't type things up or take notes.
Re: (Score:2)
"they don't type things up or take notes"
so just screwing the boss then huh
Re: (Score:2)
Re: (Score:2)
In a word, run nightly ninite [ninite.com] :)
Re: (Score:3)
Um, some of us have taught them to tick the "don't ask again" box. Sorry about that.
Getting macros to run is harder these days. There's an extra click or two. They don't execute automatically any more.
Re:Huh? (Score:4, Interesting)
As far as I can tell, the Flash updater only bothers to check for an update when the computer first boots.
Because everyone here constantly reboots their computer, right? I mean, it's not like most computers have sleep modes, and that most people just leave the OS running so they don't have to wait for it to boot. Clearly everyone constantly reboots their computer, once per day, to allow the Adobe Flash Updater to check for updates.
Re: (Score:2)
That's one of many things that annoys me about Windows. This notebook runs W7 because I just haven't gotten around to installing Linux yet. Linux would already be on it if it wouldn't hibernate. Ironically, the Linux tower gets shut down when I'm not using it, because when I boot it, all the apps and docs that were open when I shut it down reopen, and it enters its password for me. Hit the switch, pour a cup of coffee and it's good to go, as if it hadn't been shut down at all.
I wonder if Windows will ever c
Re:Huh? (Score:5, Informative)
Windows users are targeted with Microsoft Word documents delivered as an email attachments which contain malicious Flash content
Why?
Probably because of Windows sandboxing Flash through low-integrity mode. Even if you get to exploit a Flash vulnerability and execute your shell code on Windows, the code is still severely restricted in what it can do. Code executing inside of a low-integrity process can still not infect a system as write-ups (writing or interacting with a higher integrity object/process) are denied.
They could as easily infect you with a macro. Who in their right mind opens a Word doc from and unknown source, especially when Windows warns you when you start to open a word doc in Outlook (we use Outlook at work).
No, infecting with a Macro is more difficult since the last several versions of Word. Word will not automatically run macros and also has an internet-origin policy whereby documents received through Outlook or other email clients or downloaded using a browser is tainted with the "internet zone". You have to dismiss several warnings to run macros from such a document. But if Word will run Flash content (show the animation) and a vulnerability can be exploited, shell code can run as a user.
That is, until Word 2010 which *also* runs in low-integrity when viewing content tainted with the internet zone. Since Word 2010 the shell code will still be confined to the low-integrity sandbox.
LOL ... (Score:4, Insightful)
Or, don't even run it. Flash has been a security and privacy hole for a decade or more.
I refuse to install it except on work machines where I periodically have to use it for something I can't avoid.
Yet another exploit? I'd like to say I'm shocked, but that would be a lie.
FTFY (Score:2)
Email attachments have been a security and privacy hole for a decade.
Re: (Score:2)
Oddly enough, it was only ever Microsoft who decided they'd just blindly run anything in an email attachment.
Re: (Score:2)
I refuse to install it except on work machines where I periodically have to use it for something I can't avoid.
Which Flash-only websites do you use for work?
Re: (Score:2)
Why is it so bad? (Score:2)
For way to many years it's been a mess. And these near-daily emergency patches now. WTF is broken in their development/testing process? I don't understand how it can stay so horrid, or why Adobe finds this acceptable...
Even Windows has gotten a lot more secure over the years. But Flash, seems more broken each day.
Anyone have any insight?
Re:Why is it so bad? (Score:5, Insightful)
Probably because there is not much you can do to fix a fundamentally bad idea. Think of it like all the various attempts to make smoking 'healthy' at the end of day intentionally sucking combustion gases into your lungs just is not good for you, no matter how low tar, free of synthetic chemicals etc you make it.
What does flash do? It executes code from unknown origin on your machine. That has never been a good idea; even if in some cases you can't get around needing to do it. Flash has more problems though it can't be fully sandbox'ed without breaking all those old apps, it needs to be able to do things like read files, open sockets connections, etc.
Re: (Score:2)
That's what any web browser does. Flash does not run native code directly from untrusted sources, just as web browsers don't. Usually, the content exploits the bugs that let you run some binary code directly, but it's not because shipping native code around is how it was supposed to work. Both web browsers and flash players get executable content they have to compile to native code and run, or at least run on a bytecode machine.
Re: (Score:2)
No quite true. If we ignore javascript for a moment pure html rendering is not program execution; its document formatting.
Re: (Score:2)
For way to many years it's been a mess. And these near-daily emergency patches now. WTF is broken in their development/testing process? I don't understand how it can stay so horrid, or why Adobe finds this acceptable... Even Windows has gotten a lot more secure over the years. But Flash, seems more broken each day. Anyone have any insight?
Adobe outsources most of their development process to India. That's a major contributing factor.
Re: (Score:2, Insightful)
Re: (Score:2)
We don't need antivirus software! (Score:2)
Such is the mantra here...
Sooo tempted to send the CVE out to several people internally, as a word document.
*sigh*
Punishment (Score:2)
Installing flash, without browser restart? (Score:2)
One thing that I see as causing some people to delay updating their Flash, despite an update being available, is that the installer requires you to restart your browser or anything else Flash think is using it. Many people take the attitude "I am working and don't want to be bothered restarting my apps, for something I rarely use".
Is there any other way Flash could install its updates, without requiring browsers to be restarted?
Re: (Score:2)
The Netscape Plugin API (which is what Flash is implemented using on Firefox, Opera, Safari, and at least some versions of Chrome) doesn't really support this. I don't know of any legit reason why not, but it doesn't.
IE, which uses an ActiveX control for Flash, actually has no problem installing or updating plugins without restarting the browser. Refresh the page (which, if it's installed via the browser itself, will happen automatically) and you're good to go.
Re: (Score:2)
Weird. While reading this story I just barely updated Flash (on Windows XP) with both IE 8 and Firefox open. No restart at all.
I was on a Mac, so maybe Flash goes by different rules here?
My report: 6 months without using Flash (Score:5, Interesting)
Some time ago, after the last round of Flash exploits, I de-installed it and resolved to live without it.
There are glitches: I can't get most video content, and Flash-only sites are inaccessible. However, this ended up being not a big issue.
One reason for this is that many YouTube videos play in HTML5 on Firefox. (If you find a video you can't play, try embedding it; this sometimes produces a workable version.)
Overall, the playback on HTML5 is better than Flash. There are fewer random slowdowns and stall-outs. On the downside, not every video is in HTML5.
The most amazing this is that browser crashes have dropped to near zero, either one or zero during this time. Most of what I thought was FF and Opera being buggy was in fact Flash being buggy.
There's not yet enough content switched to HTML5 from Flash to navigate everything, but during my 6 months without Flash, I've noticed that more firms are going away from the Flash-only navigation school of design.
YMMV. For me, life without Flash has been better, although I do miss out on some things.
Re: (Score:2)
It used to be that the #1 source of Safari crashes auto-reported to Apple was Flash. I wouldn't be surprised if that's still the case.
Re: (Score:2)
I was quite content without it, until Google tweaked some things in their finance pages where graphs wouldn't allow static graphs anymore. I grudgingly re-installed yesterday after nearly three years without. It's out again... I will just skip using Google Finance.
Re: (Score:3)
You can solve the video playing problem quite easily with something like FF's Video Download Helper add-on or JDownloader. These tools can examine a URL and allow you to download any videos they find for local playback.
Re: (Score:2)
There are glitches: I can't get most video content, and Flash-only sites are inaccessible. However, this ended up being not a big issue. One reason for this is that many YouTube videos play in HTML5 on Firefox. (If you find a video you can't play, try embedding it; this sometimes produces a workable version.) Overall, the playback on HTML5 is better than Flash. There are fewer random slowdowns and stall-outs. On the downside, not every video is in HTML5.
If you're using Firefox, one problem is that they'
Three cheers for Firefox (Score:2)
I understand some of their reasoning and am not critical of it.
If anything, I think every FireFox user should try it without Flash. There just are not crashes. It's inspiring.
Re: (Score:2)
it is already a compile time option on linux since about FF14.
Re: (Score:2)
I can't get most video content, and Flash-only sites are inaccessible.
Sometimes if I really want something on the website I'll change my user agent string to the same as the iPad's, and I have yet to hit an issue with the site not being able to limp along at that point.
Re: (Score:2)
With FlashBlock extension, one could block Flash videos. How does one do that with embedded HTML5 videos?
IE tip (Score:2)
A simple way to make Internet Explorer block Flash by default: Gear icon -> Safety -> ActiveX Filtering.
After that, you can re-enable Flash for selected sites by clicking the blue icon in the address bar.
Windows secure, OS X not so much. (Score:5, Interesting)
We see here how the Windows platform has been battle hardened to the point where the attackers have to resort to lower-yield secondary attacks. Head-on attacking Flash on Windows does not get the attacker very far because of the security advancements such as Mandatory Integrity Control (MIC). That's why the attackers try to exploit it in contexts where MIC does not prevent system infection, such as through older versions of Microsoft Word through emails.
OS X is still wide open to such head-on attacks when a vulnerability exists, especially Firefox because Mozilla has steadfastly refused to put in place a proper sandboxing barrier. Even Safari has some sandboxing in the latest version of OS X.
Firefox not. A vulnerability in Firefox or one of its plugins means significant risk of successful exploits.
Flash on Windows executes in a low-integrity process. Even if a Flash vulnerability is exploitable and shellcode gets to execute in the Flash host process, it still cannot write anywhere or interact with higher integrity objects because of mandatory integrity control (MIC) which was introduced with Vista.
The upshot: Attackers have to try secondary routes on Windows where the conversion rates are much, much lower. And this specific attack vector will not work on Word (or other Office applications) since Word 2010. Since the 2010 versions, internet downloaded documents are also opened in low-integrity mode, meaning that even here the shellcode would be similarly restricted.
Re: (Score:2)
It's sandboxed like Chrome: http://www.webmonkey.com/2012/06/flash-firefox-play-together-in-new-security-sandbox/ [webmonkey.com]
Re: (Score:2)
It's sandboxed like Chrome: http://www.webmonkey.com/2012/06/flash-firefox-play-together-in-new-security-sandbox/ [webmonkey.com]
Flash in Firefox is only sandboxed like Chrome on Windows:
But not on OS X. Chrome on Windows uses UAC/MIC too (and also puts in place some extra sandboxing features). Note, Firefox itself on Windows is still not sandboxed. This sandboxing only applies to the Flash plugin, not the browser itself and not to other plugins. An exploit running on W
Chrome to the rescue (Score:2)
Re: (Score:2)
Your comment made be curious, so I looked into it and Chrome is indeed using the PPAPI plugin (which other programs can't make use of) on all platforms as of Chrome 23.
Good to know. :)
JRE and Flash, RIP 2013, Silverlight RIP 2010 (Score:2)
Lets all push to get rid of alternative runtimes once and for all.
Given the choice.... (Score:2)
Flash died a long time ago. (Score:2)
Re: (Score:2)
Re: (Score:3)
Does this bug also affect users of those OS's, because last time I heard
a) Adobe isn't offering a flash package for current android
b) Adobe isn't offering updates to the Linux flash version.
I'll assume that Linux users can have the vulnerable version, is there something in the OS that makes them immune or were they just not mentioned?
The 1st paragraph of TFA:
Short of using SE