Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Facebook Security

Facebook's New Chief Security Officer Wants To Set a Date To Kill Flash 283

Posted by samzenpus from the burn-it-with-fire dept.
An anonymous reader writes: Facebook's new chief security officer, Alex Stamos, has stated publicly that he wants to see Adobe end Flash. This weekend Stamos tweeted: "It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day. Even if 18 months from now, one set date is the only way to disentangle the dependencies and upgrade the whole ecosystem at once."
This discussion has been archived. No new comments can be posted.

Facebook's New Chief Security Officer Wants To Set a Date To Kill Flash More

Facebook's New Chief Security Officer Wants To Set a Date To Kill Flash

Comments Filter:

  • Why? (Score:2, Interesting)

    by Fwipp ( 1473271 )

    Why on earth would Adobe want to kill flash?

    • Re:Why? (Score:5, Funny)

      by Anonymous Coward on Tuesday July 14, 2015 @12:41AM (#50104721)

      So they can stop getting mentioned every time a security vulnerability is exposed?

    • Re:Why? (Score:5, Insightful)

      by bloodhawk ( 813939 ) on Tuesday July 14, 2015 @01:01AM (#50104813)
      Flash is a diseased animal in pain, it needs to be put out of its misery. It is going to die on its own, Adobe may as well save a little face and do Flash and the world a kindness by euthanizing it.

      • Re:Why? (Score:5, Insightful)

        by gl4ss ( 559668 ) on Tuesday July 14, 2015 @02:18AM (#50105081) Homepage Journal

        but what will you use then to play happy wheels?

        look, all this talk about "bad corporations do intentional obsoleting of software to sell new software" and then *bam* start asking for them to make tens of thousands of games unplayable.

        nice, real nice.

        yes kill date implies that you wouldn't be able to _use_ it at all after the date, which would actually work as an incentive to not update to any such version that has a kill date. kill date would also mean no further security fixes.

        putting a date on it would be stupid for everyone involved. adobe can just(and pretty much has) quit developing new features for it, thus driving people to other things.

        • Re: (Score:2)

          by camg188 ( 932324 )
          You can play flash games with media player classic. You just need to download the flash file.
        • actually your definition of kill date is different to mine. A Kill date is a date at which time if you are running upto date browsers and software it will stop working by default. It doesn't mean you can't turn it back on for yourself (albeit unsupported) or that you can't use legacy versions. It simply means only those that absolutely need it enabled for legacy reasons will have it. by being off by default instead of a slow tail off of use over many MANY years it will be a steep drop.

      • Flash is a diseased animal in pain, it needs to be put out of its misery. It is going to die on its own, Adobe may as well save a little face and do Flash and the world a kindness by euthanizing it.

        That's just the cover story; it's actually an effective deployment platform for the NSA.

        You really think it's just decades-long incompetence that just as one hole is patched, another brand-new one is quickly discovered? They're issuing hole exchanges, not patches.

    • Re: (Score:3)

      by mwvdlee ( 775178 )

      Obviously, for the same reasons Facebook new chief security officer wants to kill Facebook's anti-privacy defaults: None whatsoever.

    • Because he only has 14 hours to save the Earth!

      • General Kala, Flash Object approaching.

        What do you mean Flash Object approaching, open fire, all weapons. Send out HTML5 with AJAX to bring back its body.

    • Re: Why? (Score:3, Insightful)

      by Anonymous Coward

      We should set a date to end Facebook. Even if 18 months from now, one set date is the only way to disentangle the dependencies and upgrade the whole social networking ecosystem at once.

    • But Flash!!! We only have 8 minutes to save the Earth!!!!!

  • Can we set it for 2006? (Score:5, Insightful)

    by cfalcon ( 779563 ) on Tuesday July 14, 2015 @12:33AM (#50104675)

    Can you set an EOL date in the past? Maybe by a decade, give or take a bit? If causality doesn't currently permit that, we should look into patching this functionality into reality as a special case.

  • I worked for http://www.boardvantage.com/ [boardvantage.com] this company for a spell. It was a shit company, and a really shit product. Somehow the CTO has convinced Board rooms around the world that the flex client is the most secure thing ever, and every time some flash vulnerability was announced, he could always dance his way around it.

    Point being that as long as those in positions of power can be convinced it's a needed evil, it will be a used evil.

  • Same date to Kill Facebook too? (Score:5, Funny)

    by krelvin ( 771644 ) on Tuesday July 14, 2015 @12:41AM (#50104723)

    Use the same date to turn off Facebook too?

  • Facebook or Google decides (Score:5, Funny)

    by CaroKann ( 795685 ) on Tuesday July 14, 2015 @12:42AM (#50104731)
    So Facebook wants to decide what will work on the Internet now? I thought that was Googles job.

    • Google and Facebook have the right to dictate what ad formats they will deliver. Google further has the right to dictate what file formats Googlebot will index. Historically, it has indexed SWF, but if Google wants to bury SWF, it'll index sites as if Flash Player is not installed.

      • Re:Ad formats (Score:4, Interesting)

        by fred911 ( 83970 ) on Tuesday July 14, 2015 @01:20AM (#50104889) Journal

        Even if flash is "officially" killed, Google will still index it. Pages dependent upon Flash for their main content will take a quality hit (actually they already are), hence a rank loss

          Android doesn't support it, and if you cant render content for that platform, well you just lose the ability to meet the needs of the user (or a major percentage of them).

  • HTML5 is more broken than Flash (Score:2, Interesting)

    by Anonymous Coward

    HTML5 doesn't even work half the time because the browser implementation is off by one.

  • Take his own advice (Score:5, Interesting)

    by bug1 ( 96678 ) on Tuesday July 14, 2015 @12:52AM (#50104777)

    How about facebook just stop using flash and switch to html5 like youtube has.
    Or do i need to put my tinfoil hat on and speculate why certain influential groups might want a large proportion of the internet dependent on a binary only browser plugin.
    (yes yes in theory there is open source flash plugins, but nobody uses it because its mostly broken).

    • Re: (Score:2)

      by cen1 ( 2915315 )
      Indeed. Facebook had HTML5 video enabled on mobile for some time but until recently, the desktop page was still using Flash.

  • Flash is like IE 6 (Score:5, Interesting)

    by Billly Gates ( 198444 ) on Tuesday July 14, 2015 @12:56AM (#50104793) Journal

    So many processes have dependancies that are so ingrained in corporate apps it will be impossible to get rid of. We still use IE 6 at work and even xp eol couldn't kill it due to 2 must have apps which are impossible to ever replace. Our training only works with ancient insecure flash 11 at work due to a 10 year old version of premier which created our slides. Lock the browser out of flash and we will stick with obsolete version

    • Re:Flash is like IE 6 (Score:4, Insightful)

      by Anonymous Coward on Tuesday July 14, 2015 @02:30AM (#50105117)

      Well maybe your job should look into hiring someone to remake the old code into newer one. Saying it's "impossible to ever replace" is the problem, stop thinking that way and start thinking "what can be done to replace this dinosaur"

    • Wow, and until now I always thought your sig was sarcastic.

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      Just making click-to-play the default would greatly hasten the death of Flash. As well as mildly annoying users who couldn't figure out how to whitelist, it would kill all Flash ads and drive-by malware.

      Microsoft had success with this method when Vista came out. At first every app produced multiple UAC prompts constantly, but within months all the popular ones had been updated to avoid doing that and by the time Windows 7 came out most were well behaved.

  • Do your part nerds! (Score:5, Interesting)

    by trawg ( 308495 ) on Tuesday July 14, 2015 @12:58AM (#50104807) Homepage

    Uninstall Flash. Just stop using it. Encourage your friends to do the same.

    I uninstalled it a couple months ago. I no longer have to worry about updating it or being exposed to the vast amount of vulnerabilities - it should be clear to everyone by now that it is a /major/ vector for infection.

    Only a few times have I hit content that still requires Flash - usually sites that have an old Flash video player. Most big sites or sites using modern players happily support HTML5 video. Those that don't I can live without. (Bonus: far less irritating animated ads. For now.)

    But make sure you provide feedback to sites that still have Flash - let them know you can't use the site properly. Fortunately - largely thanks to Apple's refusal to allow Flash in iOS - there are fewer and fewer of these today.

    • Re: (Score:3)

      by tepples ( 727027 )

      Most big sites or sites using modern players happily support HTML5 video.

      Last time I checked, Albino Blacksheep, Dagobah, Weebl's Stuff, Homestar Runner, Newgrounds, and Kongregate were all Flash. When did this change?

    • Uninstall Flash. Just stop using it. Encourage your friends to do the same.

      I would, but I listen to Pandora Radio on my desktop while at work. Pandora needs flash.

      I don't know if it is something that I am doing, but in the last month or two, flash seems to crash far, far more often. Several times per day (and often several times per hour). I have installed a flash-block plugin and will see if things improve.

      • Uninstall Flash. Just stop using it. Encourage your friends to do the same.

        I would, but I listen to Pandora Radio on my desktop while at work. Pandora needs flash.

        Facepalm. Dude, it's called a boycott. It's part of the idea that you have to make compromises for it.

        • Facepalm. Dude, it's called a boycott. It's part of the idea that you have to make compromises for it.

          So you think that Pandora will change their ways if a small fraction of one percent of their userbase stops using it?

    • Re: (Score:2)

      by Kkloe ( 2751395 )
      nah I rather keep it for the porn and illegal video streaming sites, oohhh and dont forget all the fury porn flash "games"

  • Not going to happen any time soon... (Score:5, Informative)

    by David_Hart ( 1184661 ) on Tuesday July 14, 2015 @01:01AM (#50104815)

    Too many internet pages rely on Flash for video and advertisements... and,as much as we hate them, advertisements means money...

    I'm not saying that progress isn't being made. Youtube dropped Flash this year and is now using HTML5 as the default for video, but that doesn't fix legacy videos.
    http://www.theverge.com/2015/1... [theverge.com]

    My thought is that Flash will be around for another 3 to 5 years. The quoted "18 months" is just wishful thinking....

  • The Anti-Monitor Couldn't Even Do This (Score:5, Insightful)

    by Guy From V ( 1453391 ) on Tuesday July 14, 2015 @01:12AM (#50104855) Homepage

    Is Professor Zoom the Facebook CSO now? I can't keep up with all the retcons.

  • I have a better idea. (Score:4, Funny)

    by epyT-R ( 613989 ) on Tuesday July 14, 2015 @01:17AM (#50104879)

    Despite flash being a scourge, it would be better for the internet to pick a day to kill off facebook.

    • Why, because you don't like a service that 1.4 billion people around the world use?

      • Re: (Score:3)

        by epyT-R ( 613989 )

        No, it's not simple like or dislike. Online social dynamics were better when they were more anonymous. Sites like facebook trashed these old rules by forcing people to use real identities and linking them to other real life details online. This way they could fuel adolescent-like narcissism and insecurity in users as they interacted with each other, keeping them psychologically and socially dependent on the service. The company uses this fermented mentality to continually extract information on its user bas

        • Online social dynamics were better when they were more anonymous

          Yep like 4chan became the bastion of online social dynamics. I would just call you a retard now to further disprove your point because I am hiding behind a pseudonym but I'll educate you instead. There's no difference in social dynamics now than before. There are still places for anonymous online venting, and if that' your idea of what it a social interchange requires then by all means continue to do so, Facebook does nothing to stop you.

          On the flip side Facebook is about a circle of people you know, so rig

      • The exact same argument can be applied to Flash, at least a few years ago when it was used by vast majority of users on the internet.

        • There's no argument there. You are 100% right. Facebook is transient but it won't die because a single person doesn't like it, just like Flash didn't die because a single person didn't like it.

          These things die when they are replaced with something of equal or greater value to the end users, or if the value proposition ends. Flash's value started eroding a long time ago, before HTML5. Now please go and create something amazing to replace Facebook, because it's not going to simply get switched off due to rand

  • Porn (Score:3, Insightful)

    by Anonymous Coward on Tuesday July 14, 2015 @01:27AM (#50104907)

    One of the (in my opinion) major aspects should not be forgotten: As long as porn sites like youporn rely on flash, flash will not die.

  • just installed Watch with MPV & works great (Score:2, Informative)

    by Anonymous Coward

    https://addons.mozilla.org/en-us/firefox/addon/watch-with-mpv/

    I need bbc news video clip support though as bbc news web developer basically suck at there jobs. They push HTML5 video for iPads which don't support Adobe Flash, but output a message telling everybody else who doesn't have Adobe Flash installed to install it. I DON'T want to f'ing install it you idiots. I like the Gardian better, but they've got fewer articles. The Gardian does appear to do HTML5 by default too.

  • Obligatory Devil's Advocate (Score:5, Interesting)

    by Waccoon ( 1186667 ) on Tuesday July 14, 2015 @02:06AM (#50105033)

    Replace the word "Flash" with any other plugin or technology that geeks don't like. Will it still be okay if we go out of our way to kill it and make sure nobody can use it? Replace "Adobe" with "Free Software Foundation". Is that better? How about we talk about the Unity3D plugin? That's a plugin, too, just like Adobe PDF and Java, so that means it's bad. It's easy to pick on Flash and I can't say I really like the plugin, but when organizations with a large amount of industry influence start talking about killbits, that makes me really nervous.

    I'd have no problem with Facebook urging other web sites to stop using Flash, especially if they're willing to support development of an alternative. When they talk about actively killing things for the good of the community, that's going too far. This starts leaning to the direction that it's okay to execute prisoners because nobody likes them.

    Sometimes I'm really disturbed by the will of the community. I'm already pissed enough that I can't run certain Java applets [falstad.com] anymore because the great Oracle says I'd hurt myself if I tried. Heaven forbid they give me a warning and I make up my own mind. As for grandma's computer, I could just configure the web browser to not use Java or install any other plugin.

  • The TFA page cited in the post has an embedded video. It is the "SoundCloud" video player, which my Ghostery plugin blocked.

  • for its videos. Please start by fixing that first.

  • Ton of legacy (Score:3)

    by Zarhan ( 415465 ) on Tuesday July 14, 2015 @03:15AM (#50105267)

    There's plenty of legacy stuff in intranets that require flash that is *not* easily upgradeable, or at least up to the user.

    Case example on where I run every now and then in work, Cisco IMC controllers (server management cards).

    http://www.cisco.com/c/en/us/t... [cisco.com]

    Their UI is based on Flash (and Java), for remote console, status data, and so on. If I point a browser to a CIMC server, the first thing I see is "Install flash player" if it's not already installed. Even if Cisco would release an upgrade *today*, how often are people interested in rebooting their servers for firmware upgrades as long as it's running ok?

    • Case example on where I run every now and then in work, Cisco IMC controllers (server management cards).

      Yes, that is almost as dumb as HP printers requiring Java to do shit you could have done with Javascript, even then. Same story. All that means is you should avoid Cisco in the future. They have proven themselves to be dumbfucks. From the first router to a backdoor for every router, so classic.

  • Getting rid of flash won't improve Facebook. You can't fix stupid.

  • Good Riddance! Just like we killed off GIF /SARC (Score:5, Insightful)

    by TheRealHocusLocus ( 2319802 ) on Tuesday July 14, 2015 @07:41AM (#50106409)

    I'm so glad there's a move afoot to kill Flash, in which a few well-connected standards goonies who are not satisfied with the rollout for HTML5 think that no campaign to capture hearts and minds is complete without some form of digital strip mining, in which major portions of the Internet heritage are blocked by "newer, better" software and rendered dark, obsolete and broken overnight. It's just like a seat belt law,right? It's all about protecting Joe Sixpack from driving drunk on the web. And the big important players like Facebook have naught but our precious safety as a motive. /SARC

    I hated Flash for its abuses and excesses at first, but I have grown fond of the things it has become useful for, and does well. Here is a low level instruction set of instruction and vector graphic primitives that has been used to accomplish amazing feats. Even self-contained and offline feats. Things that will never make it to HTML5 without a serious ride in the newer is better and bigger and much slower (though our processors are faster and memory is bigger so we pretend that it's faster and smaller) bloat-mobile. /NOTSARC

    Remember when the Whole Damned World was ready for a GIF-killer? And PNG was one little tiny step away from doing so? The png image format was so ready to dominate the world, and we were maybe a few open source developer weekends away from having a GIFlike format with comparable non-encumbered LZW compression, and (as promised) simple animation too. To be able to animate in full RGB without shoving palettes down our collective throats. Well, some people on the Standards Committee, some <BLINK>anti-blink tag hipsters</BLINK> who were Running With Scissors cut out that promise and proceeded to punt the animate part of the bargain into the Next MNG generation, which would be a video-killer too and would happen Real Soon Now. The upshot was that the PNG rocket sled hit a big pile of jello, While MNG [wikipedia.org] was languishing, a whole generation of web-folk faced difficult times with GIF in which open source tools generated bloaty files unless you compiled them yourself (because they did not to fork money or paperwork to license the LZW) and the world was treated to... more of GIF! It is today's GIF! And do we have those <BLINK>anti-blink tag hipsters</BLINK> to thank? No, that is not really fair, they just wanted to build a better world. But bad decisions in retrospect do happen. /NOTSARC

    But Flash is different! Never mind how useful it has become, it must be killed. Because in this silly Collectivist world of planned obsolescence it is not enough to succeed. Something old must be declared evil, be systematically dismantled and ultimately fail not on its own lack of merit, but because some all seeing Standards Committee wishes to keep Joe Sixpack safe while driving drunk on the web. The insurance companies have already factored in the liability for HTML5 vulnerability coverage so we're good there. /SARC

    From this day forward, any zero day vulnerabilities in HTML5 code will be tolerated in the civilized manner, and any emerging Flash exploits will be blamed on the Iranians and North Koreans, and those who continue to use and support Flash will have their hip-credentials revoked. /NOTSARC And we're ready to destroy all those vinyl LP phonograph records too, all the music that matters has been reissued, yeah, fuck that old music. /SARC

    Because, God Forbid, the whole human race could never just gather to re-write a popular primitive procedural language without creating a shitload of new exploitable errors. It just cannot be done. /SARC

  • that needs to go HTML5 soon and make it a free upgrade as well.

  • I prefer Flash video to HTML5 video. (Score:3)

    by damnbunni ( 1215350 ) on Tuesday July 14, 2015 @09:38AM (#50107293) Journal

    Why? Because with Flash video I just get a big blank box I can click to play it, and shit never autoplays.

    Autoplaying video needs to die.

Slashdot Top Deals

Understanding is always the understanding of a smaller problem in relation to a bigger problem. -- P.D. Ouspensky

Close