6 ms·

Just out of curiosity - could there be issues other than just performance here? For ex., could it be that Flash based ads can identify user/device contributing

by harigov 11y ago

Just out of curiosity - could there be issues other than just performance here? For ex., could it be that Flash based ads can identify user/device contributing to privacy issues?

cpeterso 11y ago
Flash provides much more identifiable fingerprinting information (e.g. detailed information about your system fonts) and looser "Flash cookie" (Local Shared Objects) restrictions than JavaScript. https://panopticlick.eff.org/index.php?action=log&js=yes https://panopticlick.eff.org/index.php?action=log&js=yes
- exodust 11y ago
  Did you read their conclusions? Javascript is most certainly a method for fingerprinting, regardless of Flash presence. "Browser developers should also consider what they can do to reduce fngerprintability, particularly at the JavaScript API level." "We identified only three groups of browser with comparatively good resistance to fngerprinting: those that block JavaScript, those that use TorButton, and certain types of smartphone." Not having Flash doesn't mean you're immune to fingerprinting. That said, it would be nice if Adobe prevented system font lists via Flash.
  - cpeterso 11y ago
    That is true. Not having Flash does not mean you're immune to fingerprinting, but having Flash does mean more (a lot more) unique fingerprinting data is available to trackers. I wonder if browsers' plugin sandboxes could block Flash from calling the OS API to enumerate system fonts.
awalton 11y ago
Or possibly the constant stream of Flash security vulnerabilities that Adobe can't seem to patch out.
kevinchen 11y ago
Flash also has a ton of vulnerabilities and a huge codebase, and according to Apple, caused a ton of crash reports from their computers.
- dogma1138 11y ago
  TBH if a Flash crash or any other user space application crash causes a system crash it's an issue with the OS. Steve Jobs at the time said that every time MacOS crashes it's more often than not Flash's fault, which wasn't really true and would only speak "wonders" of how well MacOS isolates user space applications... On the security issues it's some what true because the nature of Flash, applications like these are almost impossible to sandbox properly unless you have an operating system that sandboxes everything by default. Flash it self these days is pretty much code execution as a service it can do pretty much everything you want some browsers sandbox it better than others but it's still intended to pull code from the ether and run it and when you have a setup like that you will never be able to limit it effectively. Flash can be phased out only because it's mostly used to play various forms of media, but any other use of it cannot be converted to HTML5. If Javascript (as it's parsed and executed in browsers) will ever get to the point of being as flexible and powerfull as Flash is today you'll see browser based RCE vulnerabilities skyrocket also, JS is safe to use only because the browsers restrict it, Flash and AIR are intended to support everything from an animated ad to a full desktop application. Just look at Node.JS (and many NoSQL DB's that used JS) in it's early years almost every (non-DOM based) cross-site scripting vulnerability in a Node.JS application could result in remote code execution on the server, even today you can still easily cause it if you don't handle the code properly one stupid eval in your node code which was there for lazy debugging can lead to your box getting owned in minutes.
  - Arcanum-XIII 11y ago
    They're not system crash but application crash, both are reported on MacOS X. So no, Flash didn't crash the OS, only apps like Safari, Firefox or Chrome. Isn't it enough ?
    - 11y ago
tyingq 11y ago
I'll suffer the downvotes, but going forward "Flash Ads" == non-Google provided ads. It doesn't hurt Google to hobble ads from competing networks.
- userbinator 11y ago
  The other ad networks likely won't be using Flash anymore either, which makes blocking ads more difficult - and that is a good thing to ad networks in general. Thus I won't say it's Google against others, and while it may seem so in the short term, in the long term Google and other ad networks benefit from it (while the users suffer...?)

by harigov 11y ago

Just out of curiosity - could there be issues other than just performance here? For ex., could it be that Flash based ads can identify user/device contributing to privacy issues?

cpeterso 11y ago

Flash provides much more identifiable fingerprinting information (e.g. detailed information about your system fonts) and looser "Flash cookie" (Local Shared Objects) restrictions than JavaScript. https://panopticlick.eff.org/index.php?action=log&js=yes https://panopticlick.eff.org/index.php?action=log&js=yes

exodust 11y ago
Did you read their conclusions? Javascript is most certainly a method for fingerprinting, regardless of Flash presence. "Browser developers should also consider what they can do to reduce fngerprintability, particularly at the JavaScript API level." "We identified only three groups of browser with comparatively good resistance to fngerprinting: those that block JavaScript, those that use TorButton, and certain types of smartphone." Not having Flash doesn't mean you're immune to fingerprinting. That said, it would be nice if Adobe prevented system font lists via Flash.
- cpeterso 11y ago
  That is true. Not having Flash does not mean you're immune to fingerprinting, but having Flash does mean more (a lot more) unique fingerprinting data is available to trackers. I wonder if browsers' plugin sandboxes could block Flash from calling the OS API to enumerate system fonts.

awalton 11y ago

Or possibly the constant stream of Flash security vulnerabilities that Adobe can't seem to patch out.

kevinchen 11y ago

Flash also has a ton of vulnerabilities and a huge codebase, and according to Apple, caused a ton of crash reports from their computers.

dogma1138 11y ago
TBH if a Flash crash or any other user space application crash causes a system crash it's an issue with the OS. Steve Jobs at the time said that every time MacOS crashes it's more often than not Flash's fault, which wasn't really true and would only speak "wonders" of how well MacOS isolates user space applications... On the security issues it's some what true because the nature of Flash, applications like these are almost impossible to sandbox properly unless you have an operating system that sandboxes everything by default. Flash it self these days is pretty much code execution as a service it can do pretty much everything you want some browsers sandbox it better than others but it's still intended to pull code from the ether and run it and when you have a setup like that you will never be able to limit it effectively. Flash can be phased out only because it's mostly used to play various forms of media, but any other use of it cannot be converted to HTML5. If Javascript (as it's parsed and executed in browsers) will ever get to the point of being as flexible and powerfull as Flash is today you'll see browser based RCE vulnerabilities skyrocket also, JS is safe to use only because the browsers restrict it, Flash and AIR are intended to support everything from an animated ad to a full desktop application. Just look at Node.JS (and many NoSQL DB's that used JS) in it's early years almost every (non-DOM based) cross-site scripting vulnerability in a Node.JS application could result in remote code execution on the server, even today you can still easily cause it if you don't handle the code properly one stupid eval in your node code which was there for lazy debugging can lead to your box getting owned in minutes.
- Arcanum-XIII 11y ago
  They're not system crash but application crash, both are reported on MacOS X. So no, Flash didn't crash the OS, only apps like Safari, Firefox or Chrome. Isn't it enough ?
  - 11y ago

tyingq 11y ago

I'll suffer the downvotes, but going forward "Flash Ads" == non-Google provided ads. It doesn't hurt Google to hobble ads from competing networks.

userbinator 11y ago
The other ad networks likely won't be using Flash anymore either, which makes blocking ads more difficult - and that is a good thing to ad networks in general. Thus I won't say it's Google against others, and while it may seem so in the short term, in the long term Google and other ad networks benefit from it (while the users suffer...?)