3 ms·

Sorry, nothing happened. Firefox on OSX. Prolly the worst [anti-Flash] troll post so far.

• radley 17y ago
  [Updated for technical clarity, rather than refuting bias] Reading the original article, the issues seems to be with AVM1, the portion of the Flash Player dedicated to legacy Flash (v8 and older). Flash Player was updated in 2006 to include AVM2 and that's been Adobe's focus ever since. Translation for HTML people: it's like pointing out IE6 bugs that still show up in IE7. This is nothing more than an out of date flame post. (Downvoters: have you actually looked at the nature of the bug?)
  • evgen 17y ago
    Adobe's CTO claimed that they don't ship versions of Flash that are known to crash. The bug this triggers is more than a year old and the only versions it does not crash is the most recent _beta_ version of Flash. The post merely points out the deception in Lynch's claims.
    • radley 17y ago
      I updated my post to explain why the bug is irrelevant.
      • Dbug 17y ago
        Anything, including corrupt files, that can crash it is relevant because it is also a security vulnerability.
        • deleted 17y ago
          [deleted]
        • radley 17y ago
          By my understanding, there will always be lots of ways to intentionally crash a browser. I know very little about crash-related security vulnerabilities, so I didn't see this threat as relevant.
          • scommab 17y ago
            I think you might be thinking of locking up the browers, rather then crashing it. You can easily create a javascript program that will run a loop that will make your browser non-reactive. But this is very different the plugin actually crashes. The security issues comes in to play because when the plugin crashes it is doing something it wasn't designed to do. So (in theory) someone malicious could take this crash and make the flash player do something specific it wasn't designed to do like run some code outside of it's sandbox. Which obviously would be a very big deal. This is different then the lock up/DoS case where a product is doing what it is meant to do, but will just take a very long time (maybe forever) to finish it.
  • stevenwei 17y ago
    Considering it's still occurring in the most recent release of Flash Player 10, I'd say it's nothing like pointing out IE6 bugs at all. If they had actually fixed that bug in the Flash plugin and people were using older versions, then you might have a point.
    • radley 17y ago
      The bug has to do with loading 5+ year old Flash 7/8 swfs. A better analogy would be he's making a stink about a Carbon bug for obsolete OS 8/9 apps. Carbon still ships with OSX and serves the same purpose as AVM1 in Flash Player: basic (but not perfect) backwards-compatibility for legacy code.
      • stevenwei 17y ago
        I'm surprised that more priority hasn't been put into fixing it though. A bug that crashes the browser out in the wild for a year and a half? Someone malicious could do some pretty obnoxious things with it. Incidentally this use case isn't completely unheard of. There is still a lot of AS2 content out there that companies haven't bothered to migrate to AS3 yet (for whatever reason).
      • bad_user 17y ago
        If you don't have the resources for fixing old known bugs, then you should remove backwards compatibility, especially since bugs are caused by buffers/stack overflows / segmentation faults ... which could lead to unauthorized code executed on your machine. How else do you think botnets are made?
• cracell 17y ago
  Crashed for me on Firefox 3.6 OS X 10.6. Google Chrome 4.0 gracefully handled it through (only the Flash Plugin crashed)
• bad_user 17y ago
  Yay, the "works on my machine" syndrome ... love it :-)