5 ms·
Adobe's CTO claimed that they don't ship versions of Flash that are known to crash. The bug this triggers is more than a year old and the only versions it does
by evgen 17y ago
Adobe's CTO claimed that they don't ship versions of Flash that are known to crash. The bug this triggers is more than a year old and the only versions it does not crash is the most recent _beta_ version of Flash. The post merely points out the deception in Lynch's claims.
- radley 17y agoI updated my post to explain why the bug is irrelevant.
- Dbug 17y agoAnything, including corrupt files, that can crash it is relevant because it is also a security vulnerability.
- deleted 17y ago[deleted]
- radley 17y agoBy my understanding, there will always be lots of ways to intentionally crash a browser. I know very little about crash-related security vulnerabilities, so I didn't see this threat as relevant.
- scommab 17y agoI think you might be thinking of locking up the browers, rather then crashing it. You can easily create a javascript program that will run a loop that will make your browser non-reactive. But this is very different the plugin actually crashes. The security issues comes in to play because when the plugin crashes it is doing something it wasn't designed to do. So (in theory) someone malicious could take this crash and make the flash player do something specific it wasn't designed to do like run some code outside of it's sandbox. Which obviously would be a very big deal. This is different then the lock up/DoS case where a product is doing what it is meant to do, but will just take a very long time (maybe forever) to finish it.