10 ms·
“Adobe is aware of a report that CVE-2016-1010 is being actively exploited”
- jorgecurio 11y agoAdobe exploits are still a thing. I regularly get emails from silicon valley investors asking for me to open their pdf file which contains their propsal...I chuckle everytime at that line, THERES SIMPLY NO WAY IM GOING TO OPEN A PDF or visit a site with Flash turned on in 2016.
- xentronium 11y agoMost browsers have a sandboxed pdf reader implementation. What are you afraid of?
- deathy 11y agoThey are much better in my opinion, but not perfect. Last year there was a pdf.js vulnerability: https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/ https://blog.mozilla.org/security/2015/08/06/firefox-exploit...
- korm 11y agoBrowsers are not perfect and have vulnerabilities too sometimes. And operating systems..
- RaleyField 11y agoThat's why I'm on Chrome, because it's sandboxed. In November we'll be celebrating 10th anniversary of lagging behind IE if electrolysis isn't integrated into Firefox stable builds.
- zanny 11y agoIs the PDF format itself broken, or just the awful Adobe Reader? There are dozens of PDF reader implementations, including all the major browsers. I cannot imagine they are all exploitable in the same way.
- ajross 11y agoEarly PDF was quite sane. It was the Postscript imaging model turned into a binary bytecode format with almost all the programmability features removed. Later on it got wonky (though never even close to the extent to which Flash did!) with all the hypertextification features. But basic PDF is actually one of the Great File Formats in computer history.
- wlesieutre 11y agoHypertextification features? Ha! Try 3D model viewer: https://youtu.be/n8KgxaNYRe4?t=27 https://youtu.be/n8KgxaNYRe4?t=27
- jfoutz 11y agothe javascript stuff made me nuts when i was working on a save as pdf project.
- icebraining 11y agoThe sane version is the one defined as the PDF/A ISO standard. Stuff like pulling remote resources, embedding executable code, etc are all forbidden. https://en.wikipedia.org/wiki/PDF/A https://en.wikipedia.org/wiki/PDF/A
- ajross 11y agoI didn't realize that this standard existed. Thanks for the link, that's very helpful to know. I've always viewed "modern PDF" as an ad hoc thing defined by the intersection of whatever was supported by the popular free renderers.
- lqdc13 11y agoThe standard is 1000 pages long. Most reader implementations are written in C/C++. They are of course exploitable in different ways. Adobe sometimes does not follow its own spec. People publishing PDFs sometimes use that non-standard behavior to display some graphics. This is especially true with many research papers that only render on Adobe Reader.
- noondip 11y agoYou are depriving yourself of a lot of information by avoiding files based solely on file extension (most academic papers are in PDF format, for example). Avoiding Flash, on the other hand, I completely understand.
- cm2187 11y agoI am happy to run some exe on my machine. I would never run an exe I have received by email. Not sure I get your point.
- lqdc13 11y agoWhy not open it in firefox with pdfjs? PDF is still the single best/easiest format to use to render some things.
- krylon 11y agoI have on few occasions seen PDF files where the text looked horrible in pdfjs. All in all, it's very useful, though, to quickly look at a PDF before saving it. For regular use, I have come to really like SumatraPDF on Windows, it is relatively lightweight can be used without an explicit installation (hence no admin privileges are required to get it to work), and most importantly, it saves the position on opened PDF files, so if I open a file again later, I am back right where I stopped reading.
- cozzyd 11y agoDo you only accept plain text?
- paulddraper 11y agoYou mean open a PDF with Abobe software?
- abhv 11y agoAdobe's attitude towards security is mediocre, possibly irresponsible. They know that Flash is being phased out, so they invest no effort. For 2014--15, they relied on Google Project Zero to find and sometimes even fix their security flaws.
- yborg 11y agoI especially enjoy the ad for "another Adobe product I might enjoy" that they serve up at the end of the standard install process if you don't autoinstall. "Oh yes please, may I have another?"
- melling 11y ago"Thoughts on Flash" is almost 6 years old. http://www.apple.com/hotnews/thoughts-on-flash/ http://www.apple.com/hotnews/thoughts-on-flash/ Adobe is a business. They need to move on too. When companies like Microsoft or Adobe, for example, let users hang on for too long to legacy software, it hurts everyone.
- esnard 11y agoIt's not an easy process to stop maintaining softwares for such large companies. Flash is still widely used, and so many websites still rely on it that it will take a lot of time to fully abandon it, so Adobe will still have to fix all security issues for years.
- icebraining 11y agoNobody is asking them to build new features, just fix security issues. And Flash is still a supported platform by their designing tools like Animate.
- Ajedi32 11y agoAdobe Animate isn't a new tool, fyi. It used to be called "Adobe Flash Professional". They renamed it in order to distance it from Flash.
- throwmeawaybaby 11y agoFuck Adobe. I really regret investing into their software suite. They have no vision (remember how they defended flash was the future, arguing against Steve Jobs only to later shut it down? Remember flex?? The CEO is an arrogant jerk[1] and they fucked their loyal customers by taking their softwares that we paid for in full, added some extra code that periodically pings their servers with ability to make it unusable from their remote servers and called it "Creative cloud". I hope this company rots to hell and some YC startup comes up with something much better and totally destroys them. It's about time. [1]https://www.youtube.com/watch?v=78yigV0GYGQ https://www.youtube.com/watch?v=78yigV0GYGQ
- jtokoph 11y agoI'm a bit confused about the title of this post. The actual title of the blog post is "Security Updates Available for Adobe Flash Player (APSB16-08)". The current HN link text is “Adobe is aware of a report that CVE-2016-1010 is being actively exploited”. I can't help but think that the HN post has that title to give the impression that Adobe knows about an issue and isn't fixing it. But isn't this blog post an announcement about patches that have be deployed for people to install and Adobe included that line to emphasize the importance of the patch?
- dvfjsdhgfv 11y agoI think the intention here is to make people realize they should have disabled Flash a long time ago and use it only for a limited number of critical whitelisted websites (like banking sites built on Air). If you do otherwise, you're increasing the risk of being a victim of a malicious attack.
- novaleaf 11y agoFUD is FUD, and this is preaching to the choir anyway.
- enzanki_ars 11y agoOut of curiosity, what bank do you know of that uses Air? That seems like a bank that someone should never use if they value security.
- dvfjsdhgfv 11y agohttps://www.adobe.com/showcase/casestudies/raiffeisen/casestudy.pdf https://www.adobe.com/showcase/casestudies/raiffeisen/casest... Marketed by Adobe as a "success story" - the customers are a bit less happy.
- planckscnst 11y agoWow, I can see it way now. I had first imagined a community of loyal Adobe fans wondering why Adobe hasn't addressed CVE-whatever-is-up-today and getting pitch-forky. I saw the title as a response to that: in the tone of "Yeah, folks, Adobe knows. Here's the fix, now calm the fuck down."
- simonmales 11y agoCompletely disabled Flash in my main browser (Firefox) a couple months ago. The occasional video player doesn't have a HTML5 fallback, but otherwise it's all good.
- esnard 11y agoNote to Chrome users: Chrome comes with a bundled version of Flash, so it's not because you didn't install it that Flash isn't installed.
- Yaggo 11y agoCompletely disabled Flash in my main browser over decade ago.
- Ajedi32 11y agoI've got Chrome set to only run flash when I explicitly allow it. (chrome://settings/content -> Plugins -> Let me choose when to run plugin content) All plugins are blocked unless I right click on the area where they appear on-screen and click "Run this plugin". Over time I've found myself needing to do that less and less.
- suneilp 11y agoIs there a site which lists details of these CVE security issues? The closest thing I could find via google is cve.mitre.org but CVE-2016-1010 is "reserved" for future usage.
- fulafel 11y agoIn this case Adobe is mentioning only the "registration number" of the vulnerability to avoid revealing publically what the actual vulnerability is. Don't you feel safer already?
- orbitingpluto 11y agoI am failing to download the signed key in Debian Linux when running update-flashplugin-nonfree from the flashplugin-nonfree package. (Key not maintained by Adobe...) Meanwhile I just noticed that my Windows Firefox plugins for Reader DC are not 2015.010.20060 but .20056. I leave these completely disabled at all times anyway. And nothing annoys me more than having to download the self-deleting autodownloader in Windows. What a total waste of time for something I rarely use these days...
- progressive_dad 11y agoAnyone have a link to a description of the exploit?