3 ms·
Shouldn't a fix come out with that announcement? If they're offering a temporary fix, shouldn't they at least push that temp fix as an update, and fully update
by ihodes 16y ago
Shouldn't a fix come out with that announcement?
If they're offering a temporary fix, shouldn't they at least push that temp fix as an update, and fully update the issue later? This leaves the non-technically inclined out in the cold, and informs those who may not know of the exploit of its existence.
Just something as simple as removing authplay.dll for Acrobat and Reader, and even upgrading the current version of Flash Player to the 10.1 beta, just temporarily… anything other than just announcing it and not patching it at all.
I don't know if this is a standard way of dealing with zero day exploits, but it sure doesn't seem like a good way.
- dminor 16y agoSince it's already in the wild, better to let people know so they can use the workaround.
- tptacek 16y agoA thousand times, this! Paternalism on the part of vendors keeps people who are willing to make tradeoffs from defending themselves.
- pan69 16y agoI believe its Adobe policy to only announce security issues if a fix is available. At least, that's how the policy was a few years back. I assume it's still the same.
- tptacek 16y agoIt's most vendor's policy, but it usually goes out the window when reports of exploitation surface. If you're hearing about the attacks, it's real, it's bad, and there's no point to choreography anymore.
- yock 16y agoAn inadequately-tested update is going to carry some risk of causing its own harm. If this Flash update is indeed not-ready-for-prime-time (heck, they may even know of specific issues) then it becomes irresponsible to push it out to all users. You've essentially traded a known problem for an unknown problem, as well as complicated the process by which the original problem is resolved.
- ja27 16y agoIt was a good reminder for me to disable Flash and PDF (and 30 other plugins) in Chrome. I use Chrome for almost all my browsing, but if I need Flash or something else on a specific site, I can open it in IE or Firefox. Maybe someday Chrome will have a plugin "whitelist" for sites so I can only allow Flash on the sites I want to.
- DrSprout 16y agoThat's really weird. I use firefox with NoScript for all my browsing, and if I need Flash or something I fire up Chrome. Of course, this is on desktop Ubuntu. On my Droid I guess I just use Chrome...
- CrazedGeek 16y agoFlashblock? https://chrome.google.com/extensions/detail/gofhjkjmkpinhpoiabjplobcaignabnl?hl=en https://chrome.google.com/extensions/detail/gofhjkjmkpinhpoi...
- zppx 16y agoSince it's a 0day I think it would require ninja coders to test, go to the code and fix it in the same day, for complex and legacy code (I think Adobe software falls into these categories), from my experience watching security related lists I can say that generally you publish a measure to mitigate the vulnerability and maybe a workaround before publishing a stable fix. Securing and maintaining software up-to-date in a non-intrusive way is hard in a way that works for all (ie, personal computers and large networks of computers), I think it is also a good business opportunity.
- icefox 16y agoflash block?
- tomlin 16y agoIt would be nice to know we're not just beating up on them because it's trendy and perhaps hold them accountable on the same level as other software companies. It's possible that they were in the right by announcing an issue, rather than ignoring it.