5 ms·

I don't remember the flash permissions model being problematic. I saw two main problems with flash: - it was a lightweight and compatible way to insert animate

by theamk 9y ago

I don't remember the flash permissions model being problematic. I saw two main problems with flash: - it was a lightweight and compatible way to insert animated ads. The animation consumed a lot of CPU. This is why most people blocked flash, and why most Apple refused to support it on ipads. - it had horrible security record. For some reason, Adobe could not fix the bugs in the Flash plugin. This is why IT departments started to block it. For more details, see this very interesing Steve Job's letter why Flash would never run on i-devices: https://www.apple.com/hotnews/thoughts-on-flash/ https://www.apple.com/hotnews/thoughts-on-flash/ (note it does not even mention sandboxing model)

dyarosla 9y ago
Apple's main qualm at the time though was "If developers grow dependent on third party development libraries and tools, they can only take advantage of platform enhancements if and when the third party chooses to adopt the new features. We cannot be at the mercy of a third party deciding if and when they will make our enhancements available to our developers." They've since done a double-take and have accepted games built in Unity and apps built in website-wrapper frameworks (also many of which are proprietary). Apple had many reasons to want to rightfully kill off Flash. But the thing is, it wasn't all bad. Note that I do agree however that slow security fixes and Flash causing crashes / consuming lots of CPU are real concerns.
fenomas 9y ago
> it had horrible security record I think this is overstated. Sure there were Flash 0-days, but then it was probably also the highest-value 0-day target in the world. In those days Flash was more widely installed than any single browser, or even OS. It may well have been the most widely-installed application period. The point being, if Flash was inherently horrible for security (in some way that, say, Java wasn't) there would have been exploits every day of the week and half the planet would have been owned. I think the reality is that it was just a really big target, which Adobe (with a lot of help from Google) kept relatively secure, all things considered.
- vizeroth 9y ago
  Just because no one managed to create WannaCry for Flash doesn't mean the security problems are overstated. They've published over 50 vulnerabilities in Flash this year, when the installed base is in the toilet. Java may be worse (or it may not be, but I would avoid installing either on most client machines), but blowing a bigger hole in the system's defenses doesn't really make the slightly smaller hole any less of a problem, it just changes your priorities in patching. The only thing impressive about Adobe's security record is the number of times their source code was compromised.
  - fenomas 9y ago
    To be clear I was talking about the era when a lot of people were working on Flash - on attack or defense. These days (since, say, 2013-ish?) I doubt there are many working in either direction. The point being, in its heyday Flash was a bigger target than any web browser, and I don't think its attack surface was much smaller. If Flash had 10x more vulnerabilities than browsers did that'd be bad, but I don't think that was the case.
- Joeri 9y ago
  I found a security issue in flash accidentally while working on a CAD viewer in 2005. They fixed it promptly, but even a minimal amount of fuzzing would have uncovered it. I'm not so sure they did all they could on the security front.
IIAOPSW 9y ago
That's Job's stated reasons. My understanding is that Apple/Adobe rivalry goes way back. "Thoughts on Flash" was Job's "now the tables have turned" moment. Once upon a time Adobe wouldn't make a version of their software for Apple machines cause it was to niche.
- deleted 9y ago
  [deleted]

by theamk 9y ago

dyarosla 9y ago

Apple's main qualm at the time though was "If developers grow dependent on third party development libraries and tools, they can only take advantage of platform enhancements if and when the third party chooses to adopt the new features. We cannot be at the mercy of a third party deciding if and when they will make our enhancements available to our developers." They've since done a double-take and have accepted games built in Unity and apps built in website-wrapper frameworks (also many of which are proprietary). Apple had many reasons to want to rightfully kill off Flash. But the thing is, it wasn't all bad. Note that I do agree however that slow security fixes and Flash causing crashes / consuming lots of CPU are real concerns.

fenomas 9y ago

> it had horrible security record I think this is overstated. Sure there were Flash 0-days, but then it was probably also the highest-value 0-day target in the world. In those days Flash was more widely installed than any single browser, or even OS. It may well have been the most widely-installed application period. The point being, if Flash was inherently horrible for security (in some way that, say, Java wasn't) there would have been exploits every day of the week and half the planet would have been owned. I think the reality is that it was just a really big target, which Adobe (with a lot of help from Google) kept relatively secure, all things considered.

vizeroth 9y ago
Just because no one managed to create WannaCry for Flash doesn't mean the security problems are overstated. They've published over 50 vulnerabilities in Flash this year, when the installed base is in the toilet. Java may be worse (or it may not be, but I would avoid installing either on most client machines), but blowing a bigger hole in the system's defenses doesn't really make the slightly smaller hole any less of a problem, it just changes your priorities in patching. The only thing impressive about Adobe's security record is the number of times their source code was compromised.
- fenomas 9y ago
  To be clear I was talking about the era when a lot of people were working on Flash - on attack or defense. These days (since, say, 2013-ish?) I doubt there are many working in either direction. The point being, in its heyday Flash was a bigger target than any web browser, and I don't think its attack surface was much smaller. If Flash had 10x more vulnerabilities than browsers did that'd be bad, but I don't think that was the case.
Joeri 9y ago
I found a security issue in flash accidentally while working on a CAD viewer in 2005. They fixed it promptly, but even a minimal amount of fuzzing would have uncovered it. I'm not so sure they did all they could on the security front.

IIAOPSW 9y ago

That's Job's stated reasons. My understanding is that Apple/Adobe rivalry goes way back. "Thoughts on Flash" was Job's "now the tables have turned" moment. Once upon a time Adobe wouldn't make a version of their software for Apple machines cause it was to niche.

deleted 9y ago
[deleted]