8 ms·

Zero-day Flash exploit on all platforms, fix two weeks out

172 points by vl 16y ago

acqq 16y ago
Not just Flash -- it's an all-platforms Flash and all-platforms Reader vulnerability plus the Flash exploit for Windows in the wild! I beleive we can soon expect Reader exploits too.
- blasdel 16y ago
  The Reader exploits probably involve a PDF with embedded Flash. Synergy!
swombat 16y ago
To be fair, these things happen to many other platforms. Adobe's no exception. Two weeks seems a bit on the slow side from our hacker point of view, but it is in line with what you tend to get from large corporations (and actually fairly responsive... this would be a good response time for, say, Internet Explorer - and Flash has more installs on a much wider variety of OSes and hardware than IE). Let's not all gang up on Adobe just because they're, well, just as bad as everyone else.
- drinian 16y ago
  Please enumerate some of these "other platforms." Cannot cite IE (too obvious), or Reader (also Adobe).
  - swombat 16y ago
    Apple: http://www.engadget.com/2009/07/02/apple-patching-nasty-iphone-sms-vulnerability/ http://www.engadget.com/2009/07/02/apple-patching-nasty-ipho... ("fix by the end of this month") Google: http://seclists.org/webappsec/2006/q1/66 http://seclists.org/webappsec/2006/q1/66 (6+ months) I'm sure you can find more of them by searching for them (as I just did).
    - tptacek 16y ago
      It would be a more interesting challenge to name a vendor who isn't routinely issuing security advisories. I can't think of any.
  - jacquesm 16y ago
    Because you asked: http://www.google.com/search?q=java+zero+day+exploit http://www.google.com/search?q=java+zero+day+exploit
- raganwald 16y ago
  What is this "ganging up" you are speaking of? All I can see as of this moment are people making true statements about Adobe Flash's vulnerabilities, expressing their personal opinions about using Flash, sharing tips for avoiding or disabling Flash, and so on. As for the two weeks, it sounds like you are saying that the appropriate response to being told that you have to stand in line a day to buy bread is to shrug your shoulders since you're already standing in line a day to buy milk.
- IgorPartola 16y ago
  The trouble with Flash is that it is so ubiquitous. If Firefox gets a critical zero-day vulnerability, I'll use Chrome. If Chrome does, I'll use Firefox. With a Flash vulnerability over 90% of computers on the web are susceptible and there is no alternative.
  - jrockway 16y ago
    I haven't had Flash installed since that first vulnerability where Adobe pulled support for x86_64 Linux. The web looks the same. (I used Adblock anyway.) Yeah, some Youtube videos don't work... but you can get those videos elsewhere.
    - IgorPartola 16y ago
      How about things like Google Analytics? Do you miss tools like that?
      - jrockway 16y ago
        Never used it. I think spying on my users (with the help of Google) is unethical. (FWIW, I did do a project for a client once which involved extracting data via the Analytics API. It was very easy to do, and all the metrics were there, so it seems possible to make your own chart without requiring Flash. Hell, there is even an in-browser Javascript Analytics API and many in-browser Javascript charting libraries... so you could probably even do this in the form of a bookmarklet or user script!)
        IgorPartola 16y ago
        Heh, spying is a strong word. Without GA I would have had a harder time figuring out that more of my users are from Spain than from the US for one of my projects. Thanks for the info. I knew of their API but haven't used it yet.
- DavidBishop 16y ago
  Yes, but they happen on "other" platforms. Not "ALL" platforms. I think there are too many developers out there in large and small companies that don't understand they power they wield or the responsibility they have. I'm not a big fan of Flash. It had it's day. It wants to be everywhere, but it doesn't have the track record to be safe everywhere. I recently switched to Mac and have 3 (and only 3) crashes... all in Safari and all due to Flash. I'm all for a company making a great product and making it prolific. I just want that company to have the integrity and follow through to make it right. After all, when an exploit takes over my machine who's out the time and money?
sjtgraham 16y ago
Safari OS X users, may I recommend ClickToFlash for the time being. http://clicktoflash.com/ http://clicktoflash.com/
- frou_dh 16y ago
  Great recommendation, but I'd say the torch has been passed to the bona fide Safari extension of the same name: http://www.math.northwestern.edu/~hoyois/safariextensions/clicktoflash/ http://www.math.northwestern.edu/~hoyois/safariextensions/cl...
  - isani 16y ago
    One benefit that the original ClickToFlash has compared to the extension is that it works with web content embedded in applications other than Safari.
- rwmj 16y ago
  Just disable all plug-ins & Java in Safari preferences. It's a lot easier and you won't miss them. The only thing I used Flash for was watching videos, and HTML5 has that mostly covered now.
drinian 16y ago
I uninstalled Flash three months ago, and haven't encountered any serious problems. I have Greasemonkey scripts to let me download video from most of the YouTube-like sites.
- zackattack 16y ago
  please share said scripts
  - drinian 16y ago
    I'm not a heavy video watcher, so -- YouTube: http://userscripts.org/scripts/show/62634 http://userscripts.org/scripts/show/62634 Vimeo: http://userscripts.org/scripts/show/56677 http://userscripts.org/scripts/show/56677 Neither of these scripts requires a third-party site.
shib71 16y ago
Their openness about the vulnerability is refreshing. But I assume they're only publicising the vulnerability because of the people already exploiting it.
- rbanffy 16y ago
  > But I assume they're only publicising the vulnerability because of the people already exploiting it. That and someone notified them it exists. Were it only a vulnerability they could deny knowing, they would keep silent about it.
colonelxc 16y ago
Finally, something that works on flash in linux! I jest, but flash is the perfect target if you want to hit multiple OS's. Doesn't mean the malware authors will actually develop exploits/malcode for multiple OS's though.
- jakevoytko 16y ago
  Viruses that target multiple machines may not be as ridiculous as they sound. At least one researcher has a proof-of-concept that works on multiple platforms: http://www.wired.com/science/discoveries/news/2001/03/42672 http://www.wired.com/science/discoveries/news/2001/03/42672 As an aside, the alpha releases for Flash on Linux are surprisingly stable. The "gray rectangle" problem appears to be solved, which was the worst part of Flash on Linux in years past. Video streaming works well, but animations flicker and tear, so most online games are still unplayable.
  - TallGuyShort 16y ago
    Thanks for that link - I'm enjoying the article. I'm surprised to be reading so much talk about Flash not working very well on Linux. I'm using Fedora 13 (previously Ubuntu) on an extremely low-performance machine, and I haven't seen any problems in a very long time (at least a year). Video's, games, etc... all seem to work fine, and I generally pay a lot of attention to the Flash player because I'm a flex developer. The only time I struggle is when I watch HD video, but that's to be expected on my machine even if I'm watching a DVD.
    - pmjordan 16y ago
      Yeah, I haven't encountered much in the way of compatibility problems since 10.0 was released. (I'm on OpenSUSE x86-64.) It does have a habit of crashing and/or freezing for some time, I get the impression the latter is connected to sound (ALSA). Modern browsers survive the former quite well, luckily, and everything but Firefox recovers from the latter quickly, too. One thing that seems to reliably fail is full-screen video, though.
Devilboy 16y ago
If they've found it, is it still technically considered a 'zero-day' exploit?
- Deestan 16y ago
  Apparently not: http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack > A "zero day" attack occurs on or before the first or "zeroth" day of developer awareness
bl4k 16y ago
the best thing I have done recently is to disable all plugins, including flash: http://imgur.com/mCfqQ.png http://imgur.com/mCfqQ.png YouTube HTML5 support is good, and for any other video you can directly download. Browser runs a lot faster, web pages load faster, and I don't miss flash ads at all. I also disabled flash on my parents' computer, and my brothers, and enabled YouTube HTML5 for them. They haven't noticed it yet. It is only a matter of time before more corporate networks uninstall/block all flash, especially with the bad reputation it has with security. Flash is already dead to me, I can't wait until it is dead for everybody else as well
- aw3c2 16y ago
  Why not completely uninstall them instead?
  - frou_dh 16y ago
    IIRC Google helpfully embed Flash inside Chrome
    - loumf 16y ago
      Use the kill-flash extension for Chrome. It takes off flash elements and replaces them with a zone to click on if you want to bring it back. It has a whitelist that you can use for sites that you want flash on by default.
      - bl4k 16y ago
        Flash is still in memory, and those plugins use Javascript to 'hide' the applet
- ciupicri 16y ago
  Is it to me or the Quicktime plugin is still enabled and it even has a critical security update?
- olalonde 16y ago
  I had to turn Flash back on after a few minutes after I realized that Google Analytics charts are Flash based :(
olalonde 16y ago
Damn, that's how I got this annoying adware. I think it's time to bury Flash for good.
- wensing 16y ago
  Do you have evidence? (Correlation != causation)
  - olalonde 16y ago
    I'm pretty sure. Flash has been acting very weird lately (random UAC popups) and it's the first time I get malware from the web in over 5 years. Flash is the only plugin I use so unless there is also a 0-day in Chrome, Flash is the most likely suspect.
minalecs 16y ago
No issue here.. Just use FlashBlock for chrome and firefox, and when theres flash content you want to view, click the Flash icon to enable it. Theres still a lot of flash content thats good out there. I think just enabling the flash content you want to use, will solve a lot of the issues people have with flash.
- auxbuss 16y ago
  Yup, I've used the Flashblock Firefox plug-in for quite a while. It replaces any Flash items with an icon that you can click to run the Flash. There's also a right-click option to always enable flash for a site (whitelist). Flashblock is a simple and effective way to manage Flash.
mhw 16y ago
I upgraded Flash on my old laptop just yesterday. The pain and misdirection of being pushed through installing the Adobe Download Manager extension, then restarting the browser in order to actually update the plugin, seems like enough of an obstacle to significantly slow down the roll-out of the eventual fix.
- prawn 16y ago
  Their forcing of the download manager app (painful trying to find an alternate download to upgrade Flash) should be a key reason for people to abandon the platform.
  - frou_dh 16y ago
    I think Java trying to install the Yahoo Toolbar beat that. So trashy, I couldn't believe it.
    - JoeAltmaier 16y ago
      Yahoo toolbar crosses the line - its a virus now, or at least mal-ware.
  - chadgeidel 16y ago
    Nothing burns me up more than vendor-provided "download/update managers". I'll keep my app updated myself thank you very much. No, you don't actually need to run your program 24-7 when it's only used once every few months on my machine. Just thinking about it makes my blood pressure rise. (Yes, I know I can go back and uninstall the download manager, but now there are 2 of them - one specifically for IE/ActiveX and the one for Firefox that they recently created).
wensing 16y ago
Novice question--wouldn't getting exploited require that I visit a site of ill-repute? Or, alternatively, is there some cross-domain element that makes this a threat even if I'm just seeing Flash-based ads on CNN.com?
- deleted 16y ago
  [deleted]
- joeyh 16y ago
  CVE-2010-2884 , like most prior exploits in flash, has the potential to let the attacker run arbitrary code. We're not talking javascript code either. BTW, anyone else think serving flash-based banner ads from untrusted third parties given its track record is well, the height of irresponsability?
- someone_here 16y ago
  CNN could be using an ad provider that just happens to not have enough ads so they outsourced to a few new ad networks and one accidentally let in a hacked ad.
Jach 16y ago
Can anyone explain some motivations behind Adobe continuing to keep the flash player closed source? The only reasonable thing I've heard before was about movie codecs, is there anything else? The Flex SDK is open, they're not exactly stellar on performance, several different SWF decoders work okay for some narrow subset... I doubt there's much in there that's top secret or thesis-worthy. Releasing it to the community would go a long way in improving Adobe's standings as well as letting the community fix these (in say one week rather than two) and work on 64-bit versions or performance...
- aniket_ray 16y ago
  The VM is open source, the frameworks are open source. The language specification is open. The only thing closed are codecs (many of which are licensed from other companies and can't be open sourced), DRM stuff and platform level code that glues everything together. On the other hand, there are open source versions of swf players that Adobe actively promote. Unfortunately, community involvement (developers and early testers) in all these projects have been low. My understanding is that people within Adobe (and there are many who like Open Source) have no evidence that open sourcing more stuff is any better for the player, since the community hardly gets involved. Adobe did launch a 64-bit Linux flash player on Labs. Most 64 bit users never used it, sticking with the nspluginwrapper method instead. I'm sure more community involvement with existing open source projects at Adobe would pave the way for opening up of more stuff.
  - blasdel 16y ago
    They open sourced the parts that have been solid for years. What's always been a huge problem is the runtime — the implementation of the standard library. It's it's mostly the same across all platforms and more than just 'glue code', it's what's actually using most of the CPU cycles when a Flash applet executes, it's all native code, and it's not sandboxed at all by most browsers.
- smackfu 16y ago
  You don't think it is easier to find code bugs to exploit if you have the source?
emehrkay 16y ago
I dumped firefox when safari four came out. Then I moved to webkit nightly (im still in love with the developer tools )
gojomo 16y ago
Note that running the Adobe Flash Player uninstaller may not disable Flash in Google Chrome (which integrates a separate Flash). You need to use the 'chrome://plugins' manager to disable that Flash Player. See here for details: http://www.google.com/support/forum/p/Chrome/thread?tid=10957b373ce77aed&hl=en http://www.google.com/support/forum/p/Chrome/thread?tid=1095...
DavidBishop 16y ago
"This vulnerability (CVE-2010-2884) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild..." Oh no! What if it gets my iPhone! Oh, wait...

172 points by vl 16y ago

acqq 16y ago

Not just Flash -- it's an all-platforms Flash and all-platforms Reader vulnerability plus the Flash exploit for Windows in the wild! I beleive we can soon expect Reader exploits too.

blasdel 16y ago
The Reader exploits probably involve a PDF with embedded Flash. Synergy!

swombat 16y ago

To be fair, these things happen to many other platforms. Adobe's no exception. Two weeks seems a bit on the slow side from our hacker point of view, but it is in line with what you tend to get from large corporations (and actually fairly responsive... this would be a good response time for, say, Internet Explorer - and Flash has more installs on a much wider variety of OSes and hardware than IE). Let's not all gang up on Adobe just because they're, well, just as bad as everyone else.

drinian 16y ago
Please enumerate some of these "other platforms." Cannot cite IE (too obvious), or Reader (also Adobe).
- swombat 16y ago
  Apple: http://www.engadget.com/2009/07/02/apple-patching-nasty-iphone-sms-vulnerability/ http://www.engadget.com/2009/07/02/apple-patching-nasty-ipho... ("fix by the end of this month") Google: http://seclists.org/webappsec/2006/q1/66 http://seclists.org/webappsec/2006/q1/66 (6+ months) I'm sure you can find more of them by searching for them (as I just did).
  - tptacek 16y ago
    It would be a more interesting challenge to name a vendor who isn't routinely issuing security advisories. I can't think of any.
- jacquesm 16y ago
  Because you asked: http://www.google.com/search?q=java+zero+day+exploit http://www.google.com/search?q=java+zero+day+exploit
raganwald 16y ago
What is this "ganging up" you are speaking of? All I can see as of this moment are people making true statements about Adobe Flash's vulnerabilities, expressing their personal opinions about using Flash, sharing tips for avoiding or disabling Flash, and so on. As for the two weeks, it sounds like you are saying that the appropriate response to being told that you have to stand in line a day to buy bread is to shrug your shoulders since you're already standing in line a day to buy milk.
IgorPartola 16y ago
The trouble with Flash is that it is so ubiquitous. If Firefox gets a critical zero-day vulnerability, I'll use Chrome. If Chrome does, I'll use Firefox. With a Flash vulnerability over 90% of computers on the web are susceptible and there is no alternative.
- jrockway 16y ago
  I haven't had Flash installed since that first vulnerability where Adobe pulled support for x86_64 Linux. The web looks the same. (I used Adblock anyway.) Yeah, some Youtube videos don't work... but you can get those videos elsewhere.
  - IgorPartola 16y ago
    How about things like Google Analytics? Do you miss tools like that?
    - jrockway 16y ago
      Never used it. I think spying on my users (with the help of Google) is unethical. (FWIW, I did do a project for a client once which involved extracting data via the Analytics API. It was very easy to do, and all the metrics were there, so it seems possible to make your own chart without requiring Flash. Hell, there is even an in-browser Javascript Analytics API and many in-browser Javascript charting libraries... so you could probably even do this in the form of a bookmarklet or user script!)
      - IgorPartola 16y ago
        Heh, spying is a strong word. Without GA I would have had a harder time figuring out that more of my users are from Spain than from the US for one of my projects. Thanks for the info. I knew of their API but haven't used it yet.
DavidBishop 16y ago
Yes, but they happen on "other" platforms. Not "ALL" platforms. I think there are too many developers out there in large and small companies that don't understand they power they wield or the responsibility they have. I'm not a big fan of Flash. It had it's day. It wants to be everywhere, but it doesn't have the track record to be safe everywhere. I recently switched to Mac and have 3 (and only 3) crashes... all in Safari and all due to Flash. I'm all for a company making a great product and making it prolific. I just want that company to have the integrity and follow through to make it right. After all, when an exploit takes over my machine who's out the time and money?

sjtgraham 16y ago

Safari OS X users, may I recommend ClickToFlash for the time being. http://clicktoflash.com/ http://clicktoflash.com/

frou_dh 16y ago
Great recommendation, but I'd say the torch has been passed to the bona fide Safari extension of the same name: http://www.math.northwestern.edu/~hoyois/safariextensions/clicktoflash/ http://www.math.northwestern.edu/~hoyois/safariextensions/cl...
- isani 16y ago
  One benefit that the original ClickToFlash has compared to the extension is that it works with web content embedded in applications other than Safari.
rwmj 16y ago
Just disable all plug-ins & Java in Safari preferences. It's a lot easier and you won't miss them. The only thing I used Flash for was watching videos, and HTML5 has that mostly covered now.

drinian 16y ago

I uninstalled Flash three months ago, and haven't encountered any serious problems. I have Greasemonkey scripts to let me download video from most of the YouTube-like sites.

zackattack 16y ago
please share said scripts
- drinian 16y ago
  I'm not a heavy video watcher, so -- YouTube: http://userscripts.org/scripts/show/62634 http://userscripts.org/scripts/show/62634 Vimeo: http://userscripts.org/scripts/show/56677 http://userscripts.org/scripts/show/56677 Neither of these scripts requires a third-party site.

shib71 16y ago

Their openness about the vulnerability is refreshing. But I assume they're only publicising the vulnerability because of the people already exploiting it.

rbanffy 16y ago
> But I assume they're only publicising the vulnerability because of the people already exploiting it. That and someone notified them it exists. Were it only a vulnerability they could deny knowing, they would keep silent about it.

colonelxc 16y ago

Finally, something that works on flash in linux! I jest, but flash is the perfect target if you want to hit multiple OS's. Doesn't mean the malware authors will actually develop exploits/malcode for multiple OS's though.

jakevoytko 16y ago
Viruses that target multiple machines may not be as ridiculous as they sound. At least one researcher has a proof-of-concept that works on multiple platforms: http://www.wired.com/science/discoveries/news/2001/03/42672 http://www.wired.com/science/discoveries/news/2001/03/42672 As an aside, the alpha releases for Flash on Linux are surprisingly stable. The "gray rectangle" problem appears to be solved, which was the worst part of Flash on Linux in years past. Video streaming works well, but animations flicker and tear, so most online games are still unplayable.
- TallGuyShort 16y ago
  Thanks for that link - I'm enjoying the article. I'm surprised to be reading so much talk about Flash not working very well on Linux. I'm using Fedora 13 (previously Ubuntu) on an extremely low-performance machine, and I haven't seen any problems in a very long time (at least a year). Video's, games, etc... all seem to work fine, and I generally pay a lot of attention to the Flash player because I'm a flex developer. The only time I struggle is when I watch HD video, but that's to be expected on my machine even if I'm watching a DVD.
  - pmjordan 16y ago
    Yeah, I haven't encountered much in the way of compatibility problems since 10.0 was released. (I'm on OpenSUSE x86-64.) It does have a habit of crashing and/or freezing for some time, I get the impression the latter is connected to sound (ALSA). Modern browsers survive the former quite well, luckily, and everything but Firefox recovers from the latter quickly, too. One thing that seems to reliably fail is full-screen video, though.

Devilboy 16y ago

If they've found it, is it still technically considered a 'zero-day' exploit?

Deestan 16y ago
Apparently not: http://en.wikipedia.org/wiki/Zero-day_attack http://en.wikipedia.org/wiki/Zero-day_attack > A "zero day" attack occurs on or before the first or "zeroth" day of developer awareness

bl4k 16y ago

the best thing I have done recently is to disable all plugins, including flash: http://imgur.com/mCfqQ.png http://imgur.com/mCfqQ.png YouTube HTML5 support is good, and for any other video you can directly download. Browser runs a lot faster, web pages load faster, and I don't miss flash ads at all. I also disabled flash on my parents' computer, and my brothers, and enabled YouTube HTML5 for them. They haven't noticed it yet. It is only a matter of time before more corporate networks uninstall/block all flash, especially with the bad reputation it has with security. Flash is already dead to me, I can't wait until it is dead for everybody else as well

aw3c2 16y ago
Why not completely uninstall them instead?
- frou_dh 16y ago
  IIRC Google helpfully embed Flash inside Chrome
  - loumf 16y ago
    Use the kill-flash extension for Chrome. It takes off flash elements and replaces them with a zone to click on if you want to bring it back. It has a whitelist that you can use for sites that you want flash on by default.
    - bl4k 16y ago
      Flash is still in memory, and those plugins use Javascript to 'hide' the applet
ciupicri 16y ago
Is it to me or the Quicktime plugin is still enabled and it even has a critical security update?
olalonde 16y ago
I had to turn Flash back on after a few minutes after I realized that Google Analytics charts are Flash based :(

olalonde 16y ago

Damn, that's how I got this annoying adware. I think it's time to bury Flash for good.

wensing 16y ago
Do you have evidence? (Correlation != causation)
- olalonde 16y ago
  I'm pretty sure. Flash has been acting very weird lately (random UAC popups) and it's the first time I get malware from the web in over 5 years. Flash is the only plugin I use so unless there is also a 0-day in Chrome, Flash is the most likely suspect.

minalecs 16y ago

No issue here.. Just use FlashBlock for chrome and firefox, and when theres flash content you want to view, click the Flash icon to enable it. Theres still a lot of flash content thats good out there. I think just enabling the flash content you want to use, will solve a lot of the issues people have with flash.

auxbuss 16y ago
Yup, I've used the Flashblock Firefox plug-in for quite a while. It replaces any Flash items with an icon that you can click to run the Flash. There's also a right-click option to always enable flash for a site (whitelist). Flashblock is a simple and effective way to manage Flash.

mhw 16y ago

I upgraded Flash on my old laptop just yesterday. The pain and misdirection of being pushed through installing the Adobe Download Manager extension, then restarting the browser in order to actually update the plugin, seems like enough of an obstacle to significantly slow down the roll-out of the eventual fix.

prawn 16y ago
Their forcing of the download manager app (painful trying to find an alternate download to upgrade Flash) should be a key reason for people to abandon the platform.
- frou_dh 16y ago
  I think Java trying to install the Yahoo Toolbar beat that. So trashy, I couldn't believe it.
  - JoeAltmaier 16y ago
    Yahoo toolbar crosses the line - its a virus now, or at least mal-ware.
- chadgeidel 16y ago
  Nothing burns me up more than vendor-provided "download/update managers". I'll keep my app updated myself thank you very much. No, you don't actually need to run your program 24-7 when it's only used once every few months on my machine. Just thinking about it makes my blood pressure rise. (Yes, I know I can go back and uninstall the download manager, but now there are 2 of them - one specifically for IE/ActiveX and the one for Firefox that they recently created).

wensing 16y ago

Novice question--wouldn't getting exploited require that I visit a site of ill-repute? Or, alternatively, is there some cross-domain element that makes this a threat even if I'm just seeing Flash-based ads on CNN.com?

deleted 16y ago
[deleted]
joeyh 16y ago
CVE-2010-2884 , like most prior exploits in flash, has the potential to let the attacker run arbitrary code. We're not talking javascript code either. BTW, anyone else think serving flash-based banner ads from untrusted third parties given its track record is well, the height of irresponsability?
someone_here 16y ago
CNN could be using an ad provider that just happens to not have enough ads so they outsourced to a few new ad networks and one accidentally let in a hacked ad.

Jach 16y ago

Can anyone explain some motivations behind Adobe continuing to keep the flash player closed source? The only reasonable thing I've heard before was about movie codecs, is there anything else? The Flex SDK is open, they're not exactly stellar on performance, several different SWF decoders work okay for some narrow subset... I doubt there's much in there that's top secret or thesis-worthy. Releasing it to the community would go a long way in improving Adobe's standings as well as letting the community fix these (in say one week rather than two) and work on 64-bit versions or performance...

aniket_ray 16y ago
The VM is open source, the frameworks are open source. The language specification is open. The only thing closed are codecs (many of which are licensed from other companies and can't be open sourced), DRM stuff and platform level code that glues everything together. On the other hand, there are open source versions of swf players that Adobe actively promote. Unfortunately, community involvement (developers and early testers) in all these projects have been low. My understanding is that people within Adobe (and there are many who like Open Source) have no evidence that open sourcing more stuff is any better for the player, since the community hardly gets involved. Adobe did launch a 64-bit Linux flash player on Labs. Most 64 bit users never used it, sticking with the nspluginwrapper method instead. I'm sure more community involvement with existing open source projects at Adobe would pave the way for opening up of more stuff.
- blasdel 16y ago
  They open sourced the parts that have been solid for years. What's always been a huge problem is the runtime — the implementation of the standard library. It's it's mostly the same across all platforms and more than just 'glue code', it's what's actually using most of the CPU cycles when a Flash applet executes, it's all native code, and it's not sandboxed at all by most browsers.
smackfu 16y ago
You don't think it is easier to find code bugs to exploit if you have the source?

emehrkay 16y ago

I dumped firefox when safari four came out. Then I moved to webkit nightly (im still in love with the developer tools )

gojomo 16y ago

Note that running the Adobe Flash Player uninstaller may not disable Flash in Google Chrome (which integrates a separate Flash). You need to use the 'chrome://plugins' manager to disable that Flash Player. See here for details: http://www.google.com/support/forum/p/Chrome/thread?tid=10957b373ce77aed&hl=en http://www.google.com/support/forum/p/Chrome/thread?tid=1095...

DavidBishop 16y ago

"This vulnerability (CVE-2010-2884) could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild..." Oh no! What if it gets my iPhone! Oh, wait...