4 ms·

To be fair, these things happen to many other platforms. Adobe's no exception. Two weeks seems a bit on the slow side from our hacker point of view, but it is i

by swombat 16y ago

To be fair, these things happen to many other platforms. Adobe's no exception. Two weeks seems a bit on the slow side from our hacker point of view, but it is in line with what you tend to get from large corporations (and actually fairly responsive... this would be a good response time for, say, Internet Explorer - and Flash has more installs on a much wider variety of OSes and hardware than IE). Let's not all gang up on Adobe just because they're, well, just as bad as everyone else.

drinian 16y ago
Please enumerate some of these "other platforms." Cannot cite IE (too obvious), or Reader (also Adobe).
- swombat 16y ago
  Apple: http://www.engadget.com/2009/07/02/apple-patching-nasty-iphone-sms-vulnerability/ http://www.engadget.com/2009/07/02/apple-patching-nasty-ipho... ("fix by the end of this month") Google: http://seclists.org/webappsec/2006/q1/66 http://seclists.org/webappsec/2006/q1/66 (6+ months) I'm sure you can find more of them by searching for them (as I just did).
  - tptacek 16y ago
    It would be a more interesting challenge to name a vendor who isn't routinely issuing security advisories. I can't think of any.
- jacquesm 16y ago
  Because you asked: http://www.google.com/search?q=java+zero+day+exploit http://www.google.com/search?q=java+zero+day+exploit
raganwald 16y ago
What is this "ganging up" you are speaking of? All I can see as of this moment are people making true statements about Adobe Flash's vulnerabilities, expressing their personal opinions about using Flash, sharing tips for avoiding or disabling Flash, and so on. As for the two weeks, it sounds like you are saying that the appropriate response to being told that you have to stand in line a day to buy bread is to shrug your shoulders since you're already standing in line a day to buy milk.
IgorPartola 16y ago
The trouble with Flash is that it is so ubiquitous. If Firefox gets a critical zero-day vulnerability, I'll use Chrome. If Chrome does, I'll use Firefox. With a Flash vulnerability over 90% of computers on the web are susceptible and there is no alternative.
- jrockway 16y ago
  I haven't had Flash installed since that first vulnerability where Adobe pulled support for x86_64 Linux. The web looks the same. (I used Adblock anyway.) Yeah, some Youtube videos don't work... but you can get those videos elsewhere.
  - IgorPartola 16y ago
    How about things like Google Analytics? Do you miss tools like that?
    - jrockway 16y ago
      Never used it. I think spying on my users (with the help of Google) is unethical. (FWIW, I did do a project for a client once which involved extracting data via the Analytics API. It was very easy to do, and all the metrics were there, so it seems possible to make your own chart without requiring Flash. Hell, there is even an in-browser Javascript Analytics API and many in-browser Javascript charting libraries... so you could probably even do this in the form of a bookmarklet or user script!)
      - IgorPartola 16y ago
        Heh, spying is a strong word. Without GA I would have had a harder time figuring out that more of my users are from Spain than from the US for one of my projects. Thanks for the info. I knew of their API but haven't used it yet.
DavidBishop 16y ago
Yes, but they happen on "other" platforms. Not "ALL" platforms. I think there are too many developers out there in large and small companies that don't understand they power they wield or the responsibility they have. I'm not a big fan of Flash. It had it's day. It wants to be everywhere, but it doesn't have the track record to be safe everywhere. I recently switched to Mac and have 3 (and only 3) crashes... all in Safari and all due to Flash. I'm all for a company making a great product and making it prolific. I just want that company to have the integrity and follow through to make it right. After all, when an exploit takes over my machine who's out the time and money?

by swombat 16y ago

drinian 16y ago

Please enumerate some of these "other platforms." Cannot cite IE (too obvious), or Reader (also Adobe).

swombat 16y ago
Apple: http://www.engadget.com/2009/07/02/apple-patching-nasty-iphone-sms-vulnerability/ http://www.engadget.com/2009/07/02/apple-patching-nasty-ipho... ("fix by the end of this month") Google: http://seclists.org/webappsec/2006/q1/66 http://seclists.org/webappsec/2006/q1/66 (6+ months) I'm sure you can find more of them by searching for them (as I just did).
- tptacek 16y ago
  It would be a more interesting challenge to name a vendor who isn't routinely issuing security advisories. I can't think of any.
jacquesm 16y ago
Because you asked: http://www.google.com/search?q=java+zero+day+exploit http://www.google.com/search?q=java+zero+day+exploit

raganwald 16y ago

What is this "ganging up" you are speaking of? All I can see as of this moment are people making true statements about Adobe Flash's vulnerabilities, expressing their personal opinions about using Flash, sharing tips for avoiding or disabling Flash, and so on. As for the two weeks, it sounds like you are saying that the appropriate response to being told that you have to stand in line a day to buy bread is to shrug your shoulders since you're already standing in line a day to buy milk.

IgorPartola 16y ago

The trouble with Flash is that it is so ubiquitous. If Firefox gets a critical zero-day vulnerability, I'll use Chrome. If Chrome does, I'll use Firefox. With a Flash vulnerability over 90% of computers on the web are susceptible and there is no alternative.

jrockway 16y ago
I haven't had Flash installed since that first vulnerability where Adobe pulled support for x86_64 Linux. The web looks the same. (I used Adblock anyway.) Yeah, some Youtube videos don't work... but you can get those videos elsewhere.
- IgorPartola 16y ago
  How about things like Google Analytics? Do you miss tools like that?
  - jrockway 16y ago
    Never used it. I think spying on my users (with the help of Google) is unethical. (FWIW, I did do a project for a client once which involved extracting data via the Analytics API. It was very easy to do, and all the metrics were there, so it seems possible to make your own chart without requiring Flash. Hell, there is even an in-browser Javascript Analytics API and many in-browser Javascript charting libraries... so you could probably even do this in the form of a bookmarklet or user script!)
    - IgorPartola 16y ago
      Heh, spying is a strong word. Without GA I would have had a harder time figuring out that more of my users are from Spain than from the US for one of my projects. Thanks for the info. I knew of their API but haven't used it yet.

DavidBishop 16y ago

Yes, but they happen on "other" platforms. Not "ALL" platforms. I think there are too many developers out there in large and small companies that don't understand they power they wield or the responsibility they have. I'm not a big fan of Flash. It had it's day. It wants to be everywhere, but it doesn't have the track record to be safe everywhere. I recently switched to Mac and have 3 (and only 3) crashes... all in Safari and all due to Flash. I'm all for a company making a great product and making it prolific. I just want that company to have the integrity and follow through to make it right. After all, when an exploit takes over my machine who's out the time and money?