4 ms·

The difference as I see it is that Snow Leopard will get the security updates via Apple's Software Update program. You're on your own for updating flash player,

The difference as I see it is that Snow Leopard will get the security updates via Apple's Software Update program. You're on your own for updating flash player, or at best you get notified by Adobe that a new version of flash player is installed. Apple can control or at least heavily influence the updates for Snow Leopard. It can't for flash.

smackfu 16y ago
The example given was that Apple shipped an out-of-date Flash player because a new version was released after RTM. They then presumably updated that immediately with System Update. My point is that the same thing can happen with the actual OS. You can install Snow Leopard with a vulnerability that has already been fixed in a point security release of Leopard. So is it really a good reason to stop shipping Flash?
- tptacek 16y ago
  Huh? How does Apple get a security update in its own software too late for GM? Apple handles the SDL for its own security flaws internally. It tends to know where it stands with them. Apple cannot say the same thing about Flash; Adobe (as a simple matter of course) may have tens of queued vulnerabilities, with some arbitrary subset of them having actual fixes in the pipe. That's the nature of software security on large projects. Apple can't wash its hands of Snow Leopard vulnerabilities, but it essentially can do that for 3rd party software like Flash.
  - smackfu 16y ago
    >Huh? How does Apple get a security update in its own software too late for GM? Apple ships plenty of GNU code. What if an exploit is released between RTM and the ship date? That's the kind of thing I am thinking of. But I don't disagree that this is Apple saying "this is somebody else's problem now". I just wonder if that somebody is Adobe or the end-user.
    - tptacek 16y ago
      Apple has responsibility over the GNU code they ship. They had responsibility over the Flash code they shipped. By not shipping Flash, they no longer need to take responsibility for it. That makes sense. Apple never should have been responsible for Flash. Flash is a huge project, and Apple is not in the loop on Flash security updates.

smackfu 16y ago

The example given was that Apple shipped an out-of-date Flash player because a new version was released after RTM. They then presumably updated that immediately with System Update. My point is that the same thing can happen with the actual OS. You can install Snow Leopard with a vulnerability that has already been fixed in a point security release of Leopard. So is it really a good reason to stop shipping Flash?

tptacek 16y ago
Huh? How does Apple get a security update in its own software too late for GM? Apple handles the SDL for its own security flaws internally. It tends to know where it stands with them. Apple cannot say the same thing about Flash; Adobe (as a simple matter of course) may have tens of queued vulnerabilities, with some arbitrary subset of them having actual fixes in the pipe. That's the nature of software security on large projects. Apple can't wash its hands of Snow Leopard vulnerabilities, but it essentially can do that for 3rd party software like Flash.
- smackfu 16y ago
  >Huh? How does Apple get a security update in its own software too late for GM? Apple ships plenty of GNU code. What if an exploit is released between RTM and the ship date? That's the kind of thing I am thinking of. But I don't disagree that this is Apple saying "this is somebody else's problem now". I just wonder if that somebody is Adobe or the end-user.
  - tptacek 16y ago
    Apple has responsibility over the GNU code they ship. They had responsibility over the Flash code they shipped. By not shipping Flash, they no longer need to take responsibility for it. That makes sense. Apple never should have been responsible for Flash. Flash is a huge project, and Apple is not in the loop on Flash security updates.