> they don’t give fucks about product security. More accurately stated as "we sandboxed it, so anything discovered is less likely to be critical." https://www.

> they don’t give fucks about product security. More accurately stated as "we sandboxed it, so anything discovered is less likely to be critical." https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/sandboxprotections.html https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/sa... I've heard a variant of that talk delivered by a non-C-level at an appsec/prodsec-focused conference where the rehashed quote above (though I'm blatantly paraphrasing) was the justification used. Something more closely reflecting the truth might be "we can't realistically tackle the many security defects in Acrobat and Flash, so we sandboxed both applications instead to generally reduce the technical risks posed by any vulnerabilities in code."