4 ms·

Surely, given your description and timeframes, the most likely vector is Flash, not Chrome?

by mootothemax 16y ago

nodata 16y ago
Does Chrome bundle Flash and handle updates itself? Would be interested to compare the lag if that were true.
- thezilch 16y ago
  Chrome, itself, bundles and releases updated, Flash builds. The latest vulnerability-fix release of Flash was released to Chrome users before even Adobe made it public for download, for other [browser] flavors.
drivebyacct2 16y ago
His post explicitly mentions Java. Seeing as how some 99% of users run Flash, and 100% of Chrome users are guaranteed on the latest version... I find it hard to fault chrome/flash integration. Its all good for the user, it can be disabled, and they've just added clikc-to-enable for plugins!! (Which also greatly increases its flash stability in linux, yay!)
- mootothemax 16y ago
  His post explicitly mentions Java. Not at the time of my comment it didn't ;) Seeing as how some 99% of users run Flash, and 100% of Chrome users are guaranteed on the latest version... I find it hard to fault chrome/flash integration Go back over the last 12 months - are you honestly trying to tell me that there were no ad networks serving ads containing Flash exploits? And that's only one area they appear. Edit: I'm not ignoring Chrome's Flash integration, but you have to remember that was only released at the end of June: http://techcrunch.com/2010/06/25/google-chrome-flash/ http://techcrunch.com/2010/06/25/google-chrome-flash/
  - drivebyacct2 16y ago
    "Go back over the last 12 months - are you honestly trying to tell me that there were no ad networks serving ads containing Flash exploits? And that's only one area they appear." You're missing the point. Considering that nearly everyone has flash, most people don't update it, and Chrome forces you to always have the latest security patches (AND it can be disabled AND it can be click-to-enable plugin), they're protecting users, literally as much as possible. It's certainly better than the Firefox model which is what it's being compared to...
  - drivebyacct2 16y ago
    Haha. This makes this humorous topic even funnier: http://www.techi.com/2010/12/one-small-step-for-flash-one-decently-sized-leap-for-chrome/ http://www.techi.com/2010/12/one-small-step-for-flash-one-de...

Surely, given your description and timeframes, the most likely vector is Flash, not Chrome?

nodata 16y ago

Does Chrome bundle Flash and handle updates itself? Would be interested to compare the lag if that were true.

thezilch 16y ago
Chrome, itself, bundles and releases updated, Flash builds. The latest vulnerability-fix release of Flash was released to Chrome users before even Adobe made it public for download, for other [browser] flavors.

drivebyacct2 16y ago

His post explicitly mentions Java. Seeing as how some 99% of users run Flash, and 100% of Chrome users are guaranteed on the latest version... I find it hard to fault chrome/flash integration. Its all good for the user, it can be disabled, and they've just added clikc-to-enable for plugins!! (Which also greatly increases its flash stability in linux, yay!)

mootothemax 16y ago
His post explicitly mentions Java. Not at the time of my comment it didn't ;) Seeing as how some 99% of users run Flash, and 100% of Chrome users are guaranteed on the latest version... I find it hard to fault chrome/flash integration Go back over the last 12 months - are you honestly trying to tell me that there were no ad networks serving ads containing Flash exploits? And that's only one area they appear. Edit: I'm not ignoring Chrome's Flash integration, but you have to remember that was only released at the end of June: http://techcrunch.com/2010/06/25/google-chrome-flash/ http://techcrunch.com/2010/06/25/google-chrome-flash/
- drivebyacct2 16y ago
  "Go back over the last 12 months - are you honestly trying to tell me that there were no ad networks serving ads containing Flash exploits? And that's only one area they appear." You're missing the point. Considering that nearly everyone has flash, most people don't update it, and Chrome forces you to always have the latest security patches (AND it can be disabled AND it can be click-to-enable plugin), they're protecting users, literally as much as possible. It's certainly better than the Firefox model which is what it's being compared to...
- drivebyacct2 16y ago
  Haha. This makes this humorous topic even funnier: http://www.techi.com/2010/12/one-small-step-for-flash-one-decently-sized-leap-for-chrome/ http://www.techi.com/2010/12/one-small-step-for-flash-one-de...