3 ms·

I think it's pretty safe to say that Adobe code bases have more or less earned themselves a special line item in the security concerns list at this point.

by trotsky 16y ago

tptacek 16y ago
You could --- and I'm not just saying this to be argumentative --- say the same thing about parts of Webkit. I want to be clear that I agree that Flash adds more than a banana-equivalent dose of insecurity. I just worry about the notion that the rest of the system is much better.
- trotsky 16y ago
  You make a good point that I wouldn't want to try to disagree with.
- ZeroGravitas 16y ago
  I'd argue the same could be said for the functionality of Flash. Yes, watching video via Flash can start the fans flying, particularly on OS X before Apple allowed them access to the hardware. But, it's not like displaying highly encoded H.264 and allowing people to manipulate the resulting output is easy. The last comparison I saw showed only IE9 convincingly beating Flash in this task, and the big outliers were some of the browsers like Safari on Windows which was abysmal, whereas Flash was solidly good across platforms and browsers. And I'm guessing that performance in other areas is a clearer win for Flash. I have ideological reasons for not liking Flash, but clearly my brand of ideology isn't as good at mass-mind control and reality-re-defining as the Apple-ideologues. I'll be glad to see it go, I just wish it was because people thought that core web technologies should be open with multiple interoperable implementations, rather than because of a concerted campaign of misinformation and misdirection about performance.
  - tptacek 16y ago
    I think you may have accidentally replied to the wrong comment.
    - ZeroGravitas 16y ago
      Your point appeared to be that Flash is insecure, but that the things proposed to replace it e.g. Webkit, CSS3 implementations suffer from similar issues. My point was that, similarly, its performance problems with video are shared by other browsers when implementing the same functionality.

I think it's pretty safe to say that Adobe code bases have more or less earned themselves a special line item in the security concerns list at this point.

by trotsky 16y ago

I think it's pretty safe to say that Adobe code bases have more or less earned themselves a special line item in the security concerns list at this point.

tptacek 16y ago

You could --- and I'm not just saying this to be argumentative --- say the same thing about parts of Webkit. I want to be clear that I agree that Flash adds more than a banana-equivalent dose of insecurity. I just worry about the notion that the rest of the system is much better.

trotsky 16y ago
You make a good point that I wouldn't want to try to disagree with.
ZeroGravitas 16y ago
I'd argue the same could be said for the functionality of Flash. Yes, watching video via Flash can start the fans flying, particularly on OS X before Apple allowed them access to the hardware. But, it's not like displaying highly encoded H.264 and allowing people to manipulate the resulting output is easy. The last comparison I saw showed only IE9 convincingly beating Flash in this task, and the big outliers were some of the browsers like Safari on Windows which was abysmal, whereas Flash was solidly good across platforms and browsers. And I'm guessing that performance in other areas is a clearer win for Flash. I have ideological reasons for not liking Flash, but clearly my brand of ideology isn't as good at mass-mind control and reality-re-defining as the Apple-ideologues. I'll be glad to see it go, I just wish it was because people thought that core web technologies should be open with multiple interoperable implementations, rather than because of a concerted campaign of misinformation and misdirection about performance.
- tptacek 16y ago
  I think you may have accidentally replied to the wrong comment.
  - ZeroGravitas 16y ago
    Your point appeared to be that Flash is insecure, but that the things proposed to replace it e.g. Webkit, CSS3 implementations suffer from similar issues. My point was that, similarly, its performance problems with video are shared by other browsers when implementing the same functionality.