3 ms·

As a kid, Kongregate was a safe, inclusive space for high-quality games that I didn't have to fear would mess up a family member's computer. It looks like that

As a kid, Kongregate was a safe, inclusive space for high-quality games that I didn't have to fear would mess up a family member's computer. It looks like that much hasn't changed a lot, which is great. Sites like this played a large part in increasing my bravery and familiarity on the web, on which I now earn my living.

sodaplayer 6y ago
Yeah, Kongregate was also one of my first chatroom experiences as a kid. The community had many friendly people, and now as an adult, it's nice looking back and feeling I had a good environment to learn how to interact on the web. It also inspired me to learn Actionscript to try to make my own Flash games, which eventually lead to me now with a CS degree.
maerF0x0 6y ago
> that I didn't have to fear would mess up a family member's computer Save for having flash enabled . Hard to believe they've validated all 128,000 games.
- tkzed49 6y ago
  To be more realistic, Flash was a much smaller attack surface than downloading and running random executables. I'm guessing that a fairly small number of kids were actually subject to Flash exploits while playing games on Kongregate. Compare that to downloading a screensaver...
  - TedDoesntTalk 6y ago
    I don’t see the difference between running a Flash app with no sand boxing whatsoever and a random executable.
    - rictic 6y ago
      Security is a continuum, not a binary. Things that native apps can do trivially but that require explicit permission for accessed in Flash (or the web in general): filesystem read/write, listen in on microphones, spy with webcams, etc etc. If you have a flash zero day (and they totally exist!), you can do those things, but that significantly raises the difficulty, which reduces the number of attacks you'll actually see in the wild. Most attackers aren't the NSA or Mossad, and resources that they have to spend on getting and exploiting zero days are resources they can't spend on other parts of the exploit chain.
    - geofft 6y ago
      The Flash API surface does not include direct host access the way the native application API surface does. That means that while identifying native apps doing "bad things" requires solving the halting problem (and moral philosophy), any ability of Flash applets to do "bad things" is an unambiguous bug. Sure, without a sandbox those bugs are easy to exploit when they exist, but they can nonetheless be fixed. I wouldn't trust Flash from 2005 against NSO Group from 2020, but I'd certainly trust it against the author of the Melissa virus. Another way of putting this is that there are two senses of "sandboxed" - one is having a limited API surface and one is using software fault isolation techniques on the interpreter/runtime itself. Flash (and JS) always had the former, even though the latter is fairly recent.
bitL 6y ago
Send them some love then (i.e. $) to help them out.

sodaplayer 6y ago

Yeah, Kongregate was also one of my first chatroom experiences as a kid. The community had many friendly people, and now as an adult, it's nice looking back and feeling I had a good environment to learn how to interact on the web. It also inspired me to learn Actionscript to try to make my own Flash games, which eventually lead to me now with a CS degree.

maerF0x0 6y ago

> that I didn't have to fear would mess up a family member's computer Save for having flash enabled . Hard to believe they've validated all 128,000 games.

tkzed49 6y ago
To be more realistic, Flash was a much smaller attack surface than downloading and running random executables. I'm guessing that a fairly small number of kids were actually subject to Flash exploits while playing games on Kongregate. Compare that to downloading a screensaver...
- TedDoesntTalk 6y ago
  I don’t see the difference between running a Flash app with no sand boxing whatsoever and a random executable.
  - rictic 6y ago
    Security is a continuum, not a binary. Things that native apps can do trivially but that require explicit permission for accessed in Flash (or the web in general): filesystem read/write, listen in on microphones, spy with webcams, etc etc. If you have a flash zero day (and they totally exist!), you can do those things, but that significantly raises the difficulty, which reduces the number of attacks you'll actually see in the wild. Most attackers aren't the NSA or Mossad, and resources that they have to spend on getting and exploiting zero days are resources they can't spend on other parts of the exploit chain.
  - geofft 6y ago
    The Flash API surface does not include direct host access the way the native application API surface does. That means that while identifying native apps doing "bad things" requires solving the halting problem (and moral philosophy), any ability of Flash applets to do "bad things" is an unambiguous bug. Sure, without a sandbox those bugs are easy to exploit when they exist, but they can nonetheless be fixed. I wouldn't trust Flash from 2005 against NSO Group from 2020, but I'd certainly trust it against the author of the Melissa virus. Another way of putting this is that there are two senses of "sandboxed" - one is having a limited API surface and one is using software fault isolation techniques on the interpreter/runtime itself. Flash (and JS) always had the former, even though the latter is fairly recent.

bitL 6y ago

Send them some love then (i.e. $) to help them out.