4 ms·
Perhaps I’m remembering things incorrectly, but wasn’t Flash the source of a large number of drive-by malware installs, which are much rarer today with modern b
by tshaddox 5y ago
Perhaps I’m remembering things incorrectly, but wasn’t Flash the source of a large number of drive-by malware installs, which are much rarer today with modern browsers?
- pell 5y agoThe runtime was definitely a consistent security problem. But the games, animations, etc. people made with Flash did really enrich the internet, I’d say. And Adobe Flash was a powerful tool with a relatively easy entry point for beginners and non-programmers.
- pjmlp 5y agoNowadays they will install a WebAssembly module or use your GPU instead.
- girvo 5y agoWebAssembly’s sandbox is quite a bit stronger than Flash’s was though.
- pjmlp 5y agoNo need to escape the sandbox to abuse the users computer, or reach out to possible secrets, if they happen to go through exported functions.
- girvo 5y agoFor sure. But one of the bigger issues with flash was it’s runtime being a constant source of RCEs
- pjmlp 5y agoNow you get to enjoy them as JIT CVEs.
- girvo 5y agoThough from my understanding, there is far less of them, they're harder to do, and easier to solve. And even if it's the same amount, having a sandbox that's harder to escape, holding everything else equal, seems like a win for end-users. Flash's demise, while it caused me no end of grief back in the day as it was the bulk of my income, was a good thing in the end.
- pjmlp 5y agoFlash did not went away, thanks to the wonders of WebAssembly. https://leaningtech.com/cheerpx-for-flash/ https://leaningtech.com/cheerpx-for-flash/
- domakidis 5y agoMay I ask how have you been monetizing Flash up to that point? I remember reading examples from an e-book on how to build 3D scenes with Flex 3 when I was 17-18 years old. It was a short lived dream of mine to create online video games. Instead, I ended-up making add-ons for PHP-based forums. During that era Unity had its own web browser plugin and there was at least one Tennis-like game on the miniclip site itself.
- girvo 5y agoI owned and ran a web design agency, but because of my skills in Flash a lot of our "value add" was doing impressive experiences/interactive showcases for our various clients. A lot of it was doing kiosk deployment work, which I think is still done today with Flash sometimes.
- croes 5y agoCrypto miners don't need to escape a sandbox
- aaaaaaaaata 5y agoEasy solution, don't leave random webgames running when you're done with them, and if it doesn't noticeably impact performance...?
- pjmlp 5y agoYou don't need a game for that, any website will do, specially with background workers.
- aaaaaaaaata 5y agoExactly! Who's checking for this stuff on every blog page open, actually? I wish I was, but, usually am not.
- boutell 5y agoModern browsers will flag and slow down tabs that abuse the cpu. You could probably still mine but it’s a slow drip.
- tkot 5y agoWhat is the reason why Java and Flash runtimes were somehow more prone to malware but JS seems fine? Is it some specific sandboxing technology or something else entirely?
- randomifcpfan 5y agoAll three runtimes are/were regularly compromised, so there’s no fundamental difference between them. Flash suffered from not having a spec other than its implementation. Made it hard to fix bugs while being backwards compatible