5 ms·

I run my browsers without Flash in order to avoid Adobe's exploit-du-jour crapware. This means, for example, that I don't run Chrome. If this binary blob from

I run my browsers without Flash in order to avoid Adobe's exploit-du-jour crapware. This means, for example, that I don't run Chrome. If this binary blob from Adobe isn't presented with a similar UI as regular "plugins" (that the user can disable or uninstall), then I will look into writing an extension to disable it, or perhaps rely on a Firefox fork to give me a Flash-lite(tm) free browser.

andreyf 12y ago
You might want to reconsider. Chrome sandboxes the Flash runtime [1], meaning a 0-day exploit in Flash alone doesn't get an attacker access to your machine. 1. http://thenextweb.com/google/2012/11/13/google-declares-flash-is-now-fully-sandboxed-in-chrome-for-windows-mac-linux-and-chrome-os/ http://thenextweb.com/google/2012/11/13/google-declares-flas...
- vfclists 12y ago
  What makes you so sure?
  - andreyf 12y ago
    So sure of what?
- erichurkman 12y ago
  That, of course, does not save you from other problems with Flash and the way developers have (ab)used it. Crappy/useless widgets on screen that serve only to eat your CPU and batteries, including banner ads and the like.
  - andreyf 12y ago
    You can search for "Click to play" in the settings and disable plugins until you click on them. This helps a little security-wise, too, in case an attacker is resourceful enough to have both a 0-day for Flash and the Chrome sandbox. Not sure how likely that is, but it's also trivial to white-list sites you trust not to send you exploits from the icon in the URL box.
xymostech 12y ago
You could use Chromium, the open-source version of Chrome. It comes without flash, which needs to be explicitly installed to make flash work. Not sure what OS you use, but this is what I do on Linux.
jahewson 12y ago
You can disable Flash from chrome://plugins
pcwalton 12y ago
> If this binary blob from Adobe isn't presented with a similar UI as regular "plugins" (that the user can disable or uninstall), then I will look into writing an extension to disable it, or perhaps rely on a Firefox fork to give me a Flash-lite(tm) free browser. Again, it's been stated that you will be clearly given the choice to disable the CDM entirely.
vacri 12y ago
Chrome now has a built-in 'flashblock', like the Firefox plugin of that name. Enable the setting and you'll not see flash unless you click a placeholder icon.

andreyf 12y ago

You might want to reconsider. Chrome sandboxes the Flash runtime [1], meaning a 0-day exploit in Flash alone doesn't get an attacker access to your machine. 1. http://thenextweb.com/google/2012/11/13/google-declares-flash-is-now-fully-sandboxed-in-chrome-for-windows-mac-linux-and-chrome-os/ http://thenextweb.com/google/2012/11/13/google-declares-flas...

vfclists 12y ago
What makes you so sure?
- andreyf 12y ago
  So sure of what?
erichurkman 12y ago
That, of course, does not save you from other problems with Flash and the way developers have (ab)used it. Crappy/useless widgets on screen that serve only to eat your CPU and batteries, including banner ads and the like.
- andreyf 12y ago
  You can search for "Click to play" in the settings and disable plugins until you click on them. This helps a little security-wise, too, in case an attacker is resourceful enough to have both a 0-day for Flash and the Chrome sandbox. Not sure how likely that is, but it's also trivial to white-list sites you trust not to send you exploits from the icon in the URL box.

xymostech 12y ago

You could use Chromium, the open-source version of Chrome. It comes without flash, which needs to be explicitly installed to make flash work. Not sure what OS you use, but this is what I do on Linux.

jahewson 12y ago

You can disable Flash from chrome://plugins

pcwalton 12y ago

> If this binary blob from Adobe isn't presented with a similar UI as regular "plugins" (that the user can disable or uninstall), then I will look into writing an extension to disable it, or perhaps rely on a Firefox fork to give me a Flash-lite(tm) free browser. Again, it's been stated that you will be clearly given the choice to disable the CDM entirely.

vacri 12y ago

Chrome now has a built-in 'flashblock', like the Firefox plugin of that name. Enable the setting and you'll not see flash unless you click a placeholder icon.