6 ms·

I would like to hear what Adobe have to say about their streak of serious security problems. Not only that, but they should face some consequences for that negl

by sobkas 11y ago

I would like to hear what Adobe have to say about their streak of serious security problems. Not only that, but they should face some consequences for that neglect. At least be forced to publish a working spec for Flash.

fnordfnordfnord 11y ago
If they say much of anything, they will probably just reiterate that they take security very seriously.
elorant 11y ago
Their clientele isn’t security wary people. Plus they don’t have any serious competition in most of their products so it can’t hurt them either way. So they’ll probably issue a generic statement and move on with their lives. As for consequences, the best thing most of us could do is disable Flash from the browser. I’ve done it since YouTube defaulted to HTML5 video and never looked back since.
dguido 11y ago
You think that any other software you use is any better? Flash gets it rough because it's widely used and independent of the browser (for the most part). If you're running an update to date flash, that means you're probably running it in a sandbox and probably have silent auto updates turned on. That's good enough for most people. If you're the kind of person that's going to get specifically targeted, then you should not only reconsider running flash on your computer, but any other program written in an unsafe language. Or, you know, segregate your data.
- al2o3cr 11y ago
  "You think that any other software you use is any better?" I certainly HOPE most software I use can do better than this: http://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-6761/Adobe-Flash-Player.html http://www.cvedetails.com/vulnerability-list/vendor_id-53/pr... To be certain, Flash gets a lot of attention because of its install base - but it's been a never-ending FOUNTAIN of RCE bugs for much of the last decade.
  - weland 11y ago
    Most software that's as complex as Flash is probably similarly full of bugs. Most of those vulnerabilities reek of huge development teams toiling over a codebase whose foundation was written in the late 90s and had features and fixes duct taped ever since.
    - sobkas 11y ago
      "Probably"? Complex as Flash? Whatever it have a big or small team, was started in the late 90s or whatever it causes problems now. So use whatever excuses you like, Flash is still a security concern with opportunity for more 0-day exploits(just one firm have two in the drawer, how many more there are?).
    - reagency 11y ago
      Do Chrome and Safari have as bad a track record? Flash has been insecure since originally launched.
      - thomasrossi 11y ago
        no, maybe not as bad, but JIT can be played pretty hard. I think the difference is that they are better structured and more transparent. I would definitely NOT put my hands on flash code, must be a mess!
      - dguido 11y ago
        In a way, yes, they do. Chrome pushes out a dozen or more fixes for remotely exploitable vulnerabilities every 2 weeks.
        greggman 11y ago
        No they don't. Chrome is designed from the ground up for security. It has the same number of bugs as other software of it's size but the type of bugs are much less severe. Compare FF, Safari, IE, Chrome. Same number of bugs per yet but Chrome has 10x less code execution bugs (ie, 10x less likely for your machine to be owned by unknown bugs) http://i.imgur.com/rVgu7Fs.png http://i.imgur.com/rVgu7Fs.png
- beedogs 11y ago
  Flash gets it rough because it's horribly-written software full of security holes. It's demonstrably worse than most anything else out there.
  - dguido 11y ago
    Every piece of software you use is on a constant month-to-month patch train. Chrome, Windows, Firefox, Quicktime, Adium, hell even OpenSSL updates for security-critical bugs about once a month now. Flash is nothing special. All your software is insecure.
- kijin 11y ago
  Flash "auto updates" are anything but. On Windows, you get a pop-up to update manually, which just sends you to their website so you need to download and run the installer by yourself. If you don't update manually, Flash will wait 45 days before triggering an automatic update. I never waited that long, so I don't know whether it's "silent" or not.
DavideNL 11y ago
i'm not sure if it's relevant whatever they'd have to say. Just look at the news for the past years and there's only 1 conclusion: uninstall Flash or accept increased risk of catching a virus.
pjc50 11y ago
If there were actually a government body that cared about "cyber"-security, they'd be hauled up in front of it. They're basically an infosec Bhopal - creating a toxic mess that other people have to clean up over a period of decades.
- digi_owl 11y ago
  In essence there are not critical US systems running on Flash and so the defensive side of NSA don't care. And the offensive side is just happy to let it rot, as that means more opportunities for them.
  - technion 11y ago
    The thorn in the side of removing Flash has been VMware, who, in their latest vSphere 6 release, clearly made the point that "Flash is the future", with announcements towards deprecating their alternative clients. I don't understand what they are thinking - it used to be such a progressive company. I don't know about US Government, but many Governments and sensitive organisations are still using VMware, and this isn't likely to change.
    - chm 11y ago
      Where can I find information on this?
  - rurban 11y ago
    But "thanksfully" they've switched to WordPress on the Whitehouse site and hired the maintainer , so they are improving netsec on THAT front. :) Which is actually a good thing for hosters worldwide.
- akshatpradhan 11y ago
  >They're basically an infosec Bhopal I lul'd.
- astrodust 11y ago
  Can we get Adobe declared a Superfund clean up site?
bitmapbrother 11y ago
Should we also ask what Microsoft has to say about their consistent streak of serious security problems in IE and Windows?
- Wizzard666 11y ago
  To be fair, Microsoft started taking security extremely serious years ago
Wizzard666 11y ago
It hurts to think about how many people have been financially fucked over due to Adobe software practices
dchest 11y ago
How about making police raid homes and forcefully uninstall Flash Player?
- Buge 11y ago
  Why waste money on police raids when you can exploit Flash to put "malware" on their computer that uninstalls Flash?
ytdht 11y ago
you probably can lookup news archives of the last ~15 years for that
- thomasrossi 11y ago
  :) I was at a security meeting, I've heard the same reply. I am really not sure why it's still so used though.
- deleted 11y ago
  [deleted]

by sobkas 11y ago

fnordfnordfnord 11y ago

If they say much of anything, they will probably just reiterate that they take security very seriously.

elorant 11y ago

Their clientele isn’t security wary people. Plus they don’t have any serious competition in most of their products so it can’t hurt them either way. So they’ll probably issue a generic statement and move on with their lives. As for consequences, the best thing most of us could do is disable Flash from the browser. I’ve done it since YouTube defaulted to HTML5 video and never looked back since.

dguido 11y ago

You think that any other software you use is any better? Flash gets it rough because it's widely used and independent of the browser (for the most part). If you're running an update to date flash, that means you're probably running it in a sandbox and probably have silent auto updates turned on. That's good enough for most people. If you're the kind of person that's going to get specifically targeted, then you should not only reconsider running flash on your computer, but any other program written in an unsafe language. Or, you know, segregate your data.

al2o3cr 11y ago
"You think that any other software you use is any better?" I certainly HOPE most software I use can do better than this: http://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-6761/Adobe-Flash-Player.html http://www.cvedetails.com/vulnerability-list/vendor_id-53/pr... To be certain, Flash gets a lot of attention because of its install base - but it's been a never-ending FOUNTAIN of RCE bugs for much of the last decade.
- weland 11y ago
  Most software that's as complex as Flash is probably similarly full of bugs. Most of those vulnerabilities reek of huge development teams toiling over a codebase whose foundation was written in the late 90s and had features and fixes duct taped ever since.
  - sobkas 11y ago
    "Probably"? Complex as Flash? Whatever it have a big or small team, was started in the late 90s or whatever it causes problems now. So use whatever excuses you like, Flash is still a security concern with opportunity for more 0-day exploits(just one firm have two in the drawer, how many more there are?).
  - reagency 11y ago
    Do Chrome and Safari have as bad a track record? Flash has been insecure since originally launched.
    - thomasrossi 11y ago
      no, maybe not as bad, but JIT can be played pretty hard. I think the difference is that they are better structured and more transparent. I would definitely NOT put my hands on flash code, must be a mess!
    - dguido 11y ago
      In a way, yes, they do. Chrome pushes out a dozen or more fixes for remotely exploitable vulnerabilities every 2 weeks.
      - greggman 11y ago
        No they don't. Chrome is designed from the ground up for security. It has the same number of bugs as other software of it's size but the type of bugs are much less severe. Compare FF, Safari, IE, Chrome. Same number of bugs per yet but Chrome has 10x less code execution bugs (ie, 10x less likely for your machine to be owned by unknown bugs) http://i.imgur.com/rVgu7Fs.png http://i.imgur.com/rVgu7Fs.png
beedogs 11y ago
Flash gets it rough because it's horribly-written software full of security holes. It's demonstrably worse than most anything else out there.
- dguido 11y ago
  Every piece of software you use is on a constant month-to-month patch train. Chrome, Windows, Firefox, Quicktime, Adium, hell even OpenSSL updates for security-critical bugs about once a month now. Flash is nothing special. All your software is insecure.
kijin 11y ago
Flash "auto updates" are anything but. On Windows, you get a pop-up to update manually, which just sends you to their website so you need to download and run the installer by yourself. If you don't update manually, Flash will wait 45 days before triggering an automatic update. I never waited that long, so I don't know whether it's "silent" or not.

DavideNL 11y ago

i'm not sure if it's relevant whatever they'd have to say. Just look at the news for the past years and there's only 1 conclusion: uninstall Flash or accept increased risk of catching a virus.

pjc50 11y ago

If there were actually a government body that cared about "cyber"-security, they'd be hauled up in front of it. They're basically an infosec Bhopal - creating a toxic mess that other people have to clean up over a period of decades.

digi_owl 11y ago
In essence there are not critical US systems running on Flash and so the defensive side of NSA don't care. And the offensive side is just happy to let it rot, as that means more opportunities for them.
- technion 11y ago
  The thorn in the side of removing Flash has been VMware, who, in their latest vSphere 6 release, clearly made the point that "Flash is the future", with announcements towards deprecating their alternative clients. I don't understand what they are thinking - it used to be such a progressive company. I don't know about US Government, but many Governments and sensitive organisations are still using VMware, and this isn't likely to change.
  - chm 11y ago
    Where can I find information on this?
- rurban 11y ago
  But "thanksfully" they've switched to WordPress on the Whitehouse site and hired the maintainer , so they are improving netsec on THAT front. :) Which is actually a good thing for hosters worldwide.
akshatpradhan 11y ago
>They're basically an infosec Bhopal I lul'd.
astrodust 11y ago
Can we get Adobe declared a Superfund clean up site?

bitmapbrother 11y ago

Should we also ask what Microsoft has to say about their consistent streak of serious security problems in IE and Windows?

Wizzard666 11y ago
To be fair, Microsoft started taking security extremely serious years ago

Wizzard666 11y ago

It hurts to think about how many people have been financially fucked over due to Adobe software practices

dchest 11y ago

How about making police raid homes and forcefully uninstall Flash Player?

Buge 11y ago
Why waste money on police raids when you can exploit Flash to put "malware" on their computer that uninstalls Flash?

ytdht 11y ago

you probably can lookup news archives of the last ~15 years for that

thomasrossi 11y ago
:) I was at a security meeting, I've heard the same reply. I am really not sure why it's still so used though.
deleted 11y ago
[deleted]