6 ms·

You think that any other software you use is any better? Flash gets it rough because it's widely used and independent of the browser (for the most part). If yo

by dguido 11y ago

You think that any other software you use is any better? Flash gets it rough because it's widely used and independent of the browser (for the most part). If you're running an update to date flash, that means you're probably running it in a sandbox and probably have silent auto updates turned on. That's good enough for most people. If you're the kind of person that's going to get specifically targeted, then you should not only reconsider running flash on your computer, but any other program written in an unsafe language. Or, you know, segregate your data.

al2o3cr 11y ago
"You think that any other software you use is any better?" I certainly HOPE most software I use can do better than this: http://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-6761/Adobe-Flash-Player.html http://www.cvedetails.com/vulnerability-list/vendor_id-53/pr... To be certain, Flash gets a lot of attention because of its install base - but it's been a never-ending FOUNTAIN of RCE bugs for much of the last decade.
- weland 11y ago
  Most software that's as complex as Flash is probably similarly full of bugs. Most of those vulnerabilities reek of huge development teams toiling over a codebase whose foundation was written in the late 90s and had features and fixes duct taped ever since.
  - sobkas 11y ago
    "Probably"? Complex as Flash? Whatever it have a big or small team, was started in the late 90s or whatever it causes problems now. So use whatever excuses you like, Flash is still a security concern with opportunity for more 0-day exploits(just one firm have two in the drawer, how many more there are?).
  - reagency 11y ago
    Do Chrome and Safari have as bad a track record? Flash has been insecure since originally launched.
    - thomasrossi 11y ago
      no, maybe not as bad, but JIT can be played pretty hard. I think the difference is that they are better structured and more transparent. I would definitely NOT put my hands on flash code, must be a mess!
    - dguido 11y ago
      In a way, yes, they do. Chrome pushes out a dozen or more fixes for remotely exploitable vulnerabilities every 2 weeks.
      - greggman 11y ago
        No they don't. Chrome is designed from the ground up for security. It has the same number of bugs as other software of it's size but the type of bugs are much less severe. Compare FF, Safari, IE, Chrome. Same number of bugs per yet but Chrome has 10x less code execution bugs (ie, 10x less likely for your machine to be owned by unknown bugs) http://i.imgur.com/rVgu7Fs.png http://i.imgur.com/rVgu7Fs.png
        dguido 11y ago
        The chart you just linked (which doesn't show a timescale) shows Chrome with over 300 exploitable bugs. I doubt the denial of service label, that just usually means that a bug wasn't fully investigated. So, again, how is this different from Flash? Chrome is riddled with vulnerabilities (and Safari is too). Flash runs in a low-priv environment is nearly every major browser, includes application-specific exploit mitigations, and it silently auto-updates, just like Chrome. It's all a matter of the Flash install base: it's in 90%+ of browsers and it's running the same-ish codebase in all of them, making it a relatively stable platform to develop exploits for. That's it! It's more a factor of market share and not "security." Every document reader, HTML renderer, JavaScript engine, browser, media player, etc that you use is the same -- a house of cards built on poor memory management :-/.
- x0x0 11y ago
  data: I grabbed all 500+ records and counted, by month, those with severity 10 (column 10) and severity >= 7 (column 7). Rows is the # of cve records for that month. it's not awesome month rows 10 7 2015-07 35 28 29 2015-06 14 7 7 2015-05 17 10 10 2015-04 22 19 19 2015-03 11 7 9 2015-02 19 19 19 2015-01 12 9 11 2014-12 6 5 5 2014-11 19 16 18 2014-10 3 3 3 2014-09 12 11 12 2014-08 8 7 7 2014-07 3 0 2 2014-06 6 1 3 2014-05 5 0 5 2014-04 4 1 2 2014-03 4 2 2 2014-02 4 3 4 2014-01 2 2 2 [...] 2015 has not been kind to them, but it's been a continuous trickle of remote severity 10s every month for a year and a half truncated because it took too much space; full results: https://gist.github.com/anonymous/763e28612b74d3a1817a https://gist.github.com/anonymous/763e28612b74d3a1817a NB: only months with at least one cve event show up, but given adobe's focus on security, it wasn't really necessary to fill in months with 0 events to get the point across download each screen full of results from the cve site into a single directory and run this script: https://gist.github.com/anonymous/990bfe126d273ef84134 https://gist.github.com/anonymous/990bfe126d273ef84134
  - pmontra 11y ago
    Vulnerabilities increase and usage decreases. I wonder if an economically sensible decision should be to EOL Flash soon. Are they still doing any money out of it?
    - pmontra 11y ago
      I answer to myself because I just read this http://www.theverge.com/2015/7/13/8948459/adobe-flash-insecure-says-facebook-cso http://www.theverge.com/2015/7/13/8948459/adobe-flash-insecu... from Facebook's CSO. "It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day. — Alex Stamos (@alexstamos) July 12, 2015"
beedogs 11y ago
Flash gets it rough because it's horribly-written software full of security holes. It's demonstrably worse than most anything else out there.
- dguido 11y ago
  Every piece of software you use is on a constant month-to-month patch train. Chrome, Windows, Firefox, Quicktime, Adium, hell even OpenSSL updates for security-critical bugs about once a month now. Flash is nothing special. All your software is insecure.
kijin 11y ago
Flash "auto updates" are anything but. On Windows, you get a pop-up to update manually, which just sends you to their website so you need to download and run the installer by yourself. If you don't update manually, Flash will wait 45 days before triggering an automatic update. I never waited that long, so I don't know whether it's "silent" or not.

by dguido 11y ago

al2o3cr 11y ago

"You think that any other software you use is any better?" I certainly HOPE most software I use can do better than this: http://www.cvedetails.com/vulnerability-list/vendor_id-53/product_id-6761/Adobe-Flash-Player.html http://www.cvedetails.com/vulnerability-list/vendor_id-53/pr... To be certain, Flash gets a lot of attention because of its install base - but it's been a never-ending FOUNTAIN of RCE bugs for much of the last decade.

weland 11y ago
Most software that's as complex as Flash is probably similarly full of bugs. Most of those vulnerabilities reek of huge development teams toiling over a codebase whose foundation was written in the late 90s and had features and fixes duct taped ever since.
- sobkas 11y ago
  "Probably"? Complex as Flash? Whatever it have a big or small team, was started in the late 90s or whatever it causes problems now. So use whatever excuses you like, Flash is still a security concern with opportunity for more 0-day exploits(just one firm have two in the drawer, how many more there are?).
- reagency 11y ago
  Do Chrome and Safari have as bad a track record? Flash has been insecure since originally launched.
  - thomasrossi 11y ago
    no, maybe not as bad, but JIT can be played pretty hard. I think the difference is that they are better structured and more transparent. I would definitely NOT put my hands on flash code, must be a mess!
  - dguido 11y ago
    In a way, yes, they do. Chrome pushes out a dozen or more fixes for remotely exploitable vulnerabilities every 2 weeks.
    - greggman 11y ago
      No they don't. Chrome is designed from the ground up for security. It has the same number of bugs as other software of it's size but the type of bugs are much less severe. Compare FF, Safari, IE, Chrome. Same number of bugs per yet but Chrome has 10x less code execution bugs (ie, 10x less likely for your machine to be owned by unknown bugs) http://i.imgur.com/rVgu7Fs.png http://i.imgur.com/rVgu7Fs.png
      - dguido 11y ago
        The chart you just linked (which doesn't show a timescale) shows Chrome with over 300 exploitable bugs. I doubt the denial of service label, that just usually means that a bug wasn't fully investigated. So, again, how is this different from Flash? Chrome is riddled with vulnerabilities (and Safari is too). Flash runs in a low-priv environment is nearly every major browser, includes application-specific exploit mitigations, and it silently auto-updates, just like Chrome. It's all a matter of the Flash install base: it's in 90%+ of browsers and it's running the same-ish codebase in all of them, making it a relatively stable platform to develop exploits for. That's it! It's more a factor of market share and not "security." Every document reader, HTML renderer, JavaScript engine, browser, media player, etc that you use is the same -- a house of cards built on poor memory management :-/.
x0x0 11y ago
data: I grabbed all 500+ records and counted, by month, those with severity 10 (column 10) and severity >= 7 (column 7). Rows is the # of cve records for that month. it's not awesome month rows 10 7 2015-07 35 28 29 2015-06 14 7 7 2015-05 17 10 10 2015-04 22 19 19 2015-03 11 7 9 2015-02 19 19 19 2015-01 12 9 11 2014-12 6 5 5 2014-11 19 16 18 2014-10 3 3 3 2014-09 12 11 12 2014-08 8 7 7 2014-07 3 0 2 2014-06 6 1 3 2014-05 5 0 5 2014-04 4 1 2 2014-03 4 2 2 2014-02 4 3 4 2014-01 2 2 2 [...] 2015 has not been kind to them, but it's been a continuous trickle of remote severity 10s every month for a year and a half truncated because it took too much space; full results: https://gist.github.com/anonymous/763e28612b74d3a1817a https://gist.github.com/anonymous/763e28612b74d3a1817a NB: only months with at least one cve event show up, but given adobe's focus on security, it wasn't really necessary to fill in months with 0 events to get the point across download each screen full of results from the cve site into a single directory and run this script: https://gist.github.com/anonymous/990bfe126d273ef84134 https://gist.github.com/anonymous/990bfe126d273ef84134
- pmontra 11y ago
  Vulnerabilities increase and usage decreases. I wonder if an economically sensible decision should be to EOL Flash soon. Are they still doing any money out of it?
  - pmontra 11y ago
    I answer to myself because I just read this http://www.theverge.com/2015/7/13/8948459/adobe-flash-insecure-says-facebook-cso http://www.theverge.com/2015/7/13/8948459/adobe-flash-insecu... from Facebook's CSO. "It is time for Adobe to announce the end-of-life date for Flash and to ask the browsers to set killbits on the same day. — Alex Stamos (@alexstamos) July 12, 2015"

beedogs 11y ago

Flash gets it rough because it's horribly-written software full of security holes. It's demonstrably worse than most anything else out there.

dguido 11y ago
Every piece of software you use is on a constant month-to-month patch train. Chrome, Windows, Firefox, Quicktime, Adium, hell even OpenSSL updates for security-critical bugs about once a month now. Flash is nothing special. All your software is insecure.

kijin 11y ago

Flash "auto updates" are anything but. On Windows, you get a pop-up to update manually, which just sends you to their website so you need to download and run the installer by yourself. If you don't update manually, Flash will wait 45 days before triggering an automatic update. I never waited that long, so I don't know whether it's "silent" or not.