6 ms·
Facebook's new chief security officer wants to set a date to kill Flash
- kungfooman 11y agoDunning–Kruger effect.
- godgod 11y agoAgreed. Can we the people also set a date to kill off Facebook? In my opinion they are just as bad as Adobe, not so much on security but privacy.
- lode 11y agoOn my system (without Flash), Facebook is one of the last sites where I encounter Flash for non-ad content. (Videos)
- cpncrunch 11y agoThey now have an html5 video player, which I think they just introduced a week ago. BBC is about the only site I've seen that requires flash video, but I'm sure they'll get with the program soon.
- 1ris 11y agoSo far I know NPR and Spiegel (german tabloid). All these sites work fine without flash if you set your useragent to that of a iDevice. Somebody implemented the switch between html video and flash in a foolish way.
- TD-Linux 11y agoI so far have not gotten Facebook to serve me the html5 video player, for whatever reason.
- cpncrunch 11y agoStupid question perhaps, but have you disabled the flash plugin? It seems to work fine on latest Chrome.
- TD-Linux 11y agoI don't even have it on my system. I wonder if it's some sort of UA detection thing? I tried appearing as Chrome 41 on Windows 7, but no luck. (firefox nightly on linux user here, with h.264/aac support provided by gstreamer)
- cpeterso 11y agoI think that Facebook only serves HTML5 video to Windows 7+, so I'm not sure why your Chrome 41 on Windows 7 test didn't work.
- talmand 11y agoKill it? We must be close already because my first thought on seeing the headline I wondered why someone at Facebook wanted The Scarlet Speedster dead when we haven't seen him in a movie yet. Sign of the times. EDIT: Well, I did.
- deleted 11y ago[deleted]
- deleted 11y ago[deleted]
- astrodust 11y agoIf Flash was implemented in JavaScript, which sounds slightly crazy but not entirely impractical, it probably wouldn't have nearly as many vulnerabilities. When's the last time a JavaScript exploit was found? I know the Pwn2Own contests manage to bust out of the sandbox now and then, but this seems exceedingly rare compared to the near monthly super critical Flash updates.
- ronjouch 11y agoIf Flash was implemented in JavaScript, which sounds slightly crazy but not entirely impractical Not so crazy, http://mozilla.github.io/shumway/ http://mozilla.github.io/shumway/ -and Gnash before- does it (to a certain extent) now.
- 1ris 11y agoIMHO these (and their failures) are an argument it's indeed somewhat crazy.
- TD-Linux 11y agoI wouldn't say Shumway has failed, it's still an active and new project. I can pretty much use any "traditional" vector animated flashes on them. Video is still a problem due to codec patent issues, which is a bit sad because it's a legal obstacle, not a technical one.
- ronjouch 11y ago:D . I stand corrected, have an upvote.
- danudey 11y agoBut then it would be even worse on battery life. The primary uses that I see, day to day, for Flash are: 1. Video players (which should be done natively) 2. Ads (which is an awful use case) 3. Fancy, but broken, font replacement (less so lately) 4. Weird, unnecessary utility, like copying text to the clipboard. I don't see any reason to reimplement Flash in Javascript when all of these use cases can be better done in native HTML/Javascript already (1-3), or just not done at all (4). It seems like a huge amount of engineering effort to maintain an old technology that even its creator is migrating away from.
- asadotzler 11y agoFacebook is the last major site I visit that still pushes Flash on me. When they clean up their own act, then they can start talking about what Adobe and the rest of the Web should be doing.
- deleted 11y ago[deleted]
- TD-Linux 11y agoIt works fine for me without Flash. Even multi upload and drag and drop works. Unlike Facebook videos, which just fail.
- ohitsdom 11y agoSeriously. Before calling out Adobe, Facebook should announce when they'll be Flash-free. Otherwise it sounds pretty silly: "Tell us when we have to stop using this insecure, resource-intensive software."
- AdmiralAsshat 11y agoFlash is one of those things that I will be almost sorry to see go. Not because I enjoyed it, but because I could safely ignore it most of the time: I can disable it, meaning that method of attack/annoyance is completely shut off. When I see my browser showing me something that failed to run because Flash was not turned on, I'm fairly confident that it was something I didn't need to see. Sort of like how our spam filters have been trained well enough that nobody in this day and age still gets e-mails with shady .exe attachments--they're predictable, and Gmail and Outlook's spam filters will catch them. On the other hand, once Flash is dead, I worry that the invasive crap that made Flash so obnoxious will simply be re-engineered in HTML5 and Javascript, resulting in the same problems of garish pop-ups and autoplaying videos in an implementation that is more difficult to block.
- vezycash 11y agoMy main issue with the kill-flash cult is auto playing html5 videos. I've asked multiple times on HN and have not gotten a working answer. How can I block HTML5 videos and audios or at least stop them from playing automatically?
- deleted 11y ago[deleted]
- chejazi 11y agoParticularly for mobile, the latest video-ad rendering is happening in JS [0]. This is because autoplay video is disabled by default on mobile, but video rendering in ASM JS / WebGL bypasses such restrictions. Yahoo [1] is doing this, for instance. [0] https://github.com/brion/ogv.js https://github.com/brion/ogv.js [1] https://hpto.yahoo.com/review/mobile/npte/a-haunted.html https://hpto.yahoo.com/review/mobile/npte/a-haunted.html
- mike-cardwell 11y agoYou don't need JavaScript to autoplay video or audio on a webpage: <video src="url" autoplay> <audio src="url" autoplay>
- discardorama 11y agoI can't understand how one piece of software (Flash) can be so horribly broken over so many years. I mean, they had one simple thing to do: prevent code from escaping the sandbox. So how is it possible that they have repeatedly failed at that one task? <wear-tinfoil-hat>Never attribute to malice what can be explained by incompetence, as the saying goes. But after so many years, I'm beginning to wonder: is it really incompetence, or has some TLA agency convinced them not to do a good job? </wear-tinfoil-hat>
- billyhoffman 11y ago3 thoughts: First, to be fair, "Flash" is 2 complete Virtual Machines: ActionScript 2 and ActionScript 3. I expect it to have an increased attack surface. Second, many things that Flash does (graphics, 3D, video decoding, audio decoding, etc) pretty quickly get you to unmanaged APIs in the OS. Third, Flash can be suprisingly tricky to escape. Mark Dowd did an absolutely insane series of steps to have code that was valid bytecode, that retained control of a pointer, and to properly setup the memory space for jumping. This isn't necessarily "easy" by any stretch. The full write up is here: http://www.inf.fu-berlin.de/groups/ag-si/compsec_assign/Dowd2008.pdf http://www.inf.fu-berlin.de/groups/ag-si/compsec_assign/Dowd... This isn't to give Adobe a complete pass, but there is a lot going on here. Still, the time for Flash is past and I cannot wait for it to die
- J_Darnley 11y agoFlash will never be dead as long as I still need it to play the greatest animations the internet has ever produced.
- stevenh 11y agoWhy is everyone so obsessed with bashing Flash? Is it just because a RCE exploit is found once in awhile? Let's compare Adobe's diligence of patching to another company's. How about Mozilla? Adobe usually patches a RCE exploit within 72 hours of discovery. Mozilla seem to take anywhere from one to three months. Firefox RCE exploit found on January 20, 2015: https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2015-04-disclosure-mozilla-firefox-proxy-prototype-rce-cve-2014-8636 https://community.rapid7.com/community/metasploit/blog/2015/... Firefox RCE exploit found on February 25, 2015: https://msisac.cisecurity.org/advisories/2015/2015-018.cfm https://msisac.cisecurity.org/advisories/2015/2015-018.cfm Firefox RCE exploit found on March 1, 2015: https://www.mozilla.org/en-US/security/advisories/mfsa2015-39/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-3... Firefox RCE exploit found on April 22, 2015: https://msisac.cisecurity.org/advisories/2015/2015-046.cfm https://msisac.cisecurity.org/advisories/2015/2015-046.cfm Firefox RCE exploit found on May 12, 2015: https://www.mozilla.org/en-US/security/advisories/mfsa2015-50/ https://www.mozilla.org/en-US/security/advisories/mfsa2015-5... Did you hear about any of those Firefox RCE exploits? Probably not. We only hear about Flash RCE exploits because those are the ones which happen to get exploited in the wild the most. This is not because browsers are always more secure than Flash; it is because hackers know that if they succeed in finding a RCE exploit in Flash, they will be able to target the 97% of desktop users with Flash installed rather than just the 44% who use Chrome or the 15% who use Firefox. It's the same reason Windows users have always had far more exploits actively used against them than Mac users. Should we set a kill date for Windows because of that? As long as we are making asinine suggestions, how about browsers set a kill date for Facebook, after which no one can access the site? Facebook's rampant video piracy problem harming small publishers on YouTube [1] is orders of magnitude more financially damaging to its victims than MegaUpload ever was. At bare minimum, it would be appropriate to warn users that they are about to visit a malicious piracy hub with a red full-screen "Are you sure you want to go here?" page, and perhaps provide a list of suggestions of alternative social networks to switch to. 1. https://news.ycombinator.com/item?id=9854160 https://news.ycombinator.com/item?id=9854160
- mixmastamyk 11y agoBecause flash is superfluous, while the browser is not.
- wesleytodd 11y agoIs this article one big troll? https://twitter.com/wesleytodd/status/620677489166123008 https://twitter.com/wesleytodd/status/620677489166123008
- Fiahil 11y agoQuick question, what would happen to games developed in Flash? This one was among my favorites for a time: http://www.dofus.com/en http://www.dofus.com/en
- legohead 11y agoThere are whole sites/companies built on flash games.. armorgames, kongregate.. Not to mention the developers to make a living off of it. Facebook has had a lot of vulnerabilities, maybe someone should ask them to set a kill date?
- fbender 11y agoPort to HTML5 (or whatever you prefer) or take a look at Mozilla Shumay[1]. [1] http://mozilla.github.io/shumway/ http://mozilla.github.io/shumway/
- kenshaw 11y agoIs it too late to schedule January 1st, 2014 as EOL for Flash?
- andreineculau 11y agoForget Flash, there are bigger fishes to catch: http://blog.andreineculau.com/2015/07/13/major-security-threat-linkedin-facebook-github-etc-and-secondary-email-addresses/#content http://blog.andreineculau.com/2015/07/13/major-security-thre...