3 ms·

I can't understand how one piece of software (Flash) can be so horribly broken over so many years. I mean, they had one simple thing to do: prevent code from e

I can't understand how one piece of software (Flash) can be so horribly broken over so many years. I mean, they had one simple thing to do: prevent code from escaping the sandbox. So how is it possible that they have repeatedly failed at that one task? <wear-tinfoil-hat>Never attribute to malice what can be explained by incompetence, as the saying goes. But after so many years, I'm beginning to wonder: is it really incompetence, or has some TLA agency convinced them not to do a good job? </wear-tinfoil-hat>

billyhoffman 11y ago
3 thoughts: First, to be fair, "Flash" is 2 complete Virtual Machines: ActionScript 2 and ActionScript 3. I expect it to have an increased attack surface. Second, many things that Flash does (graphics, 3D, video decoding, audio decoding, etc) pretty quickly get you to unmanaged APIs in the OS. Third, Flash can be suprisingly tricky to escape. Mark Dowd did an absolutely insane series of steps to have code that was valid bytecode, that retained control of a pointer, and to properly setup the memory space for jumping. This isn't necessarily "easy" by any stretch. The full write up is here: http://www.inf.fu-berlin.de/groups/ag-si/compsec_assign/Dowd2008.pdf http://www.inf.fu-berlin.de/groups/ag-si/compsec_assign/Dowd... This isn't to give Adobe a complete pass, but there is a lot going on here. Still, the time for Flash is past and I cannot wait for it to die