Slashdot Mirror

The sure way to block flash: just uninstall it! http://kb.adobe.com/selfservice/viewContent.do?externalId=tn_14157

Do I need flash for anything but watching Youtube these days? C'mon Google, you guys are supposed to be the masters of all web technology, won't you please change Youtube to use some more secure technology so I can abandon Flash entirely?

Pfhh Adobe had Cold Fusion years ahead of these guys. Cold Fusion

Of course! :-)

when software companies realize that they can't sell non-transferable software, they will have their economists do some calculations to determine how that will affect total sales, since people who would have had to buy the software will now buy it second-hand.

Except companies like Adobe have allowed a License Transfer [pdf]. Googling software "license transfer" results in almost 150,000 results. On the first page of results are links to Adobe, HP, and Quark as well as Microsoft.

There's no way Autodesk is going to let this ruling stand unappealed, and if the appeals court rules against them again, there will be a cavalcade of software companies prepared to flood the Supreme Court with amicus briefs on their behalf.

Actually I doubt it. Other companies allow ownership to be transfered. Take for instance Adobe, Adobe has a Transfer of Adobe License [pdf] form the seller fills out when they transfer software to someone else, whether giving it away or selling it. Just as this guy sells AutoCAD on eBay others sale various Photoshop and CS versions. And Photoshop is the leading photo editor photo pros use, whereas AutoCAD has a number of competitors.

I'd like to note here that the SWF file format finally has a published specification. Thanks, Adobe!

Now would be a great time for a project like Gnash (or any OpenFlash-linked project) to get some funds.

OpenFlash lists IDEs, compilers, players, resusable libraries for handling SWF files, programming language bindings for working with those libraries, components, debuggers, byte code manipulators, and projects built on Flash which all could use some help right now.

Personally, I like to create my Flash primarily from a programming language rather than a time line editor, so I tend to use HaXe. Others use MTASC or other tools on the creation side. The players are pretty important for those not using Windows, OS X, or a well-packaged mainstream Linux. Perhaps the libraries that are used by many projects would be a good focus, too.

The SD crowd has clearly expresses it's love of PGP, and I have lot's of love for it too. But from a business perspective this is a much larger question. From a tech side there are other products such as Microsoft Right's Manager and Adobe's Policy Server.
http://www.adobe.com/products/livecycle/rightsmanagement/
I'm not endorsing either of these products (so save the flame wars), but identifying that this market is much larger than PGP. There also add a lot of other features, like restricting printing, restricting how long a file can be accessed, multi-factor authentication etc.

As for sending the data that you mentioned (SS#, DOB etc) this is a fine marriage of technology AND company policy, along with state, local, federal and national laws. For example the EU laws are very strict about sending this information and you need to be familiar with each nations requirements. Additionally, sending sensitive data across borders is a concern. As an example, a client could NOT outsource certain HR functions because of these laws. And when overseas certain HR develoment was done a thorough cleansing of the data needed to happen before it was either accessed or sent out of country (e.g. removing SS#'s Dob etc.)

In a nutshell you need your business to define what the security policies are, then use technology to the best you can to implement the policies. This is critical for SOX compliance and legal ramifications. Having the policy is almost, if not more important than the implementation often.

Cheers.

Hi, I see you feel strongly about this. But I'm not sure whether you're aware of running 32-bit browser plugins in 64-bit browsers via nspluginwrapper, and contributing to the Tamarin Project to move the just-in-time compilation and garbage collection to a 64-bit memory space. http://gwenole.beauchesne.info/projects/nspluginwrapper/ http://blogs.adobe.com/penguin.swf/2006/10/whats_so_difficult_64bit_editi.html http://www.mozilla.org/projects/tamarin/ You can get what you want now, and contribute to getting what you want in the future. Useful...? jd/adobe

MS wants Yahoo primarily so it can infect everyone's Windows PCs with its Silverlight technology (which was dubbed the "Flash Killer"). That won't happen due to this initiative: http://www.adobe.com/openscreenproject/ Give up MS, you are destined to become a Linux software development company. The MS Windows era is coming to an end. Hypnotic dreams of Switzerland are calling to you Mr. Balmer... shortly it will be time to materialize those dreams.

"Even if software is cheap, it's never going to be cheap enough for a college student eating Ramen and saving money for beer on the weekends."

See, you're wrong about this. In any college, you will find discounted copies of software and hardware from Apple, Adobe, and Microsoft.

"If Adobe made it impossible for him to get an illegal copy of Photoshop, guess what?"

Bullshit. You can go to the Adobe page here, for example, and see that Photoshop CS3 has a price of $299, compared to $999 retail.
There is no excuse for the 'college student' you refer to to skip a few keggers and get his needed software legally, rather than pirate it.

"And when he arrives at his first job and they ask him which version of the Creative Suite he needs, he very well might say "That's alright - I know Gimp and Inkscape, and I already have them. Just get me a bigger monitor instead.""

Both Gimp and Inkscape are lacking in the areas required in the professional world, and that's a topic that's been beaten to death.
They'd actually tell him what version of CS he'll be using, because they'll (most likely) have either a site or floating license, so your analogy continues to be wrong.
Him being a rockstar in Gimp or Inkscape has just about the same value as him being fantastic with Paintshop Pro or Windows Image tool when it comes to the real world (i.e. useless).

"It's a nightmare scenario, and one of those things I wish they (Microsoft/Adobe/Autodesk/Apple) would be more honest about."

They don't need to be 'more honest'; you need to be more informed before you mouth off and display your ignorance.

See this Flex development example.

Yes, you're wrong.

It's a shame you spent so much effort writing all that and none on Googling, because there is plenty of information out there.

Adobe's own application platform for Flash is Flex. OpenLaszlo is an open-source XML based programming language for developing apps in SWF. Flash itself also has a substantial component collection for app development, and finally, there are dozens of third-party ActionScript IDEs and compliers available.

That's why Microsoft is introducing Silverlight. Flash is threatening to become an OS-independent application platform which could make Windows irrelevant.

several hundred conversations a month

Adobe Flash Player is not supported for playback in a 64-bit browser. However, you can run Flash Player in a 32-bit browser running on a 64-bit operating system.

That's a very unique definition of portability, one which suggests that that Active X components, for example, are portable because they work on every platform where Active X is available.

Adobe Flash doesn't run on my PPC/Linux box because Adobe doesn't support my browser of choice? If I ran a 32-bit browser on my PPC/Linux box and changed "literally nothing else" (including the processor), Adobe Flash would run just fine? // I find that somewhat difficult to believe.

Please use words you know.

I know what "rigorous" and "portable" mean. Check Adobe Flash Player system requirements yourself; all you need for Linux is a "modern processor" of 800 MHz or faster. Somehow that doesn't include my 1 GHz PPC processor and my 2.16 GHz 64-bit Core 2 Duo.

This kind of thing is just embarrassing.

I can agree with that.

But, as I've said, they're going to shoot themselves in the foot if they keep to their dumbass cross platform practices. And their sneaky phone home stuff (read the very bottom of the link). And their lousy installer on OS X.

Not that I'm annoyed or anything.

Bad example. When you get to the redirected page for the first search result, that page doesn't even contain the term "Serious Magic"

http://www.adobe.com/motion/

SWF specs:
http://www.adobe.com/devnet/swf/

FLV/F4V specs:
http://www.adobe.com/devnet/flv/

SWF specs:
http://www.adobe.com/devnet/swf/

FLV/F4V specs:
http://www.adobe.com/devnet/flv/

As of Flash Player 9.0.115 (if memory serves regarding the version number) you can use a standard MP4 video file encoded as H.264 instead of FLV. Not sure if that addresses your IP/GPL concerns, but you're not tied to FLV and VP6 if you target recent player versions.

The original press release is here.

PLEASE oh PLEASE oh PLEASE let the next Flash plugin incorporate 100% of the work you already put in to your now-dead SVG plugin! Making graphics out of thin air--nothing but an XML file with some basic info and a few (X,Y) coordinates--is SO sweet! C'mon Adobe, you used to* love SVG... right up until the day you bought Macromedia.

* note the dated references on that page to CS2

PLEASE oh PLEASE oh PLEASE let the next Flash plugin incorporate 100% of the work you already put in to your now-dead SVG plugin! Making graphics out of thin air--nothing but an XML file with some basic info and a few (X,Y) coordinates--is SO sweet! C'mon Adobe, you used to* love SVG... right up until the day you bought Macromedia.

* note the dated references on that page to CS2

It takes a few unobvious clicks to navigate Adobe's website, but here are the specs.

Now let's get hacking! :-)

It takes a few unobvious clicks to navigate Adobe's website, but here are the specs.

Now let's get hacking! :-)

Adobe opened up the RTMP protocol a few months ago with the release of the "BlazeDS" project. http://opensource.adobe.com/

I've been making SWFs on Linux for years. Swfmill is quite capable (the svn version has very good SVG support and works well with Inkscape), there is a fine language and compiler called haXe that can even compile for other targets as well (the Neko and generated Javascript, with PHP support in the works), among other tools.

Also, the Flex SDK is already open and works on Linux (it's Java). Finally, their (proprietary) Flexbuilder for Linux is currently a public alpha.

I've been making SWFs on Linux for years. Swfmill is quite capable (the svn version has very good SVG support and works well with Inkscape), there is a fine language and compiler called haXe that can even compile for other targets as well (the Neko and generated Javascript, with PHP support in the works), among other tools.

Also, the Flex SDK is already open and works on Linux (it's Java). Finally, their (proprietary) Flexbuilder for Linux is currently a public alpha.

Check http://www.earthbrowser.com/ . An application dates back to MacOS 9 days. Matt Giger, single author of it upgraded to version 3 and it runs on both Windows and OS X without a single glitch. It was originally a C application, it was converted to Adobe AIR and the day Linux has a stable Adobe AIR (soon I think), it is also automatically shipped to Linux/FreeBSD.

That is the opportunity Sun missed with their Webstart/Java. People and industry looks at results, not promises. You can ship a full feature commercial application RIGHT NOW using Adobe AIR Framework. Most of your customers (like me) will be amazed at the fact that it uses LESS CPU compared to "real" previous version.

If they don't make stupid mistakes, Adobe also has a full feature multimedia player/content downloader which also perfectly works both on Windows and OS X. It will be huge in couple of months.
http://www.adobe.com/products/mediaplayer/ . It is -of course- possible thanks to Adobe AIR. Needless to say, it is also automatically shipped to Linux when Adobe Air for Linux stable ships.

What did Silverlight do except bribing to some known figures to promise outdated versions emulator or abusing the panic state of Nokia? Right, Nokia says they will ship Silverlight too but everyone who is experienced on handheld/PDA knows that just by shipping a framework, you don't guarantee people who will code for it or use it. Why would established Flash developer use it instead of using Flash Lite which will be in third generation soon?

I got Silverlight on my Virtual PC 7 running XP SP2. I almost felt sad for Microsoft, shipping as a "optional windows update" with a "KB" number? Sigh.

As a side, cautionary note, Silverlight adds a potential security issue to Mac OS X since it installs as User 502 which people always use as secondary, "non admin" account. Hope they fixed it. That is MS for you and no, I am not confusing it with MS Office 08 bug.

Yes, it will help a lot. Using the Open Screen Project page, I just discovered a link to the SWF file format specification, version 9 is available for download without having to accept any NDA's.

ColdFusion is most certainly vulnerable to SQL injection if you are not religiously using the CFQUERYPARAM tag inside your queries. Of course the database being queried needs to support multiple SQL statements in a single query (MySQL does, Access does not, can't speak for any others). http://www.adobe.com/devnet/coldfusion/articles/cfqueryparam.html

Obviously you didn't read the article. Here's the page Youtube sent her to. Note that there is no '.deb' choice.

http://www.adobe.com/shockwave/download/download.cgi?P1_Prod_Version=ShockwaveFlash

When it is running Vista, there's no reason to upgrade of course.

if you're running Vista more than likely you got a new PC or you upgraded an old PC to be Vista capable.

Photoshop

Adobe recommends that if you're running Photoshop on Vista that you get CS3. And it cost $650 while Photoshop CS3 Extended cost $1000.

Upgrades to stuff like Photoshop would surely be cheaper than a decent new PC?

First, to install an upgrade for Photoshop, Photoshop already has to be installed, I believe, and as I state above Adobe recommends CS3 for Vista, so it may be foolish to install CS2 on a Vista PC. Next, a decent PC should cost less than $1000, even to run Photoshop CS3 on. The following are headless: An HP that beats Photoshop's minimum requirements is less than $900, though this one's on sale. A Dell that exceeds CS3's minimum configuration is less than $820.

However even photographers are likely to get software other than Photoshop, perhaps a design suite and an office suite. Add all the software cost up and they can easily exceed the hardware cost.

When it is running Vista, there's no reason to upgrade of course.

if you're running Vista more than likely you got a new PC or you upgraded an old PC to be Vista capable.

Photoshop

Adobe recommends that if you're running Photoshop on Vista that you get CS3. And it cost $650 while Photoshop CS3 Extended cost $1000.

Upgrades to stuff like Photoshop would surely be cheaper than a decent new PC?

First, to install an upgrade for Photoshop, Photoshop already has to be installed, I believe, and as I state above Adobe recommends CS3 for Vista, so it may be foolish to install CS2 on a Vista PC. Next, a decent PC should cost less than $1000, even to run Photoshop CS3 on. The following are headless: An HP that beats Photoshop's minimum requirements is less than $900, though this one's on sale. A Dell that exceeds CS3's minimum configuration is less than $820.

However even photographers are likely to get software other than Photoshop, perhaps a design suite and an office suite. Add all the software cost up and they can easily exceed the hardware cost.

This interesting because he's exploiting a malloc fail. The gory details of exploiting ActionScript is also cool because it has a bytecode verifier and he manages to get around it. It really is a lot more high tech than a typical stack buffer smash against a badly written C application, and that is important because everyone should hopefully have updated that sort of code to be exploit free by now. And stack checked binaries and data execute prevention, AMD's "Not Execute" bit, make those more likely to end in process death than arbitrary code execution.

Finally because it works on both IE and Firefox and Flash has such a huge installation base it should be able to target a very high percentage of current machines. Larry Osterman called it "The way the world (wide web]) ends"

Mind you, if Address Space Layout Randomisation was turned on in the Flash executable on Vista, exploiting this hole would most likely (255 times out of 256) lead to a browser crash rather than arbitrary code execution, so it's not like the last few years work on security has been totally wasted. At the moment it's not and you will get owned reliably. Adobe have published an update, so it's a good idea to download it.

http://www.adobe.com/support/security/bulletins/apsb08-11.html

Back when I was reading about security someone said that buffer overflows that execute code on the stack were first generation exploits. Second generation would be more subtle stuff like this.

I couldn't figure out how to post a new comment, so I thought I'd tag this on to yours as it is a sign that open source has been embraced my much of the corporate world for years AND a certain hold out is scrambling to play catch-up (reminiscent of the browser wars, only this time there are 1,000s of 'Netscapes' who are already very well established and profitable, in place). Only a few of the numerous examples available: Google http://code.google.com/opensource/ Adobe http://opensource.adobe.com/wiki/display/site/Home IBM http://www-03.ibm.com/linux/opensource/ Yahoo! (MSFT is threatening to go to stockholders directly they want 'in' so bad) http://developer.yahoo.com/yui/ (all of these and more large, commercial, entities have open-source research and development projects and sponsor other open-source projects and programs) And, the 'icing on the cake' http://port25.technet.com/ Microsoft's recently launched Open Source site And, then there's the whole 'server' thing and Vista fiasco (those MSFT memos were a laugh riot).

Apple are still feeling the effects of their decision 7 years ago, as the 64-bit Photoshop OS X edition will need a couple years (two release cycles) to translate ~1M lines of code from Carbon to Cocoa. Whereas, the 64 bit windows version will be out in the next release cycle — far sooner than the OS X version. http://blogs.adobe.com/jnack/2008/04/photoshop_lr_64.html

Photoshop can already use more than 3GB:

http://kb.adobe.com/selfservice/viewContent.do?externalId=320005

It's the MPL.

AIR does use Webkit: http://labs.adobe.com/wiki/index.php/Apollo:developerfaq#Why_did_Adobe_choose_WebKit.3F

From the SWF and FLV File Format Specification and License
-- This license does not permit the usage of the specification to create software which supports SWF file playback.

That's pathetic. Adobe is explicitly trying to control the _format_, while trying to convince (and confuse) people by releasing the runtime and SDK as open source. Which means they still retail all the control of closed-source software, without many people even being aware of it. Once (hopefully not) AIR or Flash becomes a widely accepted platform for applications, Adobe can easily ask people to pay up or do whatever.

These days, I get frustrated by the number of people who mention that Adobe is a major supported of open source, and get excited about it. Java may suck, but it sure is not a lock in.

It was only released last month (though it's been in beta since last June) but there are already some significant apps like ebay desktop. For loads more, of varying significance, see here. Also, I can shameless plug mine

Not totally objective (see my sig), but I'll try. AIR makes it a lot easier for web developers to create apps on the desktop. You can write apps in either Flash, Flex (now open source) or HTML and Javascript. While it's damn near impossible to create a UI in Java that doesn't look like a PoS (yeah, gross generalisation, but that's my experience), AIR makes it very easy. While stuff like Java Web Start never seemed to work smoothly, AIR integrates really well with web pages (you can do stuff like launch and install apps from the browser). I realise that much of these are benefits for the develop rather than the end user, but this obviously means that it will bring benefits to users in terms of the kind of apps developed.

This is excellent news. We've never had the resources to port our panoramic image stitcher to Linux, but as it's now an AIR app, this means we get it for free. I can finally use my own app on Ubuntu! Anyone who hasn't taken a look at AIR yet should seriously check it out, especially now that Flex is open source.

With regard to installing the software on more than two computers and
its use at the same time. I need to inform you that although Adobe
Reader is a free software, Adobe maintains its distribution rights.
Thus, as per Adobe policy there is no provision to use the software on
more than two computers simultaneously.

We apologize for the inconvenience this may cause.

Please note that, single-user Adobe branded product that is installed on
a computer at home, you can also install and use the software on one
secondary computer of the same platform at office or on a portable
computer. However, you may not run the software simultaneously on both
the primary and secondary computers.

Looks like Adobe is already planning to revise the license.

I think it's a great idea to give people a taste of what Photoshop is like.