Slashdot Mirror

The reason Perl needs taint mode at all is because it does so many things in a blatantly insecure way...In most compiled languages, a taint mode is not necessary because the language and libraries don't do 'useful' things based on magic characters in strings you happen to pass.

Have you ever used a SQL library that lets you build and pass queries to the server? There are plenty of SQL injection vulnerabilities that would have been thwarted by taint checking in the language. Applications are filled with lots of other "little languages" that can be made to interpret unchecked input dangerously.

[irony]Do you think Bill Gates is annoyed that the story on pages 10 & 11 of the whitepaper (PDF) refers to "Lisa" using a laptop instead of a Tablet?[/irony]

It's not so much that Flash competes with Java as it does compliment Java (and .NET). The solutions currently being explored is to have Flash and HTML on the front end with Java on the server back end. I think this combo could be really powerful and takes advantage of the strengths of each platform.

In fact, Macromedia did a Flash + Java "Petstore" application to show off this exact solution. See:

J2EETM: Behind the Pet Market From Macromedia
Macromedia Pet Market Blueprint Application
Macromedia JavaTM Application Development Center

Also it's interesting to note that Macromedia produces it's own J2EE application server, JRun. The latest version is actually rather nice and very well priced. So I think Macromedia has no problems supporting both Flash and Java.

It's not so much that Flash competes with Java as it does compliment Java (and .NET). The solutions currently being explored is to have Flash and HTML on the front end with Java on the server back end. I think this combo could be really powerful and takes advantage of the strengths of each platform.

In fact, Macromedia did a Flash + Java "Petstore" application to show off this exact solution. See:

J2EETM: Behind the Pet Market From Macromedia
Macromedia Pet Market Blueprint Application
Macromedia JavaTM Application Development Center

Also it's interesting to note that Macromedia produces it's own J2EE application server, JRun. The latest version is actually rather nice and very well priced. So I think Macromedia has no problems supporting both Flash and Java.

This looks like Macromedia's version of Sherlock (or Watson).

Google turned up this link on Macromedia's site: http://www.macromedia.com/support/flash/ts/documen ts/remove_player.htm

The short answer is that you need to upgrade to Player 6,0,79,0 (why the heck Macromedia uses commas instead of periods is beyond me).

The short answer is that you need to upgrade to Player 6,0,79,0 (why the heck Macromedia uses commas instead of periods is beyond me).

I didn't see anything posted to the lists (Bugtraq, Vulnwatch, Full Disclosure, etc.) about this either, until the Gentoo announcement yesterday. For an issue Macromedia calls critical, they sure are being quiet about it.

And what about Macromedia Dreamweaver? I always preferred Dreamweaver to frontpage back when I was writing HTML.

Haven't used either for a while though, the scales might be tipping in favour of Frontpage.

Flash is a standard you biased motherfucker. Why don't you check out this handy link before you go spouting your mouth off.

I can't get to the site right now due to slashdotting, but I expect that this is simply a bunch of CD-ROMs that were sumitted to the MWM program. Part of the licensing agreement is that you send 2 copies of the CD you produce to Macromedia, as well as put their logo on your credits screen.

There should be some of my work in there! When the site is back up I'll have a look.

More info about the program here: http://www.macromedia.com/support/programs/mwm/

There are Flash players for various models of cellphones and PDAs already, and more in the works.

The devices that Flash is deployed upon (e.g. Nokia's 9210 Communicator, soon) are much more hefty than the ones SVGt is being optimized for (e.g. Nokia's 3650 and 7650). Furthermore, SVG is being sold with the platform, such as TI's OMAP chipset platform. That chipset has a huge percentage of the cell phone market.

And Flash MX supports what Macromedia calls "assistive technologies functionality."

Nevertheless, SVG's markup-based, HTML-integrated syntax is much better optimized for accessibility.

Flash's licensing model is inherently anti-accessibility because it does not allow the creation of competitive "viewers" including viewers optimized for blind people. SVG is not so-encumbered.

Seems to me a Web page designer who can embed alternate XHTML code would find it trivial to implement a Javascript or other server-side check for the presence of the Flash client, then "degrade" to static pages as needed.

Those are the kinds of hacks that make the Web much less easy to index, download and otherwise manipulate. Scripting is a fallback, to be reserved for exceptional tasks.

Even if SVG becomes a widespread standard, I could imagine a lot of pages checking for Flash first, then "degrading" to SVG -- because Flash files are compressed binaries, far smaller than the equivalent SVG.

SVG files can also be compressed binaries. GZIP compression is a required part of the specification. That's the better way to do binary compression because almost every language and platform has a gzip implementation.And because they use mathematical animation rather than frame-based animations, they will often be smaller than Flash files. Try again!

To me, the issues are clear. Flash has a much better existing toolbase and a much larger deployed audience. SVG has a much stronger technical architecture and is achieving rapid uptake in all sorts of verticals. It will take years for SVG to seriously challenge Flash. But when it does, SVG will win because its technology is so much stronger and it is a true standard which already has literally hundreds of cooperating tool implementations for every language, platform and application and will have thousands in the not-too-distant future.

There are Flash players for various models of cellphones and PDAs already, and more in the works.

The devices that Flash is deployed upon (e.g. Nokia's 9210 Communicator, soon) are much more hefty than the ones SVGt is being optimized for (e.g. Nokia's 3650 and 7650). Furthermore, SVG is being sold with the platform, such as TI's OMAP chipset platform. That chipset has a huge percentage of the cell phone market.

And Flash MX supports what Macromedia calls "assistive technologies functionality."

Nevertheless, SVG's markup-based, HTML-integrated syntax is much better optimized for accessibility.

Flash's licensing model is inherently anti-accessibility because it does not allow the creation of competitive "viewers" including viewers optimized for blind people. SVG is not so-encumbered.

Seems to me a Web page designer who can embed alternate XHTML code would find it trivial to implement a Javascript or other server-side check for the presence of the Flash client, then "degrade" to static pages as needed.

Those are the kinds of hacks that make the Web much less easy to index, download and otherwise manipulate. Scripting is a fallback, to be reserved for exceptional tasks.

Even if SVG becomes a widespread standard, I could imagine a lot of pages checking for Flash first, then "degrading" to SVG -- because Flash files are compressed binaries, far smaller than the equivalent SVG.

SVG files can also be compressed binaries. GZIP compression is a required part of the specification. That's the better way to do binary compression because almost every language and platform has a gzip implementation.And because they use mathematical animation rather than frame-based animations, they will often be smaller than Flash files. Try again!

To me, the issues are clear. Flash has a much better existing toolbase and a much larger deployed audience. SVG has a much stronger technical architecture and is achieving rapid uptake in all sorts of verticals. It will take years for SVG to seriously challenge Flash. But when it does, SVG will win because its technology is so much stronger and it is a true standard which already has literally hundreds of cooperating tool implementations for every language, platform and application and will have thousands in the not-too-distant future.

The license does not allow the creation of Flash players that compete with Macromedia's, or the creation of tools that read Flash and output something else (like SVG). That's hardly open.

Every time Flash comes up in a Slashdot thread, there's always some poster who hasn't heard of Flash MX saying "It doesn't support search engines, Unicode, accessibility, or the back button." The MX version has been out about a year now -- isn't it time to update your talking points?

"It doesn't degrade if you browser isn't able to support it." And that browser would be -- what, Lynx? Which also lacks SVG support, and always will.

As for "the majority of the Web browsing public," that's a very mild way of saying that the Flash plug-in is (according to Macromedia) the most pervasive software in the world, with over half a billion users. Given that Flash MX has strong XML support, and that it's now targeting "rich Internet applications" instead of ordinary vector animation, SVG has a long uphill battle ahead.

Every time Flash comes up in a Slashdot thread, there's always some poster who hasn't heard of Flash MX saying "It doesn't support search engines, Unicode, accessibility, or the back button." The MX version has been out about a year now -- isn't it time to update your talking points?

"It doesn't degrade if you browser isn't able to support it." And that browser would be -- what, Lynx? Which also lacks SVG support, and always will.

As for "the majority of the Web browsing public," that's a very mild way of saying that the Flash plug-in is (according to Macromedia) the most pervasive software in the world, with over half a billion users. Given that Flash MX has strong XML support, and that it's now targeting "rich Internet applications" instead of ordinary vector animation, SVG has a long uphill battle ahead.

the current main svg players are closed source.

there is nothing stopping you from writing your own flash player. The flash 6 file format specification is avaliable at:

http://www.macromedia.com/software/flash/open/lice nsing/fileformat/

the issues you have seme to do with the implimentation of the technology, and not the technology itseld.

here is a link to listing of flash privacy / security resources:

http://www.markme.com/mesh/archives/000068.cfm#000 068

http://www.macromedia.com/v1/developer/securityzon e/

http://www.macromedia.com/desdev/security/

I think one reason you find more security reports for the flash player than any SVG players, is that the Flash player is more widely distributed, and thus more people look for issues in it.

Also, the main SVG player, by adobe, is also closed source, so you run into the same issues of not know what it is doing.

Macromedia has been very responsive about addressing security issues with new player updates, and I don't think there are currently any open security issues which have not been addressed.

here is a link to listing of flash privacy / security resources:

http://www.markme.com/mesh/archives/000068.cfm#000 068

http://www.macromedia.com/v1/developer/securityzon e/

http://www.macromedia.com/desdev/security/

I think one reason you find more security reports for the flash player than any SVG players, is that the Flash player is more widely distributed, and thus more people look for issues in it.

Also, the main SVG player, by adobe, is also closed source, so you run into the same issues of not know what it is doing.

Macromedia has been very responsive about addressing security issues with new player updates, and I don't think there are currently any open security issues which have not been addressed.

the flash authoring tool cannot currently export SVG. However, it is possible to render SVG (or at least a subset) within the Flash Player.

For more info see:

http://actionscript-toolbox.com/svgnotes.php

http://www.macromedia.com/desdev/mx/flash/articles /parse_svg.html

also, if you would like to see svg support within the Flash authoring tool, you can request it here. Please be sure to include why you would like it and what it would enabled you to do. mike chambers mesh@macromedia.com

the flash authoring tool cannot currently export SVG. However, it is possible to render SVG (or at least a subset) within the Flash Player.

For more info see:

http://actionscript-toolbox.com/svgnotes.php

http://www.macromedia.com/desdev/mx/flash/articles /parse_svg.html

also, if you would like to see svg support within the Flash authoring tool, you can request it here. Please be sure to include why you would like it and what it would enabled you to do. mike chambers mesh@macromedia.com

fyi, the link to the linux flash player you have is 4 years old.

you can download all of the latest flash player, including linux, solaris and os x from:

http://www.macromedia.com/shockwave/download/alter nates/

you can find the flash 6 file format specification here:
http://www.macromedia.com/software/flash/open/lice nsing/fileformat/

*ahem*

Flash 6 Beta Download page

Thank you for you're time.

when it comes to webpage editing without spending the time to learn HTML..Frontpage wins hands down.

Try Dreamweaver - you'll never go back.

I also hope fewer sites use Flash; those Flash ads are especially unnerving. Well, they were unnerving until I discovered that there are several ways to remove the Flash integration from your browser (Windows and Mac).

http://www.macromedia.com/support/flash/ts/documen ts/playerfaq.htm#remove

Personally I would go with the manual uninstall. Who knows what else that uninstall program does. Doing it nitty gritty makes you feel more confident that it's out of your system for good. Also, they don't include how to avoid the Flash Install pop-ups on their web site. Just go to your HOSTS file and add:

0.0.0.0 active.macromedia.com
0.0.0.0 download.macromedia.com

Now live you life Flash-free! :)

Flash should be banned until there are useable free software implementations running in other platforms than Intel.

macromedia just released the beta linux v6 player if you are interested:

http://www.macromedia.com/software/flashplayer/spe cial/beta/release_notes/

Flash is anywhere *near* J2EE? Last I looked, Flash is entirely orthogonol to J2EE. It is just a media/presentation layer. That's like saying HTML or SMIL just took a step closer to J2EE. Nonsense.

Sounds like you haven't looked at Flash MX. Lots of data-handling, XML support, and talking to application layers. It works transparently with ColdFusion MX as backend through the Flash Remoting technology. There are Rich Text Editors, calendar plug-ins, FTP clients, etc. for Flash MX. Macromedia calls the new Flash stuff "rich Internet applications."

31 October 2002: For those of you experiencing crashes when loading sites with Flash, check out the beta of the Macromedia Shockwave Flash plugin. This plugin fixes an issue that causes crashes in the latest mainstream Flash release.

There is no rule that says that a standard has to be open or that anything has to be published. Soemthing is a standard because it is made so by a bona fide standards agency or by ubiquity.

But since it makes you happy to think such things and I love making you look like a retard flash file format

In case you weren't aware, a new Flash player for GNU/Linux
has been released too. It's recommended that you upgrade to this version if you're
going to use Mozilla 1.2. Unfortunately, audio seems
to be broken (at least for me under Mandrake GNU/Linux 8.1).

I've filed a bug report with Macromedia about this. Keep
it in mind if you upgrade.

Here are the current statistics for the Flash Player adoption for each version: http://www.macromedia.com/software/player_census/f lashplayer/version_penetration.html. Flash 5 is about 92% and Flash 6 is about 53%.

http://www.macromedia.com/software/flashplayer/spe cial/beta/

It works great!

As for Shockwave, it works great if you install the Windows version with CodeWeavers CrossOver plugin.

Kids sites tend to use a lot of Flash, from what I've seen. My 3 year old spends a lot of time playing games on the Disney and Noggin sites.

Unfortunately, the Flash player for Linux is still at version 5. Not a huge problem, as most Flash apps are still compatible with 5, but it does mean that you will run into problems until they release an update.

I have been working on a medical application using OSX, PHP, Apache, Mysql. What does this have to do with Cold Fusion? well the application was written originally in cold fusion. What I have found is that CF is great for rapid application development and proof of concept however is it not a deployment solution. If you are with a microsoft partner as you claim .. stay with their products ... otherwise all the people saying open source are correct. Also one should think twice about asking about MS products here it is essentially the same as asking people to flame you.

http://www.phoenix.com/en/products/firstview+conne ct/default.htm

From the site: "Providing industry-leading, standards-based support such as HTML 4.0, CSS 2.0, DOM 2,0, Javascript 1.4 and Flash 4 with a small code size, FirstView Connect was designed specifically for the emerging Information Appliance market and is ideally-suited for adding new value to both traditional and next-generation digital devices."

In short: It's a small-footprint web browser. <sarcasm>Gee, that's *totally different* than the Mozilla project's Phoenix, which is a small-footprint web browser.</sarcasm>

Hrmmm...that does add a bit to the mix. But their words are ``designed specifically for the ... Information Appliance market and is ... suited for ... digital devices.''

They're embedding the thing---a very different operation from building an end-user application for a general-purpose computer. (Would you consider embedding Phoenix? :-) Now the interesting points are:

• Their trademark says nothing about the HTML, &c., part of their output
• They call it FirstView Connect, not Pheonix, the embeddable browser
• When did Phoenix-the-browser start up vs. when did Phoenix-the-company start making HTML-enabled embeddable goodies?

  Google finds nothing for ``firstview connect 1'' (or 1.0), the earliest to turn up is 2.0 in a Real Networks press release dated 1 November 2001.

  Phoenix-the-browser released 0.1 all of two months ago (September 2002), but there's a reference to a (likely unrelated) ``Phoenix browser'' dated 6 January 2000. (It's about half-way down the page.) If anyone has cause to gripe, it's those folks!

I still claim there's zero point zero chance of the products being confused in the minds of their customers, in either of the two completely-separate target markets. And trademark protection is supposed to be about confusion and mis-perception, not attempted ownership of a word.

Sites that do not use Flash get my Seal of Approval.

There are a few flaws with the article that I'd also like to mention. I've worked on a handful of commercial shrinkwrap products, as well as a few video games. I do not speak for either of these companies. That being said...

Using Inodes, or anything else that doesn't allow the user to easily manipulate the document "seems like a good idea at the time(tm)," but in practice, it really sucks.

Consider Mac OS 9
Particularly when uninstalling and installing documents, it becomes obvious that this scheme is less than useful. It makes it *really* difficult to substitute a file for another file. In the case MacOS, you can delete the file, which conveniently winds up in the trashcan. After that, you replace the file with a new file of the same name that has some changes. However, because MacOS is "protecting you," it finds and uses the file in the trash can instead!

The same thing happens on MacOS 9 as well for programs. You can run entire programs from the trash, because it doesn't rely on the "pesky" filename to uniquely identify the app, taking power away from the user.

You mentioned this as well, but I wanted to add something... Another flaw of the article is how it discusses the necessity (or lack) of a quit button. While this might be true if we still ran applications that can fit in 64K of memory, it is not true with the powerhouse applications that we run today. The last commercial shrinkwrap application I worked on required 64 megs of RAM to run really well, and it was pushing the envelope when it came out. Similarly, the game I'm working on now requires approximately 128 megs, plus 32 megs of video ram. If we were to share nicely with other applications, the performance would suffer incredibly of both applications. Anyone who has ever fired up two copies of any application of a decent size would agree that the ability to quit applications is not a hindrance, its a necessity.

(Do a search in the page for 'bugzilla' and you will see that two mozilla bugs have been addressed.)

http://www.macromedia.com/shockwave/download/alter nates/

I know, I know... it only runs on 9 os's. You're probably using something else, right?

The Flash player 6 for linux is available here:

http://www.macromedia.com/software/flashplayer/spe cial/beta

And, the full file format spec is now available too which is rather cool:

http://radio.weblogs.com/0106797/2002/10/25.html#a 318

Actionscript performance has improved some in the current beta, though it still has a ways to go. Its noteworthy this is the first Flash Beta to ship on Linux simultaneously with Mac and Windows.

Don't bash flash so fast... it's accessible! sort of.

Some guy invented a 'closed-captioning' actionscript for Flash MX that parses an XML file, which tells the Flash movie when to display which caption. "The advantage of the tool is that it not only saves time, it also allows captioning to be done by someone other than the original Flash developer..."

Also, try Macromedia's page on Flash MX Accessibility.

here

I assume one of the programmers was watching too much Kids in the Hall

A Flash 6 Linux Player, beta to watch the final match on www.brainsinbahrain.com is available here

Actually, the newest Flash version has capabilities for disabled people. the Nielsen Norman Group helped them in adapting the product for different target groups.

The latest Alertbox of Jacob Nielsen talks about Making Flash Usable for Users With Disabilities - also the subject of a tutorial at Macromedia DevCon in Orlando.

Actually, the newest Flash version has capabilities for disabled people. the Nielsen Norman Group helped them in adapting the product for different target groups.

The latest Alertbox of Jacob Nielsen talks about Making Flash Usable for Users With Disabilities - also the subject of a tutorial at Macromedia DevCon in Orlando.

Tablizer wrote:
The most annoying thing I found about ColdFusion was it's lack of first-class functions/subroutines and funky variable scoping rules. You can get subroutine-like structures using custom tags or the scripting syntax, but they are just not "full citizens". There are certain things you cannot do with or in them. Thus, one tends to end up with long "main" scripts. I want full-blown subroutines.