Slashdot Mirror

← Back to Stories (view on slashdot.org)

Adobe Flash Exploit Could Log Keystrokes

Posted by CmdrTaco on from the i-thought-adobe-was-good-in-a-wreck dept.

Kenyon Lessi writes "Adobe has issued three critical security updates, one of which is designed to stop a problem in the way the Flash player interacts with browsers, which could result in users' keystrokes being transmitted to attackers. The problem affect Adobe Flash Player version 9.0.45.0, 8.0.34.0 and 7.0.69.0, as well as their earlier versions running on all platforms."

156 comments

  1. Great... by 6Yankee · · Score: 5, Funny

    ...and TFA has a Flash ad...

    1. Re:Great... by GizmoToy · · Score: 1, Insightful

      You'd think that it would have occurred to them that they were putting a Flash ad on a page discussing a major flaw in Flash. Of course, they just want to get paid and don't really care about you, so I can't say I'm all that surprised.

    2. Re:Great... by Cutriss · · Score: 4, Insightful

      You'd think that it would have occurred to them that they were putting a Flash ad on a page discussing a major flaw in Flash. Of course, they just want to get paid and don't really care about you, so I can't say I'm all that surprised.
      Or...maybe the world isn't as evil of a place as you think, and the people writing the article aren't the same people that develop the website? Maybe they don't even know how to use Flash and just write copy?
      --
      "Mod, mod, mod...and another troll bites the dust."
    3. Re:Great... by utopianfiat · · Score: 1

      ftw

      --
      +5, Truth
    4. Re:Great... by Anonymous Coward · · Score: 1, Funny

      Or maybe it is more evil and they put the article out there to lure you to the Flash ad so they could log your keystrokes.

    5. Re:Great... by MojoRilla · · Score: 4, Informative

      You'd think that it would have occurred to them that they were putting a Flash ad on a page discussing a major flaw in Flash.
      Why? I'm sure the editorial group uses a CMS to publish these pages, and the standard template has DoubleClick ads in them. DoubleClick may or may serve out Flash ads, based on what is bought and should be served at any particular moment. This allows the advertiser to have a lot of flexibility, as they can buy only 1,000 impressions or 1,000,000 impressions, and have those ads served out over a wide range of pages. It also makes it easy for editorial people to get paid for their work, instead of having to worry about ads on every single page they publish

      There are some cases where ads will be pulled or targeted for a specific reason, such as no ads at all on plane crash stories, or no MSN ads on AOL pages. But it would be far too costly to make an exception like that for a flash ad on a page about flash insecurities.
    6. Re:Great... by shawn(at)fsu · · Score: 1

      maybe it's part of their defense. If some on gets hacked because of that banner ad, Adobe could say "Hey we warned you"

      --
      500 dollar reward for tip(s) leading to the arrest of the person(s) who stole my sig.
    7. Re:Great... by Goaway · · Score: 1

      So in your world, web browser vulnerabilities are only allowed to be published in print?

    8. Re:Great... by ThePengwin · · Score: 1

      Plus they way keyword searches are, "Flash" "insecurities" Means to a computer to display things about Flash and Security.

    9. Re:Great... by xilduq · · Score: 1

      Ads? I don't see no stinkin' ads. I use Firefox, adblock and NoScript. Ain't no ads.

  2. Always So Negative by eldavojohn · · Score: 4, Funny
    I know a lot of people are going to find something to complain about with these new bugs--no, wait--features of our beloved and adored Adobe Flash plugin but I think we should turn these lemons into lemonade and recognize all the fun things people can do with a tool like a keystroke logger:
    • Get an extremely accurate analysis of your words per minute in typing.
    • Search through the log and double check that you correctly entered all of your banking account numbers, credit card and personal information on all of your internet forms.
    • Do searches on the log to see if you ever accidentally typed "teh" and how many times that happened.
    • Compare your Letter Frequency to the standard featured in Edgar Alan Poe's The Gold Bug
    As you can see, there are many fun & great things that one can do with the potential of these new key logging features.

    </sarcasm>
    --
    My work here is dung.
    1. Re:Always So Negative by CaptainPatent · · Score: 4, Funny

      Wow... and you typed that post at 55 words per minute!

      --
      Well, back to rejecting software patent applications.
    2. Re:Always So Negative by monk.e.boy · · Score: 2, Insightful

      they should Open Source the player. That would solve most of their problems.

      The only bit that is worth anything is the Flash IDE designer thingy.

      If it was opensource it'd be a great stop gap between HTML + JS (now) and HTML + SVG + JS (future). It'd also help fight Silverlight, which is gunna take over the world if we aren't careful :-(

      Any other ideas for spreading multi-media web without using Java (ugh) Flash (ugh) or Silverlight (hm...)?

      monk.e.boy

      --
      Open source, flash charts
    3. Re:Always So Negative by UbuntuDupe · · Score: 3, Interesting

      This sounds kind of like the "exploit" in Second Life, where you can script objects to listen for commands from users, which necessarily allows you to script listening bugs -- just have it listen for whatever people say near it, and IM the results back to you. I actually wrote a few of these and ended up finding out not-too-cool things people were saying about me.

      Anyone know if they've fixed this somehow?

      --
      Apology to Ubuntu forum.
    4. Re:Always So Negative by Andrew+Kismet · · Score: 1

      That's impossible to 'fix' by the nature of the world. If you want an object to listen for another object, you set up a listener filtered to the other object's specific name or key. There's no permissions system for general chat beyond channels, and it'd be a MAJOR inconvenience if any object had to get permission from all parties within 96m of it to listen to them.
      Speaking on channel 0 is identical to speaking in public; anyone can hear you, anyone can record what you're saying. It's still a legal violation IRL, and a Terms of Service violation in Second Life, but it will always be possible. The only other way would be to make llListen like llRegionSay and make it unable to listen on channel 0. Now that WOULD be a pain, although it might reduce lag a little.

    5. Re:Always So Negative by UbuntuDupe · · Score: 1

      I was thinking of a different kind of fix. For example, every time an object "hears" someone, they get a message, "Object XYZ, owned by $Person, has detected your speech and may be passing it on to someone. To see this object, type _____. To turn off these notifications, type ____."

      Or, conversely, make it so objects can't hear people until they opt in.

      --
      Apology to Ubuntu forum.
    6. Re:Always So Negative by elrous0 · · Score: 1

      It's also a great way to let that cute hacker down the hall know that I HAVE A VERY LARGE PENIS.

      --
      SJW: Someone who has run out of real oppression, and has to fake it.
    7. Re:Always So Negative by larry+bagina · · Score: 1

      Or: don't be a second life loser.

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

    8. Re:Always So Negative by Chapter80 · · Score: 1

      55 Words per minute? Please don't type so fast, as I am a slow reader.

    9. Re:Always So Negative by Anonymous Coward · · Score: 0

      If it's really big, I'm sure he already knows

    10. Re:Always So Negative by Anonymous Coward · · Score: 0

      The only bit that is worth anything is the Flash IDE designer thingy. No, the brand "Flash". They want to control the quality of the end-user experience and they're worried about buggy / broken players diluting the reputation and strength of their brand.
  3. If exploited on a ... by Anonymous Coward · · Score: 0

    Wii, what kind of keystrokes would that record?

    1. Re:If exploited on a ... by Constantine+XVI · · Score: 2, Informative

      I believe the buttons on the Wiimote map to a few keys (for use in Flash games) and the pointer just picks up as a mouse. That's about it.

      --
      "I think an etch-a-sketch with an ethernet port would beat IE7 in web standards compliance."
    2. Re:If exploited on a ... by AKAImBatman · · Score: 2, Insightful

      I believe the buttons on the Wiimote map to a few keys (for use in Flash games)

      Actually, the keypresses only make it as far as Javascript. In order to "hear" the presses in Flash, you need to use the WiiCade API, which traps all the keypresses and forwards them to Flash. There's also the earlier Quasimondo API, but it fails to trap the keypresses, making it useless under most circumstances.
      --
      Javascript + Nintendo DSi = DSiCade
    3. Re:If exploited on a ... by popeye44 · · Score: 1

      Well it'd record a swish and a flick. But you have to say Wingardium Levosia with a slight emphasis to an R sound.

      --
      Inane Comments are Generously Disregarded
  4. Time to update! by Anonymous Coward · · Score: 3, Funny

    Time to update Adobe Updater so it can download the new updates!

    http://www.agavegroup.com/images/articles/adobeUpd ater.gif

  5. Re:Can't trust 'em by also-rr · · Score: 5, Informative

    If you don't trust adobe you could always install the open source Flash plugin swfdec. It's come on a lot recently and now plays most things. Hopefully the heavy pace of development will continue - I'm seeing about 5 commits per day adding new stuff on the mailing list.

    --
    Think of the Children; Sleep with your Sister
  6. Does it effect Flash Lite/Wii users? by Organic+User · · Score: 4, Informative

    Flash Lite is used on mobile devices. I assume this effects the Flash player on the Wii?

    1. Re:Does it effect Flash Lite/Wii users? by EveryNickIsTaken · · Score: 5, Funny

      This therefore begs the question.. Can a keystroke logger also log waggles?

    2. Re:Does it effect Flash Lite/Wii users? by AKAImBatman · · Score: 4, Informative

      Does it effect Flash Lite/Wii users?

      Since no one else will just answer the darn question, I will.

      The answer is that it may technically affect the Wii. However, it is a practically useless exploit on such a device. For one thing, the system does not multitask. So if the only keypresses that could be trapped are the ones already available through Javascript or Flash. Secondly, there are no keypresses. Flash does not receive anything as a keypress, while Javascript is capable of receiving the Wii Remote buttons as if they were "keys".

      Information placed in text fields cannot be logged, as it is handled by a "stop-the-world" on screen keyboard. (Oddly, the Flash player does not run while the keyboard is on the screen, but scheduled Javascript events continue to execute in the background. Go figure.) Since neither Flash nor Javascript can interact with this keyboard, the user is pretty safe from having their passwords or credit card information stolen. The only real exploit is the old-fashion social engineering exploit. i.e. Try to get someone to enter their information into a compromised Flash Movie or webpage. Which does not require a security exploit to accomplish. :)
      --
      Javascript + Nintendo DSi = DSiCade
    3. Re:Does it effect Flash Lite/Wii users? by Anonymous Coward · · Score: 0

      This therefore begs the question.. No it doesn't.
    4. Re:Does it effect Flash Lite/Wii users? by Fatalis · · Score: 1

      No, it raises the question. "Begging the question" means using circular reasoning.

      --
      Deus est fatalis
    5. Re:Does it effect Flash Lite/Wii users? by A_Non_Moose · · Score: 1

      I don't know, perhaps that can be the next /poll:

      Did the flash exploit affect you:

      Shake your WiiMote side to side for "NO" and Up and down for "YES".

      If the answer is being typed in for you by the exploiter...well choose the "Taco" option.

      --
      Have you read the moderator guidelines? Well, have you, PUNK? (and I want a Karma: Gnarly option)
  7. "earlier versions running on all platforms"? by Anonymous Coward · · Score: 0

    Flash doesn't run on all platforms, it doesn't even run on x86-64. Not that I'd ever install it if it did.

  8. NoScript blocks Flash by Matt+Perry · · Score: 4, Informative

    Once again NoScript helps out here since it can block Flash. I don't run Flash on any pages that don't absolutely require it, and I find few that do. Flashblock is another option for Firefox users that only want to block Flash and nothing else. Browse safely everyone.

    --
    Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
    1. Re:NoScript blocks Flash by fermion · · Score: 0
      Flash is relatively dangerous thing, mostly because it starts automatically and no one really knows where the flash originates. It is the last vestige from the bad old days when accidently going to a certain website could mean the hijacking or your computer. Windows popping up all over the place, and the only way to stop it was to turn off the computer. And, of course, the real exploit of Flash, the ability to secretely monitor your webcam and micocrophone, has not, as far as I know, been corrected.

      Thanks for flashblock with allows me to install flash. Flashblock is now included in camino, and I would encourage Firefox and Safari to do the same. It is as essential as pop up blocking and image blocking in terms of user security. I won't even bother to think IE might include such a useful thing given it history of resisting security features. And no one can say, well, the user has to voluntarily install Flash, so why do we need a blocker. In most cases, flash is installed without the users knowledge of the negative effects.

      I also recently discovered the online flash security setting. Why Adobe can't ship this with product, or have an off swithc for flash, i don't know. I guess such features prove the Flash is mostly annoy-ware, and perhaps spyware, and is only ancillary a useful product. I found it interesting how much history was recorded in the flash files. It made me even more reluctant to allow flash through.

      --
      "She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
    2. Re:NoScript blocks Flash by jschottm · · Score: 1

      I'm not sure Flashblock will help in this case. As far as I can tell, it goes back after the page has finished loading and removes the Flash rather than keeping it from loading in the first place. That could be easily be long enough for an exploit to take effect. I believe NoScript's Flash blocking would work but can't say for certain.

  9. Monopoly by plams · · Score: 3, Informative

    The Flash monopoly is probably worse than the Internet Explorer monopoly (which is slowly dissolving). While the file format is semi-open to the public you have to agree on a license that prevents you from writing your own Flash player from the documentation - it only allows you to write exporters. When you get past that you'll find a file format that is hideously obfuscated. Variable bit length integers means that your data isn't even byte-aligned. The documentation does very little to help you figure out why a seemingly valid Flash file just doesn't render correctly in the player.

    It pisses me off because Flash really has a lot of exciting stuff to offer, yet they can run the development at their own pace, writing shitty players with security holes (not to mention that they're still software rendering graphics in year of 2007). Even though my primary computer has Linux installed I find myself hoping that the new Windows Silverlight will give Flash a lot of healthy competition. It doesn't seem like any opensource projects are close to rivaling Flash yet.

    1. Re:Monopoly by WIAKywbfatw · · Score: 1, Insightful

      Even though my primary computer has Linux installed I find myself hoping that the new Windows Silverlight will give Flash a lot of healthy competition.

      You're hoping that Flash will be displaced by Silverlight, a Microsoft offering? Seriously?

      Say what you want about Adobe but at least Flash is available for more than Windows and OSX, which are the only two OSes that Silverlight will be available on.

      Not only do Adobe produce Linux players, they also produce a Solaris player. Good luck trying to get either of those out of Microsoft this side of armageddon.

      Oh, and I do appreciate that some people consider Flash to be an evil tool but at least you have the choice whether or not to install it. You just know that with Silverlight, as with MSIE, installation will be compulsory somewhere down the line, via a critical update or service pack.

      Trust me, if you're worried about monopolies then the last company that you want involved in building a Flash killer is Microsoft.

      --

      "Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
    2. Re:Monopoly by plams · · Score: 1

      I didn't say that I wanted Flash to be killed off by Silverlight just that I wanted the competition (I agree that may be a dangerous thing to wish for when the competition is Microsoft). Also, last I checked (when it was under the name WPF/E) Microsoft claimed they'd write a player for Linux too - they seem to have dropped that :(. On another note, I just discovered JavaFX which seems like an exciting 3rd contender. Too bad it's still in alpha, but open source competition for Flash is what I'm really looking forward to.

    3. Re:Monopoly by TheRaven64 · · Score: 2, Insightful

      Look at IE between killing off NetScape and FireFox becoming popular. Now compare that to IE when it had competition from NetScape and later FireFox. I don't want SilverLight to win, but I'd much rather Flash had some competition, because competition helps encourage innovation.

      --
      I am TheRaven on Soylent News
    4. Re:Monopoly by WIAKywbfatw · · Score: 1

      No, as far as I'm aware, Microsoft haven't got a Linux player yet.

      They've said that they'll develop the Windows and MacOS players first and then, at some time in the future, they'll eventually release a Linux player. Call me a cynic but I think that Linux player will either A) never see the light of day; or B) be very poorly coded and virtually unsupported.

      But, to be honest, do you want browsers (and web developers) bogged down by even more stuff? Yet another file format that adds nothing to the party doesn't exactly rock my boat.

      --

      "Accept that some days you are the pigeon, and some days you are the statue." - David Brent, Wernham Hogg
    5. Re:Monopoly by Nimey · · Score: 1, Funny

      When you gratuitously BiCapitalize you look like a WanKer.

      --
      Hail Eris, full of mischief...

      E pluribus sanguinem
    6. Re:Monopoly by bozone · · Score: 1

      Silverlight will give Flash a lot of healthy competition != will be displaced by Silverlight

      I *think* the op believes that such competition will be beneficial to the end users ... having a choice often is... I may be wrong...

      --
      "Hatred is the coward's revenge for being intimidated" ...George Bernard Shaw
    7. Re:Monopoly by mad.frog · · Score: 1

      writing shitty players with security holes

      With so many security holes, there must have been lots of exploits that have taken advantage of them.... viruses spread via them, privacy data leaked, computers crashed.... right?

      Only problem is, I can't seem to find much evidence online of that actually happening.

      Maybe you could help me out by point me at such evidence?

      Go ahead. I'll wait.

    8. Re:Monopoly by tkdtaylor · · Score: 2, Informative

      Did you miss the story posted here about Mono Coders Hack Linux Silverlight in 21 Days???

    9. Re:Monopoly by Anonymous Coward · · Score: 0

      Ever try using Flex? It's really easy to use. The SDK is free, but you pay for the IDE (which is based off of Eclipse...a plugin exists). Flex makes developing Flash apps seem more familiar to the programmer (as opposed to the whole messy timeline scheme in Flash).

      Oh yea, and flash is really secure. It essentially runs in a sandbox. For example, Flash blocks all reads/writes to disk. This keylogging exploit is nothing new or exciting and can easily be circumvented by updating to flash player 9 (which you need anyway to run a Flex application).

      I'm sorry but your Adobe bashing is unfounded and makes you look stupid. Please be more informed next time. I forgive you.

    10. Re:Monopoly by gaspyy · · Score: 1

      writing shitty players with security holes

      To be honest, this is only the second time a vulnerability has been discovered in Flash. The first time was about 7 years ago with the undocumented "save" fscommand, which allowed someone to make a proof-of-concept virus that could in theory propagate through locally-stored swf files.

      they're still software rendering graphics in year of 2007

      They've added some hardware-rendering for video, but it's granted that it's almost inexcusable not to have even an experimental, alpha-grade, hardware-rendering player. Hopefully, 3D libraries such as Papervision3d will put some pressure on them to add 3D features. I think that previously Macromedia was reluctant in adding 3D/hardware support in Flash because they didn't want Flash to completely eat Director's market (it happened anyway).
  10. Flash Player 9 is NOT affected by keystoke logging by Anonymous Coward · · Score: 5, Informative
    From the article: "In versions 7.0.69.0 and earlier running on Linux and Solaris, malicious attackers could exploit an error in the interaction between the Flash Player and certain browsers. That could potentially lead to a leaking of keystrokes to a Flash Player applet, Secunia noted. Flash Player 9 is not affected."

    Beautiful, but I guess this is slashdot and no one bothers to read the articles they submit. And yes, 9.0.45.0 still has a serious remote exploit flaw, but mixing these issues together is not the way to go.

  11. Confusing Product Names by Anonymous Coward · · Score: 1

    So I have a Flash player that acts as a plugin in my browser, right? Or is it called a Shockwave Flash player? No wait it's called "Adobe Flash Player", but I can't seem to find a version number, so I can't tell if I'm vulnerable.

    So what the hell was "Shockwave", then? How is it different from "Flash" and is "Shockwave" vulnerable too?

    Whoever was in charge of branding this crap should be bulldozed into a septic system.

    1. Re:Confusing Product Names by AKAImBatman · · Score: 5, Informative

      Shockwave was Macromedia's original online animation plugin. It is extremely feature-rich and quite fast at what it does. It's also quite large. So when a company called FutureWave created a much smaller vector-graphics competitor, Macromedia bought them out and renamed it "Shockwave Flash" to give the impression that Flash was a subset of their Shockwave technologies. (You'll notice that the Flash movie extension is "SWF". "ShockWave Flash")

      In reality, it was all just marketing BS. Flash had enough features to make animation authors (and later game developers) happy, so it quickly replaced the more heavyweight Shockwave. After the acquisition of Macromedia by Adobe, they stopped trying to maintain the charade and simply called it "Adobe Flash". There are still a few vestigial pieces of the software that refer to "Shockwave Flash", but they're slowly disappearing as time goes on.

      --
      Javascript + Nintendo DSi = DSiCade
    2. Re:Confusing Product Names by Volante3192 · · Score: 0, Redundant

      http://www.howstuffworks.com/web-animation6.htm

      Shockwave can support Flash, but Flash can't do everything Shockwave can...and Flash is cheaper. Flash probably started life as a shockwave lite. Course, doesn't help that Flash's file suffix is 'swf' which is 'shockwave flash.'

    3. Re:Confusing Product Names by Anonymous Coward · · Score: 0

      Shockwave animations were (and might still be) the files output by Macromedia Director, which they owned before they bought what is now Flash. Director is a much larger program that could be used to make elaborate animated presentations. Whenever I'm prompted to download a Shockwave update, I figure the animation was created using Director, not flash.

    4. Re:Confusing Product Names by organized · · Score: 1

      'swf' means small web format.

  12. Quality by Reality+Master+101 · · Score: 2, Interesting

    You know, to be fair to Flash, I have to say that it's an incredibly well-written application overall. It's very small to download and it works very well. Heck, they actually made video consistently work on the Internet! I think you can make an argument that they are solely responsible for making video sites like YouTube viable. All video STILL sucks except for Flash.

    Of course, the quality of Flash is a different question from how it's abused. :) [personally, I don't mind Flash all that much.]

    --
    Sometimes it's best to just let stupid people be stupid.
    1. Re:Quality by Anonymous Coward · · Score: 2, Interesting

      So well written that they couldn't port it to 64bit platforms without rewriting the underlying script host from the ground up.

      That's some "Real Quality Software" right there and it's great that flash is so instrumental in furthering the promise of an open, accessible web. How I wish every web page was a chunk of executable bytecode.

    2. Re:Quality by Reality+Master+101 · · Score: 2, Insightful

      So well written that they couldn't port it to 64bit platforms without rewriting the underlying script host from the ground up.

      Portability (which has multiple dimensions) is not a measure of quality, it is a design goal that may or may not be part of the goals of a project.

      --
      Sometimes it's best to just let stupid people be stupid.
    3. Re:Quality by Jeffrey+Baker · · Score: 1

      If an application cannot simply be recompiled on a 64-bit host then it is programmed incorrectly. End of story.

    4. Re:Quality by Anonymous Coward · · Score: 1, Interesting

      "If an application cannot simply be recompiled on a 64-bit host then it is programmed incorrectly. End of story."
      This is the most ridiculous claim I have heard today.

    5. Re:Quality by TheRaven64 · · Score: 2, Interesting

      There are a few projects that really show up Java. One is Flash. Another is Squeak, which manages to run Smalltalk fast enough that you can run video CODECs written in Smalltalk on it even on slightly old hardware. I think the Squeak team really dropped the ball on the whole web thing; a Squeak plugin could have been an incredible platform for rich client-side development (Squeak is still one of the best development environments around), but they concentrated on desktop replacement instead.

      --
      I am TheRaven on Soylent News
    6. Re:Quality by Anonymous Coward · · Score: 0

      So you're saying that the goals of the original Flash team were to not support the workstation class hardware of the day? That they never intended it to be anything other than a toy?

      I think I can agree with that.

    7. Re:Quality by mad.frog · · Score: 1

      The purpose of Tamarin wasn't to support 64-bit platforms. (In fact, it's still not 64-bit compliant, though work on that is underway. Want to help out?) It was written because the old scripting engine was slow and cranky and it was easier to write a new one than patch the old one.

      And yeah, 64-bit compliance isn't rocket science, but it isn't free either, especially when you're writing a JIT that has to generate the proper assembly code... it's a nontrivial amount of engineering and testing time.

      Since the rest of the Flash Player wasn't 64-bit ready, and since the market as a whole wasn't demanding it, engineering resources were devoted elsewhere.

    8. Re:Quality by Peganthyrus · · Score: 1

      Sadly this quality does not extend to the program one uses to create it. The editor is prone to trashing your source files every so often.

      --
      egypt urnash minimal art.
    9. Re:Quality by Lord+Ender · · Score: 1

      Flash ... actually made video consistently work on the Internet!

      Obviously, you aren't running a 64-bit-native version of Linux. This is either because:
      • You have a really old computer
      • You are wasting processing power running a 32-bit version of Linux on a new CPU
      • You are running Windows or OSX, in which case you aren't qualified to comment on the relative coolness of technologies :-)
      --
      A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
    10. Re:Quality by Mister+Whirly · · Score: 3, Insightful

      You sir, are not a programmer. End of story.

      --
      "But this one goes to 11!"
    11. Re:Quality by Anonymous Coward · · Score: 0

      It was written because the old scripting engine was slow and cranky and it was easier to write a new one than patch the old one.
      Which was the point made ;-)

      While I detest flash, Adobe have my respect for releasing Tamarin under the MPL. From what I've seen, it's well engineered and I suspect they'll get plenty of community contributions when it's in a usable state.

    12. Re:Quality by mad.frog · · Score: 1

      Ah, ok.

      It's in a usable state now, as long as you don't need 64-bit :-)

      As mentioned before, contributors to 64-bit work would be welcomed...

    13. Re:Quality by Anonymous Coward · · Score: 0

      > It's in a usable state now, as long as you don't need 64-bit :-)

      I'll set up a build env in a 32bit VM image when I get time. Last I looked there was the beginnings of code generation for X86-64.

      What about the SpiderMonkey integration work, how's that going?

    14. Re:Quality by hcdejong · · Score: 1

      All video STILL sucks except for Flash.

      No, video STILL sucks, especially Flash. At least other formats I can force to play in VLC, which has a relatively non-sucky UI. The Flash player seems to be designed to offer no control at all, which is bloody annoying.

    15. Re:Quality by IvyKing · · Score: 1

      Obviously, you aren't running a 64-bit-native version of Linux.


      Not sure if that is more of an indictment of Linux or Flash. Flash runs fine on 64 bit Solaris - but 64 bit Solaris apparently does a better job of running 32 bit binaries than Linux.
    16. Re:Quality by mad.frog · · Score: 1

      What about the SpiderMonkey integration work, how's that going?

      Not sure. You should ask someone at Mozilla.

    17. Re:Quality by whoever57 · · Score: 1

      I have a 64-bit-native Linux desktop. Flash works on it, through the magic of nspluginwrapper.

      --
      The real "Libtards" are the Libertarians!
    18. Re:Quality by PitaBred · · Score: 1

      Seconded. And Flash 9 works perfectly in Konqueror and Firefox, no sound issues or anything.

      --
      My blog. Good stuff (when I remember to update it). Read it.
    19. Re:Quality by klui · · Score: 1

      I used to hate Flash video until YouTube, Google, and all the popular sites implemented a volume control. There are still sites that don't have a control and audio comes through at full blast, regardless of what my Sound control panel is set at. How lame is that?

  13. That's all well and good for browsers. by AltGrendel · · Score: 1

    But what about spam? I know that most of us here wouldn't click the link. But I've seen spam that was supposed to be from bluemountain that had this exploit in it. Of course the headers told a different story (it originated in Poland), but my point is that you've got the usual gang of idiots that will click any link in an email if they think "Oooo, Mom send me another e-card".

    --
    The simple truth is that interstellar distances will not fit into the human imagination

    - Douglas Adams

    1. Re:That's all well and good for browsers. by illegalcortex · · Score: 1

      Well, your first mistake would be having an email reader that displays active content. I know I have Thunderbird to show everything as plain text. It's not "pretty", but it's safe. Of course, for 99% of emails, "pretty" is completely unnecessary.

    2. Re:That's all well and good for browsers. by Matt+Perry · · Score: 1

      I find it hard to believe that any email programs would be irresponsible enough to display active content in what is essentially a push medium. If your mail client can display anything beyond basic HTML, be it processing JavaScript or rendering Flash or ActiveX, I would highly recommend you turn those settings off. Better yet, I would recommend finding a safer mail client as executing this content would show they don't care about (or don't know about) security.

      --
      Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
  14. Back in the old days... by TheTranceFan · · Score: 4, Funny

    You know, back in the old days we only had linear keystrokes, and they worked fine for us. Now it's all about the log keystrokes with the kids these days.

    World's going to hell.

    1. Re:Back in the old days... by Anonymous Coward · · Score: 0

      You know, back in the old days we only had linear keystrokes, and they worked fine for us. Now it's all about the log keystrokes with the kids these days. Luxury! In our day, we had only constant keystrokes. There was one key, permanently stuck in the key down position, and we loved it!
  15. Did anyone read the article? by popo · · Score: 4, Informative

    This isn't a bug in the latest flash plugin... only older ones.

    I for one love the fact that Flash still represents one of the few uniform platforms on the interweb
    with extremely limited cross-browser issues.

    --
    ------ The best brain training is now totally free : )
    1. Re:Did anyone read the article? by stefanlasiewski · · Score: 1

      This isn't a bug in the latest flash plugin... only older ones.

      There are two exploits.

      Version 9.0.45 (which was released in April 2007?) is still subject to buffer overflows. However, it's not vulnerable to the keystroke logging problem.

      --
      "Can of worms? The can is open... the worms are everywhere."
    2. Re:Did anyone read the article? by Penguin+Programmer · · Score: 1

      I for one love the fact that Flash still represents one of the few uniform platforms on the interweb with extremely limited cross-browser issues.


      Sure, it's a uniform platform if you use one of the platforms Adobe/Macromedia deems worthy of a Flash plugin. If that's your definition of a uniform platform, then MS Office is a uniform platform as well - anyone with MS Office installed can view the documents and they look great!
    3. Re:Did anyone read the article? by Farmer+Tim · · Score: 1

      Version 9.0.45 (which was released in April 2007?) is still subject to buffer overflows.

      Perhaps that would explain why the current version is 9.0.48 (Linux) and 9.0.47 (Windows/Mac).

      --
      Blank until /. makes another boneheaded UI decision.
  16. Full Article by Anonymous Coward · · Score: 3, Informative

    Adobe Flash exploit could log keystrokes
    By Dawn Kawamoto, CNET News.com
    16/07/2007
    URL: http://www.zdnetasia.com/news/security/0,39044215, 62028443,00.htm

    Adobe has issued three critical security updates, one of which is designed to stop a problem in the way the Flash player interacts with browsers, which could result in users' keystrokes being transmitted to attackers.

    Adobe Flash Player 9.0.45.0, 8.0.34.0 and 7.0.69.0, as well as their earlier versions running on all platforms, are affected.

    Users loading a malicious vector graphics file format (SWF) in their Flash Player may find attackers exploiting security flaws due to an input validation error in 9.0.45.0 and earlier versions, according to a security advisory from Secunia. Attackers, as a result, can gain remote access to a user's system.

    In versions 7.0.69.0 and earlier running on Linux and Solaris, malicious attackers could exploit an error in the interaction between the Flash Player and certain browsers. That could potentially lead to a leaking of keystrokes to a Flash Player applet, Secunia noted. Flash Player 9 is not affected.

    Versions 8.0.34.0 and earlier contain a bug due to insufficient validation of the HTTP referrer. As a result, an attacker could execute a cross-site forgery attack. Flash Player 9, however, is not affected.

    Adobe recommends that 9.0.45.0 users upgrade to 9.0.47.0 for Windows, Mac and Solaris, or 9.0.48.0 for Linux.

    Adobe Flash Player 9 is the recommended solution for the other two versions that contain security flaws.
    --
    For Your Flash-Based Safety

  17. It's NOT "effect"! With Flash, or Herpes ... by Anonymous Coward · · Score: 0

    the verb to use is "infect"!

    However, for all other cases, the verb should be "affect"

    1. Re:It's NOT "effect"! With Flash, or Herpes ... by Anonymous Coward · · Score: 0

      No, the word should be affect.

      He's asking if the wii version of flash would be AFFECTED by this. I don't think Opera software snuck a keylogger into his Wii through his channel update -- thus infecting it.

      When being a grammar nazi at least know what the fuck you're talking about imo.

  18. Keystrokes from flash apps? by Nazlfrag · · Score: 1

    Down left down down space space right up space space space space esc

  19. Positive thinking by TheDarkener · · Score: 2, Funny

    Not that this security hole has much at all to do with it, but I strongly believe in positive thinking.

    Maybe if we all chant, they will hear us.

    Adobe will open-source flash.
    Yes.
    Adobe will open-source flash.
    Yes.
    Adobe will open-source flash.
    Yes.
    Adobe will open-source flash.
    Yes.
    Adobe will open-source flash.
    Yes.
    Adobe will open-source flash.
    Yes.
    Adobe will open-source flash.
    Yes.
    Adobe will open-source flash.
    Yes.

    --
    It is pitch black. You are likely to be eaten by a grue.
    1. Re:Positive thinking by Penguin · · Score: 1

      Wow! you actually created a text mode version of a typical flash ad...

      --
      - Peter Brodersen; professional nerd
    2. Re:Positive thinking by TheDarkener · · Score: 1

      I disagree - nowhere in the text did I mention Bonzai Buddy, free iPods OR how big J-Lo's butt is.

      --
      It is pitch black. You are likely to be eaten by a grue.
  20. Why doesn't this post link to Adobe? by snsr · · Score: 1

    Maybe it's my hang-over, but linking to a flash embedded page (as mentioned above) and having to click again to get to the fix is annoying. /bitch

  21. Is the ActiveX affected? by smooth+wombat · · Score: 2, Insightful

    We don't allow people to install Flash on their systems here at work but we do provide the ActiveX component to run Flash. Is it affected as well? The article doesn't say.

    Personally, I don't run Flash. Time and again it has been shown to be a security risk and these new developments only strengthen that perception.

    --
    We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
    1. Re:Is the ActiveX affected? by Anonymous Coward · · Score: 1, Insightful

      Personally, I don't run Flash. Time and again it has been shown to be a security risk

      And ActiveX isn't?!

    2. Re:Is the ActiveX affected? by FranTaylor · · Score: 2, Funny

      Exactly.

      "We don't let people bring shotguns to work, but pistols are okay".

    3. Re:Is the ActiveX affected? by Anonymous Coward · · Score: 0

      Time and again it [Flash] has been shown to be a security risk

      Is the ActiveX affected?

      My dear fellow, I'm not sure that I've read a more stupid remark in some time.

      When considering your stupidity I got a brief sense of the infinite, so I suppose I should thank you for that.

      Clearly you shouldn't have anything to do with other peoples computers; indeed it is debatable whether you should have control of your own computer, or your hands - lest you claw at your face and poke your eyes out!

      Truly you are an idiot.

    4. Re:Is the ActiveX affected? by Anonymous Coward · · Score: 0

      more like the other way around.

      "We don't let people bring pistols to work, but shotguns are okay"

  22. Re:Can't trust 'em by X0563511 · · Score: 4, Informative

    Thanks for linking to the project webpage which redirects to a wiki. Next time link to the sf.net project page and let us choose to go to the homepage ourselves rather than fight with sf.net.

    --
    For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
  23. AMD64 by Sunshinerat · · Score: 4, Funny

    Does Anybody know if the 64 bit Linux version is also affected?

    Oh wait...


    MvE

    --
    Load New Commander (Y/N)?
  24. gnash by Anonymous Coward · · Score: 0

    but does it effect gnash?

  25. Re:Can't trust 'em by Touvan · · Score: 2, Interesting

    This is very interesting. Like the Java clones before it, this project (swfdec), and gnash show how popular closed source projects have their own way of encouraging something similar to the dreaded "forking" that corporations fear so much. What's interesting about Java is that opening the source seems to have reversed that trend, and we now see some attempts to unify the many Java code bases.

    I wonder if Adobe will figure that out, and open up Flash Player some more.

    --
    http://www.unfocus.com/
  26. WOW! Stunning job... by Anonymous Coward · · Score: 0

    of completely missing the joke, dipstick. And since you chose to be ignorant and flame, I'm not even going to explain it to you. Maybe you could ask one of your classmates on the short bus to explain it.

    It was a wise choice for you to post AC, though - only you will know the true identity of the really stupid guy that wrote comment #19877643.

  27. Doesn't this one... by joseph449008 · · Score: 1

    threaten 'virtually everything'?

  28. Re:Flash Player 9 is NOT affected by keystoke logg by IvyKing · · Score: 1
    What kind of sucks is that Flash 9 for Solaris is only available for Solaris 10, though there may be a way of getting the necessay libraries on Solaris 9. OTOH, Solaris 10 has enough advantages for desktop users (who would need Flash on a server?) so that's not a huge limitation.


    There are some issues with Flash video on Mozilla 1.7 on Sparc, which do not occur with Firefox on Sparc.

  29. Plug for Flashblock by spottedkangaroo · · Score: 1
    I've been using flashblock since the very first time (almost 8 years ago) flash scared the shit out of me with unexpected and LOUD sounds from an ad.

    Nowadays I'm surprised how many tracking gadgets are embedded on otherwise ordinary looking pages and I'm sure to clean out my macromedia shared object folder form time to time...

    The nice thing about flashblock is the ease with which I can play flash games and watch youtube videos -- when I'm in the mood to click through. Personally, I think something like this should be standard ... not a plugin. Flash usually scares me.

    --
    Imagine if you weren't allowed to use roads because a bus company complained about your driving 3 times. --skunkpussy
    1. Re:Plug for Flashblock by Anonymous Coward · · Score: 0

      Flash usually scares me.

      Fair enough buddy...

      This problem with the key logging apparently seems to effect Solaris, and something tells me you won't be using that OS anytime soon, lets face it ;)

      Just to reassure you tho, recent versions of Flash work in whats called a "sandbox", which means that they can't do any damage to the environment outside of the player such as spreading viruses or changing settings.

      Make sure you have the latest version of the Plugin and you should be ok.

    2. Re:Plug for Flashblock by deek · · Score: 1

      I second the recommendation about flashblock. I've been using it for years myself, not because I've been worried about any flash issues, but because it stops those garish flash ads, and obnoxious flash sites. It seems that most flash designers prefer showy designs, rather than usable ones. Therefore, I prefer not to show flash.

    3. Re:Plug for Flashblock by spottedkangaroo · · Score: 1
      I fail to see how the sandbox keeps people from logging your surfing habits and building a database that forwards the intersting details to a 3rd party...

      That's the part that scares me: the staggering volume of information tracking companies have on me, what I buy, what I read, and where my mouse typically rests on the screen.

      Ever read any of the js in those ads? They really do track your mouse movements. They send the details back by loading one pixel "images" and other tricks.

      I'm not a flash programmer, but I'm sure there's ways to do this in flash also. It's the only way to explain the 1x1 flash apps I keep seeing all over the place (flashblocked of course). Call me a crackpot, or whatever, but make sure to clear out your shared objects from time to time.

      --
      Imagine if you weren't allowed to use roads because a bus company complained about your driving 3 times. --skunkpussy
    4. Re:Plug for Flashblock by mlts · · Score: 1

      I delete the directory that the Flash player stores its shared objects in, and create a file with the exact same name. Now, Flash works normally, but sites that try to store persistant stuff when they shouldn't are totally blocked from doing so.

  30. Sorry, a *what" ? by DrYak · · Score: 3, Informative

    and TFA has a Flash ad...


    Sorry a Flash-what ?

    Oh, it must be one of those things we are missing, as users of :

    Adblock plugin (stops ads, be it Flash, Javascript or plain pictures)
    Adblock+ plugin (fork with different features but similar purpose)
    Adblock Filterset.G updater plugin (updates the whitelist/blacklist of the above - no more need to configure manually, just install and forget)

    or NoScript> plugin (selectively inhibits Javascript, Java and Flash following whitelist/blacklist),
    FlashBlock plugin (prevent Flash embeds to auto-start. User must click on place holders to start them),

    or Gnash GPL Flash player (GNU page) (an Open source player which, not only has an option to prevent flash from autostarting, but also isn't probably even affected by the exploit of TFA),
    SWFDec GPL Flash decoding library (another opensource plugin for browsers which probably isn't affected by the exploid either),
    or not installing a Flash player at all and using SaveTube to watch flashvideos.

    I think most geeks haven't seen an ad for years and have anyway many mean at their disposition to avoid being exploited by flash bugs.

    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
    1. Re:Sorry, a *what" ? by 6Yankee · · Score: 1

      Yeah, I have Flashblock, actually. Doesn't mean I don't know an ad when I see one (or its placeholder), you smug smartass.

    2. Re:Sorry, a *what" ? by DrYak · · Score: 1

      Doesn't mean I don't know an ad when I see one (or its placeholder)


      You may be interested in the Adblock family of plugins, then : they completely remove the plugins and most other ad-related elements around them.
      Not only is the ad gone, but it doesn't take up screen estate anymore.

      You can also additionally try grease monkey for the last few "Advertisement :" labels that still resist to adblock.
      --
      "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
    3. Re:Sorry, a *what" ? by rm999 · · Score: 1

      Much simpler:
      1. Get adplus+ for firefox
      2. Select the easylist option when you restart firefox

      I find this much easier to convince a n00b that it's really quite simple to never see ads again. Filterset.g is fine, but easylist is pretty damn good IMO and much more organized.

    4. Re:Sorry, a *what" ? by Anonymous Coward · · Score: 0

      I found an XSS bug with GNASH last year. Not a theoretical exploit, I set up a simple that exploited GNASH (but not flash player). I emailed the devs (including a patch to fix the problem). I saw them visiting the page in my server logs. Yet it still hasn't been fixed. Score 2 for security through nobody using it.

    5. Re:Sorry, a *what" ? by 6Yankee · · Score: 1

      Thank you for the helpful response this time round.

      I manage pretty much OK with Flashblock and Firefox's own "block all images from..." option. Google ads and the like don't bother me particularly (except when someone styles them to look like navigation - that one got me yesterday).

      My biggest worry with going down the Adblock route is whether sloppily-coded (i.e., most) layouts will break once the ads disappear. Have you had any problem with this?

  31. The real solution to flash by Anonymous Coward · · Score: 0

    Just change to Microsoft's Silverlight. It's better in everyway.

  32. "Shockwave" is still in the URL and Product Name by Anonymous Coward · · Score: 0

    http://www.adobe.com/shockwave/download/download.c gi?P1_Prod_Version=ShockwaveFlash.

    And I'm not having any luck finding anywhere at tells me what version of the plugin (ActiveX Control?) I'm currently running, so now I have to walk to each and every machine in the domain and install the latest manually.

    You suck, Adobe.

  33. The current alternatives.... by DrYak · · Score: 1
    The currently under active development alternatives are :
    • Gnash - (project development page)
      an open-source project which develops a Flashplayer which can be run stand-alone, be swallowed inside web browser using appropriate plug-ins, or integrated in bigger project using extensions. Supports OpenGL and Cairo as hardware accelerated renderer. Also, has an option not to auto-start playing the flash crapnimations.
    • SWFDec
      an open-source library for decoding flash, which also comes with a browser plugin.


    They are good alternative to Flash to consider. Unlike the official crap from Adobe, you can recompile them in 64bits for modern systems. They don't play all possible flash yet, but you could use them for some situations. For other situation you can always try to copy and paste the URL into the adobe standalone payer.

    It seems the development of alternatives is well underway. The only thing that we need to fight is the stupid clause in the license that forbids using the documentation to design players. I'm sure there are several place where it could be considered an abuse of monopoly, specially here in Europe.
    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
    1. Re:The current alternatives.... by tkdtaylor · · Score: 1

      You missed Moonlight The open source version of MS Silverlight.

  34. Oh noez! by Enderandrew · · Score: 0

    If they have a keylogger, those hackers will know that I go to hot-llama-on-marsupial.com

    --
    http://blindscribblings.com - Tasty pop-culture in conceptual fashion.
    1. Re:Oh noez! by Anonymous Coward · · Score: 0

      *types, clicks*

      That's no llama! That's my wife you insensitive clod!

    2. Re:Oh noez! by DUIblog · · Score: 1

      That site is the best. However, MidgetsOnFireWrestling.com is pretty sweet too.

      --
      DUIblog DUI Blog
  35. Misleading headline by mad.frog · · Score: 2, Insightful

    More accurate would be "Adobe Issues Fixes For Flash Exploit That Could Log Keystrokes"...

    Headline implies that exploits were just found and still exist. Not so.

  36. Key logging only on older versions by allan_q · · Score: 1
    From Secunia:

    2) An error within the interaction of Flash Player and certain browsers can be exploited to leak key presses to a Flash Player applet. The vulnerability affects versions 7.0.69.0 and prior on Linux and Solaris. It does not affect Flash Player 9.
    So while everyone is susceptible to code execution, key logging only affects the older versions running under Linux and Solaris. Not everyone's YouTube passwords are getting sniffed.
    1. Re:Key logging only on older versions by SpaceLifeForm · · Score: 1

      If it can be exploited to run arbitrary code,
      that arbitrary code could be a key logger.

      --
      You are being MICROattacked, from various angles, in a SOFT manner.
  37. Bad goals... by DrYak · · Score: 1

    Portability (which has multiple dimensions) is not a measure of quality, it is a design goal that may or may not be part of the goals of a project.


    At a time when everything, including your fridge, strives to be web-enabled, I think not taking into account portability when designing a piece of code which the company hopes will take over the world as the standard format for interactive content, is a clear demonstration of short-sightness and bad design.

    Also, there are no rational argument why a well designed piece of code couldn't be successfully just recompiled into 64bits.
    Either at some points it makes assumption about the data-format of integers, but fails to declares precisely what it needs (declaring variable with plain C "int" instead of using some special typedef "uint32" or something similar) which is bad design (never make assumption that you don't enfore. Either accept whatever format comes, or force a specific format and let the compilation fails if it's not possible on the target).
    Or perhaps the code is a gordian knot of hacks that cannot be easily fixed or circumvented for 64bits platforms, which defies the definition of "well written code".
    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
  38. Weird files. by Anonymous Coward · · Score: 0, Funny

    I always thought .swf stood for "Some Weird File"

  39. Re:Flash Player 9 is NOT affected by keystoke logg by brandonbradley · · Score: 1

    Also note that Flash Player 9.0.47 is the current version on windows. I didn't dig deep enough to figure out if the new version resolves the key logging issue however.

  40. Grrr.... by mdsolar · · Score: 1

    But at least the linux version number is higher that the others. This is as it should be. Develop for linux first then port to the less important OSs.
    --
    Rent solar power with no installation cost: http://mdsolar.blogspot.com/2007/01/slashdot-users -selling-solar.html

  41. Actually... by bdjacobson · · Score: 1

    Actually he typed it at 159/5, or about 32 WPM. (Story posted at 11:55; he posted at 12:00).

    You, on the other hand, spent 5 minutes writing that one sentence. How much of that did you spend typing, and how much did you spend thinking? :p

    1. Re:Actually... by Anonymous Coward · · Score: 0

      1) That would assume instantaneous human response with no load times and

      2) I think it was also a joke

    2. Re:Actually... by PitaBred · · Score: 1

      I think the GPP was a joke, too. We really need some sarcasm tags here...

      --
      My blog. Good stuff (when I remember to update it). Read it.
  42. Good news, bad news by Anonymous+McCartneyf · · Score: 1

    The good news: Adobe makes Flash players for Linux and Solaris.
    The bad news: the keylogger bug on certain old Flash players (the one most of you seem the most worried about) is specific to the Linux and Solaris models. Windows and MacOS/OSX only got the other bugs.

    --
    There is a fine line between recklessness and courage... -- Paul McCartney
  43. Evidence by Anonymous+McCartneyf · · Score: 1

    Have you read the fine article?
    If Adobe is openly fixing security holes, then there likely were security holes.

    --
    There is a fine line between recklessness and courage... -- Paul McCartney
  44. Re:Flash Player 9 is NOT affected by keystoke logg by Anonymous+McCartneyf · · Score: 1

    The Windows vs. don't appear to be affected by keyloggers, either.

    --
    There is a fine line between recklessness and courage... -- Paul McCartney
  45. Re:"Shockwave" is still in the URL and Product Nam by Val314 · · Score: 2, Informative

    And I'm not having any luck finding anywhere at tells me what version of the plugin (ActiveX Control?) I'm currently running, so now I have to walk to each and every machine in the domain and install the latest manually.


    see here: http://www.macromedia.com/software/flash/about/
  46. You're forgetting Privoxy by Rob+Simpson · · Score: 1
    Privoxy:


    "Privoxy is a web proxy with advanced filtering capabilities for protecting privacy, modifying web page data, managing cookies, controlling access, and removing ads, banners, pop-ups and other obnoxious Internet junk. Privoxy has a very flexible configuration and can be customized to suit individual needs and tastes."

  47. MOD PARENT UP by Anonymous Coward · · Score: 0

    Thank you!

    This link should be added to the main article.

  48. You're right. Sort of. by Qbertino · · Score: 1

    Flash is a monopoly. More or less. But it's a monopoly that doeshn't suck as much as IE. In fact, I'm sure, as soon as a product shows up that is better than Flash, Flash will use marketshare inmediately. Flash gained it's position because it really *is* the best solution at hand for the stuff it's used for.
    But as it's still the single most widespread plattform on the end-user internet available and the only MM plattform that runs on all major deskstop OSes it will remain at the top. And for good reasons too. No matter how much they screw around with the IDE.
    Java actually is the only true potential competitor to date. But Sun have never show any effort beyond 2 man projects to really make inroads in the rich client / rich media internet. I really whish they would, now that Java is GPLd, but I don't think it will happen, no matter how much they anounce yet another Java MM initiative. The new JavaFX looks like a revamped JMF and has a little more oomph to it than the last attempt, but let's just wait and see how long that lasts. I'm not holding my breath just yet.

    --
    We suffer more in our imagination than in reality. - Seneca
  49. Only vulnerable on Linux? by A+non-mouse+Coward · · Score: 1

    "In versions 7.0.69.0 and earlier running on Linux and Solaris, malicious attackers could exploit an error in the interaction between the Flash Player and certain browsers. That could potentially lead to a leaking of keystrokes to a Flash Player applet, Secunia noted."
    What, not on Windows?

    I'm not surprised to see that there is little or no coverage on slashdot about this detail. I realize that the flash player isn't linux, but it's on linux. So, both of the linux flash users will have to update their plugins.

    Seriously, it goes to show that all platforms will have their problems. Regardless of the underlying OS, there are always twinkie-apps written by some twinkie-eating-developer.

    Please, no flamebait, no off-topic, and no OS religious wars (they all suck).
    --
    libertarian: (n) socially liberal, financially conservative; neither left, nor right.
    1. Re:Only vulnerable on Linux? by Anonymous Coward · · Score: 0

      not on my linux, adobe thinks it's a waste of time to make a powerpc/linux plugin.
      Bastards!

  50. Re:Flash Player 9 is NOT affected by keystoke logg by brandonbradley · · Score: 1

    It looks like the version of the flashplayer that is in Beta is allowing for hardware rendering as the default rendering method and software rendering as a backup method. For more info look here http://labs.adobe.com/technologies/flashplayer9/re leasenotes.html#known

  51. Alternatives by Trogre · · Score: 1

    Okay people it's time we started seriously contributing to the Gnash project so people who want flash content have some alternative to run it on.

    --
    "Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
  52. and PowerPC Linux by Anonymous Coward · · Score: 0

    So PowerPC Linux could be the most secure platform? (No Adobe Flash)

    *ducks*

  53. Speaking of other stuff appart from Flash by DrYak · · Score: 1

    You missed Moonlight


    If we are speaking of technologies OTHER than flash, we may also mention SVG which can be scripted for animations.
    Either using a simple XML extension like SMIL for timing an animation (and producing something like old versions of Flash or vector equivalent of .MNGs),
    or going for a Turing-complete language and use scripting like JavaScript with DOM (see the SVG Tetris).
    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
  54. But are there automatic updates for Flash..??!!! by emm-tee · · Score: 1

    This isn't a bug in the latest flash plugin... only older ones. It may well be fixed in the latest version, but it could still be a problem for a lot of people.

    Flash doesn't appear to automatically update itself. Fortunately, it does have an Automatic Notification system (go to http://www.macromedia.com/support/documentation/en /flashplayer/help/settings_manager05.html). Unfortunately, at least for me, the check interval seems to be 30 days (the minimum being 7 days).

    So currently I'm running a rather old version - 9.0.28.0.

    If a lot of people, like me, haven't received a notification yet, they are also likely to be running older versions. This could mean that there are significant numbers of vulnerable machines.
  55. Linky ? by DrYak · · Score: 1

    Could you please post a link to your bug & patch ?
    I might be interesting.

    Thank you a lot.

    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
  56. Considering the IE7 plugin seems to leak memory... by the+GeeT · · Score: 1

    ...like a sieve and crashes if you dare use tabbed browsing too much, I'm not too amazed that there would be other major security flaws. I already suspect that half of the flash things on the web are spying on me in some form anyway.

    --
    "Prepare for a pride-obliterating bitch slap" - Ignignot
  57. Sloppily coded layouts by DrYak · · Score: 1

    Thank you for the helpful response this time round.

    You're welcome.

    My biggest worry with going down the Adblock route is whether sloppily-coded (i.e., most) layouts will break once the ads disappear. Have you had any problem with this?


    Adblocks works by stoping access to external objects. Any object : <img>, <embed>, <object>, <script>, <frame>, <iframe>, etc.
    Think of it as an upgraded "Block images from".

    Almost any web site stores ads as an external object that is included in the page (using an <iFrame> or an <object>) so most of the thing that is part of the ad is gone (as opposed to ads directly integrated into the webpage code, like text ads on Damnsmall Linux).

    About the code of the layouts it self :
    - 90% of the web site I encounter either put the ad-holding tag directly in the top level of the page (like google script which generate themeselves any container they may need), or put it into a <div> construct with unspecified with and height. In those situations, once the inner <iframe> (or whatever) is supressed, the <div> becomes empty and collapse to a 0x0 size. Most ads aren't visible anymore after removal.
    - in 05% of the situations, the ad is put into a <div> that packs together the ad itself with a text like "Advertisement :". As the <div> isn't empty it collapse down to the size of the text label. Some of the labels are graphics and can further be eliminated with AdBlock or image blocking. Other labels are actual text in the webpage and need a little bit more advanced RegExp-Fu with some adapted tool to get rid of. Nevertheless, those ads, once processed by AdBlock, don't eat much screen estate except for the small text.
    - the last 05% of cases are <div> containers that have some size forced to them (using styles). In that case, the <div> doesn't collapse when empty but keeps the size that is specified in its width/height attribs. This is the only case where some place holder is left. I didn't bother removing them, but I think either some local CSS that overrides the website and downsize the ad-containing DIV to 0x0 size, or some more complexe RegExp could do the job.

    But in general, Adblock is a nice experience where you don't see anything from the ads anymore in most cases.
    --
    "Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
  58. Re:Can't trust 'em by Anonymous Coward · · Score: 1, Informative

    The problem with linking to the sf.net page is that Swfdec is no longer hosted on Sourceforge and you cannot remove projects from Sourceforge. The correct link with all the hot working stuff (including Youtube video playback) is on http://swfdec.freedesktop.org/ . You will probably not get any of the new hotness from the stuff hosted on Sourceforge.

    And thanks for pimping my work,
    Benjamin