Slashdot Mirror
Mozilla To Protect Adobe Flash Users
juct writes "Beginning with versions 3.5.3 and 3.0.14 of Firefox, Mozilla is going to check the version of installed Adobe Flash plug-ins and warn users if it discovers an outdated version with potential security holes. Mozilla confirmed this new security feature and said that the Flash version check was part of a wider commitment to 'protect users from emerging threats online.' Just recently, a study confirmed that 80 per cent of users surf with a vulnerable version of Adobe's plug-in."
"WARNING!! The version of Adobe Flash you are using is out of date and contains security holes, please upgrade by clicking here ..."
Oh dear, I don't understand what this means. Luckily my son, who got sick of me ringing him for computer help, told me what to do whenever I encounter a box I don't understand; click the X, or click cancel, or ignore. Now back to clicking on every ad I see.
Of course, that isn't likely to happen. It would be more like:
WARNING!! The version of Adobe Flash you are using is out of date and contains security holes, unfortunately you are using Internet Explorer so there is no warning.
the remaining 20% don't use Flash then?
I admit i don't use flash very often because it's annoying and Adobe's flash plugin uses way to much CPU, but is it still needed? Gnash has worked for me every time I've tried it lately (admittedly mostly for youtube). Tried it now with a flash game and it seems to work.
I've found replacements for Adobe Reader and Real player (Foxit and Real Alternative), but couldn't find a replacement for the Flash player (alas).
This is better than nothing. I have Flash (and all other scripts) turned off by default in my Firefox browser, but am still forced to use it to see some things.
Yeah, I know the troglodytes won't understand the warning, but it might give them the slightest clue that something's wrong.
Doesn't flash already prompt you to upgrade from an old version?
if so how will this warning be more effective (unless they add an auto-update feature)?
if not, WTF ADOBE!!!
IranAir Flight 655 never forget!
The real problem is all those web sites that you have to use but are completely useless when flash is disabled. What firefox should be doing is sending an email to the web site administrator (it is the semantic web, is it not?) telling them to not rely on flash. Even better is if nobody even used the cruft, but dreaming of that is going from na-na land to someplace even more remote.
I already ignore firefox updates (because I'm lazy). I wonder how many people just ignore updates in general?
And the sad part is, I know better. Why do they expect Joe Sixpack to heed update warning when a power computer user and programmer is too lazy to click "update"?
+ function IsFlashVulnerable(FlashVersion) {
+ return true;
+ }
Just recently, a study confirmed that 80 per cent of users surf with a vulnerable version of Adobe's plug-in.
It's an easy/appealing target vector. With the slow revving even the most recent version hangs your ass out in the wind to a substantial degree.
Now just throw in a good website (server/framework/XSS/whatever) exploit and you've got a serious worm.
For the worth of the putative benefits I am not encouraged enough to hang my ass out for Flash. (Except I do have it installed! Just kept dormant until I (rarely) click my NoScript button.)
I am really surprised browser makers aren't doing automatic updates for plugins like Flash. That is really the only way to keep them up-to-date.
I am happy too see an open source developer dropping the attitude that if the bug is not in their code, then it's not their problem.
The next step would be to make sure that at least the most popular extensions work with a new version of Firefox when it is released.
Broke my own first rule on this one -- never download anything you're not 100% certain of - but it's still frustrating. If FF tells me it's taking me to install Flash, I think I should be able to trust that Flash is what I'm going to get.
Does updating Flash require you restart Firefox? Even with its Session Restore, textarea content is lost as are tabs whose URLs are no longer valid. Maybe Firefox should ask you if you want to install the newest version of Flash when you first open the browser? ie. in the same window where it asks you if you want to update the add-ons you have installed?
Teaching the users to follow installation links from a standard (and unencrypted) web page is not a good idea. Not all users would be savvy enough to notice the difference between http://get.adobe.com/... and http://updateflashplayerforfree.com/... so it's only a matter of time before phishers distribute viruses through innocent Mozilla-looking pages. After all, it's Firefox and it has cute birds all over the place so it can't possibly contain a virus, right?
The correct way to do it would be to have a version check mechanism similar to that of extensions, which Mozilla can still update without releasing a new Firefox.
swap one exploit for another
http://www.google.com/search?hl=en&q=%22Adobe%20Download%20Manager%20%22%20exploit
wtf is wrong with Adobe ? whats wrong with just providing the plugin and nothing else ?
i should also rant at Sun for installing their fkin Yahoo toolbar/spyware accross our corporate network on every Java monthly update or installing their quickstarter/net assistant Firefox plugins without permission,then there is Apple with their forcing "Safari" (another exploit vector) as a pre-ticked update on their Quicktime updates WTF ? , google installing scheduled phone-home tasks every 15min with any bit of software they install
really just fuck off, fuck right off
is it any wonder with this despicable behaviour from major software companies with their "update" software is abused as a "install more crap" service that people dont update their plugins/software for fear of getting crap that they didn't ask for therefore exposing themselves to all these vulnerabilities or more if they do install it
perhaps when they get tagged as badware and spyware their behaviour might change
or maybe a good old million dollar class action lawsuit might
The back story:
Adobe top managers were sittin' around one day during one of their 3-hour martini lunches, smoking cigarettes, scratching where it itches, and making lewd comments to the waitress.
Finally, one of them said, "How can we sink the company?" After much consultation by cell phone with people who actually understand Adobe products, they found a solution: Have a product that is always in the news because it is buggy and vulnerable. That product should also have a buggy, poorly designed update installer.
Okay, you say, "I doubt that." But do you have a better explanation? Hah! I thought not.
But FreeBSD will protect you. I doubt Mozilla will ever catch me with a vulnerable version unless you say all Flash is vulnerable -- a point I won't argue. At least I have a 'kill script' to kill an annoying flash page.
While preserving the text I really want. For most viewing (video) I use VLC, clive and a script to glue them together. (written is sh -- hint tested with bash too) See the benefits of open source software?
BillSF
Sorry Microsoft -- you sold the only good thing you had -- Office. Lets hope the designers will revolt and force the source open. They are, after all the only known RealHackers(tm) in Microsoft!
How about protecting my browser from an Adobe crash? I know you're working on isolated tabs, but hurry up already!
Reviewing just the first hour of video games.
I use chrome which sandboxes plugins so most/any vulnerabilities are likely to do no more than crash the current tab. Why not make the entire browser secure from the ground up rather relying on the human element to keep things right?
For added lulz - Adobe's CS uses a full copy of an old and vulnerable version of Opera for its home-phoning loading screens, and for bridge - and of course their retarded mac devs (there used to be a a few hacks to make CS3 work In mAcOS x Hfs+ wIth CAsE sEnsitIVIty because apparently their coders are drunk monkeys, now they disabled it by making it impossible to install CS4 if the root partition is on a case-sensitive FS - I said fuck it, deleted the trialware and just moved to alternatives that fill my needs without taking up endless gigs of memory rather than waste money or time to fix it that is much more valuable in the end than what they would expect me to pay. That might amuse you.
Don't know who this guy is, but this is what developers are like. Maybe if they had a key sequence to do it, it would be easier for us. Then again I don't ever expect Mozilla to beat FreeBSD on an exploit.
I'm sorry in future we will try and make all releases of software perfect and not release until we are 100% sure no vulnerability will ever be found
~the hurd team
IranAir Flight 655 never forget!
Even as a long time FF user I keep going to the Plugins menu, looking for and wondering why there isn't a "check for updates" button, just like there is for extensions.
Most plug-in authors do have their own auto-update programs but I dislike using them - I keep having to disable them from loading at boot, and they seem to do other crap I don't want like try to installl their other crapware. Even just trying to download flash they want you to install some download manager first; there used to be a proper installer hidden away as a re-distributable but I can't find it any more. Adobe Reader auto-updates but decides to install Actobat.com (which seems to be an Air application and not a web link) and it putting a shortcut on the desktop also irritates. Java update seems relatively benign but need to remember to untick the Yahoo! search bar, I'll tolerate the advert for OpenOffice. QuickTime have at least stopped having the iTunes bundle as the default, but every time I update it seems to forget my settings.
Not so long ago we were warning newbies to be wary of any software that tries to pull stunts like these.
Everyone is using ancient versions of that also.
The reason I have not updated my very old version of Flash is because I heard about Omniture and 2o7.net and no they have not sufficiently explained themselves to their user base.
Here's a page that checks your Flash version and lists the latest version for the different browsers/operating systems: http://www.adobe.com/software/flash/about/
I don't think it would go down too well if version checking was built into the current version of Skype for Linux.
"Dear Linux user, your version of Skype has not been updated for 2 1/2 years, there are no new updates planned, and x86_64 versions are out of the question. Please feel free to vent to eBay where they will helpfully file your comments in /dev/null.
Thank you for choosing Skype."
Take Nobody's Word For It.
Why don't you just use Lynx or wget? You anti-"bloatware" people seem to make a stink about anything that isn't plain ASCII anyway.. why not just go all out and use the least "bloated" client on earth? I'm serious. Use wget. It seems more your style.
If the user doesn't upgrade does it disable the plugin?
Do you changes clothes while making the "chee-chee-cha-cha-choh" transformation sound?
Would be running it in a separate subprocess so it doesn't inevitably crash the whole browser when you close a damn tab containing a youtube video.
There are more holes in Flash than every version of Windows and MacOS combined. Updating may fix 3 of those issues at a time, while 50 more are found. Whoooooooeeeeeeeeeeeeeeeeeeeeeee
"They confiscated everything, even the stuff we didn't steal!"
That would be annoying for Linux users... while updating flash is not difficult, it is... awkward for less technically inclined users who had someone else set it up for them. As one who has set up such installs for people, I don't want to have to walk them through manually copying a new libflashplayer.so into their /usr/lib/blah/plugins directory every time a flash update happens.
And how about also dealing with the privacy/tracking issues associated with Flash? Flash has the ability to stores cookies (LSOs or Large Storage Objects) with impunity. Flash cookies can be auto-deleted using a Firefox addon called "BetterPrivacy" but it should be built in to the standard Firefox privacy feature.
Not to mention possibly troublesome for multi-user systems on a guest account where flash is grabbed from a global directory. But, I suppose if a sysadmin were to update firefox, they should also probably update flash. If they don't value security, that is.
However, flash can be installed to ~/.mozilla/plugins/ for precedency over the global directory. I'd hate to be support on that:
User: "Where's .mozilla? I can't see it!"
Support: "What file manager are you using?"
[...]
http://sourcemage.org/ - Have fun
Any chance they will protect our privacy by adding Flash Cookie Management?
I automatically wipe the via `rm -rf ~/macromedia/*` to stop tracking on UNIX, but doing it on Windows is a hassle. Flash cookie management like browser cookie management would be nice. Sign me up for session flash cookies.
As said here : http://www.osnews.com/comments/22120 What about Java? What about Quicktime? What about Unity? What about VLC? What about ...
http://latest-version.org/latest-version.txt
http://latest-version.org/linux.txt
http://latest-version.org/quicktime-version.txt ...
"This site uses a Flash plugin, instead of accepted and open internet standards. Flash has no public source code, and thus no critical peer review. Software with no peer review is intrinsically a security threat to your system. Automatically send nastygram to webmaster?" [Yes] [Search Google for a competing site]
Furries make the internet go.
Just thought I'd notify people that the above message is from an imposter, NOT from the real Hurd team! Besides the giveaway of the high UID, look at the signature people. Looking at it? It should be signed off as the GNU/Hurd team. Double-duh!!!!1!!1