Slashdot Mirror
Sandboxed Flash Player Coming To Firefox
Trailrunner7 writes "Adobe, which has spent the last few years trying to dig out of a deep hole of vulnerabilities and buggy code, is making a major change to Flash, adding a sandbox to the version of the player that runs in Firefox. The sandbox is designed to prevent many common exploit techniques against Flash. The move by Adobe comes roughly a year after the company added a sandbox to Flash for Google Chrome. Flash, which is perhaps the most widely deployed piece of software on the Internet, has been a common attack vector for several years now, and the attacks in some cases have been used to get around exploit mitigations added by the browser vendors. The sandbox is designed to prevent many of these attacks by not allowing exploits against Flash to break out into the browser itself."
Its about damn time they did this for Firefox. I don't know how many times Flash has caused my browser to crash and I couldn't do anything about it. I love how in Chrome only the Flash player dies and not the browser.
Maybe sandboxing the damn flash player will stop it from periodically causing Firefox to hang for 30 seconds or so thanks to some damn ugly "full motion video" ad that's trying to load up?
I'd love to see a ban on FMV ads. Double for FMV ads that start themselves automatically, and quadruple for those fucking ads that blast audio after doing so.
The whitelist for flash is in the single digits. Most sites don't need that privilege. ... that's about it really.
Youtube, a couple of porn sites
Look forward to the requisite performance drop and novel new glitches. Yay.
Considering Flash's extensive use as an attack vector this is great news. I would sleep better at night though if Firefox itself was also sandboxed; in fact I'm a bit surprised you can even sandbox Flash when the browser doesn't support it.
the problem with flash security and flash in general is your corporate culture, as is evidenced by consistent prior refusals to patch egregious bugs.
consider HTML5. I personally liken it to a high caliber rifle in the face of your diseased and crippled cash cow.
so long, and please dont hesitate to continue pedaling the rest of your product line straight into the ground and hell beyond with the same toxic mismanagement as flash. We here on the internet will gladly engineer the future at your expense, until your corporate office is nothing more than the 21st century equivalent of bleached bones rotting in the noon-day sun, vultured by contractors and languishing at the precipice of bankruptcy.
Good people go to bed earlier.
First there's the NPAPI, then there's plugin-container, and now there's another layer?
Yes, let's all rely on Adobe, the company who wrote one of the planet's least secure multimedia delivery platforms in history, to save us from their own software. I'm sure the sandbox will be stable and secure and in no way, shape, or form, completely useless and awful.
Better hope pandora's box v666 has good wood and nails on the lid.
Come on, ad block!!
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
... in 2016 when it becomes available for Linux.
Now if we could just get some updates on the next Realplayer release, and whether or not it will be sandboxed with AOL, I can comfortably enter 2005 on the bleeding edge.
Too little, too late.
I went full linux (Linux Mint, and now using Cinnamon) as of a month and half ago. I installed flash at first, but it sucked so bad, I took it off. I have been flash free for at least 3 weeks now and I LOVE IT. You no longer _need_ flash to get everything you want online. Even Youtube works great without it now. :)
(Note: I am a professional web developer for 13 years now, spent literally thousands of hours in flash development and animation and I teach flash at a local community college. I taught Director before that, and advised they dump it for more flash. Now it's time to start planning for a future without flash.)
Firefox is getting so torn between different developer platforms. They could cater to users of canvas, with their JS scratchpad, or they could appease flash users. Tough choice.
I am a 5th level dwarven warrior. I have shuriken.
My cat has been trying to bury Flash for years.
Have gnu, will travel.
subject says it all, really. it's nice to have it for chrome and firefox, but where it's really needed is in ie.
They still crash the browser often enough. All FF did was kill plugins that were unresponsive for an X amount of time, but the didn't do any sandboxing or insulating.
I was promised a flying car. Where is my flying car?
Cave paintings exist where they sandboxed flash. It's about time Adobe did the same....
I was promised a flying car. Where is my flying car?
Seems like the most obvious question but does this run on Linux? Also, does Gnash, or any other free implementation of the flash plugin offer this too?
But... the future refused to change.
http://www.sandboxie.com/
Does this not work?
Why is this downvoted? There's a very valid point being made here: flash needs to be dropped once and for all.