Slashdot Mirror
Apple Auto-Disables Old Flash Players In Mac OS X 10.7.4
wiredmikey writes "Just released, and coming in at 370 MB in size, the Mac OS X 10.7.4 update includes general OS fixes, and addresses more than 30 security vulnerabilities. But aside from typical security fixes, Apple has made an interesting move in an effort to protect users. Through this latest software update, Safari 5.1.7 will now automatically disable older — and typically more vulnerable — versions of the Adobe Flash player. While many software vendors would prefer OS makers to keep their hands off their software, the move appears to be welcomed by Adobe, which has constantly battled vulnerabilities in its widely installed Flash Player."
More like 730 MB.
Imagine if MS had done this, the bitching here would be enormous. Just like how Palladium was decried by everyone when it was proposed by MS to secure PCs, but when Apple did it with iOS with extreme lockdown DRM, it was the best thing ever and there was not a peep from the same commentators that blasted MS.
This space for rent.
The Adobe Flash installer deletes itself, too, after installation. They really don't want the old, buggy stuff laying around.
Kriston
Last time I had an issue with a virus intrusion attempt, t was acrobat, not flash, that was the vector.
That Adobe makes such software that it welcomes other people disabling it.
You can reenable it...
Safari 5.1.7 is installed AFTER upgrading the OS to 10.7.4. The ~400MB delta or ~1.3GB combo updates applied thru Software Update (700MB delta / 1.55GB combo if downloaded as standalone updaters) bring Safari to 5.1.6 and patch a slew of other pending issues. Then you can run Software Update again and install the ~35MB Safari 5.1.7 update.
As for the disabling of vulnerable versions of third-party software, worth noting that a couple of weeks back during the FlashBack Trojan affaire, after installing the security updates that brought the problem to a halt, the Java browser plugin was disabled by default, the user would need to manually enable it when needed, and it would auto-disable itself again after a few days of inactivity.
Why *should* they leave your computer alone? If you are either too stupid or unwilling to take proper care of it, and the repercussions of that fact affect everyone around you, then don't start complaining when others take the job out of your hands.
There are all sorts of regulations regarding cars. You need licenses, tests to prove you can drive safely, legally mandated regular checkups, etc. If you don't follow through, then the gov't will decide you can't drive it anymore.
It's inevitable that the same will happen to computers, for pretty much the exact same reasons.
TL;DR version: If you want people to treat you like an adult, then ACT like one.
This is probably good as Adobe seems to "patch" or provide "updates" to their product every 2hours or so.
This is an issue that all non-OS applications have: how to get and install updates in a timely manner? Firefox checks for updates upon launch; drawback: annoyance for user as this results in an apparent slow launch. Google installs an update service; drawback: many users will disable this service due to the perception that it could slow down the entire system. Adobe Flash Player is a "system plugin" with its own update tool that runs at boot time; drawback: it requires user interaction, thus it is annoying. RealPlayer creates update tasks in the TaskManager; drawback: some users will disable them as they could increase boot/login time and/or are perceived as intrusive/spyware. The only acceptable solution is a system-wide update system, the way it works on Linux but without any user interaction; or updates delivered for all installed applications via Windows Update on Windows (which Microsoft is unlikely to accept).
Leave MY computer alone Apple!
Is Apple preventing you from running, say, Firefox on your Mac? Firefox, as far as I know, isn't doing the Flash player check that Safari is doing.
I've always viewed Apple hardware as the toaster oven of computers. In that, I don't *care* what's going on under the hood, I just want the bloody thing to work - which it does, barring spouses leaving it switched on and resting on a feather pillow (ouch time!). When I want something to tinker with, I crank up my Linux box and if I really have a few hours to kill, on goes the Wintendo.
Operation Guillotine is in effect.
I understand not offering support or having a important sounding warning but why make it mandatory? I tend to keep my software updated but what if I didn't want to update my software? Why should Apple or any company be able to come in and make changes to my system without me first either giving them permission or setting the computer/software to auto-update?
Seriously, the gaping security holes in their products make me think they have to be consciously designing them that way.
I wish you didn't post as AC so you could receive a well deserved mod bump.
"As the intrepid kobold companion continues his journey, he begins to wonder... if priests raises dead, why anybody die?
I don't see them in the Mac App store - give it a year and you'll only be able to run what Steve Jobs 'brain in a jar' says.
And my prediction is "give it a year and you'll still be able to run stuff not from the App Store". We'll see who's right in a year.
Glad to see that Apple is taking all the necessary steps to return to "no viruses on Apple".
FTFY
why can't the updates be smaller like the MS ones?
when it means Safari?
Consider this almost a year... people were saying this when the App Store came out, and it's not true yet....
A more realistic timeline would be ten years, at which point you'll likely need to register with Apple and sign the developer's keychain to install software on whatever the OS X replacement is. Before a step like this happens (with a new OS), I don't see running arbitrary code going anywhere.
Yeah, go for it.
paying for security patches is the way to go.
Atari rules... ermm... ruled.
Because if you are stupid enough to run ancient versions of plugins like adobe flash and not bothered to update, then your ability to manage your computer is so poor that you don't deserve the privilege making that choice.
Software will always have bugs, and until there is a seismic shift in attitude over how software is designed, security vulnerabilities will always exist. The question becomes a) how do the vendors respond, and b) how do the users respond. Vendors should be putting out updates to patch the flawed software.
This is being done, for the most part (Except maybe Adobe).
Users are supposed to be responsible for making sure those updates are applied. This is chronically NOT happening. I have met users who were even proudly defiant, refusing to run updates and bizarrely equating it with "sticking it to the man". These are the people that make the internet a cesspool of viruses, spam and botnets and phishing attacks. If you count yourself among these kinds of people, I'm amazed you even managed to figure out how to post a comment on slashdot.
Wow, you really don't get it, do you?
Since you appear to be fond of the hyperbolic, lets try this: You buy a gun. Are you allowed to buy a guy? Yes. Are you allowed to wave it around in the privacy of your own home? Yes. Are you allowed to wave it at someone else? No, unless you have a license.
Now take that same gun, put it on a pedestal in front of you, and stand back as hundreds of thousands of people walk past it, some of them looking at it, some of them poking at it... and a couple attach a doohickey that causes the gun to come to life and start firing at the crowd. All this while you're still standing beside it with a shit-eating grin on your face and you proudly going, "This is my gun and you can't tell me what to do!"
And you have the audacity to be offended when someone steps up and takes the gun away from you?
And this is what you're doing when you put a poorly maintained computer on the internet. ANY computer, doesn't matter if it's Windows, Apple, Linux, or your old Commodore 64. This has nothing to do with Apple, and everything to do with cleaning up the sorry cesspool the internet has become. Apple isn't even the first company to do it... They're just the most visible. Mozilla is already disabling old Java plugins, for example.
Okay, I'm done feeding the troll. I'm gonna go back to reading http://xkcd.com/386/ now.
Congratulations.. you are a winner! And by winner, I mean you are a typical Apple cheerleader douchebag.
Fuck you.
Wow, you really showed me there. You were clearly the leader of your high school debating team. Thank you for proving this: http://www.penny-arcade.com/comic/2004/03/19
Now I see why you're posting as a coward. I admit I was curious to see how this would play out, but now that I know I can just save myself the time and effort of responding to anonymous cowards in the future.