Slashdot Mirror

← Back to Stories (view on slashdot.org)

Adobe Introduces the Paid Security Fix

Posted by timothy on from the sure-would-be-a-shame-if-somethin'-was-ta-happen dept.

Nimey writes "Adobe has posted a security bulletin for Photoshop CS5 for Windows and OSX. It seems there is a critical security hole that will allow attackers to execute arbitrary code in the context of the user running the affected application. Adobe's fix? You need to pay to upgrade to Photoshop CS6. For users who cannot upgrade to Adobe Photoshop CS6, Adobe recommends users follow security best practices and exercise caution when opening files from unknown or untrusted sources."

85 of 392 comments (clear)

  1. What a scam by StillNeedMoreCoffee · · Score: 5, Insightful

    I can see it now, all software vendors are going to introduce security flaws or wait until one is discovered to release the next paid upgrade release.

    I think a class action suit is in order for all the holders of the older version. It their software causes a security hole and if one person gets hammered by it then like the car companies having to recall and fix cars, software vendors will have to do likewise.

    Are you listening Adobe.

    1. Re:What a scam by HarrySquatter · · Score: 2

      Sure, except to use the software you agreed to the EULA where Adobe disclaimed themselves against any such defects. Good luck with that.

    2. Re:What a scam by cpu6502 · · Score: 2

      Why not? Sony got in trouble for damaging people's PCs (making them unbootable or breaking installed software). Let's put Adobe in a courtroom too.

      Of course Adobe could argue other companies do it. Apple and Microsoft do it when they stop filling holes in their old OSes, and tell you to upgrade to OS 10.7 or Win7. Mozilla does it when they abandon Firefox 4 or seaMonkey 2.0 and say, "You're on your own."

      --
      My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
    3. Re:What a scam by aaronb1138 · · Score: 5, Interesting

      I just go with a policy of buying new copies of software every several versions. If I need a feature or bug fix from a version in between buying cycles, I have no moral issues obtaining an upgrade through alternate channels.

      Pretty much the way I look at it is, if I buy a product with a manufacturer defect, there should be no limitations on my ability to obtain a refund for the product. In the case of software, I don't find it unreasonable to skip past the unreasonable methods I would need to pursue to obtain a refund and purchase a fixed version.

      Lemon laws don't exist to protect consumers from the idea that an automobile is a failure, but rather to prevent consumers from being burdened by unreasonable processes for obtaining a working automobile pursuant to the arrangements they made at purchase.

      Also, no one should ever feel respect or bound to an EULA. The practice itself is inherently outside of common and established legal practices. If I were presented the license at the time of purchase, prior to paying, I might be able to respect it. Based on the concept of the EULA, I could have my PC pass a counter EULA to the installer or e-mailed to the vendor which outlined my requirements of their software in order to occupy space on my hard drive. If the installer continues, can I not consider their consent to be implied.

      It's the same reason, no one thinks twice about installing an ad-block on their browser. They have a right to control what content runs and executes on their computing device. I've voiced the opinion for quite some time that advertisements which attempt to get around ad-blocking actually constitute violations of most computer hacking laws (use of processing time on a computing system without authorization).

    4. Re:What a scam by c0lo · · Score: 2

      If software producers can get away with that, why cant car producers? Or the other way around, if nobody else can get away with self-absolving EULAs, why do software producers?

      Because software is "Intellectual property", so you don't own the software once you bought a copy: you are only allowed to use it. (yes, I know, copyright infringement is not theft for this very same reason...).

      --
      Questions raise, answers kill. Raise questions to stay alive.
    5. Re:What a scam by javakah · · Score: 5, Interesting

      The house analogy is much closer to open source. If you find a flaw in the design, such as that thieves figured out how to pry open the windows, then you can't go back and sue the builders. You can however get new locks, add on new security to the house.

      Adobe though is more like a landlord who is anal about you making any, even tiny repairs. You aren't allowed to make any changes to the house itself. You find out that thieves have figured out how to pry open the windows. You report this to your landlord, expecting them to make appropriate repairs. They refuse to make reasonable repairs, but tell you that they have a different property for rent, with better secured windows, if you are willing to pay higher rent.

      The issue is that since they do not give you the source code to even allow you to make repairs, they should be obligated to make repairs themselves for a decent amount of time.

    6. Re:What a scam by Jane+Q.+Public · · Score: 3, Insightful

      "Sure, except to use the software you agreed to the EULA where Adobe disclaimed themselves against any such defects. Good luck with that."

      They might in fact have good luck with that. The fact that something in the EULA doesn't make it law. Or even valid.

      For example, some states have laws saying that if you sell a product intended for a particular purpose, there is an implied warranty that the product is fit for that purpose... no matter what kind of disclaimer the seller puts on it.

      Don't mistake EULAs and Limited Warranties for law. Corporate lawyers don't necessarily put valid stuff in there. On the contrary: what they include are things they'd like you to believe, and that they HOPE they can convince a judge of, if it ever goes to court. And in some cases they even include stuff that they KNOW won't stand up in court.

    7. Re:What a scam by miserere+nobis · · Score: 2

      Software isn't physical? That doesn't really matter. Software is used to create and run a whole lot of things that can cause people to get hurt or killed. It also controls, and can distribute or destroy, data whose distribution or loss can have real, physical consequences. Just because photo-editing software is not safety-critical doesn't mean computers, or networks, it runs on are not.

    8. Re:What a scam by Jane+Q.+Public · · Score: 2

      "Because software is "Intellectual property", so you don't own the software once you bought a copy: you are only allowed to use it. (yes, I know, copyright infringement is not theft for this very same reason...)."

      Wrong on both counts.

      A book is intellectual property, too, but if you buy it you own it. The idea that you are just using it (or "licensing" it) is pretty much unique to the software industry, and has between little and nothing to do with the fact that it is "intellectual property".

      I should qualify my comment about your last bit, though. While the fact that it isn't theft is related to the intellectual property concept, I suppose, but only indirectly. The more direct reason they are distinct in law is because when you steal something from somebody, you deprive them of the thing stolen. They no longer have use of that thing. Not so with software, music, books or patents. Therefore it cannot be "theft".

    9. Re:What a scam by Grishnakh · · Score: 2

      As for Adobe, or any software product. The developer should be required to fix security problems as long as there are people using the software, just like Microsoft and Windows XP.

      Oh please. There's still people using DOS and Windows 3.0. Hell, there's people still running PDP11s somewhere. Manufacturers have no responsibility to support their products indefinitely. On top of that, why do you have a double standard? You insist on Fort Knox-level security for consumer software, but you don't insist on this security in your own house, and you use crappy mechanical locks that anyone with a lock pick can get past. Locksmiths do it all the time. How liable is Schlage or Kwikset when someone picks your locks and steals your stuff or even shoots you? Hint: they're not.

      If an industrial machine does something unsafe because of bad input parameters, that's the machine manufacturer's fault for not checking all inputs. In fact, that's a security problem for that machine; it doesn't matter what software generated the input file. Since the machine mfgr is making something that can actually hurt people, it's their responsibility to make better software, not a company that makes some graphics-editing software for PCs that are constantly susceptible to viruses and worms.

    10. Re:What a scam by miserere+nobis · · Score: 4, Interesting

      There are thousands upon thousands of industrial machines the control of which has real, physical consequences and which are absolutely running Windows, in factory settings, in building control and security systems, in all kinds of settings. Remember Stuxnet? Do you think medical charting software and testing machinery control software in hospitals have no real, physical consequences? You're thinking too narrowly. And even many of the systems which are supposedly "not on the internet" get built and set up by systems which are. Nor are "windows" or "on the internet" even requirements for the vector for this problem: TIFF files through Photoshop are. Do you think there are no systems at the Pentagon, NSA, CIA, or FBI running Photoshop, and that decisions based on data in files on those networks don't involve lives potentially lost?

    11. Re:What a scam by Genda · · Score: 2

      Clearly you haven't looked very far. Windows has crept into all kinds of application that would make you think "WHAT!!!??? Who authorized this!!!???" Just a few off the top of my head include trains, cranes and ships. In any case here's a list of the 10 worst uses for Windows and they range from the silly to the life threatening. Like I'm sure you'd be all warm and fuzzy knowing that the radiation machine measuring your near lethal dose of gamma rays is running vista and hooked up to a network. Good luck with that...

  2. Ugh by bonch · · Score: 3, Informative

    If this was a years-old version, I'd understand, but CS5 was the latest version until literally days ago!

    1. Re:Ugh by HarrySquatter · · Score: 3, Insightful

      No, CS 5.5 was the latest version before 6. And considering CS5 came out April of 2010 it technically is a 'years-old version'. Still a scam, though.

  3. Car analogy by TheMeuge · · Score: 2, Funny

    This is akin to buying a 2010 Chevy (under warranty), then finding out that the brakes catch on fire under certain circumstances, and the company's suggestion: buy a 2012.

    1. Re:Car analogy by The+Infamous+Grimace · · Score: 5, Insightful

      No, but I could have my identity stolen, bank accounts compromised, vital information about friends/family/co-workers/customers stolen, etc. Looking only at one extreme possibility (or non-possibility, as you used) is, well, pretty damn narrow-minded.

      --
      Ignorance and prejudice and fear
      Walk hand in hand
    2. Re:Car analogy by turbidostato · · Score: 2

      "No, it's not. You're not going to die if your computer gets pwned. If you don't like it, don't buy Adobe products."

      Well, how is it any different that in the case of life-threatening menaces? You don't want the new Sukhoi Superjet 100 because it tends to kill you? then don't buy it.

      The point is that if a product produces an unforeseeble damage that can be tied to producer malice/miscalculus, then it is the producer the one to pay the bill. Bigger if there are deaths involved than in other case, but still to pay the bill.

    3. Re:Car analogy by turbidostato · · Score: 2

      "In fact don't most (or all) EULA's specifically say there is NO warranty, explicit or implied, that makes them liable for damages of any sort?"

      Yes, so they say.

      And for the same price they could say you owe them your firstborn.

      They saying what they want doesn't make it automatically legally bonding, didn't you know it?

    4. Re:Car analogy by Hamsterdan · · Score: 3, Insightful

      I know people here like to bash on Microsoft, but thay are going to support XP through 2014. Windows 8 will be out. That's 13 years, and *3* versions later.

      Considering the insane price Adobe sells CS, You'd think they could at least fix security holes for a little while.

      --
      I've got better things to do tonight than die.
    5. Re:Car analogy by vux984 · · Score: 2

      First of all, software doesn't come with a warranty. In fact don't most (or all) EULA's specifically say there is NO warranty, explicit or implied, that makes them liable for damages of any sort?

      This is the basic approach:

      We provide no warranty:

      COMPANY PROVIDES NO REMEDIES OR WARRANTIES, WHETHER EXPRESS OR IMPLIED, FOR THE SOFTWARE.

      We try and get out of any warranty that you might get from consumer protection laws by explicitly decaring its sold "as-is" and that we don't represent that its "merchantable" or otherwise "fit for any particular purpose". These are "code phrases" to trigger various provisions and exceptions in consumer protection laws.

      THE SOFTWARE IS PROVIDED "AS IS".

      COMPANY DISCLAIM ALL OTHER WARRANTIES AND REPRESENTATIONS, WHETHER EXPRESS, IMPLIED, OR OTHERWISE, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

      Finally, they acknowledge that despite their best efforts to disclaim any obligation to stand behind their product in any way that you still might have some warranty where you are. Talk to your lawyer.

      SOME STATES DO NOT ALLOW THE EXCLUSION OF IMPLIED WARRANTIES, SO THE ABOVE EXCLUSION MAY NOT APPLY TO YOU. THIS WARRANTY GIVES YOU SPECIFIC LEGAL RIGHTS AND YOU MAY ALSO HAVE OTHER LEGAL RIGHTS THAT VARY FROM STATE TO STATE.

  4. Re:Call it the Microsoft method by Anonymous Coward · · Score: 5, Informative

    Sorry but Microsoft does the best at offering security fixes at no cost. I can't think of another company that does it better than Microsoft.

  5. Fuck you, Adobe! by Narcocide · · Score: 5, Interesting

    Since I can't mod Adobe "-1 flamebait" I'll just say it again. Fuck you, Adobe! I'd like to go on record as stating that you should all be ashamed of yourselves.

    1. Re:Fuck you, Adobe! by Bodhammer · · Score: 4, Interesting

      Bump for agreement. Blow me Adobe...

      --
      "I say we take off, nuke the site from orbit. It's the only way to be sure."
    2. Re:Fuck you, Adobe! by Grishnakh · · Score: 2

      I think it's great, and I hope more proprietary software vendors choose this method of dealing with security problems. If you don't like it, you're free to not buy their products.

      I don't have this problem with GIMP or various other open-source products I use.

    3. Re:Fuck you, Adobe! by Em+Adespoton · · Score: 3, Insightful

      You also can't accomplish the same things on-budget and on-timeline with GIMP that you can with the full CS suite.

      While I'm mightily annoyed with Adobe for how they handle bugfixes, the sheer size of their product means that a proper QA cycle would last them almost as long as their point release cycle. I don't really think there's any good solution -- the open source suites are too disjointed and just don't cut it still for most professional work (this is true... GIMP is really good at what it does, but it's a lossy image editing program, not part of a DTP workflow), and spending the time to create bugfixes and then QA them properly for previous versions of CS would just cost Adobe too much money, more than they'd be able to pass on to the consumer.

    4. Re:Fuck you, Adobe! by Anonymous Coward · · Score: 2, Interesting

      Sorry, but you'll have to pay for that service...

    5. Re:Fuck you, Adobe! by jimicus · · Score: 2

      If you're making buckets of cash of their produt, pay for the upgrade and quit bitching...wow.

      You'd be amazed how many companies in this world aren't making buckets of cash. They're making enough to meet payroll and cover any loans, but beyond that every month is a struggle.

      Even when you look at national and even multinational companies, the story frequently doesn't change much. Yes, they cover their expenses every month but for many, it doesn't take a particularly big problem to come bouncing out of nowhere and that's it, thank you and goodnight.

  6. Lifecycle Management by devilsdean · · Score: 2

    Interesting enough, the CS collections aren't listed on Adobe's products and Enterprise Technical Support Lifecycle Policy.

    1. Re:Lifecycle Management by Sycraft-fu · · Score: 2

      That's because their Lifecycle policy is approximately: "Fuck you." They'll support a version up until around the time a new version is getting ready to go, then they stop and only deal with the new version.

  7. Call it the /. method by Moheeheeko · · Score: 5, Insightful

    When you have nothing to say, blame Microsoft.

  8. And they wonder why there's so much piracy ... by warren.oates · · Score: 3, Insightful

    Seriously. This is why people download pirated versions. Even if you have a paid version of something, the damned thing "phones home" every time you launch it, the bozos are so paranoid. You can disable this in /etc/hosts, but it's still indicative of greedy grubbing stupidity. If they charged a third of the price, they'd sell 3 times more copies. Look what Apple did with FCP -- they made it affordable (yes, I've read the complaints, but it works fine).

    --
    Doh.
  9. And this is still on /.'s front page by TubeSteak · · Score: 4, Funny

    "Just released, and coming in at 370 MB in size, the Mac OS X 10.7.4 update includes general OS fixes, and addresses more than 30 security vulnerabilities. But aside from typical security fixes, Apple has made an interesting move in an effort to protect users. Through this latest software update, Safari 5.1.7 will now automatically disable older â" and typically more vulnerable â" versions of the Adobe Flash player. While many software vendors would prefer OS makers to keep their hands off their software, the move appears to be welcomed by Adobe, which has constantly battled vulnerabilities in its widely installed Flash Player."

    Maybe Apple should disable Photoshop CS5 as well?

    --
    [Fuck Beta]
    o0t!
  10. Re:Glad I'm using the GIMP... by robot256 · · Score: 5, Insightful

    And everyone who downloaded it illegally will just download CS6 in response. Oh, and half the people who paid for CS5 will probably do the same thing. Great move, Adobe.

  11. Re:This is not new by timeOday · · Score: 3

    CS5 was released only 24 months ago, whereas Win98 was EOL'd when it was a little over 8 years old. Say what you will about Microsoft, but they look pretty good in that particular comparison.

  12. Re:Call it the Microsoft method by DogDude · · Score: 3, Insightful

    You couldn't be more wrong. Nobody provides for longer support than Microsoft.

    --
    I don't respond to AC's.
  13. Re:Call it the Microsoft method by Moheeheeko · · Score: 4, Insightful

    Three orders of magnitude is very large in real life.

    Windows 7 Ultimate: $200

    Photoshop CS6: $700

    Oh yeah, Microsoft is so much worse.

  14. Re:I think they learned that from... by Threni · · Score: 2

    Sure, blame it on the Eskimos - as if they don't suffer enough...

  15. This is nothing new by SmallFurryCreature · · Score: 5, Insightful

    There is an old story I will retell that should serve as a warning for all customers.

    Once upon a time, there was a transport company employee charged with replacing a large segment of the companies trucks made by Volvo. The employee, being a bright individual called up a sales clerk from Ford that had been trying to get a foot in the door and asked him to send three Ford trucks for testing. The day the Volvo sales clerk came to make discuss the purchase of new Volvo trucks, these three Ford trucks happened to be parked on the lot. When the trucking company employee saw the Volvo sales clerk glance at them, he said "Yeah, the boss has been looking them, he seems to think they are an alternative worth looking into. But that is for later, lets discuss the deal you were going to offer us".

    In another company far far away, an CTO who loved IBM hardware knew it was time to discuss the purchase of new hardware, so he ordered an underling to set up a trial project with HP servers, just to see what the competition was doing. When the IBM man came by he of course showed him the workfloor including the corner where the junior was working on those shiny new HP servers, "Got to give the kids their toys to play with " the CTO told the IBM sales clerk. "Btw, what was the price you were going to ask for again".

    But in the dark and damp lands of Mordor, a very different tale was playing out. There the CTO invited the MS and Abobe sales clerk and proudly showed them how his entire business depended completely on their software product and how not only did they need the software to work flawlessly or they would be bankrupt in seconds, all the staff could only use the latest software and their customers demanded that they use the latest software. "BTW", The CTO asked, "what was that deal you wanted me to sign in my own blood again while bending over"? And there was much rejoicing among the Tribes of MS and Abobe, for they knew exactly who was calling the shots. One lockin to rule them all and in Eula bind them. For the users of MS and Abobe where greedy and feeble minded and could not break free of the spell.

    ---

    Really, this is nothing new. In the land of NAS and control systems, this is par de course. You let a supplier control you, control you they will. Want to break free? Good luck, your company needs the new version, license or risk being unable to produce so you hand them the cash and lock yourself in just a little bit more.

    Not a SINGLE Photoshop user will invest in his own freedom by making sure there are alternative methods to do his production. They will grind their teeth buy the latest version and invest yet more to make sure their production is entirely locked into Adobe clutches.

    Cue countless protests about how there are no alternatives... no, there are none because any who dares to try is ridiculed for not instantly producting a 100% compatible product for free because freedom should be free of effort and cost.

    You gave Adobe the control, enjoy it.

    It is not as if you are alone. Governments often dictate that procurement must be regulated, meaning that once a procurement contract has been done, all interest in customer satisfaction goes out the window because the contract is fixed, can't be ended and renewal depends solely on the price offered (not charged) so fuck you peon.

    I seen it to often in other industries, entire production line depended on one type of machine, fired your own maintenance team and anyone who could switch them out with other hardware. Goes, the "extra" charges sure went up a lot didn't they? Suddenly maintenance must be done by their certified team, at weekend charges.

    Lockin, avoid it or pay the price.

    --

    MMO Quests are like orgasms:

    You may solo them, I prefer them in a group.

    1. Re:This is nothing new by bws111 · · Score: 2

      Did it ever occur to you that people may value things differently?

      Maybe Photoshop users enjoy the freedom being able to hire any artist without special training. Maybe they enjoy the freedom to be able to go to any art school, photography school, community college, or vo-tec program and get quality training on the product. Maybe they enjoy the freedom to get a job at any professional shop that does graphics work. Maybe they enjoy the freedom of being able to send files to and from their clients. Maybe they enjoy the freedom of being able to take in more business because they are using tools they are proficient with. Maybe they enjoy the freedom to go to Amazon and buy any of countless books on Photoshop usage and technique. Maybe the enjoy the freedom to express themselves through their art without having to work around uncomfortable tools.

      Your idea of freedom seems to consist solely of being able to avoid the cost of maintaining the tools your livelihood depends on. I think most professionals have far different ideas of what freedom means to them.

    2. Re:This is nothing new by Anonymous Coward · · Score: 5, Insightful

      No, but if everytime a Photoshop user spent $2000 on updating to the latest version of Photoshop, they also sent a $100 check to the GIMP developers with a note explaining why they don't use GIMP... then pretty soon they wouldn't have to pay for Photoshop because GIMP would cover their needs (assuming enough Photoshop users did that, of course).

  16. Re:This is not new by Em+Adespoton · · Score: 4, Interesting

    This is not only not new, but the exact same thing happened for CS4 -> CS5. I still use CS4, because I spent so much time waiting for CS5, which kept missing its release dates, that I bought CS4 instead. Then they wanted me, TWO MONTHS LATER, to shell out another $400 for what amounted to a security/bug fix, as I didn't need any of the new features included in CS5, just the bugs fixed -- and they weren't willing to fix the bugs.

    At least at this point, all the attacks are targeting CS5, so CS4 isn't getting any worse than it already was....

    I'm starting to think I should try migrating to another package again... anyone know of decent (yes, decent) equivalents for Photoshop, Distiller, InDesign and Illustrator? GIMP takes care of many of the Photoshop issues, but Inkscape isn't there yet, Ghostscript has the wrong feature set for me (and I don't have the time to write my own scripts to fix that), and nothing else I've found is integrating these other apps into one workflow package the way InDesign does, nor will they read InDesign templates or publish to industry workflows with proper color and bleed profiles.

  17. Re:Call it the Microsoft method by Galestar · · Score: 5, Informative

    I'm sorry, but even "Non-Genuine" copies of Windows still get security fixes. There is no comparison here.

    Windows: Pirate our software, we'll still give you security fixes (although we might put a watermark asking you to stop pirating it)
    Adobe: Buy our software, but you only get security fixes if you give us even more money.

    Hell, MS gives security fixes even to XP until 2014 (13 years after its release). CS5 is less than 2 years old.

    --
    AccountKiller
  18. Re:This is not new by Overzeetop · · Score: 5, Insightful

    More importantly, if you bought CS5 for $2000 just three months ago, you have to pay to upgrade. It's like your iPhone 4 warranty running out when the 4s was released, even if you just purchased a v4 a couple weeks before hand.

    --
    Is it just my observation, or are there way too many stupid people in the world?
  19. Re:Call it the Microsoft method by exomondo · · Score: 5, Insightful

    If it's broken, get them to buy something to fix it.

    Oh come on, this 'oh Microsoft is just as bad' is the biggest cop-out. In this case it's just a blatant lie, CS5 was released early 2010 and this announcement means they've discontinued support for it, Windows XP was released in 2001 and is still supported now and will be until mid-2014.

  20. Solution: The Gimp by drewstah · · Score: 2

    I made the switch to the Gimp years ago. I got tired of pirating Photoshop. Then, when I switched to Linux, Photoshop doesn't run on Linux. Lo and behold, Gimp is an easy install, and I learned that. Now that I've switched to Mac (for the desktop), I still use Gimp. Ooh, and there's a new version out, and the development version handles high-bit images!
     
      gimp.org

    --
    I do stuff Zhrodague
  21. Re:Glad I'm using the GIMP... by AvitarX · · Score: 3, Insightful

    Actually, they now have a $50/month subscription service that allows install on 2 computers (non-simultaeneous use).

    The $600/year comes to 2-3 times as much as keeping current ($300 year for every upgrade since CS3, or about $200 year to go from 3-6), but does not have the $1800 upfront cost, meaning for new purchasers are actually ahead for about 4-6 years. An upgrade from 5 -> 6 is $725, so it's 2 years before it's more expensive to use the subscription than purchasing the upgrade (the subscription comes with cloudiness, and the full master-collection, but I'm using Design and Web Premium prices).

    I the the relatively low start-up cost ($50) of the subscription, is going to seriously cut-into piracy, and make them A LOT of money.

    --
    Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
  22. Suckers. by loshwomp · · Score: 4, Insightful

    Adobe's fix? You need to pay to upgrade [from CS5] to Photoshop CS6.

    Ah yes, I would be delighted to buy more software from you, since it worked out so well last time around.

  23. They knew over six months ago! by greenreaper · · Score: 3, Informative

    This is especially egregious since according to the researcher's announcement, Adobe has been sitting on this bug since last September. Users of CS5 should demand a patch.

  24. Re:Call it the Microsoft method by Surt · · Score: 2, Insightful

    1000 / 3.5 ~= 285. Of course, that assumes you believe the OP's billions vs millions claim.

    Sources claim 650M for windows 7:
    http://news.softpedia.com/news/Windows-7-Approximately-650-Million-Sold-Licenses-by-the-End-of-2011-202026.shtml

    http://finance.yahoo.com/q/ks?s=ADBE+Key+Statistics
    If 100% of Adobe's 4.2B revenue comes from $700 Photoshop sales, that's 6M units/year, call that 24M units over the lifespan of windows 7 since release in 2009.

    So for every unit of Photshop, you have at least 27 units of windows. Factor in the 3.5X price and you still have about 8 equivalent units of windows for every photshop over which to amortize costs.

    --
    "Who is the Journal of Quantum Physics going to believe?" --Stephen Hawking
  25. Re:A non story by greenreaper · · Score: 3, Informative

    Here's the problem with that - they were told about the issue in September 2011. They didn't address it then, but apparently decided to wait until well after the public advisory.

  26. Re:Call it the Microsoft method by TENTH+SHOW+JAM · · Score: 4, Interesting

    CS6 is not available in some markets. And this is going to be a real killer for chunks of the corporate world. My pet artists are going to be on a sneakernet if they want to keep CS5 and are going to have to learn a new toolset in the meantime if they want to come back onto my network. (The one hooked up to the internet with support contracts and enterprise agreements and production web servers)

    PAIN.

    --
    A sig is placed here
    To display how futile
    English Haiku is
  27. Re:Slight correction by Aphonia · · Score: 2

    Also, Photoshop 6 has only been the stable release for 50 days according to Wiki - not exactly the time to upgrade if you're actually working with Photoshop...

  28. Re:Call it the Microsoft method by dwywit · · Score: 3, Insightful

    *cough*IBM typewriters*cough*

    --
    They sentenced me to twenty years of boredom
  29. Re:Call it the Microsoft method by WalkingBear · · Score: 2

    Check your sources again. $50 / mos for the entire Adobe CS6 suite. All the packages.

  30. Re:Awful nice program ya got there... by Anonymous Coward · · Score: 2, Funny

    I was picturing it more along the lines of the following (read it in Cave Johnson's voice if need be):

    Okay, seriously, you guys. Seriously this time. We want out of this industry. The CEO and the board members are filthy stinking rich Silicon Valley douchebags, they want to get the hell out and retire while the retirin's good. The only thing stopping them is all those code monkey drones they need to pay, and so long as you idiots keep buying our products, we can't really stop them. I mean, have you SEEN some of those people? I don't even want to LOOK at them, let alone do anything that would either require me getting close enough to them to physically stop them nor give them a reason to get anywhere near me where I might have to look at them.

    So here's the plan: STOP BUYING OUR PRODUCTS ALREADY. If we go around firing everyone when the company's doing well, we'll be up to our necks with questions, lawsuits, and neckbeards. But if you people stop buying our products due to our own incompetence, the company dies out, avoiding all those unpleasantries. All right? It's a win-win situation: We get to retire to our private islands in luxury and bliss, you get to no longer use our catastrophically braindead products.

    To that end, we'll be instituting a series of corporationally suicidal moves to convince you, the unhappy consumer, to start investing heavily in HTML5 development and get those amateur art hacks who bought copies of Photoshop with their college discounts to switch to something cheaper, since they only use a couple features from Photoshop anyway, and those features have been in free stuff for a decade or so by now. Sure, sure, there'll be some professionals who DO need Photoshop and who will gladly keep pumping money into our retirement plans for another bug-riddled incremental update to a big-riddled raster image editor, but I'm certain whoever takes over our assets after our graceless plummet into corporate financial ruin will continue to service them perfectly well until they wise up and get out of this business, too.

    Everybody got the plan? Good! We'll start with a program to charge for security updates and progress onward to a microtransaction-based Illustrator. If you want those vector tools, you're going to pay for 'em. See you at this quarter's board meeting!

  31. Re:Call it the Microsoft method by Koim-Do · · Score: 3, Informative

    Actually, if by "RHEL from 2008" you mean RHEL5 then you were quite wrong. Apparently, redhat promises security updates at last until sometime in 2017:

    https://access.redhat.com/support/policy/updates/errata/

  32. Re:Nobody is going to exploit this. by NeverVotedBush · · Score: 3, Insightful

    Do you really expect a virus or exploit to announce to you that your system has been pwned?

    They used to do that but it's rare now.

    These days all that saying you have never run into a virus or exploit means for many people is that they are silently pwned.

  33. And the real shitty thing? by Sycraft-fu · · Score: 4, Interesting

    CS6 just launched and I mean JUST. It shipped on May 7th. So this isn't a case of an old version where Adobe is saying "Look guys, we are discontinuing support, have to buy the new one if you want it." The "old" version is only "old" by 3 days now.

  34. Re:Slight correction by Anonymous Coward · · Score: 4, Informative

    And it has only been released for purchase for a few DAYS. It was released this week (the week of the 7th).

    Almost makes me wonder if they new about the problem and only acknowledged it now so they didn't have to patch it for free. captcha revenues

  35. Re:Call it the Microsoft method by Gadget_Guy · · Score: 4, Insightful

    Windows ME got 6 years of support (Microsoft offers a minimum of 10 years of support for Business and Developer products). Mac OS 10.3 got 4 years of support (Apple don't have a defined policy for their life cycle, just a general rule that they offer support for the current and previous version). REHL will get 13 years of support.

    Two years of support for CS5 is not just "a *bit* quick" for such expensive, professional software. It is an insult.

  36. Re:Call it the Microsoft method by Grishnakh · · Score: 2

    Exactly. If people don't like this, they should find another vendor.

  37. Re:Call it the Microsoft method by rayharris · · Score: 3, Informative

    This is not support. This is fixing something that was broke in the first place.

    --
    I void warranties.
  38. Re:Call it the Microsoft method by acoustix · · Score: 5, Insightful

    MS security fixes are not "no cost".

    They just look cheaper on the surface, because the cost is amortized across BILLIONS of forced Windows licenses, instead of MILLIONS of Photoshop licenses.

    Three orders of magnitude is very large in real life.

    Does not compute. Windows XP has been around for a decade. XP will have received "free" updates for 12 years when support is finally dropped. On the other hand, Adobe Photoshop has had 8 major version releases during that time. According to Adobe's website site, 4 of those versions are no longer supported...and apparently we need to add another few versions to the list.

    Bitch about MS all you want, but their support of security fixes for Windows and Office has been excellent compared to companies like Adobe. If I were a Photoshop user I would have spent thousands of dollars to keep my version in support compared to the $200 that XP costs up front. And yes, it really isn't fair to compare OS support to application support.

    --
    "A plan fiendishly clever in its intricacies"- Homer Simpson
  39. Re:Call it the Microsoft method by Anonymous Coward · · Score: 5, Insightful

    You're not a programmer, are you?

    You certainly know nothing about how impossible it is to write "perfect" software.

  40. Re:Call it the Microsoft method by chipschap · · Score: 5, Insightful

    "Bitch about MS all you want, but their support of security fixes for Windows and Office has been excellent compared to companies like Adobe"

    I have to agree, MS has indeed patched XP for a long time. MS gets lots of practice in patching security holes but to their credit (I never thought I'd say that about MS!) they have not charged anything for it. I can't even complain about them dropping support for XP in 2014; they've carried it for a long, long time and that is pretty responsible behavior (given the very slow move away from XP). Neither did they need to provide patches to pirated versions, but they did that in the best interests of the worldwide computing community.

    IIRC Adobe is not the first to pull this "buy the new version" stunt.

  41. Re:Call it the Microsoft method by alices+ice · · Score: 2

    GIMP? ...lol

  42. Re:This is not new by couchslug · · Score: 4, Insightful

    "More importantly, if you bought CS5 for $2000 just three months ago, you have to pay to upgrade."

    Good reason not to pay for it in the first place.

    --
    "This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
  43. Re:Slight correction by Altieres+Rohr · · Score: 2

    Perhaps they did. Protek Research Lab says they reported apparently the same bug to Adobe in September 2011. They went public after six months with no fix.

    http://www.protekresearchlab.com/index.php?option=com_content&view=article&id=40&Itemid=40

  44. Again, hard to empathize by Un+pobre+guey · · Score: 2

    As I said before (received with the standard mockery and excuses), it's hard to empathize with Windows or Adobe users. You know you're buying a paid service. You know they're in it for the money. They aren't your friends or your Mommy or your guardian angel. You give them money, they give you a license to use their product for a while, with premium services at extra cost. It's all in the EULA. You did read it, didn't you?

  45. Re:Call it the Microsoft method by fuzzyfuzzyfungus · · Score: 4, Funny

    I'm pretty sure that Adobe doesn't have to plan security bugs... They just unlock the cages that they keep the Flash dev team in and let them use their keyboards for a few minutes.

  46. Re:obvious.... by Local+ID10T · · Score: 3, Insightful

    In a way, it is obvious...

    if old version has a problem
    and new version doesn't have (this particular) problem

    then solution = buy the new version.

    If it was the current release that was buggy, I would say they should put developers on a fix... If it is a flaw in an older version, that doesn't exist in the new version, then telling the customers to buy the current version is perfectly acceptable.

    If they were already in development on the new version when they found out about a flaw in the current version... then its a decision about how much developer time it will cost to create a fix for the old (current) version and whether that time could be put to better use working on the new version. I deal with those kind of questions all the time at work myself. They are not easy.

    --
    "You want to know how to help your kids? Leave them the fuck alone." -George Carlin
  47. Re:Call it the Microsoft method by gstrickler · · Score: 2

    $50/mo for 12-24 mos (until CS6.5/CS7 upgrade time) = $600-$1200, and you don't even have a license to use the software if you stop paying $50/mo.

    Nope, doesn't sound like a good deal to me.

    --
    make imaginary.friends COUNT=100 VISIBLE=false
  48. People pay for Photoshop? by bryan1945 · · Score: 3, Funny

    That's news.

    --
    Vote monkeys into Congress. They are cheaper and more trustworthy.
    1. Re:People pay for Photoshop? by L4t3r4lu5 · · Score: 2

      Businesses pay for Photoshop because home users (future employees) grow up using the pirated version at home. Adobe profits from piracy of Photoshop by home users.

      This factoid has been published in the press, and is attributed either to someone from Adobe, or to someone doing a study on the subject.

      --
      Finally had enough. Come see us over at https://soylentnews.org/
  49. Re:obvious.... by Ocker3 · · Score: 4, Insightful

    Yes, however many companies have sunk many thousands of dollars into testing and release of a new version of the software in their offices, Adobe taking this step may cost those organisations even more funds and cause increased internal stress. It's not only internal factors that must be considered, but also external ones. If you're not considering the impact on your customers of such a decision, you're ignoring a key stakeholder.

  50. Untrusted sources by mr_diags · · Score: 2

    "... exercise caution when opening files from unknown or untrusted sources."

    Untrusted sources, you mean like Adobe?

  51. Re:Call it the Microsoft method by dudpixel · · Score: 3, Informative

    So are you offering to pay $10K or more for this hypothetical near-perfect software?

    or will you pay $200 and accept that there may be bugs (and that the company will offer fixes for major security issues for x years) ?

    It all comes down to economics at some point.

    --
    This seemed like a reasonable sig at the time.
  52. Re:Slight correction by __aaltlg1547 · · Score: 4, Funny

    Photoshop 6 == Photoshop CS1, the CS is quite important here.

    And the CS stands for Compromised Security.

  53. Re:Call it the Microsoft method by drkim · · Score: 2

    It's not released "knowingly defective."

    With millions of lines of code they also can't test every possible application and error. What you're suggesting is that no OS could be released until there are no errors whatsoever. In this case, no OS would ever be released.

    An OS can't anticipate the future.

    A lot of patches and drivers have to be written after gold release, because of changes and new versions of hardware, new third-party software and apps, and new types of attacks.

  54. Re:Call it the Microsoft method by andymadigan · · Score: 2

    If they pirate, they'll certainly download VLC. VLC can play the DVD, with or without the Windows codec.

    --
    The right to protest the State is more sacred than the State.
  55. Re:Call it the Microsoft method by TapeCutter · · Score: 2

    you can't tell at the same time "it's impossible to write zero bug software" and "but I didn't know my software had bugs"

    Excuse me, I'm not sure if you are aware of it but your post has an identifyable bug, it contains an obvious strawman that your proof-reading appears to have missed. Can you please patch your original post and remove said strawman. Note, I don't want a new post, I want you to fix the original. I've donated to slashdot several times over the last decade to the tune of maybe $30 total, I know it's not a lot but nevertheless I didn't pay to see your bug ridden posts. /sarcasm

    --
    And did you exchange a walk on part in the war for a lead role in a cage? - Pink Floyd.
  56. Re:obvious.... by makomk · · Score: 5, Insightful

    Look at the release date of Adobe CS6. It was released on the 7th of May, basically just a few days ago. Now look at when the bug apparently reported to them - back in September of last year! It looks very much like Adobe have delayed fixing a serious security vulnerability until they could get away with charging users for the fix.

  57. I'm still using Photoshop 6 by dsmithhfx · · Score: 2

    And this seems to be a disincentive to "upgrade".

  58. Re:obvious.... by PortHaven · · Score: 2

    It's also a matter of time...

    CS5 was released in 2010, followed by CS5.5 in 2011. CS6 was just released in April.

    So to say the solution for a owner of Adobe's CS suites (which can run over a thousand dollars) is to upgrade to a newer version is kind of ridiculous.

    Say you just bought CS5.5 in February. Now you have to pay $550 to make your software safe? Or let's say you bought CS5 Master Collection back in March 2011.

    You now have to pay over $1,000 to upgrade a 14 month old program.

    SERIOUSLY

    Adobe please point shotgun at face and pull trigger again and again....FIRE YOU CEO!!!!

  59. Re:obvious.... by cundare · · Score: 2

    Yeah, it's "obvious" all right. If a company sells a defective product, it's liable to legal action in tort (and possible criminal or class action suit under various consumer-protection statutes) if that company refuses to repair or replace the defective merchandise. This is especially true if the defect is serious and capable of causing injury, as it is here. If you disagree, I have all sorts of stuff I'd like to sell you.