Slashdot Mirror
Adobe Releases Sandboxed Flash Player For Firefox
Trailrunner7 writes "Adobe has released a new version of their Flash player that now gives Firefox users the additional security of a sandbox and also includes a background update mechanism for Mac users. Flash has run in a sandbox on Google Chrome and Internet Explorer for some time already. The big security news in Flash player 11.3 is the addition of the protected mode sandbox for Firefox on Windows. That's a major change for Adobe, which has been adding sandbox to its main product lines for a couple of years now. Adobe Reader X has run in protected mode — which is what Adobe calls its sandbox — since its release, and the company also added a sandbox to Flash on Google Chrome. The sandbox is designed to prevent attackers from using vulnerabilities in Flash to break out of the application and move to other apps or the OS itself."
How about they release a new 64bit version for Linux? The colour in YT videos is totally messed up on my Ubuntu box
adobe hates linux.
I thought adobe was abandoning flash.
To offset political mods, replace Flamebait with Insightful.
I'm not sure if you recall, but Flash for linux is discontinued unless you're using the bundled Chrome version (http://www.osnews.com/story/25639). In light of that I've given up on the idea of them fixing any major bugs for that platform.
This really solidifies Flash as the web container of choice and knocks HTML 5 for six!
Gotta be a sad day if you're an IOS user.
So, now i could use my little pity Firefox without crashing my little Windows 7 x64 bit??? We will see.....
I guess someone will have to get Gnash to work. Or something.
I upgraded from the old Flash when youtube stopped supporting it, and the new Flash runs very poorly on my 1/2 gigabyte PC. It slowsdown Firefox 10 LTS and makes the non-google Chromium randomly freeze for 1-2 minutes (until a popup asks if I want to kill flash).
My AC stalker: " I personally agree with your posts most of the time, but that won't keep me from modding you troll"
I've personally found the best way to sandbox Flash is to not install it.
I honestly can't name a single site that I care about that uses it -- possibly because Flash makes me immediately not care about a web site. I know some people really like it, and it does things they really think is cool, but to me it's been something I've avoided for a long time now.
But, who knows, maybe next week I'll discover something I can't live without that uses it.
Lost at C:>. Found at C.
http://youtube.com/html5
"You might as well get your son a ticket to hell as give him a five string banjo." -unknown minister
It's funny that there are virturally no comments for this article as Adobe
has long been replaced by much safer, reliable ways of viewing content.
CAPTCHA = corridor
FF has vastly improved since the bloayed 4 release but I still wont touch it until the whole thing is sand boxed. Even IE is sandboxed with aslr and other enhancements. Flash scares me and until FF catches up to IE and Chrome I wont use it. Ajax or any code executing without any sandboxing is a nightmare.
Just use dwhelper and mplayer.
Give me Classic Slashdot or give me death!
I can only imagine how tough it would be to be a developer on the Flash team. Would you even want that on your resume? I'm not sure I would want to be associated with one of the most hated, least trusted applications out there. I'm guessing that when people find out you work on Flash, you would be constantly forced to defend Adobe and the Flash team or admit that you were part of a huge failure.
I still need Flash because one or two sites I visit use it as a major vehicle for content (e.g. Homestuck).
So, where's a nice, safer sandbox for the platforms I use?
*Technically* it's discontinued until Firefox and the other browser writers support the Pepper API.
At https://www.adobe.com/software/flash/about/ (which tells you what flash version you have and what are the latest), it says that the latest for linux is 11.3.300.257. However the "player download center" link on this page goes to http://get.adobe.com/flashplayer/ and that the latest version is 11.2.202.236 (and that 11.2 will be the last for linux). I'm running 64 bit fedora 17, so that might be the wrinkle.
Like a good neighbor, fsck is there
They won't. And I assume you're using the nvidia binary driver. In that case, the only known solution is installing a patched version of libvdpau or disabling the hardware accelerated rendering.
Disable hardware acceleration (I had that problem with an Arch Linux box, x86-64, using the nvidia propietary drivers)
I was under the impression that it wouldn't even be available for Chromium Browser, which implements the same Pepper API as Google Chrome. According to Adobe's blog, not only will Flash Player "only be available via the 'Pepper' API", but the Pepper version will be distributed "as part of the Google Chrome browser distribution and will no longer be available as a direct download from Adobe". So even if you have another browser that implements Pepper, it still won't be able to run Flash Player for Pepper because Flash Player for Pepper is exclusive to Google Chrome.
Just use dwhelper and mplayer.
There are uses of Flash Player other than to stream video. How well does this combination that you recommend work for Flash vector animations and Flash games?
This forces HTML5 forever, and it seems to work with just about any video.
Does it work even with videos that have advertisements? This includes videos posted by Partners and videos that comment on a particular piece of commercial recorded music.
Ditto, 'cept I was using Windows. Adobe can't do hardware acceleration right.
Adobe on the other hand...
Does User Account Control have to be enabled for the low integrity process stuff to work?
Just in case anyone is interested, the best patch I've seen is http://lists.freedesktop.org/archives/vdpau/2012-May/000022.html
You need to apply it to the current git head for libvdpau, not just version 0.4.1, which is behind one commit... http://cgit.freedesktop.org/~aplattner/libvdpau/diff/?id=4262513e67c3572ed19bd796ec6180cdde7ccb7e&id2=c4a2273edb161c2e3c7847a91db4aa514c073fe3
Finally make sure the cfg file the patch makes is put in /etc/vdpau_wrapper.cfg
I was hoping that a'duebe would compile a 64 bit debug version for Linux. I guess it's hard, for them, to do. But maybe it's because they're getting so much love from Apple?
who still uses Linux?
I do.
I want a small lightweight laptop, with a full keyboard (dedicated delete / backspace / pg up/ pg dn / home / end / INSert / PrtScreen / etc. keys!). So I have had Thinkpads X... machines for the last 10 years or so. (X31, X200s).
And I also want access to a Real Terminal with a Real Shell. So I install Linux on that Thinkpad, and a couple of WinXP virtual machines for a few special apps that only run on Windows.
I recommend their authors port their work to a non-proprietary format
I agree with you in principle. However:
I thought since Adobe changed its SWF spec licensing policy years ago as part of the Open Screen Project, SWF was a non-proprietary format. And even if not, what solution do you recommend for an author to convert something like Homestar Runner or Weebl and Bob to a non-proprietary format? And what techniques should I use to convince authors to do so?
From Adobe's news release:
[Emphasis added]
The restrictions we apply to this sandboxed process come from the Windows OS. Windows Vista and Windows 7 provide the tools necessary to properly sandbox a process. For the Adobe Reader and Acrobat sandbox implementation introduced in 2010, Adobe spent significant engineering effort trying to approximate those same controls on Windows XP. Today, with Windows 8 just around the corner and Windows XP usage rapidly decreasing, it did not make sense for the Flash Player team to make that same engineering investment for Windows XP. Therefore, we've focused on making Protected Mode for Firefox available on Windows Vista and later.
What one fool can do, another can. (Ancient Simian Proverb)
Let me guess, anything red is turned into a blue-ish color?
I think a downgrade is in your future
Load a youtube video, right click, select "Settings", go to the leftmost tab, de-select "Enable Hardware Acceleration". Voila, colours are back to normal.
If you want whole applications sandboxed, give sandboxie a shot.
http://soylentnews.org/~tibman
They just released an update today. flash-plugin-11.2.202.236-release.x86_64 is available to download from their website.
Adobe changed its SWF spec licensing policy years ago as part of the Open Screen Project
If there's anything actually worthwhile locked up in flash, someone will reverse engineer it and create a flash emulator
And the Open Screen Project makes it that much easier to make a Flash Player emulator like Smokescreen, which we discussed two years ago.
Do you mean faces look blue? Try going into the flash settings and disable the hardware acceleration. But I saw there was a release of flash 11.2.202.236 recently so maybe that's fixed now.
One wonders if Adobe will revisit that decision if Mozilla changes their minds. Bet you they would.
Hail Eris, full of mischief...
E pluribus sanguinem
They did release a small build update for v11.2, but that's it. I guess non-Chrome users are screwed like me. :(
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
You have Flashblock, Better Privacy, and downloaders that are all tied to Flash. Does this new version bypass any of those add-ons?
It's called FlashBlock.
#DeleteChrome
I thought a new feature for 11.2 was autoupdate in the background. Did not work for 11.3.
Why wouldn't you properly sandbox your browsers to begin with. Aren't you a geek?
Change is certain; progress is not obligatory.
They had an exceptionally poor developer on linux, so it's unlikely you'll see anything more on that front.
It took a while, but I finally located the Sandbox Flash for Firefox and updated my Firefox.
Now I have no flash on Wired, I have no flash on Youtube, I have no flash on my forums.
Thanks a lot, Adobe, you useless shits.
So i'm running sandboxed flash inside a sandboxie'd firefox? Sounds good to me.
Now i just need to run sandboxie inside a different sandbox and i'll be set.
I just got the latest Flash update, and the process to get to the license was so horrific that I have sent it off to the lawyers to go through it with a fine comb - I really don't trust any organisation that makes it so hard to find the terms you agree to.
When you receive the update and you want to see the license you have to:-
1 - click a link which leads you to an external page. The relevant license is not embedded in the package you download, so there is a risk of disconnect between product and license.
2 - find the product, because the page you land on is an Adobe page with EVERY PRODUCT LICENSE EVER WRITTEN. Sure, it has a hash link which may land you in the right spot, but that's not where the tortuous journey ends
3 - identify the right version for the software as every version comes with its own license
4 - find your own language in the PDF you get, because Adobe produces one massive file with the license translated in all languages of the planet. I'm not sure if the index is enabled in Adobe Reader (I don't use it), but the reader I used the index was off. Adobe has sorted the languages alphabetically, but spelled in English (so Deutsch - which comes before English alphabetically - would actually be found as "German"). This means, the first thing you see when you open the PDF is Arabic.
As far as I am aware there is actually a serious issue with making it so hard to find what you agree to - it may render their license invalid in a number of countries.
Whatever the legality, the first thing that you get when you have to do this sort of digging is a feeling they really, really do not want you to look at it - i.e. you become suspicious. I actually hope the lawyers find something objectionable..
Insert
Do not feed the trolls.
FCKGW 09F9 42
I'm using 32-bit Win7, not 64-bit. (Ask my work IT department why; it's not my choice.) I've got 4GB of RAM. It won't let me set more than 4GB of swap space, even if I use multiple partitions. It's really annoying.
And as far as the person who asked about Firefox memory goes, I've usually got 50-100 tabs open, with usually about 1GB of Firefox and 1/4-1/3 as much plugin-container, which works just fine 90% of the time, though it occasionally wants to spin disks for a while, or crash.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks