Slashdot Mirror
Adobe: Click-to-Play Would Have Avoided Flood of Java Zero-days
mask.of.sanity writes: Oracle could have saved mountains of cash and bad press if Click-to-Play was enabled before Java was hosed by an armada of zero day vulnerabilities, Adobe security boss Brad Arkin says. The simple fix introduced into browsers over the last year stopped the then zero day blitzkrieg in its tracks by forcing users to click a button to enable Java.
how's them apples?
Copyright (c) 1990 - 2014 Dice. All rights reserved. Use of this comment is subject to certain Terms and Conditions.
Adobe isn't exactly in the best position to be lobbing stones at others' houses of security.
...is such a beautiful thing.
Click-to-Play makes flash videos better by making them less useful as advertisements. Content like Flash and Java should always, always require the user's consent before running. There's no excuse for doing otherwise. Any code that doesn't await the user's consent before running is malware, and should be handled as such by any means available.
I write sci-fi for metalheads
The same could be said for any external plugins, AND internal javascript.
Sure, a minority block it, but JS still gets blocked by people because of stupid shit like popup spam, tracking and other such things.
Websites can even prevent you from using the god damn keyboard, who the fuck thought that was a good idea?
Luckily the MouseLock feature added recently very specifically asks for permission to lock your mouse, and there is an escape key if I remember correct.
Now if only they'd do the damn same for popups and keyboard hooks. (or very specifically prevent some keys from being blocked from bubbling up to the OS level)
Quite frankly, Pause button should halt any JS execution period, in fact it should completely halt an entire tabs processing.
It is about damn time this button got a use outside of a few small programs!
Do you really think I'm going to click on that link?
Yes. Not automatically running untrusted code is MUCH MORE secure than just sticking your fingers in your ears and assuming the problem will be handled.
Modern webpages are a rats nest of external scripts coming from who knows where. Browsers should not be enablers of this.
A Pirate and a Puritan look the same on a balance sheet.
Is there a reason not to link to the SMBC comic, itself?
http://www.smbc-comics.com/?id=3497#comic
Comment removed based on user account deletion
Comment removed based on user account deletion
Konqueror already had this when I started using it in 2006.
When was the last time you wanted to run a Java applet?
Your point is false. Just because they don't implement decent security doesn't mean they have staff that don't know about the subject. Flash is not Adobe's fault, it's Macromedia's mess. Adobe just wanted additional tools to add to their content creation arsenal, the product was complete enough as far as decision makers were concerned and not worth the cost of reengineering.
We need to prevent all the clueless users from infecting themselfs with JAVA.
Are these enough to at least protect Firefox from JAVA,
plugin.scan.SunJRE;99
security.enable_java;false
(Captcha: liberty)
even if the flash vulnerabilities were imaginary the acrobat ones are for sure very real !
Maybe, and I mean this as a real MAYBE, they learned something from those vulnerabilities...
Hmm, the humour and sarcasm seem to have been be lost on you.
No, those were just Photoshopped in.
Flash is not Adobe's fault, it's Macromedia's mess
By buying Macromedia, they by default are a party to the blame. If they wanted, they could re-write the whole plugin; nah too much work...
Good call. From the URL that looks like an ad-wrapper around imgur, so tried punching the same ID into imgur itself, and voila!.
So if you don't enable Java, you avoid the Java exploit, that's the security model you're bragging about. Ok.
Obvious statement from Adobe after years of observation. Ignores the fact that the early attitudes were that software components should run seamlessly without the user noticing that the web page was composed of different components.
Click to Play is great for the public web but it is important to remember that there is a huge darknet of private intranet sites as well. Click to play breaks a lot of Java intranet applications that assumed that the applet would load at page load time without any user interaction.
I hate the powers that be who decided to get paid for advertising by infesting the world with malware. No doubt some people are making money and others are losing it in huge quantities.
a zero day vulnerability http://en.wikipedia.org/wiki/Z... does not become less zero dayish because you need to click to execute it. This is some executive who has misunderstood what his underlings actually do, and what they mean when they say they are dealing with a zero day issue.
He ends up being right, for all the wrong reasons, and he is just saying words he doesn't fully comprehend.
The reality of the Java situation is that it's not just consumers hosing their machine by visiting a website hosting an exploit. There are tons and tons of crappy internal Java applications running in businesses everywhere. A lot of them are poorly documented, or the developer isn't there anymore, or the consulting company who wrote it wants a million bucks every time you want a change. Like it or not, Java is the language of large business...I'm sure we're going to be talking about J2EE in 40 years the same way we talk about COBOL. Most of the "mainframe modernization projects" large businesses go through consist of hiring the lowest-bidder consulting body shop to rewrite all the business logic in J2EE running on WebSphere or WebLogic. The consulting shop chooses Java because they can get a bunch of fresh CS grads who have exposure to the language, and it's reasonably portable.
I deal with this all the time. Java introduced the "expiration date" in version 1.7, and it took them months to add in a very poorly documented way to disable the dire warnings that our users get when running internal code. Microsoft made it worse by expiring the Java ActiveX controls that weren't on the absolute latest versions as of August. At least they provided a policy to shut it off right from the start.
So what was your reason for not linking to it?
Enough said ...
Fixing bugs is possible: browser makers are confident enough in their complicated two-tiered JavaScript JIT engines to run them without click-to-play, so why not Java? The reason is that Oracle had a "better" solution: "pay-to-play". Developers now need to purchase a commercial certificate to deploy applets that run without going through hoops, even for unsigned applets that are already security-constrained. In other words, Oracle chose to milk whatever's left of Java Applets for money until it dies.
Lilith is right. Auto-play shouldn't exist. With rare exceptions when a video auto-plays on a page, I hit Cmd-W on my Mac to move to another page, not reading what's on that one. And on the occasions when I feel I need to read the article, I turn off the sound, scroll the video out of sight, and make a point of not watching it. The advertiser's schemes come to naught.
My other gripe is when that Flash video asks permission to get information about me. I click 'dismiss' twice and it it still refuses to move on, that page gets the Cmd-W treatment too.
if only i could click through the full screen automatic overlay ads on top of the applet i'm trying to run...
Yeh right, then all the security problems with Acrobat reader plugin were my imagination!!
I still don't understand why a READ-ONLY print format needs a programming language and interactivity (hint: it doesn't! and that is why almost all other pdf reader ignore that)
Higuita
Yes laziness
Apparently the SMBC site doesn't tag it's comics well enough for google to find them or put them anywhere near the top of it's rankings
Only so much effort that I am willing to make to point out the ridiculousness of this story. There are still corporate intraweb sites running on IE 6 because developers and users just didn't give a crap. Users of course are the ultimate culprits and will turn off security settings faster than you can say i can haz cheezburger. Enabling click to play isn't even a speedbump.
Click to play is only small roadblock, its no different then click to install and we all know how well that roadblock has worked. Users must be far better educated "Nothing is safe" should be the theme of the internet and all computer programs. And we cant count on Microsoft or Adobe or Google to tell us the truth. And each of theses have been fined triple digit millions of dollars for breaking the customers trust or in one way or another.
Jack of all trades,master of none
Flash and Java are inherently more insecure than JavaScript.
In what sense do you mean "inherently"? Do you mean that it would be theoretically impossible to interpret .swf and .jar files in JavaScript? The existence of a PC emulator written in JavaScript defeats that. So you must mean "inherently" in another sense.
Running arbitrary code on a user's computer using JavaScript is rather difficult on any modern browser.
What "inherent" advantage of JavaScript over SWF and JVM makes this the case?
Also, JavaScript is very widely adopted and a core function in today's web design whereas Flash and Java are slowly being phased out from web applications.
How would one go about phasing Flash out of, say, Newgrounds or Albino Blacksheep or Weebl's Stuff?
When I visit the NetAlyzr site.
They should really dump Java and update to Flash (or even HTML5 if possible).
... update to Flash ...
Does not compute.
And after all that, the original source is http://www.smbc-comics.com/?id... (don't forget to click the red button).