Slashdot Mirror
New Default: Mozilla Temporarily Disables Flash In Firefox
Trailrunner7 writes with news that "Mozilla has taken the unusual step of disabling by default all versions of Flash in Firefox." Two flaws that came to light from the recent document dump from Hacking Team could be used by an attacker to gain remote code execution. From Threatpost's article:
One of the flaws is in Action Script 3 while the other is in the BitMapData component of Flash. Exploits for these vulnerabilities were found in the data taken from HackingTeam in the attack disclosed last week. An exploit for one of the Flash vulnerabilities, the one in ActionScript 3, has been integrated into the Angler exploit kit already and there's a module for it in the Metasploit Framework, as well.
Reader Mickeycaskill adds a link to TechWeek Europe's article, which says these are the 37th and 38th flaws found in Flash so far this month, and that the development "is a blow for Flash after Alex Stamos, Facebook's new chief security officer, urged Adobe to set an 'end of life' date for the much-maligned software."
We need Flash because it is easy to block. You can remove a huge chunk of Web obnoxiousness by simply disabling/uninstalling Flash while not breaking the rest of the website. With HTML5, this won't be as straight-forward process.
ESPN, Bleacher report, Faebook, Hulu, steam trailers, pretty much every single news website, etc.
Arch Linux master race!
Depends on your definition of "useful".
A lot of people seem to complain about how tragic it would be if people could no longer access games.
Me, I'm of the opinion Flash has been a terrible security/privacy nightmare as long as it has existed and don't install it on my machines.
Flash is long overdue to be killed off.
Being the source of at least one security exploit every month for the last 15 years tells me it's a Steaming Heap of Innovative Technology, and always has been.
Lost at C:>. Found at C.
For Finnish people, YLE Areena is kind of important. That's the national public-broadcasting company's programme streaming website.
It's mostly on Facebook that I notice I've not got Flash installed. I especially like the way it tells me my technology is out of date.
Who ordered that?
Won't this just cause frustrated users to switch to Chrome or another browser, further further hurting Mozilla's market share? Recently I went to a flash web site, it didn't work, so I booted up Chrome.
Mozilla did block the then-latest version of Flash Player, 18.0.0.203, last night. Adobe released version 18.0.0.209 early today, which fixes this vulnerability and which Mozilla is not blocking. They didn't really block "all versions," they just blocked versions less than or equal to known vulnerable versions, which at that time happened to also include the then-latest version. Let's stop using misleading phrasing that will make people think they blocked any past, current, or hypothetical future version of the plugin.
R.Mo
Chrome can block popups, that Firefox lets through. This is because Flash is doing the popup, and Firefox does not catch the CreateWindow, but Chrome does. Firefox only intercepts the normal web window creates.
So at least for the moment, this fixes Firefox's crappy non-functioning popup blocker.
Likewise Chrome now runs Flash in a separate process, because Adobe are so inept they cannot be trusted not to leave lots of security bugs in their products. So Google wrapped it in a process wrapper, the same way people pick up dog poop in plastic bags because they don't want to get their hands dirty in that pile of shit.
Firefox should do the same!
Now if only Firefox could also fix their tendency to add unwanted 'cloud' features, we'd be fine!
Whack-a-mole with Flash continues this week with yet another zero day vulnerability with Flash being fixed. This is unsustainable. Time for Flash to really die.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
It's one of the 3 browsers I keep open all the time.
I don't give a damn about any of their new features. But it's the one which is set to not run any javascript ever or accept cookies and has the most locked down settings.
It's my "I don't trust you" browser.
Lost at C:>. Found at C.
People who want to use the best browser, that's who.
IE is trash of course, and Chrome, while it was a good option a while ago because FF was so buggy and Chrome was leaner and faster, today Chrome is a slow memory hog and FF has fixed most of its problems and runs much faster and with far less memory.
Some can, some can't. Flash is not installed on my machine, and I can see various videos without it, but some throw the "missing plugin" tile.
Flash has historically been used for vector-based multimedia. If, say, Strong Bad emails or French Erotic Film were converted to MP4 or WebM, they'd be ten times bigger (source: my tests) and thus count ten times more against your ISP's monthly cap. Sure, Adobe's newer tools can export .fla to HTML5, but those tools are available only for rental, and anything needing the .fla works only if the original author is still contactable.
It's not that Firefox disables flash behind your back: it displays a security warning in place of flash boxes, having a button to enable the plugin again. Also, it will only do it for versions of flash which are known to be vulnerable. This is quite a good thing IMHO: remaining within the nanny terminology, it's not a matter of how much grown up you are, if you have a vulnerable plugin, and you visit a compromised site, your machine will be owned.
Not seeing any hits on google for that one. Pale Moon?
https://www.palemoon.org/
Palaces, barricades, threats, meet promises
Except the OPs other example, Chrome, offers no workaround. Chrome removed all support for NPAPI, and therefore Java, from the Linux codebase. There is no command line flag or back-end setting to bring it back This makes it IMPOSSIBLE to use Chrome for work purposes by a huge number of people, and forced us all to Firefox.
The only way to get it back is to build it from source yourself, since no one has created a fork yet.
If you're (forced to!) run the outdated version of Flash in Firefox on Linux, now might be a good time to go to the tools menu > addons > plugins and set Shockwave Flash to "Ask to Activate". Then the plugin will stay disabled per default, but can be activated on a per-site basis.
Adobe: "You're on your own."
They give a reasoning in the FAQ:
"Yle Areenan videot toimivat edelleen Flash-soittimen avulla. Flash-soitinta käytämme siksi, että HTML5 standardi ei medioiden jakelussa tarjoa vielä sellaista suojausta, jota tekijänoikeuksien haltijat Yleltä vaativat. Vaatimukset tulevat sekä ohjelmantoimittajilta, että musiikin tekijänoikeusjärjestöiltä. Käyttöliittymätekniikkana HTML5 on käytössä, kuitenkin niin että palvelu on saavutettavissa myös vanhemmilla selaimilla."
Translation: "Yle Areena videos still utilize Flash player. Flash is used because the HTML5 standard does not provide sufficient content protection that the copyright holders expect from Yle when distributing media. These requirements come from both programme distributors and music copyright organizations. HTML5 is being used in the user interface, but in a fashion that older browsers are also supported."
Of course that information is now a bit obsolete, as these days HTML5 supports DRM as well.
MY forced HTML5 Youtube is still asking to activate flash for every video...
This may prove an excellent incentive for those websites to stop using such dangerous technologies.
I've had flash on "ask to activate" by default for a while now, and it wants to activate on almost every fucking website I visit. I don't see any flash elements on those pages. It's probably used solely for advertising by most sites.
But yeah, youtube don't need it anymore. You can still watch your cat vids.
Always read at -1, don't let others decide what you should and should not read.
My national broadcasters used Silverlight. This angered many people because of obvious reasons.
Max schadenfreude of course when MS pulled the plug on Silverlight
Always read at -1, don't let others decide what you should and should not read.
When Jobs made the decision to disallow Flash on the iPhone, there were no third-party apps. Period. There wasn't even a jailbreak, since he made the decision prior to the release of the original iPhone. So, his decision had nothing to do with the App Store, since it didn't exist.
FC Closer
Adobe should provide/sell tools that will enable people to convert their Flash content into the equivalent standards based browser supported formats. If they make it easy they will have created an essential web development tool in the process. If they stick with Flash they are just milking the dead horse.
Yes, that was the narrative at the time - 'they are taking away our freedom'. In hindsight, even though I probably would have heavily criticized Apple for the move, and would have pointed to it as a reason to choose Android, the reality of the situation was, at least in my experience, that Flash on Android was a rather shitty experience that never really worked that well. And while it seemed arrogant and annoying that Steve Jobs tried to use his sway to annihilate Flash as a platform, I now believe that it was for the best. Flash has a heavy impact on battery life, is generally a lot slower, and is generally less secure than native alternatives.
So, yes, Apple made a seemingly arrogant move and exiled Flash from the iOS platform, but in the long run this drove development toward alternatives and pushed web developers to use technologies that were more mobile friendly (like using HTML for your content instead of some flash application) and I think the overall net effect for the web community has been positive.
Ooops. Sorry to answer my own question, but after a bit of research (which I should have done before posing the question, I guess) I found the answer. It's at www.youtube.com/html5 I guess it just isn't the default yet.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
What Apple wanted was lock-in to their tool chain, so all interpreters were blocked from release for iOS. It's not about "forward looking" -- it's about being able to sell an Apple Mac to every single developer out there that wants to run their tool chain. Money, money, money. And more money.
I do not fail; I succeed at finding out what does not work.
I care about none of those things.
Oh well we dont need it then.
I seriously can't believe how self-involved and ignorant some people on here are. People like you are why the stereotype of anti-social, geek basement dwellers is proliferated, you define it.
Those don't even matter. PORN sites use Flash. QED.