Slashdot Mirror
New Default: Mozilla Temporarily Disables Flash In Firefox
Trailrunner7 writes with news that "Mozilla has taken the unusual step of disabling by default all versions of Flash in Firefox." Two flaws that came to light from the recent document dump from Hacking Team could be used by an attacker to gain remote code execution. From Threatpost's article:
One of the flaws is in Action Script 3 while the other is in the BitMapData component of Flash. Exploits for these vulnerabilities were found in the data taken from HackingTeam in the attack disclosed last week. An exploit for one of the Flash vulnerabilities, the one in ActionScript 3, has been integrated into the Angler exploit kit already and there's a module for it in the Metasploit Framework, as well.
Reader Mickeycaskill adds a link to TechWeek Europe's article, which says these are the 37th and 38th flaws found in Flash so far this month, and that the development "is a blow for Flash after Alex Stamos, Facebook's new chief security officer, urged Adobe to set an 'end of life' date for the much-maligned software."
We need Flash because it is easy to block. You can remove a huge chunk of Web obnoxiousness by simply disabling/uninstalling Flash while not breaking the rest of the website. With HTML5, this won't be as straight-forward process.
ESPN, Bleacher report, Faebook, Hulu, steam trailers, pretty much every single news website, etc.
Arch Linux master race!
It's mostly on Facebook that I notice I've not got Flash installed. I especially like the way it tells me my technology is out of date.
Who ordered that?
Won't this just cause frustrated users to switch to Chrome or another browser, further further hurting Mozilla's market share? Recently I went to a flash web site, it didn't work, so I booted up Chrome.
Mozilla did block the then-latest version of Flash Player, 18.0.0.203, last night. Adobe released version 18.0.0.209 early today, which fixes this vulnerability and which Mozilla is not blocking. They didn't really block "all versions," they just blocked versions less than or equal to known vulnerable versions, which at that time happened to also include the then-latest version. Let's stop using misleading phrasing that will make people think they blocked any past, current, or hypothetical future version of the plugin.
R.Mo
Chrome now runs Flash in a separate process, because Adobe are so inept they cannot be trusted not to leave lots of security bugs in their products. So Google wrapped it in a process wrapper [...] Firefox should do the same!
Firefox has been running Flash Player in plugin-container.exe for years.
It's one of the 3 browsers I keep open all the time.
I don't give a damn about any of their new features. But it's the one which is set to not run any javascript ever or accept cookies and has the most locked down settings.
It's my "I don't trust you" browser.
Lost at C:>. Found at C.
Not seeing any hits on google for that one. Pale Moon?
https://www.palemoon.org/
Palaces, barricades, threats, meet promises
They give a reasoning in the FAQ:
"Yle Areenan videot toimivat edelleen Flash-soittimen avulla. Flash-soitinta käytämme siksi, että HTML5 standardi ei medioiden jakelussa tarjoa vielä sellaista suojausta, jota tekijänoikeuksien haltijat Yleltä vaativat. Vaatimukset tulevat sekä ohjelmantoimittajilta, että musiikin tekijänoikeusjärjestöiltä. Käyttöliittymätekniikkana HTML5 on käytössä, kuitenkin niin että palvelu on saavutettavissa myös vanhemmilla selaimilla."
Translation: "Yle Areena videos still utilize Flash player. Flash is used because the HTML5 standard does not provide sufficient content protection that the copyright holders expect from Yle when distributing media. These requirements come from both programme distributors and music copyright organizations. HTML5 is being used in the user interface, but in a fashion that older browsers are also supported."
Of course that information is now a bit obsolete, as these days HTML5 supports DRM as well.
When Jobs made the decision to disallow Flash on the iPhone, there were no third-party apps. Period. There wasn't even a jailbreak, since he made the decision prior to the release of the original iPhone. So, his decision had nothing to do with the App Store, since it didn't exist.
FC Closer
Yes, that was the narrative at the time - 'they are taking away our freedom'. In hindsight, even though I probably would have heavily criticized Apple for the move, and would have pointed to it as a reason to choose Android, the reality of the situation was, at least in my experience, that Flash on Android was a rather shitty experience that never really worked that well. And while it seemed arrogant and annoying that Steve Jobs tried to use his sway to annihilate Flash as a platform, I now believe that it was for the best. Flash has a heavy impact on battery life, is generally a lot slower, and is generally less secure than native alternatives.
So, yes, Apple made a seemingly arrogant move and exiled Flash from the iOS platform, but in the long run this drove development toward alternatives and pushed web developers to use technologies that were more mobile friendly (like using HTML for your content instead of some flash application) and I think the overall net effect for the web community has been positive.
I care about none of those things.
Oh well we dont need it then.
I seriously can't believe how self-involved and ignorant some people on here are. People like you are why the stereotype of anti-social, geek basement dwellers is proliferated, you define it.