SoylentNews is people
SoylentNews
A ComputerWorld story explains that Mozilla has taken the unusual step of blocking all Flash after the announcement of the third 'zero-day' vulnerability in the last few days. It is possible to override the block by user selection for a single flash link or for all links. The block is in force even if Flash player has been updated since the first vulnerability was announced.
Mozilla on Monday began blocking all versions of Adobe Flash Player from running automatically in its Firefox browser, reacting to news of even more zero-day vulnerabilities unearthed in a massive document cache pilfered from the Italian Hacking Team surveillance firm.
Mozilla engineers swung into action over the weekend after reports surfaced late Friday of another Flash zero-day -- the term that describes a flaw for which there is yet no fix, or patch -- discovered in the gigabytes of data and documents stolen from the Hacking Team. At the time, the bug was the second in Flash spotted in just five days.
After reading the block warning, Firefox users can still run Flash content by authorizing the plug-in's operation. Since then a third Flash zero-day has cropped up.
Neither the second or the third vulnerability had been patched by Adobe as of late Monday, although the company has promised to do so this week.
(Score: 3, Informative) by Anonymous Coward on Tuesday July 14 2015, @07:52PM
The latest version is allowed. The version that came out today that fixes those bugs.
Given that set it to only load when you allow it. Either thru the use of a plugin or ask to activate.
Be careful the flash installer switches 'ask to activate' back to always in firefox.
(Score: -1, Troll) by Anonymous Coward on Tuesday July 14 2015, @08:14PM
Who gives a fucking fuck? Mozilla is for dinosaurs, gramps.
(Score: 1) by mucsdnop on Tuesday July 14 2015, @08:51PM
I can see someone has high hopes for the Microsoft Edge browser.
(Score: 2) by Nerdfest on Tuesday July 14 2015, @08:54PM
It's a great name though. Heck, even though using IE were living on the edge for years.
(Score: 0) by Anonymous Coward on Tuesday July 14 2015, @09:40PM
I'm edgy, dude! Old folks can't touch me. I'll cut ya!
(Score: 3, Informative) by Pino P on Wednesday July 15 2015, @02:22AM
The version that came out today that fixes those bugs.
No version of Flash Player for Linux came out today. Only Flash Player for Windows, Flash Player for OS X, and Flash Player for Google Chrome were updated. I just did sudo apt-get install --reinstall flashplugin-installer five minutes ago, and it's still on the vulnerable 11.2.202.481. The security bulletin [adobe.com] states: "Adobe will provide an update for Flash Player for Linux during the week of July 12. The update will be available by visiting the Adobe Flash Player Download Center. Please continue to monitor the PSIRT blog for updates."
(Score: 0) by Anonymous Coward on Wednesday July 15 2015, @04:21PM
http://www.phoronix.com/scan.php?page=news_item&px=Adobe-Flash-Hacking-Team [phoronix.com]
You only had to wait 1 day for something you probably should disable most of the time anyway....
(Score: 2) by captain normal on Wednesday July 15 2015, @06:03AM
It is not only Mozilla. Same thing with chromium browsers (chrome and dragon).
The Musk/Trump interview appears to have been hacked, but not a DDOS hack...more like A Distributed Denial of Reality.
(Score: 4, Informative) by K_benzoate on Tuesday July 14 2015, @08:49PM
There are few sites anymore that hard-fail when Flash isn't available, and you can always temporarily re-enable it for those. I don't even have Flash installed anymore. Video loads fine with HTML5 players, and all the other "functionality" that Flash provides is related to tracking and serving ads--which are anti-features. Flash is a nightmare from a privacy standpoint. Just having it installed is a liability and a burden. You have to have a special plugin [mozilla.org] just to block malicious, persistent, Flash LSOs (cookies).
To hell with Flash.
Climate change is real and primarily caused by human activity.
(Score: 3, Informative) by WillR on Tuesday July 14 2015, @09:24PM
About Flash: Another Flash 0-day? Must be a day that ends in Y again.
Or about Mozilla: I guess blocking all versions of the Flash plugin is an easier way to kill it off than making YouTube's HD HTML5 player work without dorking around in about:config.
decisions, decisions...
(Score: 0) by Anonymous Coward on Wednesday July 15 2015, @04:16AM
Adobe are the conflicted ones, always have been.
10,000 credits for Photoshop (at least up to version CS5)
-1.0 x 10^2^16 credits for PDF and its spyware reader and ongoing security issues
-1.0 x 10^2^googol credits for Flash in all it forms
So in the balance of the equation, Adobe is going to Hell, a giant hole of boiling lava should already have opened up under their HQ - seems overdue.
(Score: 2) by panachocala on Tuesday July 14 2015, @10:48PM
I wish Firefox devs would consider that some of us already block Flash by default. Therefore when they hardcode another block in Firefox, it takes a while to figure out how to disable it. It's redundant redundancy. Also, if someone would tell pogo.com to stop rejecting out of date Flash versions that would be great. Basically they're saying: we won't let you run your version of Flash because we may pose a security risk to you. Pout.
Flash is bad for security okay we get it - but it's manageable with Flashblock. The intentional breakage 'for your own good' is what really fucks everyone over.
(Score: 2) by hash14 on Tuesday July 14 2015, @11:24PM
What service does Mozilla use to update which versions that are out of date? Is it possible to block it?
(Score: 2) by wantkitteh on Wednesday July 15 2015, @08:44AM
While I agree that forcing a blockage on Flash may be inconvenient for some, I would have thought it's fairly obvious that this is an emergency move. The whole point of something being defined as an emergency is that you simply don't have the tools and resources at hand to fix the issue gracefully. So they clobbered Flash - between a few million people being at major risk of being cracked and a few thousand people moaning that they already blocked something, it's not hard to see which is better for society. I can't say I'm thrilled about they way they did it either, would have been nice if they'd told anyone about it - explains why I've been having such major problems firing up Twitch streams for the last few days.
(Score: 3, Interesting) by hash14 on Tuesday July 14 2015, @11:22PM
I can't see a single benefit that Adobe gets from keeping the wraps on this product. Hackers are running in circles around them, exploiting one vulnerability after another. These exploits are made known after one small-time hacking organization has been exposed - how many zero-days do you think other organizations have, including those of oppressive (and well-funded) governments? And this is for a platform that's dying, so there's absolutely no chance that they intend to expand on it, so it's not like they would be losing any future investment opportunity.
Adobe keeping this product closed source and under their abysmally poor stewardship is harmful for the entire internet community and everyone who uses it. Understood that open sourcing Flash would breathe more life into it as people would actually work on it to improve it and fix its issues, and also that open source doesn't automatically provide 100% security. But the alternative is to leave everyone on the internet at a much greater risk. Of course, knowing Adobe, that's probably of very little consequence to them.
And the best part is that this whole circus is going to start all over with the Web DRM module that they're supposed to provide. It will be a major shitstorm, but it's primarily going to affect censorship promoters, so I won't be all that upset to watch it happen.
(Score: 4, Insightful) by jmorris on Wednesday July 15 2015, @12:40AM
If they dumped the source out, how many zero day exploits do you think would be found in the first week? The code is obviously a roach motel and has been for years. Sure, a year later it would probably be fairly safe but who would get the hit to their reputation? Adobe. No, better to just bury their mistake and hope everyone eventually just forgets.
And probably better for the net too, an open sourced Flash Player would run the risk of extend the life of Adobe's content creation tools and all of those are closed and none run on Linux. So everyone who likes Free Software should want to see the day Flash dies.
(Score: 4, Insightful) by Grishnakh on Wednesday July 15 2015, @01:41AM
Why would open sourcing it fix anything at all? You seem to be assuming a bunch of top-notch programmers are going to take it upon themselves to do security audits of Adobe's code, for free. Why would they do that? Anyone who was really interested in volunteering for such a project would already be working on Gnash, but look how dead that project is.
It's simple: FOSS programmers don't want to waste their time with a dying technology, which is what Flash is. This doesn't mean that people aren't willing to work on projects for free, but Flash just isn't one of them.
The only fix for this problem is for the browsers to all block Flash, so that stupid website operators who still use it are forced to fix their sites. In this age of HTML5, there is simply no reason at all to use Flash.
(Score: 1) by Pino P on Wednesday July 15 2015, @02:25AM
The only fix for this problem is for the browsers to all block Flash, so that stupid website operators who still use it are forced to fix their sites.
How would (say) Newgrounds go about fixing its site?
In this age of HTML5, there is simply no reason at all to use Flash.
With one exception: to play legacy SWFs that don't work well in Shumway, Mozilla's Flash Player clone written in JavaScript.
(Score: 2) by Grishnakh on Thursday July 16 2015, @01:44AM
I'm not sure what to tell your about Newsgrounds, other than that they need to fix their site (assuming you're talking about "newsgrounds.com"). I just went there and got a blank page.
Of course, if their page is powered by Flash, I'm using the latest Firefox which blocks it, so that would explain it. But again, that's their problem. Basing your whole web business on some bloated, bug-filled, proprietary POS instead of regular HTML is a recipe for disaster.
(Score: 1) by Pino P on Thursday July 16 2015, @07:40PM
That's Newgrounds [newgrounds.com] (one S), not Newsgrounds (two S's). It's like YouTube, except for SWF vector animations and games instead of pixel-based video.
(Score: 0) by Anonymous Coward on Wednesday July 15 2015, @03:24AM
Isn't that "strength" basically the sole reason for using anything open source? Are you saying that "many eyes" line people always use to explain how open source is infinitely superior to everything is a li?
(Score: 0) by Anonymous Coward on Wednesday July 15 2015, @10:10AM
No. Richard M. Stallman uses a GNU/Linux operating system, [stallman.org] but I'm pretty sure the reason that he does is not that so many people look for bugs in the Linux kernel.
(Score: 0) by Anonymous Coward on Wednesday July 15 2015, @03:43AM
Many years ago I had to deal with a developer from Adobe. He was pretty obnoxious and was convinced that Adobe was better at programming than any other company. I got the distinct impression that he wasn't the only one at Adobe that felt that way. I doubt they could imagine that things could be better with someone else helping out.
(Score: 3, Insightful) by twistedcubic on Wednesday July 15 2015, @04:18AM
I'd rather see Flash die. Is it good for anything?
(Score: 2) by halcyon1234 on Wednesday July 15 2015, @03:50AM
I love that this block comes from Mozilla. The company that made the decision to remove Click-to-Play. The company that based that decision on an INDEPTH user study utilizing a huge, diverse user base.
Sorry, make that 16 diverse users.
Sorry, make that 16 INTERNAL users.
The most advanced of which got confused as to "where is grumpy cat".
Including users who said, and I quote, "...I feel those are unnecessary steps for me to take. I do not understand why Firefox is asking me to activate Flash or not. Is using Flash on a site going to add a virus to my computer, slow it down or in some way make my experience less with it than without it?".
And no, I'm not kidding about any of this [mozilla.org]
Yes, Mozilla. Yes Flash is going to add a virus to your computer, slow down your computer, and make your experience less (sic). Good jorb keeping that Flash player active and autoloading on every random site a user goes to!
Original Submission [thedailywtf.com]
(Score: 2) by WillR on Wednesday July 15 2015, @01:27PM
Go to about:plugins. Change Flash from "Always activate" to "Ask to activate". Consult a doctor if your rage-boner persists more than four hours.
(Score: 2) by halcyon1234 on Wednesday July 15 2015, @02:33PM
Original Submission [thedailywtf.com]