12 replies to this topic

[+Mephistopheles]

Adobe adds Flash sandboxing to Firefox
Hackers bypass it in 3, 2…

Adobe has released beta code for sandboxing its heavily hacked Flash code within Firefox, in a similar fashion to the Chrome security protections added to its Reader software and Google’s Chrome browser.

“Sandboxing technology has proven very effective in protecting users by increasing the cost and complexity of authoring effective exploits,” said Peleus Uhley, senior security researcher for Adobe in a blog post.

“For example, since its launch in November 2010, we have not seen a single successful exploit in the wild against Adobe Reader X. We hope to see similar results with the Flash Player sandbox for Firefox once the final version is released later this year.”

Adobe used elements of the sandboxing technology Google had built into Chrome for its Reader code, after a string of attacks against the popular Flash platform. The technology was released on November 2010 – and promptly broken less than two months later by a Google engineer, although Adobe said this didn't count as it couldn't be done remotely. The code has also been added to Chrome, and Adobe promised other browsers would get similar protections.

The code will work with Firefox 4.0 or later versions running on Windows 7 or Vista. More details will be given in Uhley’s talk at the CanSecWest security conference in Vancouver, British Columbia, early next month.

Source: The Register

[+CPressland]

More security is a great thing, it's just a shame that when it comes to Adobe it means a 10-Point performance hit because of messy code!!

[Aethec]

It's sad that Adobe has to do it since they know Mozilla never will.

[MiukuMac]

Sad that people still feel they have to use Flash. Thankfully pretty much every place I care in the slightest about has already switched away.

[+c3ntury]

Aethec, on 07 February 2012 - 16:12, said:

It's sad that Adobe has to do it since they know Mozilla never will.

What makes you think Mozilla wouldn't implement such a thing? I'd say Adobe need to do it themselves because Flash is a mess when it comes to security at this point.

[DARKFiB3R]

Shame it won't stop it being a horrendous pile of ****.

[The_Decryptor]

c3ntury, on 07 February 2012 - 16:15, said:

What makes you think Mozilla wouldn't implement such a thing? I'd say Adobe need to do it themselves because Flash is a mess when it comes to security at this point.

It depends on how you implement the sandboxing, the mode Windows offers would break Flash and Java (Which is why Mozilla haven't implemented it). Google seems to have written their own sandboxing code which is why it works with Flash (because it's designed to simply, it allows it to break out of the sandbox when needed, while an OS provided sandbox would be stricter, etc.)

[+Boz]

MiukuMac, on 07 February 2012 - 16:15, said:

Sad that people still feel they have to use Flash. Thankfully pretty much every place I care in the slightest about has already switched away.

It's sad that people feel that they don't have to use Flash to avoid the clusterf*** of web standards and growing disparity between browsers and the fact that it gives us things you would have never had on the web. The ignorance among people is astounding. But I guess people will hate when they are being told to hate. No way around it.

[threetonesun]

Boz, on 10 February 2012 - 12:32, said:

It's sad that people feel that they don't have to use Flash to avoid the clusterf*** of web standards and growing disparity between browsers and the fact that it gives us things you would have never had on the web. The ignorance among people is astounding. But I guess people will hate when they are being told to hate. No way around it.

But, installing Flash always was the disparity. IMO, had Flash begun like Adobe Air (that is, a download and run anywhere piece of external software), it wouldn't have taken such a hit when Apple decided not to support it. It was the fact that Jobs said it couldn't run on iOS that made everyone else say, "oh, maybe we don't really need Flash." On the other hand, had it been a stand alone application that didn't require browser buy in, it could have taken a huge lead in early mobile development by porting Air over to iOS and Android (and anything else).

[Kirkburn]

Boz, on 10 February 2012 - 12:32, said:

growing disparity between browsers

Huh? I know this is going a bit off topic, but the disparity has almost entirely been between IE and [the others] for about ten years. Since IE is catching up with the others, I really fail to see a 'growing' disparity. Sure there's differences between Webkit and Gecko for example (and there's some concern in CSS circles about that), but they're not so extreme as pretty much [everything] to IE6/7.

[Pink Floyd]

Unfortunatly, still too many websites still use flash. Adobe decided to leave mobile flash dev a couple of months ago, they should do the same with all flash dev eh

[_Heracles]

Adobe Flash is rock solid now. It outperforms IE9 HTML5 h264 performance on netbooks by my testing.

Kirkburn, on 10 February 2012 - 17:06, said:

Huh? I know this is going a bit off topic, but the disparity has almost entirely been between IE and [the others] for about ten years. Since IE is catching up with the others, I really fail to see a 'growing' disparity. Sure there's differences between Webkit and Gecko for example (and there's some concern in CSS circles about that), but they're not so extreme as pretty much [everything] to IE6/7.

Everyone is adapting to Webkit now.

[+Boz]

_Heracles, on 10 February 2012 - 22:13, said:

Adobe Flash is rock solid now. It outperforms IE9 HTML5 h264 performance on netbooks by my testing.


Everyone is adapting to Webkit now.

Who is everyone? Google and Apple.. you still have disparity between Google's Chrome and Apple's Safari in how they support CSS3 features (for example Google will support CSS3 regions and some Adobe proposed CSS3 additions while Apple added some Safari specific webkit transforms that allow you to get hardware accelerated effects that only work on Safari). Naturally, Firefox, Opera and IE do not use Webkit and have completely different ways of dealing with CSS and even DOM in some cases.

We have never been further away from unified browser because every browser maker has their own interests and politics and want to rule the web.


But I do agree with you, Flash is by far, today, years ahead of anything HTML5 offers and has quickly trumped the HTML5 video/h.264 performance it briefly lost to HTML5 but with Flash you have huge interactivity support via coding on top of the video layer, plus good DRM for commercial videos and so many other things. This is only for videos mind you.

I just hope that Adobe disables, sooner than later, right click on the Flash player as I guarantee all the hate mongering people will not even know what's flash and what's HTML if that was the case today.