Do you (still) use flash?

[hjlbx]

When it comes to Flash, very few people really know what they're talking about.

Just like so many things on the net, more than half of it is mis-\dis-information - and just plain, outright scare tactics, sensationalism, hyperbole and media hype.

HTML5 is a dog... with fleas of a different kind.

 

[Dirk41]

If you compare the CVEs for Flash versus Windows - well... - we might as well do away with Windows too.

Everybody move to Linux.

12 - 18 months down the road and malc0ders are having a field-day - and BAM ! - the first billion dollar ripper wipes out the equivalent of the GDP of one of the Carribean island nations.

Security via obscurity is utter nonsense.

What do you mean with obscurity ? Fleeing from a sw to another ?

 

[Dirk41]

When it comes to Flash, very few people really know what they're talking about.

Just like so many things on the net, more than half of it is mis-\dis-information - and just plain, outright scare tactics, sensationalism, hyperbole and media hype.

HTML5 is a dog... with fleas of a different kind.

But you have to admit that ,reading security news , you often read about flash. It's obvious you use the less targeted sw

 

[hjlbx]

But you have to admit that ,reading security news , you often read about flash. It's obvious you use the less targeted sw

Just wait until HTML5 is widely targeted. It's just a matter of time...

 

[hjlbx]

What do you mean with obscurity ? Fleeing from a sw to another ?

Yes.

 

[Dirk41]

Just wait until HTML5 is widely targeted. It's just a matter of time...

Sure , another solution will be found . But as far as you live in a sandbox ( custom settings) you are safer



If they bomb a place, you move to another . Or you live in a bunker

 

[hjlbx]

• HTML, for the content
• CSS, for the presentation
• And Javascript for the behavior (dynamic stuff)

JavaScript. mwahahahahahhahahahahahah....

 

[Dirk41]

• HTML, for the content
• CSS, for the presentation
• And Javascript for the behavior (dynamic stuff)

JavaScript. mwahahahahahhahahahahahah....

Please take a sit in a sandbox
As far as you download frome safe sources you reduce a lot the risk

 

[Dirk41]

Oh if you disable JavaScript you can read anyway most websites , even if you can't interact XD

 

[LASER_oneXM]

flash is still installed (using firefox only) but i use it only if it's necessary ("Click to enable")... should be safer when browsing.

 

[hjlbx]

Oh if you disable JavaScript you can read anyway most websites , even if you can't interact XD

You can use NoScript or equivalent for customized webpage javascript, but the vast majority of users aren't gonna do it - even if they knew how because it alters the webpage experience too drastically.

 

[Dirk41]

Yeah with " interact " I meant that " webpage experience "

 

[Wave]

Disabled in Chrome, I enable it if I really need it.

Most websites are moving to HTML5 now anyway these days so Flash will become less and less used... For example, there is a HTML5 Video Player version on YouTube and there has been for a very long time.

 

[enaph]

Disabled in Chrome, I enable it if I really need it.

Most websites are moving to HTTPS now anyway these days so Flash will become less and less used... For example, there is a HTTPS Video Player version on YouTube and there has been for a very long time.

I think you wanted to say HTML5

 

[HeroCloudAntivirus]

some websites still demand it oh well

 

[Wave]

I think you wanted to say HTML5

Yeah, I'll edit my post, sorry... I had a very long night and got up early today...

Thanks for correcting me

 

[Deleted member 178]

I dont mind much, i run Chrome permanently isolated

 

[Windows_Security]

• HTML, for the content
• CSS, for the presentation
• And Javascript for the behavior (dynamic stuff)

JavaScript. mwahahahahahhahahahahahah....

Well you have a point that everyone seems to be enthusiastic over the replacement of Flash, while its successpr has not been tested and challenged to the max yet. That said (my friend), you are not mentioning the improvements on security of next javascript standards. ECMAScript 5 introduced Srict Mode. Strict Mode imposes a layer of constraint on JavaScript (see for instance Mozilla reference document).

Strict mode changes both syntax and runtime behavior. Changes generally fall into these categories: changes converting mistakes into errors (as syntax errors or at runtime), changes simplifying how the particular variable for a given use of a name is computed, changes simplifying eval and arguments, changes making it easier to write "secure" JavaScript, and changes anticipating future ECMAScript evolution.

On top of that browsers keep competing themselves on, so they are building new features into their capabilities to process javascript. The trend is towards more structured and static code, see for instance new V8 javascript interpreter "Ingnition" design document

The BytecodeArrayBuilder checks that all labels referenced in bytecode are bound before the BytecodeArray is emitted. Because the Bind() call binds a label to the end of the bytecode being generated, labels are always constrained to target offsets .... There is no support for jumping to a dynamically computed value, for instance jumping to an offset in a register...
(this closes a door often used in exploits)

This browser competition on speed and ECMA's wish to further structure, simplify and secure Javascript will lead to cleaner and more transparent Javascript syntax. When Flash is replaced by HTML it will implicitly benefit from those improvements. In short I am a lot more positive towards the future in regard to browser security

 

[jamescv7]

Well I just leave the Flash Player in Chrome to be enabled and updated automatically.

Some instances where GC automatically switch to HTML 5 however majority of sites still relying on Flash Player especially in streaming videos.

---------------

Yes we cannot insist that security is the number one priority however as long you keep it to the latest patches and same usual habit of infection free then no issues must occur.

 

[Amiga500]

I only use the flash plugin for one particular flashgame site and otherwise its disabled.