Mozilla Details How Firefox 17 Will Block Old, Vulnerable Versions Of Flash

http://thenextweb.com/insider/2012/10/12/mozilla-details-how-old-adobe-reader-flash-and-silverlight-plugins-will-be-blocked-in-firefox-17

by Quekster • 14 years ago

38 16 14 years ago

thenextweb.com

JoshTriplett2• 14 years ago

Why would it make sense to allow running a vulnerable version of a plugin with just a click?

Perhaps with a hidden preference, for people who absolutely need an old version (to run some internal business app that fails with new versions, for instance), but by default?

asadotzler• 14 years ago

There are a number of reasons that we're taking these steps.

First, click to play for vulnerable plug-ins will make driveby exploits less likely to be successful.

Second, it gives users some protection while while they wait for a time to upgrade a plug-in that's more convenient to them.

Third, we've learned that if you simply take the plug-in away, users don't upgrade, they switch to one of the other browsers on their system which isn't taking their (potentially similarly vulnerable) plug-in away.

This is not the only answer, though. It's a step in an ongoing process to protect more users and one that I believe all browser vendors are converging on.

JoshTriplett2• 14 years ago

> Third, we've learned that if you simply take the plug-in away, users don't upgrade, they switch to one of the other browsers on their system which isn't taking their (potentially similarly vulnerable) plug-in away.

That make sense, and that sounds like the real reason. The first two reasons would work just as well with disabling the plugin entirely without the click to bypass. However, if you think people will ignore the warnings and run another browser entirely, that seems like a good argument for letting them use the plugin with Firefox, as long as you have an appropriately severe warning about what it means to let a site access a vulnerable plugin.

steevdave• 14 years ago

There are many reasons why you'd want to allow an older version, such as there simply isn't a newer version available.

Just to give an example, Flash on ARM (non-Android) is old, however, most of the attacks won't work, due to the different architecture (that's not to say it's safe, just that most people aren't targeting non-android ARM devices yet.)

The odds of seeing any sort of update for it (I think, but don't quote me on it, it's version 10 or 11) are slim to none based on Google not releasing a version of Chrome for non android devices, nor does Adobe do the work of preparing Flash for these devices.

I'm not saying these machines are worry free, but I definitely don't concern myself near as much as for my amd64 boxes

ck2• 14 years ago

How can flash have a serious vulnerability EVERY WEEK and it's over TWELVE years old?

That kinda blows my mind. I mean it's not an entire OS, just flash.

shardling2• 14 years ago

Yeah, it's just a framework for writing almost arbitrary types of applications in. What could possibly be so hard about that?

evride• 14 years ago

Virtual machine, not framework. Flex would be a framework though.

rachelbythebay• 14 years ago

I take it you have a fairly negative opinion of Flash. That's okay by me, since I do too. Anyway, would you ever work on that project? I sure wouldn't, because it would look like a horrible black mark on my resume. Some projects are bad enough to where it leaves a stink on the people who touch it.

Once a project gets to that point, who can you hire to work on it? I'm guessing you're not going to get the best and the brightest. So, you get whoever's left. I think you can see where this is going.

I call this cycle "The Bozo Loop".

jrockway• 14 years ago

Interesting theory. My theory is that Flash doesn't make Adobe any money, so they don't have any resources working on it.

I'd happily work on Flash if it was a Google product, for example. I don't think it's a black mark, but if it was, I would just say, "Oh, I optimized a virtual machine for running lightweight dynamic languages" or something that's not obviously "I designed the Macromedia Flash Plugin". (But I wouldn't want to work for Adobe, even though they do have some successful products.)

azakai• 14 years ago

Flash is huge, it runs a dynamic-language VM which is always hard to secure, and it is constantly adding APIs. That sort of program tends to have security vulnerabilities all the time, in fact exactly like browsers do - they also fit the three traits mentioned above.

But, better to have one such program - a browser - than two - a plugin as complex as a browser, inside a browser.

ashray• 14 years ago

I believe Safari already did this in the 6.0 version. I hadn't upgraded my Flash and I got a [Plugin Blocked] message wherever there should be some flash content.

After upgrading Flash I started seeing ads there again :P Not sure if upgrading was the right thing to do :D

aeontech• 14 years ago

This is a great, flexible solution. Props to Firefox team for making an extra effort to protect their users.

Mozilla Details How Firefox 17 Will Block Old, Vulnerable Versions Of Flash

Related Stories