Hacker News Reader

Comment by bl4k | Hacker News Reader

the best thing I have done recently is to disable all plugins, including flash:

YouTube HTML5 support is good, and for any other video you can directly download. Browser runs a lot faster, web pages load faster, and I don't miss flash ads at all.

I also disabled flash on my parents' computer, and my brothers, and enabled YouTube HTML5 for them. They haven't noticed it yet. It is only a matter of time before more corporate networks uninstall/block all flash, especially with the bad reputation it has with security.

Flash is already dead to me, I can't wait until it is dead for everybody else as well

View on HN

Use Flashblock or something similar. By default Flash objects are turned off, but you can click on them to enable.

Firefox: https://addons.mozilla.org/en-US/firefox/addon/433/

Chrome: https://chrome.google.com/extensions/detail/cdngiadmnkhgemki...

As I mentioned below, I had Flashblock, and used it for a while until I noticed that Flash is still in memory and Flashblock is just some JS that hides flash elements.

Killing everything is much better.

I don't know what Flashblock you were using but the ones I have used do not behave this way. Maybe Flash was in memory because you clicked one of them and allowed it to run?

I used the following FlashBlock for Chrome, and using resource tracker I could see that no SWFs were downloaded on a YouTube page until after I temporarily enabled Flash on that page.

https://chrome.google.com/extensions/detail/gofhjkjmkpinhpoi...

Is that good enough proof that the SWF is not put into memory?

Also, the FlashBlockBlock page here does not load when I have the extension enabled: https://woofle.net/flashblockblock/

Yes, extensions named 'Flashblock' are pretty universally mediocre and don't actually keep Flash from crashing your browser — they just keep it from being displayed.

ClickToFlash for native Webkit views on OS X actually blocks Flash for real — it's a native Webkit plugin that registers for Flash's primary mimetype and preempts it. When you selectively enable a flash embed, it replaces itself with Adobe's NPAPI plugin.

Using NoScript is probably best. It actually blocks Flash content properly, and protects against most other browsing-related vulnerabilities. Plus, if you don't allow scripts to run from advertiser's domains, most ads can't load.

Note - The title is misleading. It's a zero day vulnerability on all platforms, but the exploits hit XP Vista and W7. It's still prudent to kill Flash on all though.

http://www.theregister.co.uk/2010/09/13/adobe_flash_0day_vul...

It is easy to turn off Flash in the Firefox plugins, and running the Better Privacy extension which kills the Flash hidden cookies normal cookie management doesn't touch. (One stalks you keeping track of every site you've visited with Flash) Better Privacy isn't yet compatible with the Firefox 4 beta but is fine with 3.x

NoScript is still a good idea for many reasons.

The malware is worse this year than last... http://www.gdatasoftware.co.uk/about-g-data/press-centre/new...

On last months zero-day Flash exploit thread, someone linked to a demo that shows bypassing Flashblock. I think this is it (but I don't run Flashblock).

[EDIT: Note: I don't know how safe the link in this article is.] http://seclists.org/fulldisclosure/2008/Jul/444

Here's a simple proof of concept I wrote a while back that bypasses Firefox FlashBlock: https://woofle.net/flashblockblock/

The payload is harmless but silly.

Is it to me or the Quicktime plugin is still enabled and it even has a critical security update?

I did that for a while but had issues like really needing Flash on a couple sites and the fact that every Flash or PDF update would re-enable their plugins in Chrome.

Now instead of disabling individual plugins, now in Chrome I do not allow any site to use plugins, then go back and whitelist sites as needed.

Why not completely uninstall them instead?

IIRC Google helpfully embed Flash inside Chrome

Use the kill-flash extension for Chrome. It takes off flash elements and replaces them with a zone to click on if you want to bring it back. It has a whitelist that you can use for sites that you want flash on by default.

Flash is still in memory, and those plugins use Javascript to 'hide' the applet

I had to turn Flash back on after a few minutes after I realized that Google Analytics charts are Flash based :(

Reply on news.ycombinator.com