Hacker News Reader

Comment by potatolicious | Hacker News Reader

This may be confirmation bias, and admittedly no software is without vulnerability, but is it just me or do we see these updates for Flash moreso than just about any other internet-facing client?

Is Flash really that bad or is everyone else just bad at reporting zero-day exploits publicly?

View on HN

Flash really is that bad:

http://en.wikipedia.org/wiki/Adobe_Flash#Flash_client_securi...

Also "Zero Day Exploits" generally mean that the exploit was released to 3rd parties before it was given to the company whose software was being exploited.

I think 0-day means something a little different http://en.wikipedia.org/wiki/Zero-day_attack

That Wikipedia article appears to give the same definition. What difference are you trying to call attention to?

They are correct (it's zero-day) in that the vulnerability is announced, yet Adobe says it's going to be a week (the 21st) before they release a fix.

Vulnerability known before the vendor can release a fix is "zero-day".

I'm a sysadmin at a Big 4 auditing firm. Adobe products are the bane of our existence.

Acrobat 9.4.1 takes over to install. Oh that's right, there's a vulnerability in that version, so now we're gonna have to push 9.4.2

When a user's Flash installation is corrupted, many times the uninstaller fails, so we have to use Windows Installer Cleanup to remove it. Every week, there's a new issue. Can't these fellows get it right?

I'm an ex-flash developer (8 years). I can tell you it's bad. I could find many ways of crashing the browser a few years back. And just reading this article, I went about:plugins in chrome and disabled flash for now.

Most software companies will put security bugs on a uber priority fix list. Everything else goes to the back of the line :).

One of the best ways to get any bug fixed in any Library, OS etc... is to find a way to exploit it.

Flash really is that bad. As a potential malware vector & as something where most users are probably hopelessly out of date (and not by their own fault).

I can't comment on Flash being worse than other software, but one thing is clear: it extends the attack surface of your browser with a whole maze of exploitable goodness.

It's bias.

Java has ~3 times as many holes as Flash does (if one is comparing in the context of "browser plugins").

Reply on news.ycombinator.com