Hacker News Reader

Comment by rendall | Hacker News Reader

> Flash was riddled with problems - it was a resource hog, the macOS implementation was buggy and slow and Adobe seemed to not care about fixing these problems, and it had a very bad record of security holes

Yeah, see this? This "riddled" word? That's how I know you're just repeating what you read. It's a tell.

Jobs + Wired + Gawker + Apple made an incredibly strong conceptual gravity well that makes conversation about this difficult. They all use this "riddled with security holes" phrasing. It's like you just repeated "No, you don't understand. Brawndo is what plants crave."

What security holes? Specifically? Were they more serious than any browser?

View on HN

Security issues? Yes, there were 0days after 0days. Adobe kept pushing updates, but users were often lagging behind. Researchers continually found new vulnerabilities.

Browsers weren't as sandboxed and hardened as they are today, and flash plugged directly into them.

Flash was one of the most used vectors for adware, all you had to do was visit some shady website.

> 0days after 0days

[Citation needed]

Here you go

https://www.zero-day.cz/database/?set_filter=Y&arrFilter_pf%...

100% of all zero-day vulnerabilities from 2008-2022 are due to Adobe?

Let's look at the entire context.

https://www.zero-day.cz/database/?set_filter=Y&arrFilter_pf%...

One in twelve of all security issues—in a period that begins when Flash was already on the decline and extends far beyond when Flash was at all relevant—were caused by a single web browser plugin and you're trying to handwave that off as not a big deal? Adobe has the highest percentage of exploits listed there for any company that is not an OS vendor, and Flash has the most of any single product that is not Windows (in an era when XP was still supported!) or IE (which it ties with).

And, yeah, Flash did suck as an end-user experience. For a few years it seemed like every restaurant in existence had an all-Flash web presence, and, no, waiting for endless animations while wading through some entirely non-standard "rich media" experience, while listening to my laptop fans kick into overdrive, did not "surprise and delight" when I was just trying to find their hours and a menu. It was absolutely infuriating.

This is ignoring that one of the major malware vectors that wasn't a zero-day at the time was to just put up a webpage claiming that Flash was out of date, and then linking a fake updater. Sure, that wasn't entirely Adobe's fault, but if they'd done a better job of keeping it up to date on their own it would have been an awful lot less believable to end users.

No, I was filtering on Adobe so you could easily see all Flash zero days.

Good citation. :)

Riddled is a common word that native English speakers tend to use. It’s not a tell.

Your aggression, on the other hand, is uncommon. It is a tell.

Sorry. Not intending to be aggressive. That's me being weirded out, not intentionally aggressive.

As a native English speaker, I can assure you it's not a common technical term at all. It's a poetic phrase, designed to elicit thoughts of illness and damage. A house can be riddled with termites, a body can be riddled with cancer, a bridge can be riddled with rust. But Flash, uniquely, is "riddled" with security holes. No one says that about Windows.

As an engineer, I hear it used all the time in contexts outside of Flash. It's extremely common.

Strange, I googled “windows riddled” (without quotes - try it). This was the first result:

https://answers.microsoft.com/en-us/windows/forum/all/why-is...

“Why is Windows 10 riddled with so many bugs and the updates make matters worse?”

It’s likely time to admit that you’re wrong. Riddled is a word, the meaning fits and people use it to describe software.

Getting “riddled” specifically means to get holes put in you, as in with bullets. It’s a very fitting term for having lots of security holes.

https://www.cvedetails.com/vulnerability-list/vendor_id-53/p...

During this conversation, someone inevitably posts this without comment, as if it is a rhetorical slam-dunk.

Could you expand on this? Your point is the Flash had vulnerabilities?

What software doesn't? https://www.cvedetails.com/product-list/vendor_id-1224/Googl...

Remember, Jobs' contention was that Flash's problems were inherent. Can you support that?

Compare Flash to Safari then: Flash is a comparatively small VM runtime and vector graphics engine while Safari is a whole browser, which has a much larger attack surface. And Safari, despite its increased complexity, had about the same amount of reported vulnerabilities around 2010:

https://www.cvedetails.com/product/2935/Apple-Safari.html?ve...

So, objectively, Flash did have very persistent security issues.

"Comparatively small" is doing a lot of lifting, there. What about Flash was "comparatively small" compared with Safari, and why does that let Safari of the hook for its vulnerabilities compared with Flash?

I spelunked through the Firefox source code about 10 years ago.

A modern browser is an amazingly complex piece of software. A gazillion parsers with the ability to handle malformed content that should give anyone nightmares. Multiple JITs and interpreters. Layout handling with incremental grid calculation algorithms that gave me vertigo - before I understood that it was done asynchronously.

There is no way in hell flash is anywhere near as complex.

Your "no way in hell" is not really an answer, and any response will just devolve into "Uh huh!" "Nuh uh!"

Browsers now are very complex. At the time, we were still dealing with IE6 and JavaScript 3.

Flash could do literally everything that browsers at the time did, and more. Load and display multimedia files, animate them, interpret ActionScript, and do it cross platform, cross browser, in a performant, relatively secure manner.

"No well in hell" is a very good answer. Just the HTML DOM and layouting code in KHTML before it was forked into WebKit was an enormously complex piece of code. Then there is the JS implementation (including compiler - JS gets transferred as source code), the SVG DOM and renderer and other goodies that were integral parts of browsers already back then that I'm probably not thinking about.

Just adding to this: the attack surface of a web browser is humongous compared to that of a relatively small runtime, even in 2008. In 2011 when I had a look through the FF codebase, there were already 2 JITs for JavaScript, one which had been in for years (but I don't remember if it was in use).

You compiled to flash. Content served that were run by the flash runtime were valid or didn't work at all. The amount of code dealing with malformed content in browsers is staggering. A browser deals with everything that flash did, but in more complex ways, while also doing a LOT more.

On the other hand, flash was being used by everyone, windows, mac, linux, mobile... Safari was just being used by mac users. Les users, less bugs found.

Compare apples with oranges. Flash is a program, safari is an operating system.

So, you will ask for citations and then rip them apart because “every piece of software is vulnerable”?? If you don’t like what you get, why did you ask for it?

At first, you were merely overly aggressive. But this is turning into bullying.

https://www.cvedetails.com/vulnerability-list/vendor_id-49/p...

> Jobs + Wired + Gawker + Apple made an incredibly strong conceptual gravity well that makes conversation about this difficult.

I never, ever, read the Jobs manifesto against flash. Never cared to read any article about flash back in the day and I absolutely dreaded opening a website that used flash.

It was a guaranteed loading times on my bad internet, followed and/or preceded by a notice saying that I needed to install this crapware or update it. Not to mention my numerous crashes directly related to an unresponsive flash application.

But as you clearly wrote somewhere on this thread, this was probably due to me using windows and most flash devs using macOS.

As someone who just learned about jobs hate to flash and never touched on a MacBook in his life. I’m extremely happy this technology belongs to the past.

Reply on news.ycombinator.com