Hacker News Reader

Comment by dijit | Hacker News Reader

Maybe you have a bias since you worked with flash.

As a flash consumer from 2001-2011 I must tell you that honestly; flash was fucking painful.

Run a very weird binary blob riddled with security holes and questionable browser integrations or suffer.

Yes, some things became possible (habbo hotel, flash games, video/audio before browsers supported it) but it wasn’t worth it. I very much wanted flash to die by 2006 and ran a lot of extensions to bypass flash on Linux such as the “HTML5 everywhere” browser add on that tried to force YouTube to use HTML5 video (with mixed results).

I think anyone looking at flash now is romanticising the past. It was the least enjoyable thing about web browsing in the 00-s

View on HN

> "riddled with security holes"

There it is again! That specific phrasing. Curious. [1]

> "flash on Linux"

Yes, Flash on Linux sucked. We're talking about macOS, and it did not suck on macOS.

> Maybe you have a bias since you worked with flash.

Oh, absolutely. I chose to work with Flash because it was great! But that's not really germane. I would not have wanted to work with Flash if it sucked on Apple, since that was the platform I used at the time.

[1] https://news.ycombinator.com/item?id=30585649

Riddled is pretty common verbiage for native English speakers when something is heavily afflicted with something which is probably why you’re seeing it everywhere.

“Riddled with holes” is the original phrase, usually when referring to worn out clothing or something which has been damaged with many punctures.

It’s not a conspiracy or a retcon. I think I have tweets from this period where I was extolling my frustration with YouTube specifically for requiring flash.

To be fair I didn’t use Apple computers in that era so you could be right; but I did use Windows and Linux and Linux was by far the least favoured by adobe, but it still wasn’t pleasant on Windows.

I bought my first MacBook in 2011 and flash was already dead by then.

I disagree that it's a common phrase. It's used primarily when talking about cancer or infestations. It is almost never used in any engineering context. Except when people speak about Flash. You don't find that odd at all?

That you don't use the word doesn't mean no one does. There's no grand conspiracy here.

It's not about my using that phrase. It's about how often it's used and in what context.

It's inevitable when talking about Flash, but not, say, Windows, or other contexts with security vulnerabilities. Always "Flash" specifically "riddled".

I have used “riddled with problems” and “riddled with security holes” to talk about other software than flash.

I just googled the phrase:

https://www.computerweekly.com/news/252512175/Investigators-...

https://blog.avast.com/aws-freertos-riddled-with-security-vu...

https://www.zdnet.com/article/hola-vpn-still-riddled-with-se...

https://securityinfive.com/episode-659-tiktok-riddled-with-s...

https://www.computerworld.com/article/2490527/many-antivirus...

It’s a common phrase, not a conspiracy.

It's incredibly common.

I find your interpretation odd. I use the term "riddled with bugs" in software engineering regularly.

It might not be common vernacular in your neck of the woods, but it is where I'm from.

I’ve refused the phrase “riddled with security bugs” to describe XML parsers.

Who are you to decide if it was worth it or not ? Tons of humans had a really good time and memories on e.g. Habbo. That alone makes it entirely worth it.

Sorry. I should have clarified maybe.

When I say “was not worth it” I am implying that it was not worth it for me.

That I often didn’t enable flash even if I did enjoy some of the things flash provided.

I still firmly believe that we have much less energy consumptive software since flash died, I recently brought back some old /f/ content from 4chan and ran a flash emulator written in rust and it crippled my laptop, so it hasn’t improved a whole lot.

I hated it so much and it was so forced upon me that I am finding it extremely hard to have sympathy for you.

>I think anyone looking at flash now is romanticising the past. It was the least enjoyable thing about web browsing in the 00-s

The least enjoyable thing about web browsing in the 00-s was javascript. Pop-up windows, window resizing, stealing focus. Now javascript is still the reason web sucks. And security has not improved much.

> And security has not improved much.

What?!

Modern browser security has gotten orders of magnitude better since Shockwave Flash was removed from web browsers. The sheer unending volume of security vulnerabilities flash introduced into browsers was staggering. Flash (until very near the end of its life) had no sandboxing, and had its own update mechanism. It was the norm for people to be running old versions of flash with unpatched security holes. And flash had so many vulnerabilities - if memory serves, flash generally fielded more CVEs in any given year than the entire rest of the browser!

Remember how revolutionary pwn2own was? "Wow, find a vulnerability and win $1000!". These days vulnerabilities of that magnitude are worth way more money, because of how secure the browser environment has become. ($100k-$1M on the black market as I understand it.)

The only reason it feels like security hasn't improved much is because crypto ransomware has made hacking so much more profitable. But even then, most randomware doesn't usually take advantage of security vulnerabilities in web browsers. Its really quite remarkable how secure the modern web has become; and that wouldn't have been possible if flash were still around.

> Remember how revolutionary pwn2own was? "Wow, find a vulnerability and win $1000!". These days vulnerabilities of that magnitude are worth way more money, because of how secure the browser environment has become.

Theses amounts were low because there was no interest in rewarding white hat hackers sadly. Bug bounties at the time were extremely rare. It wasn't lower because it was easier (though it may have been easier, not arguing it wasn't, just that the amounts are not evidence of it).

> ($100k-$1M on the black market as I understand it.)

On the "white" market you means. Zerodium is paying theses amounts. I don't feel like it would be higher in the black market than what they are offering, but could be.

Speaking of which, in 2020 Zerodium stopped accepting "Apple iOS LPE, Safari RCE, or sandbox escapes" for a few months because there was too many of them... still no "Thought on iOS" yet... It's not like it's even a new thing, I remember a long time ago when you could jailbreak your iPhone using a website directly.

Didn't even need to go far either... check CVE-2022-22620, only a month ago.

Reply on news.ycombinator.com