Hacker News Reader

Comment by Terretta | Hacker News Reader

> doing SWF rendering in-browser and in-sandbox makes the security nightmare that is Flash go away

I think it's crucial to make sure end users concerned with security understand the difference between built-in or bundled Adobe Flash Player (Google Chrome style), and what Firefox is offering.

As soon as Chrome added a built-in Flash Player, it became the preferred target for hack contests, and still falls over repeatedly: http://www.securelist.com/en/advisories/52983

> Multiple vulnerabilities have been reported in Google Chrome, which can be exploited by malicious people to compromise a user's system. The vulnerabilities are caused due to a bundled vulnerable version of Adobe Flash Player.

That's not what Firefox is doing, and I hope the tech community helps regular users understand the difference.

View on HN

> I think it's crucial to make sure end users understand the difference between built-in or bundled Adobe Flash Player

And please, for the love of all that is holy, also make sure they understand what it might mean for the stability of features such as video recording.

Over the past few years Chrome has repeatedly shipped PepperFlash versions with various degrees of brokenness for video recording; wreaking havoc for webcam based services across the web.

Ironically enough these issues are extra hard to address, because when you tell Chrome users to 'try another browser' they all go "Nahh. I'm already on the best one."

Calling shenanigans. I wrote a couple of fairly complex publishers and Chrome isn't the problematic browser (if you use ExtermalInterface correctly). It's Safari which doesn't handle plugins well, but Camera and Microphone devices should still work as Flash handles those by itself.

Safari has how much of the browser market share?

Nobody gives two glances about Safari, mate.

Pretty large if you count mobile devices.

There was a well publicized audio problem with Pepper. It broke nearly all audio playback for weeks. Happened on every platform.

Okay, but playback problems don't negate the ability to record or stream input devices.

Apart from the fact that until February this year it was impossible to keep PepperFlash disabled [1], we've so far had:

- Frequent crashes when acquiring video camera [2]

- Recorded sound being choppy and broken (still not fixed for Red5) [3]

- Audio delays and broken echo cancellation in Speex [4]

- Microphone sound levels not reported, breaking apps like ours which check if a microphone worked properly. (resolved together with [3])

- Sound stopping to record after a few minutes [5]

- Inability to give camera access on retina displays [6]

- Rushed fix for a click-jacking attack introduces horrible UX that gets into an unrecoverable state by default [7]

All in all I can personally confirm that Chrome has not been good for people doing video recording on the web.

Boy, am I glad these bugs were fixed around the time I wrote my publishers. Remind me to check all the relevant bug trackers before going full steam ahead with a rewrite, ha ha.

Reply on news.ycombinator.com