Hacker News Reader

Comment by isomorphic | Hacker News Reader

I run my browsers without Flash in order to avoid Adobe's exploit-du-jour crapware. This means, for example, that I don't run Chrome.

If this binary blob from Adobe isn't presented with a similar UI as regular "plugins" (that the user can disable or uninstall), then I will look into writing an extension to disable it, or perhaps rely on a Firefox fork to give me a Flash-lite(tm) free browser.

View on HN

You might want to reconsider. Chrome sandboxes the Flash runtime [1], meaning a 0-day exploit in Flash alone doesn't get an attacker access to your machine.

1. http://thenextweb.com/google/2012/11/13/google-declares-flas...

That, of course, does not save you from other problems with Flash and the way developers have (ab)used it. Crappy/useless widgets on screen that serve only to eat your CPU and batteries, including banner ads and the like.

You can search for "Click to play" in the settings and disable plugins until you click on them. This helps a little security-wise, too, in case an attacker is resourceful enough to have both a 0-day for Flash and the Chrome sandbox. Not sure how likely that is, but it's also trivial to white-list sites you trust not to send you exploits from the icon in the URL box.

What makes you so sure?

So sure of what?

> If this binary blob from Adobe isn't presented with a similar UI as regular "plugins" (that the user can disable or uninstall), then I will look into writing an extension to disable it, or perhaps rely on a Firefox fork to give me a Flash-lite(tm) free browser.

Again, it's been stated that you will be clearly given the choice to disable the CDM entirely.

You could use Chromium, the open-source version of Chrome. It comes without flash, which needs to be explicitly installed to make flash work. Not sure what OS you use, but this is what I do on Linux.

Chrome now has a built-in 'flashblock', like the Firefox plugin of that name. Enable the setting and you'll not see flash unless you click a placeholder icon.

You can disable Flash from chrome://plugins

Reply on news.ycombinator.com