Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Flash also has a ton of vulnerabilities and a huge codebase, and according to Apple, caused a ton of crash reports from their computers.


TBH if a Flash crash or any other user space application crash causes a system crash it's an issue with the OS. Steve Jobs at the time said that every time MacOS crashes it's more often than not Flash's fault, which wasn't really true and would only speak "wonders" of how well MacOS isolates user space applications...

On the security issues it's some what true because the nature of Flash, applications like these are almost impossible to sandbox properly unless you have an operating system that sandboxes everything by default.

Flash it self these days is pretty much code execution as a service it can do pretty much everything you want some browsers sandbox it better than others but it's still intended to pull code from the ether and run it and when you have a setup like that you will never be able to limit it effectively. Flash can be phased out only because it's mostly used to play various forms of media, but any other use of it cannot be converted to HTML5.

If Javascript (as it's parsed and executed in browsers) will ever get to the point of being as flexible and powerfull as Flash is today you'll see browser based RCE vulnerabilities skyrocket also, JS is safe to use only because the browsers restrict it, Flash and AIR are intended to support everything from an animated ad to a full desktop application.

Just look at Node.JS (and many NoSQL DB's that used JS) in it's early years almost every (non-DOM based) cross-site scripting vulnerability in a Node.JS application could result in remote code execution on the server, even today you can still easily cause it if you don't handle the code properly one stupid eval in your node code which was there for lazy debugging can lead to your box getting owned in minutes.


They're not system crash but application crash, both are reported on MacOS X. So no, Flash didn't crash the OS, only apps like Safari, Firefox or Chrome. Isn't it enough ?


>They're not system crash but application crash, both are reported on MacOS X. So no, Flash didn't crash the OS, only apps like Safari, Firefox or Chrome. Isn't it enough ?

That wasn't what Apple (Steve Jobs) claimed... [1]"Whenever a Mac crashes more often than not it’s because of Flash. No one will be using Flash, the world is moving to HTML5." Also Flash doesn't crash Chrome, doesn't crash FF for ages either. No clue about Safari the quote was debunked by everyone, even Apple backtracked on it to a more "we meant Safari in certain cases" type of statement. we can all move along.

[1]http://www.digitaltrends.com/computing/steve-jobs-unleashes-...


I doubt it's worth picking over all that stuff Jobs said about Flash - it was FUD top to bottom. I mean, in his famous letter he flamed Flash for being closed even as iOS locked people into a single browser, flamed it for being nonstandard while Apple pushed out Safari-only web pages [1] and weird quicktime extensions, etc. He even called out Adobe for being late to adopt Cocoa even though core Apple apps hadn't migrated yet.

So, the language about crashes may have had more or less basis in reality, but it's not as if Jobs was concerned with nuance and details.

[1] http://www.infoq.com/news/2010/06/apple-html5-gallery


It also chews up resources like nobody's business. Note that Android has also scrapped Flash. I'm pretty sure that Steve Jobs can't be blamed for that. :-)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: