For more info on the Flash thing, a fellow actually chastised us a while back about Flash still being used on here due to it's security issues, and also linked us to this:
wired.com/2015/07/adobe-flash-player-die/ADOBE FLASH—THAT INSECURE, ubiquitous resource hog everyone hates to need—is under siege, again, and hopefully for the last time. The latest calls for its retirement come from some of the Internet’s most powerful players, but if the combined clattering of Facebook, Firefox, and a legion of unsatisfied users isn’t enough finally to put it in the ground, scroll down to see how to axe it from your devices yourself.
Why would you want to?
Because Flash is a closed, proprietary system on a web that deserves open standards. It’s a popular punching bag for hackers, which puts users at risk over and over again. And it’s a resource-heavy battery suck that at this point mostly finds its purchase in pop-up ads you didn’t want to see anyway.
This week, in the wake of newly discovered vulnerabilities in Flash, Facebook security boss Alex Stamos called for a termination date for Flash, and late Monday night Mozilla disabled all current versions of the plug-in by default in its Firefox browser. Even Google is limiting Flash’s impact; last month, it announced that future versions of Chrome will “intelligently pause” Flash-based content that isn’t part of a website’s core experience (e.g. video ads).
That doesn’t mean this is the end … yet. Facebook still uses Flash to play video on some browsers, and Firefox reintroduced Flash support on Tuesday when a secure update arrived. The point is clear, though: Flash is officially more trouble than it’s worth. And it has been for some time.
There’s always been a moderate anti-Flash undercurrent rumbling through the web; there’s even an “Occupy Flash” movement whose stated goal is strongly (but blandly) stated as “To get the world to uninstall the Flash Player plugin from their desktop browsers.” In fact, killing of Flash has been on-trend since being software non-grata on the original iPhone. Steve Jobs penned a famous open letter in April, 2010, explaining why he wouldn’t let Flash anywhere near Apple’s mobile products, highlighting concerns over openness, security, and its impact on battery life.
More than five years later, the case against Flash remains largely unchanged—and the security problem is the most immediate and important. After all, the newly discovered critical vulnerability that led Mozilla to quarantine Firefox from Flash was the third problem of its kind discovered this week thanks to a data breach of controversial digital surveillance firm Hacking Team.
When we reached out to Adobe to ask about those security holes and the mounting calls for Flash to disappear altogether, a representative directed us to a statement that says the company fixed the issues and has pushed an update. It also had this to say about its security issues generally:
“Flash Player is one of the most ubiquitous and widely distributed pieces of software in the world, and as such, is a target of malicious hackers. We are actively working to improve Flash Player security, and as we did in this case, will work to quickly address issues when they are discovered.”
However actively Adobe has been working on Flash Player security, it doesn't seem to be enough. This week’s mistrials are but the latest in a string of security lapses that have plagued Flash for years. Exploit kits—packets of code that take advantage of these sorts of vulnerabilities in your browser to push malware or ransomware—have used Flash to futz with countless sites. So-called zero-day vulnerabilities (a security hole that hackers find before the software company does) are found on Flash with such regularity they almost feel like a feature.
“The Flash Player is a very interesting target for attackers because it really is ubiquitous and runs in all major browsers,” says Jérôme Segura, senior security researcher at Malwarebytes. “On top of zero-days, many end users are still running older versions which explains why the number one piece of software exploit kit writers go after is Flash.”
That last point is critical; Adobe releasing a secure new version of Flash doesn't guarantee its users will download it.
As quickly as Adobe can beat back trouble, more pops up. It’s a never-ending game of Whac-a-Mole, with the fun twist that you always end up losing.
Segura’s torn on whether Flash should die altogether. “At the moment it is the most responsible thing to do,” he says, “But I also think it may be short sighted. After all, malicious actors can easily move on to a new target.”
The good news is, you don’t have to wait for Adobe to pull the plug. You can do it yourself.
