Hacker News Reader

Comment by swombat | Hacker News Reader

To be fair, these things happen to many other platforms. Adobe's no exception. Two weeks seems a bit on the slow side from our hacker point of view, but it is in line with what you tend to get from large corporations (and actually fairly responsive... this would be a good response time for, say, Internet Explorer - and Flash has more installs on a much wider variety of OSes and hardware than IE).

Let's not all gang up on Adobe just because they're, well, just as bad as everyone else.

View on HN

What is this "ganging up" you are speaking of? All I can see as of this moment are people making true statements about Adobe Flash's vulnerabilities, expressing their personal opinions about using Flash, sharing tips for avoiding or disabling Flash, and so on.

As for the two weeks, it sounds like you are saying that the appropriate response to being told that you have to stand in line a day to buy bread is to shrug your shoulders since you're already standing in line a day to buy milk.

Yes, but they happen on "other" platforms. Not "ALL" platforms.

I think there are too many developers out there in large and small companies that don't understand they power they wield or the responsibility they have.

I'm not a big fan of Flash. It had it's day. It wants to be everywhere, but it doesn't have the track record to be safe everywhere. I recently switched to Mac and have 3 (and only 3) crashes... all in Safari and all due to Flash.

I'm all for a company making a great product and making it prolific. I just want that company to have the integrity and follow through to make it right. After all, when an exploit takes over my machine who's out the time and money?

The trouble with Flash is that it is so ubiquitous. If Firefox gets a critical zero-day vulnerability, I'll use Chrome. If Chrome does, I'll use Firefox. With a Flash vulnerability over 90% of computers on the web are susceptible and there is no alternative.

I haven't had Flash installed since that first vulnerability where Adobe pulled support for x86_64 Linux. The web looks the same. (I used Adblock anyway.)

Yeah, some Youtube videos don't work... but you can get those videos elsewhere.

How about things like Google Analytics? Do you miss tools like that?

Never used it. I think spying on my users (with the help of Google) is unethical.

(FWIW, I did do a project for a client once which involved extracting data via the Analytics API. It was very easy to do, and all the metrics were there, so it seems possible to make your own chart without requiring Flash. Hell, there is even an in-browser Javascript Analytics API and many in-browser Javascript charting libraries... so you could probably even do this in the form of a bookmarklet or user script!)

Heh, spying is a strong word. Without GA I would have had a harder time figuring out that more of my users are from Spain than from the US for one of my projects.

Thanks for the info. I knew of their API but haven't used it yet.

Please enumerate some of these "other platforms."

Cannot cite IE (too obvious), or Reader (also Adobe).

Apple: http://www.engadget.com/2009/07/02/apple-patching-nasty-ipho... ("fix by the end of this month")

Google: http://seclists.org/webappsec/2006/q1/66 (6+ months)

I'm sure you can find more of them by searching for them (as I just did).

It would be a more interesting challenge to name a vendor who isn't routinely issuing security advisories. I can't think of any.

Because you asked:

http://www.google.com/search?q=java+zero+day+exploit

Reply on news.ycombinator.com