6

As said,

What makes Adobe Flash so vulnerable and how does Mozilla Shumway fix it?

Flash related malicious activity is due to malicious website right? Not in Adobe's software right? If so, how can Shumway replace the Flash nightmare??

4
  • 1
    Adobe Flash is vulnerable because 1. They don't know how to program. 2. Programs are 10,000++ lines of code and are hard to debug. 3. It is web based and on almost every computer, for now, so it makes it easy to target millions of people. (victim of there own success). Therefore hackers do whatever they can to exploit even the smallest flaws. Breaking in to flash gives them access to your local OS, or at least parts of it.
    – cybernard
    Aug 14, 2015 at 0:14
  • 5
    @cybernard saying that they don't know how to program is a bit harsh. Its an old codebase and priorities, tools and policies have changed over the years.
    – heavyd
    Aug 14, 2015 at 0:45
  • I stand by what I said. I forgave Adobe Flash the first 1000 vulnerabilities, but no more!!! Anyone who has as many 1000's of vulnerabilities, even though some of them have been since fixed, has bad programmers. When you run Windows Update from scratch it doesn't say installing 1 of 1000 updates, even though it may feel like it.
    – cybernard
    Aug 14, 2015 at 1:24
  • 2

1 Answer 1

3

Adobe Flash is not inherently vulnerable, however Adobe's implementation has had it fair share of severe exploits. My explanation for this is simply history. Flash has been around for a long time. Adobe took over Flash from Macromedia back in 2007, and Flash was already on its 9th version. Back in the early 2000's, security was not on anyone's feature list for software, they were trying to ship features that enhanced the product and made a better experience for their users. Security just wasn't a problem, so it was addressed. Fast forward 5-10 years, and now Flash is all over the Internet and installed in every browser. It makes for a huge attack surface, on a complex codebase. That is why.

Shumway has a few things going for it. First, it can be developed with security as a feature. Regular security checks are happening as the code is being written. Also, its implemented in JavaScript and run in the browser, so it can leverage the browser sandbox. Even if there were a bug in the Shumway code, it would only be able to access the browser, not the host OS (unless there is also a bug in the browser).

2
  • but I thought virus had been invented before 2000?
    – Ooker
    Dec 16, 2015 at 15:43
  • 1
    @Ooker Most viruses before 2000 spread by explicitly executing an infected file on the system. People at the time were not sufficiently knowledgeable or concerned about drive-by exploits spread via malformed data.
    – jamesdlin
    Jan 12, 2016 at 5:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .