Metro IE 10 - Flash lives! (maybe)

2 hours ago, blowdart wrote

*snip*

Oh that gets better. Yahoo left their private key in that plug-in, so people are having fun spoofing being yahoo.

 

!!

It turns out its a chrome extension signing key. So you can create a chrome extension  and sign it as yahoo

http://nikcub.appspot.com/posts/yahoo-axis-chrome-extension-leaks-private-certificate-file

BTW, did you all hear Cockford left Yahoo for PayPal?

It only works for selected sites. So depending on the size and adaptability of the whitelist it remains to be seen how useful this is.

@DeathByVisualStudio:No This is the worst possible outcome.

Obviously I want Flash in my browser so the web isn't broken but I'm as keen for Flash to die as any man. Now, when flash does die, I won't be able to get rid of that security-hole-ridden browser-crashing PoS. And if updates have to come via MS, rather than Adobe, that's probably going to take too long and potentially lead to more of this kind of fiasco. And what happens when MS stop supporting it? (I have hideous memories of using computers running the MS VM for Java for years after it was discontinued)

This means potentially unpatched flash installations are going to be sat on bajillions of computers around the world. And a flashback style attack on Windows would probably see more than just a few hundred thousand systems affected...

@DeathByVisualStudio: I think it's cool that Adobe provided the code to MS. While a Flash-less IE10 was a good idea, it's a little ahead of its time. I think we'll see it for good in Windows 9. I hope this means they can "integrate" Silverlight as well. The whole experience of dropping to the desktop for certain sites is annoying.

2 hours ago, GoddersUK wrote

@DeathByVisualStudio:No This is the worst possible outcome.

Obviously I want Flash in my browser so the web isn't broken but I'm as keen for Flash to die as any man. Now, when flash does die, I won't be able to get rid of that security-hole-ridden browser-crashing PoS. And if updates have to come via MS, rather than Adobe, that's probably going to take too long and potentially lead to more of this kind of fiasco. And what happens when MS stop supporting it? (I have hideous memories of using computers running the MS VM for Java for years after it was discontinued)

This means potentially unpatched flash installations are going to be sat on bajillions of computers around the world. And a flashback style attack on Windows would probably see more than just a few hundred thousand systems affected...

 

Outside Apple's and Microsoft's control how many people actually keep their flash plug-ins up-to-date? There's no guarantees there either. Besides if Microsoft is as slow on getting updates out as Apple they deserve the bad PR.

Also I think you missed this part:

"So, Microsoft has extended the Internet Explorer Compatibility View list to include rules for popular Flash-based web sites that are known to meet certain criteria. That is, Flash is supported for only those popular but legacy web sites that need it. This feature is not broadly available for all sites"

So you don't have to worry about all of those p0rn sites you visit as they won't be on the list. I'll just be happy that I don't have to "show in desktop" so much on my tablet.

42 minutes ago, spivonious wrote

@DeathByVisualStudio: I think it's cool that Adobe provided the code to MS. While a Flash-less IE10 was a good idea, it's a little ahead of its time. I think we'll see it for good in Windows 9. I hope this means they can "integrate" Silverlight as well. The whole experience of dropping to the desktop for certain sites is annoying.

My thoughts exactly. I use "show in desktop" way, way, way too much on my tablet. If they want to keep eyes focused on the new metro side of W8 they better try and keep them there.

1 hour ago, DeathByVisualStudio wrote

*snip*

Outside Apple's and Microsoft's control how many people actually keep their flash plug-ins up-to-date? There's no guarantees there either. Besides if Microsoft is as slow on getting updates out as Apple they deserve the bad PR.

Also I think you missed this part:

"So, Microsoft has extended the Internet Explorer Compatibility View list to include rules for popular Flash-based web sites that are known to meet certain criteria. That is, Flash is supported for only those popular but legacy web sites that need it. This feature is not broadly available for all sites"

So you don't have to worry about all of those p0rn sites you visit as they won't be on the list. I'll just be happy that I don't have to "show in desktop" so much on my tablet.

I keep my plugins up to date. Frankly if other people don't that's their fault. No matter how much bad PR MS get/deserve if they are slow to release updates that won't help the little old granny who has had her bank account compromised (and no matter how quick MS can release updates, it won't be instant - they'll need to receive the code from Adobe and alter/repackage it for their implementation and then test it - that will take a finite amount of time).

And it's perfectly possible for flash exploits to be launched from legitimate site e.g. via malicious adverts. I'm also not aware that MS actually screen compatibility view sites for exploits - I've always assumed the list is based solely in telemetry data (ie. lots of people use this site, but it doesn't work properly so we'll add it to the list). Beside (in IE9, at least) if you visit a website that doesn't display correctly a large balloon pops up telling you to enable compatibility view for that site.

To be honest Microsofts approach to plugins in  Metro IE was rather like this cyclist's approach to safe cycling: http://youtu.be/EWEk4lj5LZs?t=17s

Now it seems to be like this:http://youtu.be/O6oem0WRm1M?t=1m20s

What's wrong with the middle ground? What was broken previously?

(FTR I think this is far, far worse than no plugins at all, for the reasons I outline in my previous post) 

Ok, this is even worse, I mean, I am potentially valnerable to Flash virus and I cannot remove flash when it is part of the IE. It is the same with WebGL virus plagued many browsers that have it pre-installed.

1 hour ago, GoddersUK wrote

*snip*

I keep my plugins up to date. Frankly if other people don't that's their fault. No matter how much bad PR MS get/deserve if they are slow to release updates that won't help the little old granny who has had her bank account compromised (and no matter how quick MS can release updates, it won't be instant - they'll need to receive the code from Adobe and alter/repackage it for their implementation and then test it - that will take a finite amount of time).

And it's perfectly possible for flash exploits to be launched from legitimate site e.g. via malicious adverts. I'm also not aware that MS actually screen compatibility view sites for exploits - I've always assumed the list is based solely in telemetry data (ie. lots of people use this site, but it doesn't work properly so we'll add it to the list). Beside (in IE9, at least) if you visit a website that doesn't display correctly a large balloon pops up telling you to enable compatibility view for that site.

To be honest Microsofts approach to plugins in  Metro IE was rather like this cyclist's approach to safe cycling: http://youtu.be/EWEk4lj5LZs?t=17s

Now it seems to be like this:http://youtu.be/O6oem0WRm1M?t=1m20s

What's wrong with the middle ground? What was broken previously?

(FTR I think this is far, far worse than no plugins at all, for the reasons I outline in my previous post) 

 

Middle ground? Metro IE 10 is so far from middle ground it's not funny. Let's see:

1. No favorites.
2. No immediate back/forward history
3. No accelerators
4. No flash/SL support

And that's just off the top of my head. The inclusion of some means to play video or audio formats that are predominant on the web today is the least that they could do. Toggling to the desktop is more painful than just switching context; depending on the web site you may need to re-login and scroll back down to the video you want to watch. Rinse & repeat and that gets old pretty quick.

BTW, granny is the first person who will fail to update her plug-ins so in her case she is screwed no matter what.

IMO the reasons behind Flash's "doom" are mostly

(1) Adobe sucking at security, updates, reliability, performance etc.

(2) Platform vendors wanting to control their dev stacks and not wanting an intermediary layer

Flash dying is one possible outcome, but "Adobe gets their **** together on security etc., and grovels before platform vendors enough to gain their favor" is an alternative outcome that's not impossible (Microsoft mostly got their **** together on security after being hopeless through the late 90s/early 2000s). Who knows, Apple might do the same thing in iOS 6 or 7.

18 hours ago, DeathByVisualStudio wrote

*snip*

Middle ground?

By middle ground I meant IE9 - I can have the compatibility, I can install whatever plugins I like. Or I can have the security and install none of them. Or I can mix and match - I can have some plugins (e.g. Flash), but not others (e.g. Quicktime).

Metro IE has switched from one extreme (absolutely no plugins etc.; we're going to treat you like a bunch of 3 year olds) to the other (you must have flash, you have no option, we're going to irremovably bake it in there). 

BTW, granny is the first person who will fail to update her plug-ins so in her case she is screwed no matter what.

Well there are solutions to that issue. IMHO the updating experience for Flash has improved substantially - in fact I seem to recall that last time I a flash update prompt appeared on my screen it said something about auto updating and never having to see such a prompt again. Another solution to this issue would be to allow third party software vendors to integrate their software with Windows Update in some way (e.g. have a list of update servers that WU checks on each machine - when you install Flash Adobe could add their server to that list).

(And perhaps I shouldn't have chosen the granny example... if there's an unpatched vulnerability in the browser it could affect any of us...) 

1 hour ago, GoddersUK wrote

*snip*

By middle ground I meant IE9 - I can have the compatibility, I can install whatever plugins I like. Or I can have the security and install none of them. Or I can mix and match - I can have some plugins (e.g. Flash), but not others (e.g. Quicktime).

On that we can agree. I would have loved Metro IE to have the same richness as the desktop but with better support for touch. There are so many things that could have easily carried over but they apparently were the "wiser"...

Metro IE has switched from one extreme (absolutely no plugins etc.; we're going to treat you like a bunch of 3 year olds) to the other (you must have flash, you have no option, we're going to irremovably bake it in there). 

Again I totally agree with your characterization here. They stripped Metro IE (I'm sure based on their feature usage stats) to the bone and justified it with a little Apple arrogance. I'm glad to see they've had a change of heart to some degree. While you may have a case with they way they did it as a consumer I'm happy they did something at all.

*snip*

Well there are solutions to that issue. IMHO the updating experience for Flash has improved substantially - in fact I seem to recall that last time I a flash update prompt appeared on my screen it said something about auto updating and never having to see such a prompt again.

I've selected the "auto update" option for flash and it still nags for installation upon reboot. Maybe they'll get it right someday.

On the other hand, I'd rather have "Microsoft's Flash" rather than "Adobe's Flash". In the former case, the code goes thru the SDL and is subject to regular patches and security reviews. I'd rather have that

You're suggesting that Microsoft will patch flash independently of Adobe? Surely that creates a whole host of problems in itself as the MS Flash and Adobe Flash begin to diverge?

@GoddersUK: Unless Adobe releases the specifications for Flash, and allows third party players. That would make Flash similar to PDF I suppose. It doesn't change the fact that Flash must die, but it would extend the life support.

@kettch: "Unless Adobe releases the specifications for Flash, and allows third party players. "

I thought they already did that some time ago? There just haven't been any worthwhile third party players  developed.

2 days ago, DeathByVisualStudio wrote

I hope this good news turns out to be true. And if so a big THANK YOU out to the IE team!

Where is EvilD when you need him?

Must suck to be a Win 8 apologist. Defending all these egolomaniacal decisions.. only to paddle back and procolaim the complete opposite when those in charge finally get some common sense infused into their thick skulls.

This is what happens if a product gets developed solely with the motivation to ease some Apple envy.

I wonder if Flash will be included with WindowsRT?

@contextfree`:

Maybe Microsoft could contribute to Gnash.