No more flash.
Posted in security on October 24th, 2011 by mdw
OK I have never been a fan of Adobe flash, but never thought of it as something I would not allow to execute either. Adobe was never interested in web standards, they always chose to go the closed, proprietary route with Flash.
Now over time, javascript evolved to enable the same capabilities as flash, and yet it remains an embedded plugin on most people’s browsers. In fact niches have evolved, particularly in the advertising space, where flash is the best choice. When short animations or video clips need to be paired with transmitting data to and from the client, flash is the obvious tool of choice.
And this is really the basis for my complaint against flash. With javascript in charge there are real and quantifiable dangers. Any javascript code on a page can interfere, snoop on, change, and take data from anything else on the page. Javascript code on a web page cannot protect itself against other script or indeed the page itself, and vice versa.
However, this is a well understood issue, and browser vendors have the ability to shut it down at any time. They had better do so promptly.
But with flash, they’re dealing with an opaque agent. It can be limited in the same ways as javascript, so all seems OK right?
Well this week we heard of an exploit to flash that was very serious. A bug which enabled an attacker to gain control of your machine’s camera and microphone. Adobe shut it down very quickly. All’s well then, eh?
Hang on, how were they able to shut fix it so quickly? How many millions of flash plugins installed on how many millions of machines? Believe it or not, Adobe decided to design a system architecture in which access control is managed remotely by Adobe. Code running on THEIR servers decides if access to YOUR camera is allowed. If you care at all about where security decisions about your machine are made, I need say no more.
Domainers complain a lot about Google. Or at least some of the high profile domainers do. I think most of the old guard in this industry seems to have lost perspective on things, and this is one area where that really shows.
Facebook is everywhere. Does that mean you should be afraid of them? No.
The thing about the web is you can build to your heart’s content. Ever really thought about what you’d like to build?
It is not easy to tell how much information is on the Internet today. You must first define what you intend to count, be it kilobytes of stored data, number of unique web pages, number of web sites, etc. Next you must pick a strategy of counting or estimating and then extrapolating. This is of course, a moving target, so enumeration is not feasible.
.GAY has plenty of people talking, yet it may face a tough ICANN evaluation. It’ll surely have applicants, but will it meet the criteria for acceptance by ICANN? We’ll find out early next year!
In the early days it meant putting all the processing capabilities in central servers and accessing them remotely with “dumb clients.” The advent of the PC changed that paradigm. Now mobile devices are re-shaping it yet again.
In the early days storage was not persistent. Data was loaded together with program instructions, and resided in RAM during program execution, because external storage was expensive and error prone.
There are groups eager to bring new real estate related domains to fruition in next year’s new TLD application frenzy. Applications will be submitted in a few months, and the remainder of next year will likely be spent in the approval process. 