Re:Adobe CVEs
by azinman2 on Saturday January 28, 2017 @04:39AM
(#13505611)
How does Adobe allow this to happen? After enough of these over time, you'd think they'd fine some way to invest majorly in securing their runtimes.... either via another language like Mozilla is doing with Rust, some provably secure math-vm-thingie like Microsoft Research, massive security reviews & reduction of attack surfaces like OpenBSD, or another CS-driven solution.
[ Parent
| on HN ]
Adobe would definitely profit from languages such as Rust. But they are not a "tech" company in the traditional sense anymore, I don't see them investing in anything that doesn't yield high short term returns. It's a big company that dominates the "creative" market, because it can impose its formats on an industry that does not care about open technologies.
Rust isn't a cure-all for every security issue.
True, and there are lots of security exploits that are caused by logical error, but the majority of those CVEs are caused by memory corruption, use-after-free and out-of-bounds memory corruption.
All errors avoidable in Rust, as well as other safe languages, outside unsafe blocks.
But if you look at those CVEs, it is something that would prevent a majority of those issues. Use after free, boundary errors, etc.
Their customers don't care and they are not altruistic like Mozilla or OpenBSD.
When Flash and Acrobat go away completely, Adobe most certainly does care because it has lost its customers.
Apparently people on HN aren't aware that nowadays Flash compiles to native code and used in many mobile games
http://www.adobe.com/devnet-apps/flashshowcase/#/main
As for Acrobat, it is daily used across all our Fortune 500 customers.