News for hackers. Stuff that matters.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by toasterlovin on Thursday May 14, 2020 @03:42PM (#23184374)
On the Mac, by default, Creative Cloud has an option enabled that indicates it will sync your entire home directory to their cloud storage service! I don’t think it actually does that, because I couldn’t see any of my files when I accessed their cloud storage product via their website, but what in the actual fuck.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by jasim on Thursday May 14, 2020 @03:48PM (#23184456)
The "Folder Location" option determines the parent directory where the "Creative Cloud Files" folder is stored, which is the actual sync folder. You can verify this by creating an empty directory and moving the sync location there. Bad, alarming UI though.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by hanklazard on Thursday May 14, 2020 @03:51PM (#23184487)
Wow, I’ll have to double check my system when I get home, that’s horrible.

I’ve been meaning to get out of the adobe photo software ecosystem, maybe this weekend is the time to find the right alternatives. Save a few bucks per month too.

Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by killerdhmo on Thursday May 14, 2020 @07:32PM (#23187012)
just in case you didn't see below, this is for you to choose the location of your CC Files Sync folder. Not that it's syncing your hard drive to the cloud. the label is unclear, and I've filed feedback with the team to update the string.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by killerdhmo on Thursday May 14, 2020 @03:49PM (#23184462)
Hi, work for Adobe. Where do you see this feature?
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by toasterlovin on Thursday May 14, 2020 @05:24PM (#23185697)
While I've got your ear: the software update process is insane. It constantly notifies me about updates even though I dismiss the notifications (I'm not a frequent user, so I really don't care about updates much). Then, after I finally update Illustrator (the only CS app I use), I try to close the Creative Cloud app, but it asks me to confirm because there are pending installations. But I've double checked and there aren't! And then I get another notification letting me know that the updates are finished!
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by killerdhmo on Thursday May 14, 2020 @06:02PM (#23186118)
this is something we're definitely working on, there's a few things going on at the same time.

1. The CC app itself gets updates. If you're a purely Illustrator user you might not notice (or use! which is ok!) the features we've added, but it now has the ability to add custom fonts to your Adobe account, we've added new tutorials, and community features, support for CC Libraries, and a new unified search. One of these new features is notifications, which is #2.

2. Our notifications can be a little noisy, especially if you're not a frequent user. In the Creative Cloud app, you should see under Preferences > Notifications, the ability to select which notifications you want. So, if you want to disable App update notifications, you can.

3. On top of the features, there are some update/sync processes that go on in the background that won't function. Our current messaging just says "pending installations" which doesn't cover it all and we've heard a lot of feedback from users internally and externally about it. We're going to make that message more tailored to anything that's actively going on, and if there's nothing, allow you to close the app silently. To double check that nothing is actively installing, you can check the cloud icon in the top right to confirm. If there's nothing there, you can close it with confidence that it isn't installing an update.

Hope to get these enhancements out to our user base soon. Thanks for your feedback! Please note, we do actively track anything we see on our User Voice (http://creativecloud.uservoice.com) and try to engage on social media, in case you'd like to keep giving us more feedback outside of HN. Thank you!

Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by nikanj on Friday May 15, 2020 @01:37AM (#23189233)
1) Words can't adequately explain how little I care about Creative Cloud. I would really appreciate it if Adobe's stuff only ran on my machine when I was actually using one of the tools.

2) See above

3) Again, see above. I don't want anything to work in the background.

Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by greggman3 on Friday May 15, 2020 @01:44AM (#23189274)
It re-iterate what nikanj said, agreed. I have absolutely zero use for Creative Cloud. Wish I could run without it. Wish Photoshop and Lightroom would at most check for updates when run instead of some constant processes.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by SCAQTony on Friday May 15, 2020 @12:09AM (#23188809)
I am a fine artist and I am really scared.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by hetspookjee on Friday May 15, 2020 @11:03AM (#23192973)
Haha, its as if they took the legendary Adobe greentext story literally and took the effort to automatically update the entire beast constantly! For anyone not familiar with the great story: https://imgur.com/gallery/iJD8f
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by karlshea on Thursday May 14, 2020 @11:55PM (#23188744)
Great. Maybe you can explain why "Adobe Desktop Service" needs 2.16GB of memory wired with no Adobe products running (including the Creative Cloud app) and sync turned off.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by toasterlovin on Thursday May 14, 2020 @03:56PM (#23184548)
Open Creative Cloud app. Click Preferences, then Syncing. Folder Location = “/Users/toasterlovin”. That, to me, indicates that it will try and sync that folder.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by killerdhmo on Thursday May 14, 2020 @04:15PM (#23184802)
Ah, no. I see your point, this is as a fellow poster indicated, the location for your Creative Cloud Files folder. I will check with the team to see if we can make the language clearer.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by hesk on Thursday May 14, 2020 @09:03PM (#23187689)
Thanks for being so responsive. This is a truly alarming UI.

While you're at it, please ask the user whether he wants to sync at all during installation. By default it should not sync.

I only have Creative Cloud installed because I am a Lightroom and Photoshop user. I use the sync feature in Lightroom but do not need another generic file system cloud sync.

Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by derefr on Thursday May 14, 2020 @04:16PM (#23184809)
"Folder Location" = "location where a folder will go." Like when choosing where to unzip something, or where to create a new library bundle in Photos/Music.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by toasterlovin on Thursday May 14, 2020 @04:29PM (#23184961)
I get that now. But it’s trying to sync a folder, so why not just point to the folder it’s syncing?
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by JadeNB on Thursday May 14, 2020 @04:40PM (#23185115)
Because, like every other sync solution out there, though for what reason I don't know, it fears the consequences if you are allowed to name the sync folder yourself.
Re:Security Flaws in Adobe Acrobat Reader Allow Gaining Root... by Reelin on Thursday May 14, 2020 @04:52PM (#23185264)
Not perfectly analogous to specifying folder names yourself, but the infamous Steam deletion bug comes to mind. (https://github.com/valvesoftware/steam-for-linux/issues/3671) Caused by a failure to use readlink (plus not sanity checking variable contents), so introducing a symlink would break it.